Merge pull request #12 from kmc7468/dev

v0.5.0

.dockerignore

@@ -1,5 +1,6 @@
 .git
 node_modules
+/Makefile
 
 # Output
 .output
@@ -10,13 +11,15 @@ node_modules
 /build
 /data
 /library
+/thumbnails
 
 # OS
 .DS_Store
 Thumbs.db
 
-# VSCode
+# Editors
 /.vscode
+/.idea
 
 # Env
 .env
@@ -27,6 +30,3 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
-
-# SQLite
-*.db

.env.example

@@ -1,9 +1,14 @@
 # Required environment variables
+DATABASE_PASSWORD=
 SESSION_SECRET=
 
 # Optional environment variables
-DATABASE_URL=
+DATABASE_HOST=
+DATABASE_PORT=
+DATABASE_USER=
+DATABASE_NAME=
 SESSION_EXPIRES=
 USER_CLIENT_CHALLENGE_EXPIRES=
 SESSION_UPGRADE_CHALLENGE_EXPIRES=
 LIBRARY_PATH=
+THUMBNAILS_PATH=

.gitignore

@@ -9,13 +9,15 @@ node_modules
 /build
 /data
 /library
+/thumbnails
 
 # OS
 .DS_Store
 Thumbs.db
 
-# VSCode
+# Editors
 /.vscode
+/.idea
 
 # Env
 .env
@@ -26,6 +28,3 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
-
-# SQLite
-*.db

.prettierignore

@@ -3,8 +3,5 @@ package-lock.json
 pnpm-lock.yaml
 yarn.lock
 
-# Output
-/drizzle
-
 # Documents
 *.md

Dockerfile

@@ -2,6 +2,10 @@
 FROM node:22-alpine AS base
 WORKDIR /app
 
+RUN apk add --no-cache bash curl && \
+    curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && \
+    chmod +x /usr/local/bin/wait-for-it
+
 RUN npm install -g pnpm@9
 COPY pnpm-lock.yaml .
 
@@ -10,10 +14,9 @@ FROM base AS build
 RUN pnpm fetch
 
 COPY . .
-RUN pnpm install --offline
+RUN pnpm install --offline && \
-RUN pnpm build
+    pnpm build && \
-
+    sed -i "s/http\.createServer()/http.createServer({ requestTimeout: 0 })/g" ./build/index.js
-RUN sed -i "s/http\.createServer()/http.createServer({ requestTimeout: 0 })/g" ./build/index.js
 
 # Deploy Stage
 FROM base
@@ -23,9 +26,7 @@ COPY package.json .
 RUN pnpm install --offline --prod
 
 COPY --from=build /app/build ./build
-COPY drizzle ./drizzle
 
 EXPOSE 3000
 ENV BODY_SIZE_LIMIT=Infinity
-
+CMD ["bash", "-c", "wait-for-it ${DATABASE_HOST:-localhost}:${DATABASE_PORT:-5432} -- node ./build/index.js"]
-CMD ["node", "./build/index.js"]

README.md

@@ -23,7 +23,7 @@ vim .env # 아래를 참고하여 환경 변수를 설정해 주세요.
 docker compose up --build -d
 ```
 
-모든 데이터는 `./data` 디렉터리에 저장될 거예요.
+모든 데이터는 `./data` 디렉터리에 아래에 저장될 거예요.
 
 ### Environment Variables
 
@@ -31,7 +31,8 @@ docker compose up --build -d
 
 |이름|필수|기본값|설명|
 |:-|:-:|:-:|:-|
-|`SESSION_SECRET`|Y||Session ID의 서명을 위해 사용돼요. 안전한 값으로 설정해 주세요.|
+|`DATABASE_PASSWORD`|Y||데이터베이스에 접근하기 위해 필요한 비밀번호예요. 안전한 값으로 설정해 주세요.|
+|`SESSION_SECRET`|Y||Session ID의 서명에 사용되는 비밀번호예요. 안전한 값으로 설정해 주세요.|
 |`SESSION_EXPIRES`||`14d`|Session의 유효 시간이에요. Session은 마지막으로 사용된 후 설정된 유효 시간이 지나면 자동으로 삭제돼요.|
 |`USER_CLIENT_CHALLENGE_EXPIRES`||`5m`|암호 키를 서버에 처음 등록할 때 사용되는 챌린지의 유효 시간이에요.|
 |`SESSION_UPGRADE_CHALLENGE_EXPIRES`||`5m`|암호 키와 함께 로그인할 때 사용되는 챌린지의 유효 시간이에요.|

docker-compose.dev.yaml

@@ -0,0 +1,15 @@
+services:
+  database:
+    image: postgres:17
+    restart: always
+    volumes:
+      - database:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=${DATABASE_USER:-}
+      - POSTGRES_PASSWORD=${DATABASE_PASSWORD:?} # Required
+      - POSTGRES_DB=${DATABASE_NAME:-}
+    ports:
+      - ${DATABASE_PORT:-5432}:5432
+
+volumes:
+  database:

docker-compose.yaml

@@ -2,20 +2,36 @@ services:
   server:
     build: .
     restart: unless-stopped
+    depends_on:
+      - database
     user: ${CONTAINER_UID:-0}:${CONTAINER_GID:-0}
     volumes:
-      - ./data:/app/data
+      - ./data/library:/app/data/library
+      - ./data/thumbnails:/app/data/thumbnails
     environment:
       # ArkVault
-      - DATABASE_URL=/app/data/database.sqlite
+      - DATABASE_HOST=database
+      - DATABASE_USER=arkvault
+      - DATABASE_PASSWORD=${DATABASE_PASSWORD:?} # Required
       - SESSION_SECRET=${SESSION_SECRET:?} # Required
       - SESSION_EXPIRES
       - USER_CLIENT_CHALLENGE_EXPIRES
       - SESSION_UPGRADE_CHALLENGE_EXPIRES
       - LIBRARY_PATH=/app/data/library
+      - THUMBNAILS_PATH=/app/data/thumbnails
       # SvelteKit
       - ADDRESS_HEADER=${TRUST_PROXY:+X-Forwarded-For}
       - XFF_DEPTH=${TRUST_PROXY:-}
       - NODE_ENV=${NODE_ENV:-production}
     ports:
       - ${PORT:-80}:3000
+
+  database:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    user: ${CONTAINER_UID:-0}:${CONTAINER_GID:-0}
+    volumes:
+      - ./data/database:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=arkvault
+      - POSTGRES_PASSWORD=${DATABASE_PASSWORD:?}

drizzle.config.ts

@@ -1,13 +0,0 @@
-import { defineConfig } from "drizzle-kit";
-
-export default defineConfig({
-  schema: "./src/lib/server/db/schema",
-
-  dbCredentials: {
-    url: process.env.DATABASE_URL || "local.db",
-  },
-
-  verbose: true,
-  strict: true,
-  dialect: "sqlite",
-});

drizzle/0000_unknown_stark_industries.sql

@@ -1,175 +0,0 @@
-CREATE TABLE `client` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`encryption_public_key` text NOT NULL,
-	`signature_public_key` text NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE `user_client` (
-	`user_id` integer NOT NULL,
-	`client_id` integer NOT NULL,
-	`state` text DEFAULT 'challenging' NOT NULL,
-	PRIMARY KEY(`client_id`, `user_id`),
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`client_id`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `user_client_challenge` (
-	`id` integer PRIMARY KEY NOT NULL,
-	`user_id` integer NOT NULL,
-	`client_id` integer NOT NULL,
-	`answer` text NOT NULL,
-	`allowed_ip` text NOT NULL,
-	`expires_at` integer NOT NULL,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`client_id`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`client_id`) REFERENCES `user_client`(`user_id`,`client_id`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `directory` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`parent_id` integer,
-	`user_id` integer NOT NULL,
-	`master_encryption_key_version` integer NOT NULL,
-	`encrypted_data_encryption_key` text NOT NULL,
-	`data_encryption_key_version` integer NOT NULL,
-	`encrypted_name` text NOT NULL,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`parent_id`) REFERENCES `directory`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`master_encryption_key_version`) REFERENCES `master_encryption_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `directory_log` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`directory_id` integer NOT NULL,
-	`timestamp` integer NOT NULL,
-	`action` text NOT NULL,
-	`new_name` text,
-	FOREIGN KEY (`directory_id`) REFERENCES `directory`(`id`) ON UPDATE no action ON DELETE cascade
-);
---> statement-breakpoint
-CREATE TABLE `file` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`parent_id` integer,
-	`user_id` integer NOT NULL,
-	`path` text NOT NULL,
-	`master_encryption_key_version` integer NOT NULL,
-	`encrypted_data_encryption_key` text NOT NULL,
-	`data_encryption_key_version` integer NOT NULL,
-	`hmac_secret_key_version` integer,
-	`content_hmac` text,
-	`content_type` text NOT NULL,
-	`encrypted_content_iv` text NOT NULL,
-	`encrypted_name` text NOT NULL,
-	FOREIGN KEY (`parent_id`) REFERENCES `directory`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`master_encryption_key_version`) REFERENCES `master_encryption_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`hmac_secret_key_version`) REFERENCES `hmac_secret_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `file_log` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`file_id` integer NOT NULL,
-	`timestamp` integer NOT NULL,
-	`action` text NOT NULL,
-	`new_name` text,
-	FOREIGN KEY (`file_id`) REFERENCES `file`(`id`) ON UPDATE no action ON DELETE cascade
-);
---> statement-breakpoint
-CREATE TABLE `hmac_secret_key` (
-	`user_id` integer NOT NULL,
-	`version` integer NOT NULL,
-	`state` text NOT NULL,
-	`master_encryption_key_version` integer NOT NULL,
-	`encrypted_key` text NOT NULL,
-	PRIMARY KEY(`user_id`, `version`),
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`master_encryption_key_version`) REFERENCES `master_encryption_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `hmac_secret_key_log` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`user_id` integer NOT NULL,
-	`hmac_secret_key_version` integer NOT NULL,
-	`timestamp` integer NOT NULL,
-	`action` text NOT NULL,
-	`action_by` integer,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`action_by`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`hmac_secret_key_version`) REFERENCES `hmac_secret_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `client_master_encryption_key` (
-	`user_id` integer NOT NULL,
-	`client_id` integer NOT NULL,
-	`version` integer NOT NULL,
-	`encrypted_key` text NOT NULL,
-	`encrypted_key_signature` text NOT NULL,
-	PRIMARY KEY(`client_id`, `user_id`, `version`),
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`client_id`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`version`) REFERENCES `master_encryption_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `master_encryption_key` (
-	`user_id` integer NOT NULL,
-	`version` integer NOT NULL,
-	`state` text NOT NULL,
-	`retired_at` integer,
-	PRIMARY KEY(`user_id`, `version`),
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `master_encryption_key_log` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`user_id` integer NOT NULL,
-	`master_encryption_key_version` integer NOT NULL,
-	`timestamp` integer NOT NULL,
-	`action` text NOT NULL,
-	`action_by` integer,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`action_by`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`user_id`,`master_encryption_key_version`) REFERENCES `master_encryption_key`(`user_id`,`version`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `session` (
-	`id` text PRIMARY KEY NOT NULL,
-	`user_id` integer NOT NULL,
-	`client_id` integer,
-	`created_at` integer NOT NULL,
-	`last_used_at` integer NOT NULL,
-	`last_used_by_ip` text,
-	`last_used_by_user_agent` text,
-	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`client_id`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `session_upgrade_challenge` (
-	`id` integer PRIMARY KEY NOT NULL,
-	`session_id` text NOT NULL,
-	`client_id` integer NOT NULL,
-	`answer` text NOT NULL,
-	`allowed_ip` text NOT NULL,
-	`expires_at` integer NOT NULL,
-	FOREIGN KEY (`session_id`) REFERENCES `session`(`id`) ON UPDATE no action ON DELETE no action,
-	FOREIGN KEY (`client_id`) REFERENCES `client`(`id`) ON UPDATE no action ON DELETE no action
-);
---> statement-breakpoint
-CREATE TABLE `user` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`email` text NOT NULL,
-	`password` text NOT NULL,
-	`nickname` text NOT NULL
-);
---> statement-breakpoint
-CREATE UNIQUE INDEX `client_encryption_public_key_unique` ON `client` (`encryption_public_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `client_signature_public_key_unique` ON `client` (`signature_public_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `client_encryption_public_key_signature_public_key_unique` ON `client` (`encryption_public_key`,`signature_public_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `user_client_challenge_answer_unique` ON `user_client_challenge` (`answer`);--> statement-breakpoint
-CREATE UNIQUE INDEX `directory_encrypted_data_encryption_key_unique` ON `directory` (`encrypted_data_encryption_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `file_path_unique` ON `file` (`path`);--> statement-breakpoint
-CREATE UNIQUE INDEX `file_encrypted_data_encryption_key_unique` ON `file` (`encrypted_data_encryption_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `hmac_secret_key_encrypted_key_unique` ON `hmac_secret_key` (`encrypted_key`);--> statement-breakpoint
-CREATE UNIQUE INDEX `session_user_id_client_id_unique` ON `session` (`user_id`,`client_id`);--> statement-breakpoint
-CREATE UNIQUE INDEX `session_upgrade_challenge_session_id_unique` ON `session_upgrade_challenge` (`session_id`);--> statement-breakpoint
-CREATE UNIQUE INDEX `session_upgrade_challenge_answer_unique` ON `session_upgrade_challenge` (`answer`);--> statement-breakpoint
-CREATE UNIQUE INDEX `user_email_unique` ON `user` (`email`);

drizzle/0001_blushing_alice.sql

@@ -1,2 +0,0 @@
-ALTER TABLE `file` ADD `encrypted_created_at` text;--> statement-breakpoint
-ALTER TABLE `file` ADD `encrypted_last_modified_at` text NOT NULL;

drizzle/meta/_journal.json

@@ -1,20 +0,0 @@
-{
-  "version": "7",
-  "dialect": "sqlite",
-  "entries": [
-    {
-      "idx": 0,
-      "version": "6",
-      "when": 1736704436996,
-      "tag": "0000_unknown_stark_industries",
-      "breakpoints": true
-    },
-    {
-      "idx": 1,
-      "version": "6",
-      "when": 1736720831242,
-      "tag": "0001_blushing_alice",
-      "breakpoints": true
-    }
-  ]
-}

kysely.config.ts

@@ -0,0 +1,18 @@
+import { defineConfig } from "kysely-ctl";
+import { Pool } from "pg";
+
+export default defineConfig({
+  dialect: "pg",
+  dialectConfig: {
+    pool: new Pool({
+      host: process.env.DATABASE_HOST,
+      port: process.env.DATABASE_PORT ? parseInt(process.env.DATABASE_PORT) : undefined,
+      user: process.env.DATABASE_USER,
+      password: process.env.DATABASE_PASSWORD,
+      database: process.env.DATABASE_NAME,
+    }),
+  },
+  migrations: {
+    migrationFolder: "./src/lib/server/db/migrations",
+  },
+});

package.json

@@ -1,7 +1,7 @@
 {
   "name": "arkvault",
   "private": true,
-  "version": "0.2.0",
+  "version": "0.5.0",
   "type": "module",
   "scripts": {
     "dev": "vite dev",
@@ -11,55 +11,55 @@
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
     "format": "prettier --write .",
     "lint": "prettier --check . && eslint .",
-    "db:push": "drizzle-kit push",
+    "db:up": "docker compose -f docker-compose.dev.yaml -p arkvault-dev up -d",
-    "db:generate": "drizzle-kit generate",
+    "db:down": "docker compose -f docker-compose.dev.yaml -p arkvault-dev down",
-    "db:migrate": "drizzle-kit migrate",
+    "db:migrate": "kysely migrate"
-    "db:studio": "drizzle-kit studio"
   },
   "devDependencies": {
-    "@eslint/compat": "^1.2.4",
+    "@eslint/compat": "^1.3.1",
-    "@iconify-json/material-symbols": "^1.2.12",
+    "@iconify-json/material-symbols": "^1.2.29",
-    "@sveltejs/adapter-node": "^5.2.11",
+    "@sveltejs/adapter-node": "^5.2.13",
-    "@sveltejs/kit": "^2.15.2",
+    "@sveltejs/kit": "^2.22.5",
     "@sveltejs/vite-plugin-svelte": "^4.0.4",
-    "@types/better-sqlite3": "^7.6.12",
     "@types/file-saver": "^2.0.7",
     "@types/ms": "^0.7.34",
-    "@types/node-schedule": "^2.1.7",
+    "@types/node-schedule": "^2.1.8",
-    "autoprefixer": "^10.4.20",
+    "@types/pg": "^8.15.4",
-    "axios": "^1.7.9",
+    "autoprefixer": "^10.4.21",
-    "dexie": "^4.0.10",
+    "axios": "^1.10.0",
-    "drizzle-kit": "^0.22.8",
+    "dexie": "^4.0.11",
-    "eslint": "^9.17.0",
+    "eslint": "^9.30.1",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-svelte": "^2.46.1",
+    "eslint-plugin-svelte": "^3.10.1",
-    "eslint-plugin-tailwindcss": "^3.17.5",
+    "eslint-plugin-tailwindcss": "^3.18.0",
-    "exifreader": "^4.26.0",
+    "exifreader": "^4.31.1",
     "file-saver": "^2.0.5",
-    "globals": "^15.14.0",
+    "globals": "^16.3.0",
     "heic2any": "^0.0.4",
-    "mime": "^4.0.6",
+    "kysely-ctl": "^0.13.1",
+    "lru-cache": "^11.1.0",
+    "mime": "^4.0.7",
     "p-limit": "^6.2.0",
-    "prettier": "^3.4.2",
+    "prettier": "^3.6.2",
-    "prettier-plugin-svelte": "^3.3.2",
+    "prettier-plugin-svelte": "^3.4.0",
-    "prettier-plugin-tailwindcss": "^0.6.9",
+    "prettier-plugin-tailwindcss": "^0.6.14",
-    "svelte": "^5.17.1",
+    "svelte": "^5.35.6",
-    "svelte-check": "^4.1.3",
+    "svelte-check": "^4.2.2",
     "tailwindcss": "^3.4.17",
-    "typescript": "^5.7.3",
+    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.19.1",
+    "typescript-eslint": "^8.36.0",
-    "unplugin-icons": "^0.22.0",
+    "unplugin-icons": "^22.1.0",
-    "vite": "^5.4.11"
+    "vite": "^5.4.19"
   },
   "dependencies": {
     "@fastify/busboy": "^3.1.1",
-    "argon2": "^0.41.1",
+    "argon2": "^0.43.0",
-    "better-sqlite3": "^11.7.2",
+    "kysely": "^0.28.2",
-    "drizzle-orm": "^0.33.0",
     "ms": "^2.1.3",
     "node-schedule": "^2.1.1",
-    "uuid": "^11.0.4",
+    "pg": "^8.16.3",
-    "zod": "^3.24.1"
+    "uuid": "^11.1.0",
+    "zod": "^3.25.76"
   },
   "engines": {
     "node": "^22.0.0",

src/app.html

@@ -1,5 +1,5 @@
 <!doctype html>
-<html lang="en">
+<html lang="ko">
   <head>
     <meta charset="utf-8" />
     <link rel="icon" href="%sveltekit.assets%/favicon.png" />

src/hooks.client.ts

@@ -4,6 +4,15 @@ import { prepareFileCache } from "$lib/modules/file";
 import { prepareOpfs } from "$lib/modules/opfs";
 import { clientKeyStore, masterKeyStore, hmacSecretStore } from "$lib/stores";
 
+const requestPersistentStorage = async () => {
+  const isPersistent = await navigator.storage.persist();
+  if (isPersistent) {
+    console.log("[ArkVault] Persistent storage granted.");
+  } else {
+    console.warn("[ArkVault] Persistent storage not granted.");
+  }
+};
+
 const prepareClientKeyStore = async () => {
   const [encryptKey, decryptKey, signKey, verifyKey] = await Promise.all([
     getClientKey("encrypt"),
@@ -32,6 +41,7 @@ const prepareHmacSecretStore = async () => {
 
 export const init: ClientInit = async () => {
   await Promise.all([
+    requestPersistentStorage(),
     prepareFileCache(),
     prepareClientKeyStore(),
     prepareMasterKeyStore(),

src/hooks.server.ts

@@ -2,15 +2,15 @@ import type { ServerInit } from "@sveltejs/kit";
 import { sequence } from "@sveltejs/kit/hooks";
 import schedule from "node-schedule";
 import { cleanupExpiredUserClientChallenges } from "$lib/server/db/client";
-import { migrateDB } from "$lib/server/db/drizzle";
+import { migrateDB } from "$lib/server/db/kysely";
 import {
   cleanupExpiredSessions,
   cleanupExpiredSessionUpgradeChallenges,
 } from "$lib/server/db/session";
 import { authenticate, setAgentInfo } from "$lib/server/middlewares";
 
-export const init: ServerInit = () => {
+export const init: ServerInit = async () => {
-  migrateDB();
+  await migrateDB();
 
   schedule.scheduleJob("0 * * * *", () => {
     cleanupExpiredUserClientChallenges();

src/lib/components/BottomSheet.svelte

@@ -1,39 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-  import { fade, fly } from "svelte/transition";
-  import { AdaptiveDiv } from "$lib/components/divs";
-
-  interface Props {
-    children: Snippet;
-    onclose?: () => void;
-    isOpen: boolean;
-  }
-
-  let { children, onclose, isOpen = $bindable() }: Props = $props();
-
-  const closeBottomSheet = $derived(
-    onclose ||
-      (() => {
-        isOpen = false;
-      }),
-  );
-</script>
-
-{#if isOpen}
-  <!-- svelte-ignore a11y_click_events_have_key_events -->
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div onclick={closeBottomSheet} class="fixed inset-0 z-10 flex items-end justify-center">
-    <div class="absolute inset-0 bg-black bg-opacity-50" transition:fade={{ duration: 100 }}></div>
-    <div class="z-20 w-full">
-      <AdaptiveDiv>
-        <div
-          onclick={(e) => e.stopPropagation()}
-          class="flex max-h-[70vh] min-h-[30vh] rounded-t-2xl bg-white px-4"
-          transition:fly={{ y: 100, duration: 200 }}
-        >
-          {@render children?.()}
-        </div>
-      </AdaptiveDiv>
-    </div>
-  </div>
-{/if}

src/lib/components/Modal.svelte

@@ -1,38 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-  import { fade } from "svelte/transition";
-  import { AdaptiveDiv } from "$lib/components/divs";
-
-  interface Props {
-    children: Snippet;
-    onclose?: () => void;
-    isOpen: boolean;
-  }
-
-  let { children, onclose, isOpen = $bindable() }: Props = $props();
-
-  const closeModal = $derived(
-    onclose ||
-      (() => {
-        isOpen = false;
-      }),
-  );
-</script>
-
-{#if isOpen}
-  <!-- svelte-ignore a11y_click_events_have_key_events -->
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div
-    onclick={closeModal}
-    class="fixed inset-0 z-10 bg-black bg-opacity-50"
-    transition:fade={{ duration: 100 }}
-  >
-    <AdaptiveDiv>
-      <div class="flex h-full items-center justify-center px-4">
-        <div onclick={(e) => e.stopPropagation()} class="rounded-2xl bg-white p-4">
-          {@render children?.()}
-        </div>
-      </div>
-    </AdaptiveDiv>
-  </div>
-{/if}

src/lib/components/TopBar.svelte

@@ -1,31 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-
-  import IconArrowBack from "~icons/material-symbols/arrow-back";
-
-  interface Props {
-    children?: Snippet;
-    onback?: () => void;
-    title?: string;
-  }
-
-  let { children, onback, title }: Props = $props();
-
-  const back = $derived(() => {
-    setTimeout(onback || (() => history.back()), 100);
-  });
-</script>
-
-<div class="sticky top-0 z-10 flex flex-shrink-0 items-center justify-between bg-white py-4">
-  <button onclick={back} class="w-[2.3rem] flex-shrink-0 rounded-full p-1 active:bg-gray-100">
-    <IconArrowBack class="text-2xl" />
-  </button>
-  {#if title}
-    <p class="flex-grow truncate px-2 text-center text-lg font-semibold">{title}</p>
-  {/if}
-  <div class="w-[2.3rem] flex-shrink-0">
-    {#if children}
-      {@render children?.()}
-    {/if}
-  </div>
-</div>

src/lib/components/atoms/BottomSheet.svelte

@@ -0,0 +1,40 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+  import { fade, fly } from "svelte/transition";
+  import { AdaptiveDiv } from "$lib/components/atoms";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    isOpen: boolean;
+    onclose?: () => void;
+  }
+
+  let { children, class: className, isOpen = $bindable(), onclose }: Props = $props();
+</script>
+
+{#if isOpen}
+  <!-- svelte-ignore a11y_click_events_have_key_events -->
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    onclick={onclose || (() => (isOpen = false))}
+    class="fixed inset-0 z-10 flex items-end justify-center"
+  >
+    <div
+      class="absolute inset-0 bg-black bg-opacity-50"
+      transition:fade|global={{ duration: 100 }}
+    ></div>
+    <AdaptiveDiv class="z-10 w-full">
+      <div
+        onclick={(e) => e.stopPropagation()}
+        class="flex max-h-[70vh] min-h-[30vh] flex-col rounded-t-2xl bg-white"
+        transition:fly|global={{ y: 100, duration: 200 }}
+      >
+        <div class={["flex-grow overflow-y-auto", className]}>
+          {@render children()}
+        </div>
+      </div>
+    </AdaptiveDiv>
+  </div>
+{/if}

src/lib/components/atoms/Modal.svelte

@@ -0,0 +1,31 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+  import { fade } from "svelte/transition";
+  import { AdaptiveDiv } from "$lib/components/atoms";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    isOpen: boolean;
+    onclose?: () => void;
+  }
+
+  let { children, class: className, isOpen = $bindable(), onclose }: Props = $props();
+</script>
+
+{#if isOpen}
+  <!-- svelte-ignore a11y_click_events_have_key_events -->
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    onclick={onclose || (() => (isOpen = false))}
+    class="fixed inset-0 z-10 bg-black bg-opacity-50"
+    transition:fade|global={{ duration: 100 }}
+  >
+    <AdaptiveDiv class="flex h-full items-center justify-center px-4">
+      <div onclick={(e) => e.stopPropagation()} class={["rounded-2xl bg-white p-4", className]}>
+        {@render children()}
+      </div>
+    </AdaptiveDiv>
+  </div>
+{/if}

src/lib/components/atoms/buttons/ActionEntryButton.svelte

@@ -0,0 +1,59 @@
+<script lang="ts">
+  import type { Component, Snippet } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+
+  interface Props {
+    actionButtonClass?: ClassValue;
+    actionButtonIcon?: Component<SvelteHTMLElements["svg"]>;
+    children: Snippet;
+    class?: ClassValue;
+    onActionButtonClick?: () => void;
+    onclick?: () => void;
+  }
+
+  let {
+    actionButtonIcon: ActionButtonIcon,
+    actionButtonClass: actionButtonClassName,
+    children,
+    class: className,
+    onActionButtonClick,
+    onclick,
+  }: Props = $props();
+</script>
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<!-- svelte-ignore a11y_click_events_have_key_events -->
+<div
+  id="container"
+  onclick={onclick && (() => setTimeout(onclick, 100))}
+  class={["rounded-xl", className]}
+>
+  <div id="children" class="flex h-full items-center gap-x-4 p-2 transition">
+    <div class="flex-grow overflow-x-hidden">
+      {@render children()}
+    </div>
+    {#if ActionButtonIcon}
+      <button
+        id="action-button"
+        onclick={(e) => {
+          e.stopPropagation();
+          if (onActionButtonClick) {
+            setTimeout(onActionButtonClick, 100);
+          }
+        }}
+        class={["flex-shrink-0 rounded-full p-1 text-lg active:bg-gray-100", actionButtonClassName]}
+      >
+        <ActionButtonIcon />
+      </button>
+    {/if}
+  </div>
+</div>
+
+<style>
+  #container:active:not(:has(#action-button:active)) {
+    @apply bg-gray-100;
+  }
+  #children:active:not(:has(#action-button:active)) {
+    @apply scale-95;
+  }
+</style>

src/lib/components/atoms/buttons/Button.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    color?: "primary" | "gray";
+    onclick?: () => void;
+  }
+
+  let { children, class: className, color = "primary", onclick }: Props = $props();
+
+  let bgColor = $derived(
+    {
+      primary: "bg-primary-600 active:bg-primary-500",
+      gray: "bg-gray-300 active:bg-gray-400",
+    }[color],
+  );
+  let textColor = $derived(
+    {
+      primary: "text-white",
+      gray: "text-gray-800",
+    }[color],
+  );
+</script>
+
+<button
+  onclick={onclick && (() => setTimeout(onclick, 100))}
+  class={[
+    "h-12 min-w-fit rounded-xl p-3 font-medium transition active:scale-95",
+    bgColor,
+    textColor,
+    className,
+  ]}
+>
+  {@render children()}
+</button>

src/lib/components/atoms/buttons/EntryButton.svelte

@@ -0,0 +1,26 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  import IconChevronRight from "~icons/material-symbols/chevron-right";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    onclick?: () => void;
+  }
+
+  let { children, class: className, onclick }: Props = $props();
+</script>
+
+<button
+  onclick={onclick && (() => setTimeout(onclick, 100))}
+  class={["rounded-xl active:bg-gray-100", className]}
+>
+  <div class="flex h-full items-center gap-x-4 p-2 transition active:scale-95">
+    <div class="flex-grow">
+      {@render children()}
+    </div>
+    <IconChevronRight class="flex-shrink-0 text-xl text-gray-800" />
+  </div>
+</button>

src/lib/components/atoms/buttons/FloatingButton.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+  import type { Component } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+  import { AdaptiveDiv } from "$lib/components/atoms";
+
+  interface Props {
+    class: ClassValue;
+    icon: Component<SvelteHTMLElements["svg"]>;
+    onclick?: () => void;
+  }
+
+  let { class: className, icon: Icon, onclick }: Props = $props();
+</script>
+
+<div class="pointer-events-none fixed inset-0">
+  <AdaptiveDiv class="relative h-full">
+    <button
+      onclick={onclick && (() => setTimeout(onclick, 100))}
+      class={[
+        "pointer-events-auto absolute flex h-14 w-14 items-center justify-center rounded-full bg-gray-300 text-xl shadow-lg transition active:scale-95 active:bg-gray-400",
+        className,
+      ]}
+    >
+      <Icon />
+    </button>
+  </AdaptiveDiv>
+</div>

src/lib/components/atoms/buttons/TextButton.svelte

@@ -10,14 +10,10 @@
 </script>
 
 <button
-  onclick={() => {
+  onclick={onclick && (() => setTimeout(onclick, 100))}
-    setTimeout(() => {
-      onclick?.();
-    }, 100);
-  }}
   class="text-sm font-medium text-gray-800 underline underline-offset-2 active:rounded-xl active:bg-gray-100"
 >
-  <div class="h-full w-full p-1 transition active:scale-95">
+  <div class="h-full p-1 transition active:scale-95">
-    {@render children?.()}
+    {@render children()}
   </div>
 </button>

src/lib/components/atoms/buttons/index.ts

@@ -1,3 +1,4 @@
+export { default as ActionEntryButton } from "./ActionEntryButton.svelte";
 export { default as Button } from "./Button.svelte";
 export { default as EntryButton } from "./EntryButton.svelte";
 export { default as FloatingButton } from "./FloatingButton.svelte";

src/lib/components/atoms/divs/AdaptiveDiv.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+  }
+
+  let { children, class: className }: Props = $props();
+</script>
+
+<div class={["mx-auto max-w-screen-md", className]}>
+  {@render children()}
+</div>

src/lib/components/atoms/divs/BottomDiv.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+  }
+
+  let { children, class: className }: Props = $props();
+</script>
+
+<div class={["sticky bottom-0 bg-white pb-4", className]}>
+  {@render children()}
+</div>

src/lib/components/atoms/divs/FullscreenDiv.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+  }
+
+  let { children, class: className }: Props = $props();
+</script>
+
+<div class={["flex flex-grow flex-col justify-between px-4", className]}>
+  {@render children()}
+</div>

src/lib/components/atoms/divs/index.ts

@@ -1,3 +1,3 @@
 export { default as AdaptiveDiv } from "./AdaptiveDiv.svelte";
 export { default as BottomDiv } from "./BottomDiv.svelte";
-export { default as TitleDiv } from "./TitleDiv.svelte";
+export { default as FullscreenDiv } from "./FullscreenDiv.svelte";

src/lib/components/atoms/index.ts

@@ -1,3 +1,5 @@
 export { default as BottomSheet } from "./BottomSheet.svelte";
+export * from "./buttons";
+export * from "./divs";
+export * from "./inputs";
 export { default as Modal } from "./Modal.svelte";
-export { default as TopBar } from "./TopBar.svelte";

src/lib/components/atoms/inputs/CheckBox.svelte

@@ -0,0 +1,23 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+
+  import IconCheckCircle from "~icons/material-symbols/check-circle";
+  import IconCheckCircleOutline from "~icons/material-symbols/check-circle-outline";
+
+  interface Props {
+    checked?: boolean;
+    children: Snippet;
+  }
+
+  let { checked = $bindable(false), children }: Props = $props();
+</script>
+
+<label class="flex items-center gap-x-1">
+  <input bind:checked type="checkbox" class="hidden" />
+  {@render children()}
+  {#if checked}
+    <IconCheckCircle class="text-primary-600" />
+  {:else}
+    <IconCheckCircleOutline class="text-gray-300" />
+  {/if}
+</label>

src/lib/components/atoms/inputs/TextInput.svelte

@@ -0,0 +1,40 @@
+<script lang="ts">
+  import type { ClassValue } from "svelte/elements";
+
+  interface Props {
+    class?: ClassValue;
+    placeholder: string;
+    type?: "text" | "password";
+    value?: string;
+  }
+
+  let { class: className, placeholder, type = "text", value = $bindable("") }: Props = $props();
+</script>
+
+<div class={className}>
+  <div class="relative mt-5">
+    <input
+      bind:value
+      {type}
+      placeholder=""
+      class="w-full border-b-2 border-gray-300 py-1 text-xl outline-none transition duration-300 ease-in-out"
+    />
+    <!-- svelte-ignore a11y_label_has_associated_control -->
+    <label
+      class="pointer-events-none absolute left-0 top-1/2 -translate-y-1/2 transform text-xl text-gray-400 transition-all duration-300 ease-in-out"
+    >
+      {placeholder}
+    </label>
+  </div>
+</div>
+
+<style>
+  input:focus,
+  input:not(:placeholder-shown) {
+    @apply border-primary-300;
+  }
+  input:focus + label,
+  input:not(:placeholder-shown) + label {
+    @apply top-0 -translate-y-full text-sm text-primary-400;
+  }
+</style>

src/lib/components/atoms/inputs/index.ts

@@ -1 +1,2 @@
+export { default as CheckBox } from "./CheckBox.svelte";
 export { default as TextInput } from "./TextInput.svelte";

src/lib/components/buttons/Button.svelte

@@ -1,37 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-
-  interface Props {
-    children: Snippet;
-    color?: "primary" | "gray";
-    onclick?: () => void;
-  }
-
-  let { children, color = "primary", onclick }: Props = $props();
-
-  const bgColorStyle = $derived(
-    {
-      primary: "bg-primary-600 active:bg-primary-500",
-      gray: "bg-gray-300 active:bg-gray-400",
-    }[color],
-  );
-  const fontColorStyle = $derived(
-    {
-      primary: "text-white",
-      gray: "text-gray-800",
-    }[color],
-  );
-</script>
-
-<button
-  onclick={() => {
-    setTimeout(() => {
-      onclick?.();
-    }, 100);
-  }}
-  class="{bgColorStyle} {fontColorStyle} h-12 w-full min-w-fit rounded-xl font-medium"
->
-  <div class="h-full w-full p-3 transition active:scale-95">
-    {@render children?.()}
-  </div>
-</button>

src/lib/components/buttons/EntryButton.svelte

@@ -1,30 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-
-  import IconChevronRight from "~icons/material-symbols/chevron-right";
-
-  interface Props {
-    children: Snippet;
-    onclick?: () => void;
-  }
-
-  let { children, onclick }: Props = $props();
-</script>
-
-<button
-  onclick={() => {
-    setTimeout(() => {
-      onclick?.();
-    }, 100);
-  }}
-  class="w-full rounded-xl active:bg-gray-100"
->
-  <div class="flex w-full justify-between p-2 transition active:scale-95">
-    <div>
-      {@render children?.()}
-    </div>
-    <div class="flex items-center justify-center">
-      <IconChevronRight class="text-xl text-gray-800" />
-    </div>
-  </div>
-</button>

src/lib/components/buttons/FloatingButton.svelte

@@ -1,36 +0,0 @@
-<script lang="ts">
-  import type { Component } from "svelte";
-  import type { SvelteHTMLElements } from "svelte/elements";
-  import { AdaptiveDiv } from "$lib/components/divs";
-
-  interface Props {
-    icon: Component<SvelteHTMLElements["svg"]>;
-    offset?: string;
-    onclick?: () => void;
-  }
-
-  let { icon: Icon, offset = "bottom-20", onclick }: Props = $props();
-
-  const click = () => {
-    setTimeout(() => {
-      onclick?.();
-    }, 100);
-  };
-</script>
-
-<div class="pointer-events-none fixed inset-0">
-  <div class="absolute w-full {offset}">
-    <AdaptiveDiv>
-      <div class="relative">
-        <div class="absolute bottom-4 right-4">
-          <button
-            onclick={click}
-            class="pointer-events-auto flex h-14 w-14 items-center justify-center rounded-full bg-gray-300 shadow-lg transition active:scale-95 active:bg-gray-400"
-          >
-            <Icon class="text-xl" />
-          </button>
-        </div>
-      </div>
-    </AdaptiveDiv>
-  </div>
-</div>

src/lib/components/divs/AdaptiveDiv.svelte

@@ -1,7 +0,0 @@
-<script lang="ts">
-  let { children } = $props();
-</script>
-
-<div class="mx-auto h-full w-full max-w-screen-md">
-  {@render children?.()}
-</div>

src/lib/components/divs/BottomDiv.svelte

@@ -1,7 +0,0 @@
-<script lang="ts">
-  let { children } = $props();
-</script>
-
-<div class="sticky bottom-0 flex flex-col items-center gap-y-2 bg-white pb-4">
-  {@render children?.()}
-</div>

src/lib/components/divs/TitleDiv.svelte

@@ -1,21 +0,0 @@
-<script lang="ts">
-  import type { Component, Snippet } from "svelte";
-  import type { SvelteHTMLElements } from "svelte/elements";
-
-  interface Props {
-    children: Snippet;
-    icon?: Component<SvelteHTMLElements["svg"]>;
-    topPadding?: boolean;
-  }
-
-  let { topPadding = true, children, icon: Icon }: Props = $props();
-</script>
-
-<div>
-  <div class="box-content flex min-h-[10vh] items-center {topPadding ? 'pt-4' : ''}">
-    {#if Icon}
-      <Icon class="text-5xl text-gray-600" />
-    {/if}
-  </div>
-  {@render children?.()}
-</div>

src/lib/components/inputs/TextInput.svelte

@@ -1,35 +0,0 @@
-<script lang="ts">
-  interface Props {
-    placeholder: string;
-    type?: "text" | "password";
-    value?: string;
-  }
-
-  let { placeholder, type = "text", value = $bindable("") }: Props = $props();
-</script>
-
-<div class="relative mt-5">
-  <input
-    bind:value
-    {type}
-    placeholder=""
-    class="w-full border-b-2 border-gray-300 py-1 text-xl outline-none transition duration-300 ease-in-out"
-  />
-  <!-- svelte-ignore a11y_label_has_associated_control -->
-  <label
-    class="absolute left-0 top-1/2 -translate-y-1/2 transform text-xl text-gray-400 transition-all duration-300 ease-in-out"
-  >
-    {placeholder}
-  </label>
-</div>
-
-<style>
-  input:focus,
-  input:not(:placeholder-shown) {
-    @apply border-primary-300;
-  }
-  input:focus + label,
-  input:not(:placeholder-shown) + label {
-    @apply top-0 -translate-y-full text-sm text-primary-400;
-  }
-</style>

src/lib/components/molecules/ActionModal.svelte

@@ -0,0 +1,57 @@
+<script module lang="ts">
+  export type ConfirmHandler = () => void | Promise<void> | boolean | Promise<boolean>;
+</script>
+
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import { Button, Modal } from "$lib/components/atoms";
+
+  interface Props {
+    cancelText?: string;
+    children: Snippet;
+    confirmText: string;
+    isOpen: boolean;
+    onbeforeclose?: () => void;
+    oncancel?: () => void;
+    onConfirmClick: ConfirmHandler;
+    title: string;
+  }
+
+  let {
+    cancelText = "닫기",
+    children,
+    confirmText,
+    isOpen = $bindable(),
+    onbeforeclose,
+    oncancel,
+    onConfirmClick,
+    title,
+  }: Props = $props();
+
+  const closeModal = () => {
+    onbeforeclose?.();
+    isOpen = false;
+  };
+
+  const cancelAction = () => {
+    oncancel?.();
+    closeModal();
+  };
+
+  const confirmAction = async () => {
+    if ((await onConfirmClick()) !== false) {
+      closeModal();
+    }
+  };
+</script>
+
+<Modal bind:isOpen onclose={cancelAction} class="space-y-4">
+  <div class="flex flex-col gap-y-2 break-keep">
+    <p class="text-xl font-bold">{title}</p>
+    {@render children()}
+  </div>
+  <div class="flex gap-x-2">
+    <Button color="gray" onclick={cancelAction} class="flex-1">{cancelText}</Button>
+    <Button onclick={confirmAction} class="flex-1">{confirmText}</Button>
+  </div>
+</Modal>

src/lib/components/molecules/Categories/Categories.svelte

@@ -0,0 +1,63 @@
+<script lang="ts">
+  import { untrack, type Component } from "svelte";
+  import type { SvelteHTMLElements } from "svelte/elements";
+  import { get, type Writable } from "svelte/store";
+  import type { CategoryInfo } from "$lib/modules/filesystem";
+  import { SortBy, sortEntries } from "$lib/modules/util";
+  import Category from "./Category.svelte";
+  import type { SelectedCategory } from "./service";
+
+  interface Props {
+    categories: Writable<CategoryInfo | null>[];
+    categoryMenuIcon?: Component<SvelteHTMLElements["svg"]>;
+    onCategoryClick: (category: SelectedCategory) => void;
+    onCategoryMenuClick?: (category: SelectedCategory) => void;
+    sortBy?: SortBy;
+  }
+
+  let {
+    categories,
+    categoryMenuIcon,
+    onCategoryClick,
+    onCategoryMenuClick,
+    sortBy = SortBy.NAME_ASC,
+  }: Props = $props();
+
+  let categoriesWithName: { name?: string; info: Writable<CategoryInfo | null> }[] = $state([]);
+
+  $effect(() => {
+    categoriesWithName = categories.map((category) => ({
+      name: get(category)?.name,
+      info: category,
+    }));
+
+    const sort = () => {
+      sortEntries(categoriesWithName, sortBy);
+    };
+    return untrack(() => {
+      sort();
+
+      const unsubscribes = categoriesWithName.map((category) =>
+        category.info.subscribe((value) => {
+          if (category.name === value?.name) return;
+          category.name = value?.name;
+          sort();
+        }),
+      );
+      return () => unsubscribes.forEach((unsubscribe) => unsubscribe());
+    });
+  });
+</script>
+
+{#if categoriesWithName.length > 0}
+  <div class="space-y-1">
+    {#each categoriesWithName as { info }}
+      <Category
+        {info}
+        menuIcon={categoryMenuIcon}
+        onclick={onCategoryClick}
+        onMenuClick={onCategoryMenuClick}
+      />
+    {/each}
+  </div>
+{/if}

src/lib/components/molecules/Categories/Category.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+  import type { Component } from "svelte";
+  import type { SvelteHTMLElements } from "svelte/elements";
+  import type { Writable } from "svelte/store";
+  import { ActionEntryButton } from "$lib/components/atoms";
+  import { CategoryLabel } from "$lib/components/molecules";
+  import type { CategoryInfo } from "$lib/modules/filesystem";
+  import type { SelectedCategory } from "./service";
+
+  interface Props {
+    info: Writable<CategoryInfo | null>;
+    menuIcon?: Component<SvelteHTMLElements["svg"]>;
+    onclick: (category: SelectedCategory) => void;
+    onMenuClick?: (category: SelectedCategory) => void;
+  }
+
+  let { info, menuIcon, onclick, onMenuClick }: Props = $props();
+
+  const openCategory = () => {
+    const { id, dataKey, dataKeyVersion, name } = $info as CategoryInfo;
+    if (!dataKey || !dataKeyVersion) return; // TODO: Error handling
+
+    onclick({ id, dataKey, dataKeyVersion, name });
+  };
+
+  const openMenu = () => {
+    const { id, dataKey, dataKeyVersion, name } = $info as CategoryInfo;
+    if (!dataKey || !dataKeyVersion) return; // TODO: Error handling
+
+    onMenuClick!({ id, dataKey, dataKeyVersion, name });
+  };
+</script>
+
+{#if $info}
+  <ActionEntryButton
+    class="h-12"
+    onclick={openCategory}
+    actionButtonIcon={menuIcon}
+    onActionButtonClick={openMenu}
+  >
+    <CategoryLabel name={$info.name!} />
+  </ActionEntryButton>
+{/if}

src/lib/components/molecules/Categories/index.ts

@@ -0,0 +1,2 @@
+export { default } from "./Categories.svelte";
+export * from "./service";

src/lib/components/molecules/Categories/service.ts

@@ -0,0 +1,6 @@
+export interface SelectedCategory {
+  id: number;
+  dataKey: CryptoKey;
+  dataKeyVersion: Date;
+  name: string;
+}

src/lib/components/molecules/IconEntryButton.svelte

@@ -0,0 +1,30 @@
+<script lang="ts">
+  import type { Component, Snippet } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+  import { EntryButton } from "$lib/components/atoms";
+  import { IconLabel } from "$lib/components/molecules";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    icon: Component<SvelteHTMLElements["svg"]>;
+    iconClass?: ClassValue;
+    onclick?: () => void;
+    textClass?: ClassValue;
+  }
+
+  let {
+    children,
+    class: className,
+    icon,
+    iconClass: iconClassName,
+    onclick,
+    textClass: textClassName,
+  }: Props = $props();
+</script>
+
+<EntryButton {onclick} class={className}>
+  <IconLabel {icon} class="h-full" iconClass={iconClassName} textClass={textClassName}>
+    {@render children()}
+  </IconLabel>
+</EntryButton>

src/lib/components/molecules/SubCategories.svelte

@@ -0,0 +1,67 @@
+<script lang="ts">
+  import type { Component } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+  import type { Writable } from "svelte/store";
+  import { Categories, IconEntryButton, type SelectedCategory } from "$lib/components/molecules";
+  import { getCategoryInfo, type CategoryInfo } from "$lib/modules/filesystem";
+  import { masterKeyStore } from "$lib/stores";
+
+  import IconAddCircle from "~icons/material-symbols/add-circle";
+
+  interface Props {
+    class?: ClassValue;
+    info: CategoryInfo;
+    onSubCategoryClick: (subCategory: SelectedCategory) => void;
+    onSubCategoryCreateClick: () => void;
+    onSubCategoryMenuClick?: (category: SelectedCategory) => void;
+    subCategoryCreatePosition?: "top" | "bottom";
+    subCategoryMenuIcon?: Component<SvelteHTMLElements["svg"]>;
+  }
+
+  let {
+    class: className,
+    info,
+    onSubCategoryClick,
+    onSubCategoryCreateClick,
+    onSubCategoryMenuClick,
+    subCategoryCreatePosition = "bottom",
+    subCategoryMenuIcon,
+  }: Props = $props();
+
+  let subCategories: Writable<CategoryInfo | null>[] = $state([]);
+
+  $effect(() => {
+    subCategories = info.subCategoryIds.map((id) =>
+      getCategoryInfo(id, $masterKeyStore?.get(1)?.key!),
+    );
+  });
+</script>
+
+<div class={["space-y-1", className]}>
+  {#snippet subCategoryCreate()}
+    <IconEntryButton
+      icon={IconAddCircle}
+      onclick={onSubCategoryCreateClick}
+      class="h-12 w-full"
+      iconClass="text-gray-600"
+      textClass="text-gray-700"
+    >
+      카테고리 추가하기
+    </IconEntryButton>
+  {/snippet}
+
+  {#if subCategoryCreatePosition === "top"}
+    {@render subCategoryCreate()}
+  {/if}
+  {#key info}
+    <Categories
+      categories={subCategories}
+      categoryMenuIcon={subCategoryMenuIcon}
+      onCategoryClick={onSubCategoryClick}
+      onCategoryMenuClick={onSubCategoryMenuClick}
+    />
+  {/key}
+  {#if subCategoryCreatePosition === "bottom"}
+    {@render subCategoryCreate()}
+  {/if}
+</div>

src/lib/components/molecules/TitledDiv.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+  import type { Component, Snippet } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+  import { TitleLabel } from "$lib/components/molecules";
+
+  interface Props {
+    children?: Snippet;
+    childrenClass?: ClassValue;
+    class?: ClassValue;
+    description?: Snippet;
+    icon?: Component<SvelteHTMLElements["svg"]>;
+    title: Snippet;
+    titleClass?: ClassValue;
+  }
+
+  let {
+    children,
+    childrenClass: childrenClassName,
+    class: className,
+    description,
+    icon,
+    title,
+    titleClass: titleClassName,
+  }: Props = $props();
+</script>
+
+<div class={["space-y-4 py-4", className]}>
+  <div class="space-y-2 break-keep">
+    <TitleLabel {icon} textClass={titleClassName}>
+      {@render title()}
+    </TitleLabel>
+    {#if description}
+      <p>
+        {@render description()}
+      </p>
+    {/if}
+  </div>
+  {#if children}
+    <div class={childrenClassName}>
+      {@render children()}
+    </div>
+  {/if}
+</div>

src/lib/components/molecules/TopBar.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+  import type { ClassValue } from "svelte/elements";
+
+  import IconArrowBack from "~icons/material-symbols/arrow-back";
+
+  interface Props {
+    children?: Snippet;
+    class?: ClassValue;
+    onBackClick?: () => void;
+    title?: string;
+  }
+
+  let { children, class: className, onBackClick, title }: Props = $props();
+</script>
+
+<div
+  class={[
+    "sticky top-0 z-10 flex items-center justify-between gap-x-2 px-2 py-3 backdrop-blur-2xl",
+    className,
+  ]}
+>
+  <button
+    onclick={onBackClick || (() => history.back())}
+    class="w-[2.3rem] flex-shrink-0 rounded-full p-1 active:bg-black active:bg-opacity-[0.04]"
+  >
+    <IconArrowBack class="text-2xl" />
+  </button>
+  {#if title}
+    <p class="flex-grow truncate text-center text-lg font-semibold">{title}</p>
+  {/if}
+  <div class="w-[2.3rem] flex-shrink-0">
+    {#if children}
+      {@render children()}
+    {/if}
+  </div>
+</div>

src/lib/components/molecules/index.ts

@@ -0,0 +1,9 @@
+export * from "./ActionModal.svelte";
+export { default as ActionModal } from "./ActionModal.svelte";
+export * from "./Categories";
+export { default as Categories } from "./Categories";
+export { default as IconEntryButton } from "./IconEntryButton.svelte";
+export * from "./labels";
+export { default as SubCategories } from "./SubCategories.svelte";
+export { default as TitledDiv } from "./TitledDiv.svelte";
+export { default as TopBar } from "./TopBar.svelte";

src/lib/components/molecules/labels/CategoryLabel.svelte

@@ -0,0 +1,28 @@
+<script lang="ts">
+  import type { ClassValue } from "svelte/elements";
+  import { IconLabel } from "$lib/components/molecules";
+
+  import IconCategory from "~icons/material-symbols/category";
+
+  interface Props {
+    class?: ClassValue;
+    name: string;
+    subtext?: string;
+    textClass?: ClassValue;
+  }
+
+  let { class: className, name, subtext, textClass: textClassName }: Props = $props();
+</script>
+
+{#snippet subtextSnippet()}
+  {subtext}
+{/snippet}
+
+<IconLabel
+  icon={IconCategory}
+  subtext={subtext ? subtextSnippet : undefined}
+  class={className}
+  textClass={textClassName}
+>
+  {name}
+</IconLabel>

src/lib/components/molecules/labels/DirectoryEntryLabel.svelte

@@ -0,0 +1,50 @@
+<script lang="ts">
+  import type { ClassValue } from "svelte/elements";
+  import { IconLabel } from "$lib/components/molecules";
+
+  import IconFolder from "~icons/material-symbols/folder";
+  import IconDraft from "~icons/material-symbols/draft";
+
+  interface Props {
+    class?: ClassValue;
+    name: string;
+    subtext?: string;
+    textClass?: ClassValue;
+    thumbnail?: string;
+    type: "directory" | "file";
+  }
+
+  let {
+    class: className,
+    name,
+    subtext,
+    textClass: textClassName,
+    thumbnail,
+    type,
+  }: Props = $props();
+</script>
+
+{#snippet iconSnippet()}
+  <div class="flex h-10 w-10 items-center justify-center text-xl">
+    {#if thumbnail}
+      <img src={thumbnail} alt={name} loading="lazy" class="aspect-square rounded object-cover" />
+    {:else if type === "directory"}
+      <IconFolder />
+    {:else}
+      <IconDraft class="text-blue-400" />
+    {/if}
+  </div>
+{/snippet}
+
+{#snippet subtextSnippet()}
+  {subtext}
+{/snippet}
+
+<IconLabel
+  {iconSnippet}
+  subtext={subtext ? subtextSnippet : undefined}
+  class={className}
+  textClass={textClassName}
+>
+  {name}
+</IconLabel>

src/lib/components/molecules/labels/IconLabel.svelte

@@ -0,0 +1,46 @@
+<script lang="ts">
+  import type { Component, Snippet } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    icon?: Component<SvelteHTMLElements["svg"]>;
+    iconClass?: ClassValue;
+    iconSnippet?: Snippet;
+    subtext?: Snippet;
+    textClass?: ClassValue;
+  }
+
+  let {
+    children,
+    class: className,
+    icon: Icon,
+    iconClass: iconClassName,
+    iconSnippet,
+    subtext,
+    textClass: textClassName,
+  }: Props = $props();
+</script>
+
+<div class={["flex items-center gap-x-4", className]}>
+  {#if iconSnippet}
+    <div class={["flex-shrink-0", iconClassName]}>
+      {@render iconSnippet()}
+    </div>
+  {:else if Icon}
+    <div class={["flex-shrink-0 text-lg", iconClassName]}>
+      <Icon />
+    </div>
+  {/if}
+  <div class="flex flex-grow flex-col overflow-x-hidden text-left">
+    <p class={["truncate font-medium", textClassName]}>
+      {@render children()}
+    </p>
+    {#if subtext}
+      <p class="truncate text-xs text-gray-800">
+        {@render subtext()}
+      </p>
+    {/if}
+  </div>
+</div>

src/lib/components/molecules/labels/TitleLabel.svelte

@@ -0,0 +1,24 @@
+<script lang="ts">
+  import type { Component, Snippet } from "svelte";
+  import type { ClassValue, SvelteHTMLElements } from "svelte/elements";
+
+  interface Props {
+    children: Snippet;
+    class?: ClassValue;
+    icon?: Component<SvelteHTMLElements["svg"]>;
+    textClass?: ClassValue;
+  }
+
+  let { children, class: className, icon: Icon, textClass: textClassName }: Props = $props();
+</script>
+
+<div class={className}>
+  <div class="flex min-h-[10vh] items-center">
+    {#if Icon}
+      <Icon class="text-5xl text-gray-600" />
+    {/if}
+  </div>
+  <p class={["text-3xl font-bold", textClassName]}>
+    {@render children()}
+  </p>
+</div>

src/lib/components/molecules/labels/index.ts

@@ -0,0 +1,4 @@
+export { default as CategoryLabel } from "./CategoryLabel.svelte";
+export { default as DirectoryEntryLabel } from "./DirectoryEntryLabel.svelte";
+export { default as IconLabel } from "./IconLabel.svelte";
+export { default as TitleLabel } from "./TitleLabel.svelte";

src/lib/components/organisms/Category/Category.svelte

@@ -0,0 +1,107 @@
+<script lang="ts">
+  import { untrack } from "svelte";
+  import { get, type Writable } from "svelte/store";
+  import { CheckBox } from "$lib/components/atoms";
+  import { SubCategories, type SelectedCategory } from "$lib/components/molecules";
+  import { getFileInfo, type FileInfo, type CategoryInfo } from "$lib/modules/filesystem";
+  import { SortBy, sortEntries } from "$lib/modules/util";
+  import { masterKeyStore } from "$lib/stores";
+  import File from "./File.svelte";
+  import type { SelectedFile } from "./service";
+
+  import IconMoreVert from "~icons/material-symbols/more-vert";
+
+  interface Props {
+    info: CategoryInfo;
+    onFileClick: (file: SelectedFile) => void;
+    onFileRemoveClick: (file: SelectedFile) => void;
+    onSubCategoryClick: (subCategory: SelectedCategory) => void;
+    onSubCategoryCreateClick: () => void;
+    onSubCategoryMenuClick: (subCategory: SelectedCategory) => void;
+    sortBy?: SortBy;
+    isFileRecursive: boolean;
+  }
+
+  let {
+    info,
+    onFileClick,
+    onFileRemoveClick,
+    onSubCategoryClick,
+    onSubCategoryCreateClick,
+    onSubCategoryMenuClick,
+    sortBy = SortBy.NAME_ASC,
+    isFileRecursive = $bindable(),
+  }: Props = $props();
+
+  let files: { name?: string; info: Writable<FileInfo | null>; isRecursive: boolean }[] = $state(
+    [],
+  );
+
+  $effect(() => {
+    files =
+      info.files
+        ?.filter(({ isRecursive }) => isFileRecursive || !isRecursive)
+        .map(({ id, isRecursive }) => {
+          const info = getFileInfo(id, $masterKeyStore?.get(1)?.key!);
+          return {
+            name: get(info)?.name,
+            info,
+            isRecursive,
+          };
+        }) ?? [];
+
+    const sort = () => {
+      sortEntries(files, sortBy);
+    };
+    return untrack(() => {
+      sort();
+
+      const unsubscribes = files.map((file) =>
+        file.info.subscribe((value) => {
+          if (file.name === value?.name) return;
+          file.name = value?.name;
+          sort();
+        }),
+      );
+      return () => unsubscribes.forEach((unsubscribe) => unsubscribe());
+    });
+  });
+</script>
+
+<div class="space-y-4">
+  <div class="space-y-4 bg-white p-4">
+    {#if info.id !== "root"}
+      <p class="text-lg font-bold text-gray-800">하위 카테고리</p>
+    {/if}
+    <SubCategories
+      {info}
+      {onSubCategoryClick}
+      {onSubCategoryCreateClick}
+      {onSubCategoryMenuClick}
+      subCategoryMenuIcon={IconMoreVert}
+    />
+  </div>
+  {#if info.id !== "root"}
+    <div class="space-y-4 bg-white p-4">
+      <div class="flex items-center justify-between">
+        <p class="text-lg font-bold text-gray-800">파일</p>
+        <CheckBox bind:checked={isFileRecursive}>
+          <p class="font-medium">하위 카테고리의 파일</p>
+        </CheckBox>
+      </div>
+      <div class="space-y-1">
+        {#key info}
+          {#each files as { info, isRecursive }}
+            <File
+              {info}
+              onclick={onFileClick}
+              onRemoveClick={!isRecursive ? onFileRemoveClick : undefined}
+            />
+          {:else}
+            <p class="text-gray-500 text-center">이 카테고리에 추가된 파일이 없어요.</p>
+          {/each}
+        {/key}
+      </div>
+    </div>
+  {/if}
+</div>

src/lib/components/organisms/Category/File.svelte

@@ -0,0 +1,59 @@
+<script lang="ts">
+  import type { Writable } from "svelte/store";
+  import { ActionEntryButton } from "$lib/components/atoms";
+  import { DirectoryEntryLabel } from "$lib/components/molecules";
+  import type { FileInfo } from "$lib/modules/filesystem";
+  import { requestFileThumbnailDownload, type SelectedFile } from "./service";
+
+  import IconClose from "~icons/material-symbols/close";
+
+  interface Props {
+    info: Writable<FileInfo | null>;
+    onclick: (selectedFile: SelectedFile) => void;
+    onRemoveClick?: (selectedFile: SelectedFile) => void;
+  }
+
+  let { info, onclick, onRemoveClick }: Props = $props();
+
+  let thumbnail: string | undefined = $state();
+
+  const openFile = () => {
+    const { id, dataKey, dataKeyVersion, name } = $info as FileInfo;
+    if (!dataKey || !dataKeyVersion) return; // TODO: Error handling
+
+    onclick({ id, dataKey, dataKeyVersion, name });
+  };
+
+  const removeFile = () => {
+    const { id, dataKey, dataKeyVersion, name } = $info as FileInfo;
+    if (!dataKey || !dataKeyVersion) return; // TODO: Error handling
+
+    onRemoveClick!({ id, dataKey, dataKeyVersion, name });
+  };
+
+  $effect(() => {
+    if ($info?.dataKey) {
+      requestFileThumbnailDownload($info.id, $info.dataKey)
+        .then((thumbnailUrl) => {
+          thumbnail = thumbnailUrl ?? undefined;
+        })
+        .catch(() => {
+          // TODO: Error Handling
+          thumbnail = undefined;
+        });
+    } else {
+      thumbnail = undefined;
+    }
+  });
+</script>
+
+{#if $info}
+  <ActionEntryButton
+    class="h-12"
+    onclick={openFile}
+    actionButtonIcon={onRemoveClick && IconClose}
+    onActionButtonClick={removeFile}
+  >
+    <DirectoryEntryLabel type="file" {thumbnail} name={$info.name} />
+  </ActionEntryButton>
+{/if}

src/lib/components/organisms/Category/index.ts

@@ -0,0 +1,2 @@
+export { default } from "./Category.svelte";
+export * from "./service";

src/lib/components/organisms/Category/service.ts

@@ -0,0 +1,8 @@
+export { requestFileThumbnailDownload } from "$lib/services/file";
+
+export interface SelectedFile {
+  id: number;
+  dataKey: CryptoKey;
+  dataKeyVersion: Date;
+  name: string;
+}

src/lib/components/organisms/index.ts

@@ -0,0 +1,3 @@
+export * from "./Category";
+export { default as Category } from "./Category";
+export * from "./modals";

src/lib/components/organisms/modals/CategoryCreateModal.svelte

@@ -0,0 +1,18 @@
+<script lang="ts">
+  import { TextInputModal } from "$lib/components/organisms";
+
+  interface Props {
+    isOpen: boolean;
+    onCreateClick: (name: string) => Promise<boolean>;
+  }
+
+  let { isOpen = $bindable(), onCreateClick }: Props = $props();
+</script>
+
+<TextInputModal
+  bind:isOpen
+  title="새 카테고리"
+  placeholder="카테고리 이름"
+  submitText="만들기"
+  onSubmitClick={onCreateClick}
+/>

src/lib/components/organisms/modals/ForceLoginModal.svelte

@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { ActionModal } from "$lib/components/molecules";
+
+  interface Props {
+    isOpen: boolean;
+    oncancel?: () => void;
+    onLoginClick: () => void;
+  }
+
+  let { isOpen = $bindable(), oncancel, onLoginClick }: Props = $props();
+</script>
+
+<ActionModal
+  bind:isOpen
+  title="다른 디바이스에 이미 로그인되어 있어요."
+  cancelText="아니요"
+  {oncancel}
+  confirmText="네"
+  onConfirmClick={onLoginClick}
+>
+  <p>다른 디바이스에서는 로그아웃하고, 이 디바이스에서 로그인할까요?</p>
+</ActionModal>

src/lib/components/organisms/modals/RenameModal.svelte

@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { TextInputModal } from "$lib/components/organisms";
+
+  interface Props {
+    isOpen: boolean;
+    onbeforeclose?: () => void;
+    onRenameClick: (newName: string) => Promise<boolean>;
+    originalName: string | undefined;
+  }
+
+  let { isOpen = $bindable(), onbeforeclose, onRenameClick, originalName }: Props = $props();
+</script>
+
+<TextInputModal
+  bind:isOpen
+  {onbeforeclose}
+  title="이름 바꾸기"
+  placeholder="이름"
+  defaultValue={originalName}
+  submitText="바꾸기"
+  onSubmitClick={onRenameClick}
+/>

src/lib/components/organisms/modals/TextInputModal.svelte

@@ -0,0 +1,42 @@
+<script lang="ts">
+  import { TextInput } from "$lib/components/atoms";
+  import { ActionModal, type ConfirmHandler } from "$lib/components/molecules";
+
+  interface Props {
+    defaultValue?: string;
+    isOpen: boolean;
+    onbeforeclose?: () => void;
+    onSubmitClick: (value: string) => ReturnType<ConfirmHandler>;
+    placeholder: string;
+    submitText: string;
+    title: string;
+  }
+
+  let {
+    defaultValue = "",
+    isOpen = $bindable(),
+    onbeforeclose,
+    onSubmitClick,
+    placeholder,
+    submitText,
+    title,
+  }: Props = $props();
+
+  let value = $state("");
+
+  $effect.pre(() => {
+    if (isOpen) {
+      value = defaultValue;
+    }
+  });
+</script>
+
+<ActionModal
+  bind:isOpen
+  {onbeforeclose}
+  {title}
+  confirmText={submitText}
+  onConfirmClick={() => onSubmitClick(value)}
+>
+  <TextInput bind:value {placeholder} class="mb-3" />
+</ActionModal>

src/lib/components/organisms/modals/index.ts

@@ -0,0 +1,4 @@
+export { default as CategoryCreateModal } from "./CategoryCreateModal.svelte";
+export { default as ForceLoginModal } from "./ForceLoginModal.svelte";
+export { default as RenameModal } from "./RenameModal.svelte";
+export { default as TextInputModal } from "./TextInputModal.svelte";

src/lib/indexedDB/filesystem.ts

@@ -15,16 +15,28 @@ interface FileInfo {
   contentType: string;
   createdAt?: Date;
   lastModifiedAt: Date;
+  categoryIds: number[];
+}
+
+export type CategoryId = "root" | number;
+
+interface CategoryInfo {
+  id: number;
+  parentId: CategoryId;
+  name: string;
+  files: { id: number; isRecursive: boolean }[];
 }
 
 const filesystem = new Dexie("filesystem") as Dexie & {
   directory: EntityTable<DirectoryInfo, "id">;
   file: EntityTable<FileInfo, "id">;
+  category: EntityTable<CategoryInfo, "id">;
 };
 
-filesystem.version(1).stores({
+filesystem.version(2).stores({
   directory: "id, parentId",
   file: "id, parentId",
+  category: "id, parentId",
 });
 
 export const getDirectoryInfos = async (parentId: DirectoryId) => {
@@ -43,6 +55,10 @@ export const deleteDirectoryInfo = async (id: number) => {
   await filesystem.directory.delete(id);
 };
 
+export const getAllFileInfos = async () => {
+  return await filesystem.file.toArray();
+};
+
 export const getFileInfos = async (parentId: DirectoryId) => {
   return await filesystem.file.where({ parentId }).toArray();
 };
@@ -59,13 +75,29 @@ export const deleteFileInfo = async (id: number) => {
   await filesystem.file.delete(id);
 };
 
+export const getCategoryInfos = async (parentId: CategoryId) => {
+  return await filesystem.category.where({ parentId }).toArray();
+};
+
+export const getCategoryInfo = async (id: number) => {
+  return await filesystem.category.get(id);
+};
+
+export const storeCategoryInfo = async (categoryInfo: CategoryInfo) => {
+  await filesystem.category.put(categoryInfo);
+};
+
+export const deleteCategoryInfo = async (id: number) => {
+  await filesystem.category.delete(id);
+};
+
 export const cleanupDanglingInfos = async () => {
   const validDirectoryIds: number[] = [];
   const validFileIds: number[] = [];
-  const queue: DirectoryId[] = ["root"];
+  const directoryQueue: DirectoryId[] = ["root"];
 
   while (true) {
-    const directoryId = queue.shift();
+    const directoryId = directoryQueue.shift();
     if (!directoryId) break;
 
     const [subDirectories, files] = await Promise.all([
@@ -74,13 +106,28 @@ export const cleanupDanglingInfos = async () => {
     ]);
     subDirectories.forEach(({ id }) => {
       validDirectoryIds.push(id);
-      queue.push(id);
+      directoryQueue.push(id);
     });
     files.forEach(({ id }) => validFileIds.push(id));
   }
 
+  const validCategoryIds: number[] = [];
+  const categoryQueue: CategoryId[] = ["root"];
+
+  while (true) {
+    const categoryId = categoryQueue.shift();
+    if (!categoryId) break;
+
+    const subCategories = await filesystem.category.where({ parentId: categoryId }).toArray();
+    subCategories.forEach(({ id }) => {
+      validCategoryIds.push(id);
+      categoryQueue.push(id);
+    });
+  }
+
   await Promise.all([
     filesystem.directory.where("id").noneOf(validDirectoryIds).delete(),
     filesystem.file.where("id").noneOf(validFileIds).delete(),
+    filesystem.category.where("id").noneOf(validCategoryIds).delete(),
   ]);
 };

src/lib/modules/crypto/rsa.ts

@@ -46,6 +46,56 @@ export const exportRSAKeyToBase64 = async (key: CryptoKey) => {
   return encodeToBase64((await exportRSAKey(key)).key);
 };
 
+export const importEncryptionKeyPairFromBase64 = async (
+  encryptKeyBase64: string,
+  decryptKeyBase64: string,
+) => {
+  const algorithm: RsaHashedImportParams = {
+    name: "RSA-OAEP",
+    hash: "SHA-256",
+  };
+  const encryptKey = await window.crypto.subtle.importKey(
+    "spki",
+    decodeFromBase64(encryptKeyBase64),
+    algorithm,
+    true,
+    ["encrypt", "wrapKey"],
+  );
+  const decryptKey = await window.crypto.subtle.importKey(
+    "pkcs8",
+    decodeFromBase64(decryptKeyBase64),
+    algorithm,
+    true,
+    ["decrypt", "unwrapKey"],
+  );
+  return { encryptKey, decryptKey };
+};
+
+export const importSigningKeyPairFromBase64 = async (
+  signKeyBase64: string,
+  verifyKeyBase64: string,
+) => {
+  const algorithm: RsaHashedImportParams = {
+    name: "RSA-PSS",
+    hash: "SHA-256",
+  };
+  const signKey = await window.crypto.subtle.importKey(
+    "pkcs8",
+    decodeFromBase64(signKeyBase64),
+    algorithm,
+    true,
+    ["sign"],
+  );
+  const verifyKey = await window.crypto.subtle.importKey(
+    "spki",
+    decodeFromBase64(verifyKeyBase64),
+    algorithm,
+    true,
+    ["verify"],
+  );
+  return { signKey, verifyKey };
+};
+
 export const makeRSAKeyNonextractable = async (key: CryptoKey) => {
   const { key: exportedKey, format } = await exportRSAKey(key);
   return await window.crypto.subtle.importKey(

src/lib/modules/file/cache.ts

@@ -1,12 +1,15 @@
+import { LRUCache } from "lru-cache";
 import {
   getFileCacheIndex as getFileCacheIndexFromIndexedDB,
   storeFileCacheIndex,
   deleteFileCacheIndex,
   type FileCacheIndex,
 } from "$lib/indexedDB";
-import { readFile, writeFile, deleteFile } from "$lib/modules/opfs";
+import { readFile, writeFile, deleteFile, deleteDirectory } from "$lib/modules/opfs";
+import { getThumbnailUrl } from "$lib/modules/thumbnail";
 
 const fileCacheIndex = new Map<number, FileCacheIndex>();
+const loadedThumbnails = new LRUCache<number, string>({ max: 100 });
 
 export const prepareFileCache = async () => {
   for (const cache of await getFileCacheIndexFromIndexedDB()) {
@@ -48,3 +51,30 @@ export const deleteFileCache = async (fileId: number) => {
   await deleteFile(`/cache/${fileId}`);
   await deleteFileCacheIndex(fileId);
 };
+
+export const getFileThumbnailCache = async (fileId: number) => {
+  const thumbnail = loadedThumbnails.get(fileId);
+  if (thumbnail) return thumbnail;
+
+  const thumbnailBuffer = await readFile(`/thumbnail/file/${fileId}`);
+  if (!thumbnailBuffer) return null;
+
+  const thumbnailUrl = getThumbnailUrl(thumbnailBuffer);
+  loadedThumbnails.set(fileId, thumbnailUrl);
+  return thumbnailUrl;
+};
+
+export const storeFileThumbnailCache = async (fileId: number, thumbnailBuffer: ArrayBuffer) => {
+  await writeFile(`/thumbnail/file/${fileId}`, thumbnailBuffer);
+  loadedThumbnails.set(fileId, getThumbnailUrl(thumbnailBuffer));
+};
+
+export const deleteFileThumbnailCache = async (fileId: number) => {
+  loadedThumbnails.delete(fileId);
+  await deleteFile(`/thumbnail/file/${fileId}`);
+};
+
+export const deleteAllFileThumbnailCaches = async () => {
+  loadedThumbnails.clear();
+  await deleteDirectory("/thumbnail/file");
+};

src/lib/modules/file/upload.ts

@@ -8,12 +8,16 @@ import {
   wrapDataKey,
   encryptData,
   encryptString,
+  digestMessage,
   signMessageHmac,
 } from "$lib/modules/crypto";
+import { generateThumbnail } from "$lib/modules/thumbnail";
 import type {
   DuplicateFileScanRequest,
   DuplicateFileScanResponse,
+  FileThumbnailUploadRequest,
   FileUploadRequest,
+  FileUploadResponse,
 } from "$lib/server/schemas";
 import {
   fileUploadStatusStore,
@@ -97,11 +101,17 @@ const encryptFile = limitFunction(
     const dataKeyWrapped = await wrapDataKey(dataKey, masterKey.key);
 
     const fileEncrypted = await encryptData(fileBuffer, dataKey);
+    const fileEncryptedHash = encodeToBase64(await digestMessage(fileEncrypted.ciphertext));
+
     const nameEncrypted = await encryptString(file.name, dataKey);
     const createdAtEncrypted =
       createdAt && (await encryptString(createdAt.getTime().toString(), dataKey));
     const lastModifiedAtEncrypted = await encryptString(file.lastModified.toString(), dataKey);
 
+    const thumbnail = await generateThumbnail(fileBuffer, fileType);
+    const thumbnailBuffer = await thumbnail?.arrayBuffer();
+    const thumbnailEncrypted = thumbnailBuffer && (await encryptData(thumbnailBuffer, dataKey));
+
     status.update((value) => {
       value.status = "upload-pending";
       return value;
@@ -110,24 +120,26 @@ const encryptFile = limitFunction(
     return {
       dataKeyWrapped,
       dataKeyVersion,
-      fileEncrypted,
       fileType,
+      fileEncrypted,
+      fileEncryptedHash,
       nameEncrypted,
       createdAtEncrypted,
       lastModifiedAtEncrypted,
+      thumbnail: thumbnailEncrypted && { plaintext: thumbnailBuffer, ...thumbnailEncrypted },
     };
   },
   { concurrency: 4 },
 );
 
 const requestFileUpload = limitFunction(
-  async (status: Writable<FileUploadStatus>, form: FormData) => {
+  async (status: Writable<FileUploadStatus>, form: FormData, thumbnailForm: FormData | null) => {
     status.update((value) => {
       value.status = "uploading";
       return value;
     });
 
-    await axios.post("/api/file/upload", form, {
+    const res = await axios.post("/api/file/upload", form, {
       onUploadProgress: ({ progress, rate, estimated }) => {
         status.update((value) => {
           value.progress = progress;
@@ -137,11 +149,23 @@ const requestFileUpload = limitFunction(
         });
       },
     });
+    const { file }: FileUploadResponse = res.data;
+
+    if (thumbnailForm) {
+      try {
+        await axios.post(`/api/file/${file}/thumbnail/upload`, thumbnailForm);
+      } catch (e) {
+        // TODO
+        console.error(e);
+      }
+    }
 
     status.update((value) => {
       value.status = "uploaded";
       return value;
     });
+
+    return { fileId: file };
   },
   { concurrency: 1 },
 );
@@ -152,7 +176,9 @@ export const uploadFile = async (
   hmacSecret: HmacSecret,
   masterKey: MasterKey,
   onDuplicate: () => Promise<boolean>,
-) => {
+): Promise<
+  { fileId: number; fileBuffer: ArrayBuffer; thumbnailBuffer?: ArrayBuffer } | undefined
+> => {
   const status = writable<FileUploadStatus>({
     name: file.name,
     parentId,
@@ -178,17 +204,19 @@ export const uploadFile = async (
         value = value.filter((v) => v !== status);
         return value;
       });
-      return false;
+      return undefined;
     }
 
     const {
       dataKeyWrapped,
       dataKeyVersion,
-      fileEncrypted,
       fileType,
+      fileEncrypted,
+      fileEncryptedHash,
       nameEncrypted,
       createdAtEncrypted,
       lastModifiedAtEncrypted,
+      thumbnail,
     } = await encryptFile(status, file, fileBuffer, masterKey);
 
     const form = new FormData();
@@ -209,12 +237,26 @@ export const uploadFile = async (
         createdAtIv: createdAtEncrypted?.iv,
         lastModifiedAt: lastModifiedAtEncrypted.ciphertext,
         lastModifiedAtIv: lastModifiedAtEncrypted.iv,
-      } as FileUploadRequest),
+      } satisfies FileUploadRequest),
     );
     form.set("content", new Blob([fileEncrypted.ciphertext]));
+    form.set("checksum", fileEncryptedHash);
 
-    await requestFileUpload(status, form);
+    let thumbnailForm = null;
-    return true;
+    if (thumbnail) {
+      thumbnailForm = new FormData();
+      thumbnailForm.set(
+        "metadata",
+        JSON.stringify({
+          dekVersion: dataKeyVersion.toISOString(),
+          contentIv: thumbnail.iv,
+        } satisfies FileThumbnailUploadRequest),
+      );
+      thumbnailForm.set("content", new Blob([thumbnail.ciphertext]));
+    }
+
+    const { fileId } = await requestFileUpload(status, form, thumbnailForm);
+    return { fileId, fileBuffer, thumbnailBuffer: thumbnail?.plaintext };
   } catch (e) {
     status.update((value) => {
       value.status = "error";

src/lib/modules/filesystem.ts

@@ -9,10 +9,20 @@ import {
   getFileInfo as getFileInfoFromIndexedDB,
   storeFileInfo,
   deleteFileInfo,
+  getCategoryInfos as getCategoryInfosFromIndexedDB,
+  getCategoryInfo as getCategoryInfoFromIndexedDB,
+  storeCategoryInfo,
+  deleteCategoryInfo,
   type DirectoryId,
+  type CategoryId,
 } from "$lib/indexedDB";
 import { unwrapDataKey, decryptString } from "$lib/modules/crypto";
-import type { DirectoryInfoResponse, FileInfoResponse } from "$lib/server/schemas";
+import type {
+  CategoryInfoResponse,
+  CategoryFileListResponse,
+  DirectoryInfoResponse,
+  FileInfoResponse,
+} from "$lib/server/schemas";
 
 export type DirectoryInfo =
   | {
@@ -41,10 +51,30 @@ export interface FileInfo {
   name: string;
   createdAt?: Date;
   lastModifiedAt: Date;
+  categoryIds: number[];
 }
 
+export type CategoryInfo =
+  | {
+      id: "root";
+      dataKey?: undefined;
+      dataKeyVersion?: undefined;
+      name?: undefined;
+      subCategoryIds: number[];
+      files?: undefined;
+    }
+  | {
+      id: number;
+      dataKey?: CryptoKey;
+      dataKeyVersion?: Date;
+      name: string;
+      subCategoryIds: number[];
+      files: { id: number; isRecursive: boolean }[];
+    };
+
 const directoryInfoStore = new Map<DirectoryId, Writable<DirectoryInfo | null>>();
 const fileInfoStore = new Map<number, Writable<FileInfo | null>>();
+const categoryInfoStore = new Map<CategoryId, Writable<CategoryInfo | null>>();
 
 const fetchDirectoryInfoFromIndexedDB = async (
   id: DirectoryId,
@@ -77,6 +107,7 @@ const fetchDirectoryInfoFromServer = async (
   if (res.status === 404) {
     info.set(null);
     await deleteDirectoryInfo(id as number);
+    return;
   } else if (!res.ok) {
     throw new Error("Failed to fetch directory information");
   }
@@ -123,7 +154,7 @@ export const getDirectoryInfo = (id: DirectoryId, masterKey: CryptoKey) => {
     directoryInfoStore.set(id, info);
   }
 
-  fetchDirectoryInfo(id, info, masterKey);
+  fetchDirectoryInfo(id, info, masterKey); // Intended
   return info;
 };
 
@@ -149,6 +180,7 @@ const fetchFileInfoFromServer = async (
   if (res.status === 404) {
     info.set(null);
     await deleteFileInfo(id);
+    return;
   } else if (!res.ok) {
     throw new Error("Failed to fetch file information");
   }
@@ -176,6 +208,7 @@ const fetchFileInfoFromServer = async (
     name,
     createdAt,
     lastModifiedAt,
+    categoryIds: metadata.categories,
   });
   await storeFileInfo({
     id,
@@ -184,6 +217,7 @@ const fetchFileInfoFromServer = async (
     contentType: metadata.contentType,
     createdAt,
     lastModifiedAt,
+    categoryIds: metadata.categories,
   });
 };
 
@@ -201,6 +235,95 @@ export const getFileInfo = (fileId: number, masterKey: CryptoKey) => {
     fileInfoStore.set(fileId, info);
   }
 
-  fetchFileInfo(fileId, info, masterKey);
+  fetchFileInfo(fileId, info, masterKey); // Intended
+  return info;
+};
+
+const fetchCategoryInfoFromIndexedDB = async (
+  id: CategoryId,
+  info: Writable<CategoryInfo | null>,
+) => {
+  if (get(info)) return;
+
+  const [category, subCategories] = await Promise.all([
+    id !== "root" ? getCategoryInfoFromIndexedDB(id) : undefined,
+    getCategoryInfosFromIndexedDB(id),
+  ]);
+  const subCategoryIds = subCategories.map(({ id }) => id);
+
+  if (id === "root") {
+    info.set({ id, subCategoryIds });
+  } else {
+    if (!category) return;
+    info.set({ id, name: category.name, subCategoryIds, files: category.files });
+  }
+};
+
+const fetchCategoryInfoFromServer = async (
+  id: CategoryId,
+  info: Writable<CategoryInfo | null>,
+  masterKey: CryptoKey,
+) => {
+  let res = await callGetApi(`/api/category/${id}`);
+  if (res.status === 404) {
+    info.set(null);
+    await deleteCategoryInfo(id as number);
+    return;
+  } else if (!res.ok) {
+    throw new Error("Failed to fetch category information");
+  }
+
+  const { metadata, subCategories }: CategoryInfoResponse = await res.json();
+
+  if (id === "root") {
+    info.set({ id, subCategoryIds: subCategories });
+  } else {
+    const { dataKey } = await unwrapDataKey(metadata!.dek, masterKey);
+    const name = await decryptString(metadata!.name, metadata!.nameIv, dataKey);
+
+    res = await callGetApi(`/api/category/${id}/file/list?recurse=true`);
+    if (!res.ok) {
+      throw new Error("Failed to fetch category files");
+    }
+
+    const { files }: CategoryFileListResponse = await res.json();
+    const filesMapped = files.map(({ file, isRecursive }) => ({ id: file, isRecursive }));
+
+    info.set({
+      id,
+      dataKey,
+      dataKeyVersion: new Date(metadata!.dekVersion),
+      name,
+      subCategoryIds: subCategories,
+      files: filesMapped,
+    });
+    await storeCategoryInfo({
+      id,
+      parentId: metadata!.parent,
+      name,
+      files: filesMapped,
+    });
+  }
+};
+
+const fetchCategoryInfo = async (
+  id: CategoryId,
+  info: Writable<CategoryInfo | null>,
+  masterKey: CryptoKey,
+) => {
+  await fetchCategoryInfoFromIndexedDB(id, info);
+  await fetchCategoryInfoFromServer(id, info, masterKey);
+};
+
+export const getCategoryInfo = (categoryId: CategoryId, masterKey: CryptoKey) => {
+  // TODO: MEK rotation
+
+  let info = categoryInfoStore.get(categoryId);
+  if (!info) {
+    info = writable(null);
+    categoryInfoStore.set(categoryId, info);
+  }
+
+  fetchCategoryInfo(categoryId, info, masterKey); // Intended
   return info;
 };

src/lib/modules/key.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { storeClientKey } from "$lib/indexedDB";
+import type { ClientKeys } from "$lib/stores";
+
+const serializedClientKeysSchema = z.intersection(
+  z.object({
+    generator: z.literal("ArkVault"),
+    exportedAt: z.string().datetime(),
+  }),
+  z.object({
+    version: z.literal(1),
+    encryptKey: z.string().base64().nonempty(),
+    decryptKey: z.string().base64().nonempty(),
+    signKey: z.string().base64().nonempty(),
+    verifyKey: z.string().base64().nonempty(),
+  }),
+);
+
+type SerializedClientKeys = z.infer<typeof serializedClientKeysSchema>;
+
+type DeserializedClientKeys = {
+  encryptKeyBase64: string;
+  decryptKeyBase64: string;
+  signKeyBase64: string;
+  verifyKeyBase64: string;
+};
+
+export const serializeClientKeys = ({
+  encryptKeyBase64,
+  decryptKeyBase64,
+  signKeyBase64,
+  verifyKeyBase64,
+}: DeserializedClientKeys) => {
+  return JSON.stringify({
+    version: 1,
+    generator: "ArkVault",
+    exportedAt: new Date().toISOString(),
+    encryptKey: encryptKeyBase64,
+    decryptKey: decryptKeyBase64,
+    signKey: signKeyBase64,
+    verifyKey: verifyKeyBase64,
+  } satisfies SerializedClientKeys);
+};
+
+export const deserializeClientKeys = (serialized: string) => {
+  const zodRes = serializedClientKeysSchema.safeParse(JSON.parse(serialized));
+  if (zodRes.success) {
+    return {
+      encryptKeyBase64: zodRes.data.encryptKey,
+      decryptKeyBase64: zodRes.data.decryptKey,
+      signKeyBase64: zodRes.data.signKey,
+      verifyKeyBase64: zodRes.data.verifyKey,
+    } satisfies DeserializedClientKeys;
+  }
+  return undefined;
+};
+
+export const storeClientKeys = async (clientKeys: ClientKeys) => {
+  await Promise.all([
+    storeClientKey(clientKeys.encryptKey, "encrypt"),
+    storeClientKey(clientKeys.decryptKey, "decrypt"),
+    storeClientKey(clientKeys.signKey, "sign"),
+    storeClientKey(clientKeys.verifyKey, "verify"),
+  ]);
+};

src/lib/modules/opfs.ts

@@ -59,3 +59,39 @@ export const deleteFile = async (path: string) => {
 
   await parentHandle.removeEntry(filename);
 };
+
+const getDirectoryHandle = async (path: string) => {
+  if (!rootHandle) {
+    throw new Error("OPFS not prepared");
+  } else if (path[0] !== "/") {
+    throw new Error("Path must be absolute");
+  }
+
+  const parts = path.split("/");
+  if (parts.length <= 1) {
+    throw new Error("Invalid path");
+  }
+
+  try {
+    let directoryHandle = rootHandle;
+    let parentHandle;
+    for (const part of parts.slice(1)) {
+      if (!part) continue;
+      parentHandle = directoryHandle;
+      directoryHandle = await directoryHandle.getDirectoryHandle(part);
+    }
+    return { directoryHandle, parentHandle };
+  } catch (e) {
+    if (e instanceof DOMException && e.name === "NotFoundError") {
+      return {};
+    }
+    throw e;
+  }
+};
+
+export const deleteDirectory = async (path: string) => {
+  const { directoryHandle, parentHandle } = await getDirectoryHandle(path);
+  if (!parentHandle) return;
+
+  await parentHandle.removeEntry(directoryHandle.name, { recursive: true });
+};

src/lib/modules/thumbnail.ts

@@ -0,0 +1,114 @@
+import { encodeToBase64 } from "$lib/modules/crypto";
+
+const scaleSize = (width: number, height: number, targetSize: number) => {
+  if (width <= targetSize || height <= targetSize) {
+    return { width, height };
+  }
+
+  const scale = targetSize / Math.min(width, height);
+  return {
+    width: Math.round(width * scale),
+    height: Math.round(height * scale),
+  };
+};
+
+const capture = (
+  width: number,
+  height: number,
+  drawer: (context: CanvasRenderingContext2D, width: number, height: number) => void,
+  targetSize = 250,
+) => {
+  return new Promise<Blob>((resolve, reject) => {
+    const canvas = document.createElement("canvas");
+    const { width: scaledWidth, height: scaledHeight } = scaleSize(width, height, targetSize);
+
+    canvas.width = scaledWidth;
+    canvas.height = scaledHeight;
+
+    const context = canvas.getContext("2d");
+    if (!context) {
+      return reject(new Error("Failed to generate thumbnail"));
+    }
+
+    drawer(context, scaledWidth, scaledHeight);
+    canvas.toBlob((blob) => {
+      if (blob) {
+        resolve(blob);
+      } else {
+        reject(new Error("Failed to generate thumbnail"));
+      }
+    }, "image/webp");
+  });
+};
+
+const generateImageThumbnail = (imageUrl: string) => {
+  return new Promise<Blob>((resolve, reject) => {
+    const image = new Image();
+    image.onload = () => {
+      capture(image.width, image.height, (context, width, height) => {
+        context.drawImage(image, 0, 0, width, height);
+      })
+        .then(resolve)
+        .catch(reject);
+    };
+    image.onerror = reject;
+
+    image.src = imageUrl;
+  });
+};
+
+export const captureVideoThumbnail = (video: HTMLVideoElement) => {
+  return capture(video.videoWidth, video.videoHeight, (context, width, height) => {
+    context.drawImage(video, 0, 0, width, height);
+  });
+};
+
+const generateVideoThumbnail = (videoUrl: string, time = 0) => {
+  return new Promise<Blob>((resolve, reject) => {
+    const video = document.createElement("video");
+    video.onloadedmetadata = () => {
+      video.currentTime = Math.min(time, video.duration);
+      video.requestVideoFrameCallback(() => {
+        captureVideoThumbnail(video).then(resolve).catch(reject);
+      });
+    };
+    video.onerror = reject;
+
+    video.muted = true;
+    video.playsInline = true;
+    video.src = videoUrl;
+  });
+};
+
+export const generateThumbnail = async (fileBuffer: ArrayBuffer, fileType: string) => {
+  let url;
+  try {
+    if (fileType === "image/heic") {
+      const { default: heic2any } = await import("heic2any");
+      url = URL.createObjectURL(
+        (await heic2any({
+          blob: new Blob([fileBuffer], { type: fileType }),
+          toType: "image/png",
+        })) as Blob,
+      );
+      return await generateImageThumbnail(url);
+    } else if (fileType.startsWith("image/")) {
+      url = URL.createObjectURL(new Blob([fileBuffer], { type: fileType }));
+      return await generateImageThumbnail(url);
+    } else if (fileType.startsWith("video/")) {
+      url = URL.createObjectURL(new Blob([fileBuffer], { type: fileType }));
+      return await generateVideoThumbnail(url);
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (url) {
+      URL.revokeObjectURL(url);
+    }
+  }
+};
+
+export const getThumbnailUrl = (thumbnailBuffer: ArrayBuffer) => {
+  return `data:image/webp;base64,${encodeToBase64(thumbnailBuffer)}`;
+};

src/lib/modules/util.ts

@@ -27,3 +27,37 @@ export const formatNetworkSpeed = (speed: number) => {
   if (speed < 1000 * 1000 * 1000) return `${(speed / 1000 / 1000).toFixed(1)} Mbps`;
   return `${(speed / 1000 / 1000 / 1000).toFixed(1)} Gbps`;
 };
+
+export const truncateString = (str: string, maxLength = 20) => {
+  if (str.length <= maxLength) return str;
+  return `${str.slice(0, maxLength)}...`;
+};
+
+export enum SortBy {
+  NAME_ASC,
+  NAME_DESC,
+}
+
+type SortFunc = (a?: string, b?: string) => number;
+
+const collator = new Intl.Collator(undefined, { numeric: true, sensitivity: "base" });
+
+const sortByNameAsc: SortFunc = (a, b) => {
+  if (a && b) return collator.compare(a, b);
+  if (a) return -1;
+  if (b) return 1;
+  return 0;
+};
+
+const sortByNameDesc: SortFunc = (a, b) => -sortByNameAsc(a, b);
+
+export const sortEntries = <T extends { name?: string }>(entries: T[], sortBy: SortBy) => {
+  let sortFunc: SortFunc;
+  if (sortBy === SortBy.NAME_ASC) {
+    sortFunc = sortByNameAsc;
+  } else {
+    sortFunc = sortByNameDesc;
+  }
+
+  entries.sort((a, b) => sortFunc(a.name, b.name));
+};

src/lib/server/db/category.ts

@@ -0,0 +1,147 @@
+import { IntegrityError } from "./error";
+import db from "./kysely";
+import type { Ciphertext } from "./schema";
+
+export type CategoryId = "root" | number;
+
+interface Category {
+  id: number;
+  parentId: CategoryId;
+  userId: number;
+  mekVersion: number;
+  encDek: string;
+  dekVersion: Date;
+  encName: Ciphertext;
+}
+
+export type NewCategory = Omit<Category, "id">;
+
+export const registerCategory = async (params: NewCategory) => {
+  await db.transaction().execute(async (trx) => {
+    const mek = await trx
+      .selectFrom("master_encryption_key")
+      .select("version")
+      .where("user_id", "=", params.userId)
+      .where("state", "=", "active")
+      .limit(1)
+      .forUpdate()
+      .executeTakeFirst();
+    if (mek?.version !== params.mekVersion) {
+      throw new IntegrityError("Inactive MEK version");
+    }
+
+    const { categoryId } = await trx
+      .insertInto("category")
+      .values({
+        parent_id: params.parentId !== "root" ? params.parentId : null,
+        user_id: params.userId,
+        master_encryption_key_version: params.mekVersion,
+        encrypted_data_encryption_key: params.encDek,
+        data_encryption_key_version: params.dekVersion,
+        encrypted_name: params.encName,
+      })
+      .returning("id as categoryId")
+      .executeTakeFirstOrThrow();
+    await trx
+      .insertInto("category_log")
+      .values({
+        category_id: categoryId,
+        timestamp: new Date(),
+        action: "create",
+        new_name: params.encName,
+      })
+      .execute();
+  });
+};
+
+export const getAllCategoriesByParent = async (userId: number, parentId: CategoryId) => {
+  let query = db.selectFrom("category").selectAll().where("user_id", "=", userId);
+  query =
+    parentId === "root"
+      ? query.where("parent_id", "is", null)
+      : query.where("parent_id", "=", parentId);
+  const categories = await query.execute();
+  return categories.map(
+    (category) =>
+      ({
+        id: category.id,
+        parentId: category.parent_id ?? "root",
+        userId: category.user_id,
+        mekVersion: category.master_encryption_key_version,
+        encDek: category.encrypted_data_encryption_key,
+        dekVersion: category.data_encryption_key_version,
+        encName: category.encrypted_name,
+      }) satisfies Category,
+  );
+};
+
+export const getCategory = async (userId: number, categoryId: number) => {
+  const category = await db
+    .selectFrom("category")
+    .selectAll()
+    .where("id", "=", categoryId)
+    .where("user_id", "=", userId)
+    .limit(1)
+    .executeTakeFirst();
+  return category
+    ? ({
+        id: category.id,
+        parentId: category.parent_id ?? "root",
+        userId: category.user_id,
+        mekVersion: category.master_encryption_key_version,
+        encDek: category.encrypted_data_encryption_key,
+        dekVersion: category.data_encryption_key_version,
+        encName: category.encrypted_name,
+      } satisfies Category)
+    : null;
+};
+
+export const setCategoryEncName = async (
+  userId: number,
+  categoryId: number,
+  dekVersion: Date,
+  encName: Ciphertext,
+) => {
+  await db.transaction().execute(async (trx) => {
+    const category = await trx
+      .selectFrom("category")
+      .select("data_encryption_key_version")
+      .where("id", "=", categoryId)
+      .where("user_id", "=", userId)
+      .limit(1)
+      .forUpdate()
+      .executeTakeFirst();
+    if (!category) {
+      throw new IntegrityError("Category not found");
+    } else if (category.data_encryption_key_version.getTime() !== dekVersion.getTime()) {
+      throw new IntegrityError("Invalid DEK version");
+    }
+
+    await trx
+      .updateTable("category")
+      .set({ encrypted_name: encName })
+      .where("id", "=", categoryId)
+      .where("user_id", "=", userId)
+      .execute();
+    await trx
+      .insertInto("category_log")
+      .values({
+        category_id: categoryId,
+        timestamp: new Date(),
+        action: "rename",
+        new_name: encName,
+      })
+      .execute();
+  });
+};
+
+export const unregisterCategory = async (userId: number, categoryId: number) => {
+  const res = await db
+    .deleteFrom("category")
+    .where("id", "=", categoryId)
+    .where("user_id", "=", userId)
+    .executeTakeFirst();
+  if (res.numDeletedRows === 0n) {
+    throw new IntegrityError("Category not found");
+  }
+};

src/lib/server/db/client.ts

@@ -1,53 +1,97 @@
-import { SqliteError } from "better-sqlite3";
+import pg from "pg";
-import { and, or, eq, gt, lte } from "drizzle-orm";
-import db from "./drizzle";
 import { IntegrityError } from "./error";
-import { client, userClient, userClientChallenge } from "./schema";
+import db from "./kysely";
+import type { UserClientState } from "./schema";
+
+interface Client {
+  id: number;
+  encPubKey: string;
+  sigPubKey: string;
+}
+
+interface UserClient {
+  userId: number;
+  clientId: number;
+  state: UserClientState;
+}
+
+interface UserClientWithDetails extends UserClient {
+  encPubKey: string;
+  sigPubKey: string;
+}
 
 export const createClient = async (encPubKey: string, sigPubKey: string, userId: number) => {
-  return await db.transaction(
+  return await db
-    async (tx) => {
+    .transaction()
-      const clients = await tx
+    .setIsolationLevel("serializable")
-        .select({ id: client.id })
+    .execute(async (trx) => {
-        .from(client)
+      const client = await trx
-        .where(or(eq(client.encPubKey, sigPubKey), eq(client.sigPubKey, encPubKey)))
+        .selectFrom("client")
-        .limit(1);
+        .where((eb) =>
-      if (clients.length !== 0) {
+          eb.or([
+            eb("encryption_public_key", "=", encPubKey),
+            eb("encryption_public_key", "=", sigPubKey),
+            eb("signature_public_key", "=", encPubKey),
+            eb("signature_public_key", "=", sigPubKey),
+          ]),
+        )
+        .limit(1)
+        .executeTakeFirst();
+      if (client) {
         throw new IntegrityError("Public key(s) already registered");
       }
 
-      const newClients = await tx
+      const { clientId } = await trx
-        .insert(client)
+        .insertInto("client")
-        .values({ encPubKey, sigPubKey })
+        .values({ encryption_public_key: encPubKey, signature_public_key: sigPubKey })
-        .returning({ id: client.id });
+        .returning("id as clientId")
-      const { id: clientId } = newClients[0]!;
+        .executeTakeFirstOrThrow();
-      await tx.insert(userClient).values({ userId, clientId });
+      await trx
-
+        .insertInto("user_client")
-      return clientId;
+        .values({ user_id: userId, client_id: clientId })
-    },
+        .execute();
-    { behavior: "exclusive" },
+      return { id: clientId };
-  );
+    });
 };
 
 export const getClient = async (clientId: number) => {
-  const clients = await db.select().from(client).where(eq(client.id, clientId)).limit(1);
+  const client = await db
-  return clients[0] ?? null;
+    .selectFrom("client")
+    .selectAll()
+    .where("id", "=", clientId)
+    .limit(1)
+    .executeTakeFirst();
+  return client
+    ? ({
+        id: client.id,
+        encPubKey: client.encryption_public_key,
+        sigPubKey: client.signature_public_key,
+      } satisfies Client)
+    : null;
 };
 
 export const getClientByPubKeys = async (encPubKey: string, sigPubKey: string) => {
-  const clients = await db
+  const client = await db
-    .select()
+    .selectFrom("client")
-    .from(client)
+    .selectAll()
-    .where(and(eq(client.encPubKey, encPubKey), eq(client.sigPubKey, sigPubKey)))
+    .where("encryption_public_key", "=", encPubKey)
-    .limit(1);
+    .where("signature_public_key", "=", sigPubKey)
-  return clients[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return client
+    ? ({
+        id: client.id,
+        encPubKey: client.encryption_public_key,
+        sigPubKey: client.signature_public_key,
+      } satisfies Client)
+    : null;
 };
 
 export const createUserClient = async (userId: number, clientId: number) => {
   try {
-    await db.insert(userClient).values({ userId, clientId });
+    await db.insertInto("user_client").values({ user_id: userId, client_id: clientId }).execute();
   } catch (e) {
-    if (e instanceof SqliteError && e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    if (e instanceof pg.DatabaseError && e.code === "23505") {
       throw new IntegrityError("User client already exists");
     }
     throw e;
@@ -55,52 +99,76 @@ export const createUserClient = async (userId: number, clientId: number) => {
 };
 
 export const getAllUserClients = async (userId: number) => {
-  return await db.select().from(userClient).where(eq(userClient.userId, userId));
+  const userClients = await db
+    .selectFrom("user_client")
+    .selectAll()
+    .where("user_id", "=", userId)
+    .execute();
+  return userClients.map(
+    ({ user_id, client_id, state }) =>
+      ({
+        userId: user_id,
+        clientId: client_id,
+        state,
+      }) satisfies UserClient,
+  );
 };
 
 export const getUserClient = async (userId: number, clientId: number) => {
-  const userClients = await db
+  const userClient = await db
-    .select()
+    .selectFrom("user_client")
-    .from(userClient)
+    .selectAll()
-    .where(and(eq(userClient.userId, userId), eq(userClient.clientId, clientId)))
+    .where("user_id", "=", userId)
-    .limit(1);
+    .where("client_id", "=", clientId)
-  return userClients[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return userClient
+    ? ({
+        userId: userClient.user_id,
+        clientId: userClient.client_id,
+        state: userClient.state,
+      } satisfies UserClient)
+    : null;
 };
 
 export const getUserClientWithDetails = async (userId: number, clientId: number) => {
-  const userClients = await db
+  const userClient = await db
-    .select()
+    .selectFrom("user_client")
-    .from(userClient)
+    .innerJoin("client", "user_client.client_id", "client.id")
-    .innerJoin(client, eq(userClient.clientId, client.id))
+    .selectAll()
-    .where(and(eq(userClient.userId, userId), eq(userClient.clientId, clientId)))
+    .where("user_id", "=", userId)
-    .limit(1);
+    .where("client_id", "=", clientId)
-  return userClients[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return userClient
+    ? ({
+        userId: userClient.user_id,
+        clientId: userClient.client_id,
+        state: userClient.state,
+        encPubKey: userClient.encryption_public_key,
+        sigPubKey: userClient.signature_public_key,
+      } satisfies UserClientWithDetails)
+    : null;
 };
 
 export const setUserClientStateToPending = async (userId: number, clientId: number) => {
   await db
-    .update(userClient)
+    .updateTable("user_client")
     .set({ state: "pending" })
-    .where(
+    .where("user_id", "=", userId)
-      and(
+    .where("client_id", "=", clientId)
-        eq(userClient.userId, userId),
+    .where("state", "=", "challenging")
-        eq(userClient.clientId, clientId),
+    .execute();
-        eq(userClient.state, "challenging"),
-      ),
-    );
 };
 
 export const setUserClientStateToActive = async (userId: number, clientId: number) => {
   await db
-    .update(userClient)
+    .updateTable("user_client")
     .set({ state: "active" })
-    .where(
+    .where("user_id", "=", userId)
-      and(
+    .where("client_id", "=", clientId)
-        eq(userClient.userId, userId),
+    .where("state", "=", "pending")
-        eq(userClient.clientId, clientId),
+    .execute();
-        eq(userClient.state, "pending"),
-      ),
-    );
 };
 
 export const registerUserClientChallenge = async (
@@ -110,30 +178,36 @@ export const registerUserClientChallenge = async (
   allowedIp: string,
   expiresAt: Date,
 ) => {
-  await db.insert(userClientChallenge).values({
+  const { id } = await db
-    userId,
+    .insertInto("user_client_challenge")
-    clientId,
+    .values({
-    answer,
+      user_id: userId,
-    allowedIp,
+      client_id: clientId,
-    expiresAt,
+      answer,
-  });
+      allowed_ip: allowedIp,
+      expires_at: expiresAt,
+    })
+    .returning("id")
+    .executeTakeFirstOrThrow();
+  return { id };
 };
 
-export const consumeUserClientChallenge = async (userId: number, answer: string, ip: string) => {
+export const consumeUserClientChallenge = async (
-  const challenges = await db
+  challengeId: number,
-    .delete(userClientChallenge)
+  userId: number,
-    .where(
+  ip: string,
-      and(
+) => {
-        eq(userClientChallenge.userId, userId),
+  const challenge = await db
-        eq(userClientChallenge.answer, answer),
+    .deleteFrom("user_client_challenge")
-        eq(userClientChallenge.allowedIp, ip),
+    .where("id", "=", challengeId)
-        gt(userClientChallenge.expiresAt, new Date()),
+    .where("user_id", "=", userId)
-      ),
+    .where("allowed_ip", "=", ip)
-    )
+    .where("expires_at", ">", new Date())
-    .returning({ clientId: userClientChallenge.clientId });
+    .returning(["client_id", "answer"])
-  return challenges[0] ?? null;
+    .executeTakeFirst();
+  return challenge ? { clientId: challenge.client_id, answer: challenge.answer } : null;
 };
 
 export const cleanupExpiredUserClientChallenges = async () => {
-  await db.delete(userClientChallenge).where(lte(userClientChallenge.expiresAt, new Date()));
+  await db.deleteFrom("user_client_challenge").where("expires_at", "<=", new Date()).execute();
 };

src/lib/server/db/drizzle.ts

@@ -1,15 +0,0 @@
-import Database from "better-sqlite3";
-import { drizzle } from "drizzle-orm/better-sqlite3";
-import { migrate } from "drizzle-orm/better-sqlite3/migrator";
-import env from "$lib/server/loadenv";
-
-const client = new Database(env.databaseUrl);
-const db = drizzle(client);
-
-export const migrateDB = () => {
-  if (process.env.NODE_ENV === "production") {
-    migrate(db, { migrationsFolder: "./drizzle" });
-  }
-};
-
-export default db;

src/lib/server/db/error.ts

@@ -1,4 +1,6 @@
 type IntegrityErrorMessages =
+  // Category
+  | "Category not found"
   // Challenge
   | "Challenge already registered"
   // Client
@@ -7,6 +9,8 @@ type IntegrityErrorMessages =
   // File
   | "Directory not found"
   | "File not found"
+  | "File not found in category"
+  | "File already added to category"
   | "Invalid DEK version"
   // HSK
   | "HSK already registered"

src/lib/server/db/file.ts

@@ -1,21 +1,25 @@
-import { and, eq, isNull } from "drizzle-orm";
+import { sql, type NotNull } from "kysely";
-import db from "./drizzle";
+import pg from "pg";
 import { IntegrityError } from "./error";
-import { directory, directoryLog, file, fileLog, hsk, mek } from "./schema";
+import db from "./kysely";
+import type { Ciphertext } from "./schema";
 
-type DirectoryId = "root" | number;
+export type DirectoryId = "root" | number;
 
-export interface NewDirectoryParams {
+interface Directory {
+  id: number;
   parentId: DirectoryId;
   userId: number;
   mekVersion: number;
   encDek: string;
   dekVersion: Date;
-  encName: string;
+  encName: Ciphertext;
-  encNameIv: string;
 }
 
-export interface NewFileParams {
+export type NewDirectory = Omit<Directory, "id">;
+
+interface File {
+  id: number;
   parentId: DirectoryId;
   userId: number;
   path: string;
@@ -26,216 +30,320 @@ export interface NewFileParams {
   contentHmac: string | null;
   contentType: string;
   encContentIv: string;
-  encName: string;
+  encContentHash: string;
-  encNameIv: string;
+  encName: Ciphertext;
-  encCreatedAt: string | null;
+  encCreatedAt: Ciphertext | null;
-  encCreatedAtIv: string | null;
+  encLastModifiedAt: Ciphertext;
-  encLastModifiedAt: string;
-  encLastModifiedAtIv: string;
 }
 
-export const registerDirectory = async (params: NewDirectoryParams) => {
+export type NewFile = Omit<File, "id">;
-  await db.transaction(
-    async (tx) => {
-      const meks = await tx
-        .select({ version: mek.version })
-        .from(mek)
-        .where(and(eq(mek.userId, params.userId), eq(mek.state, "active")))
-        .limit(1);
-      if (meks[0]?.version !== params.mekVersion) {
-        throw new IntegrityError("Inactive MEK version");
-      }
 
-      const newDirectories = await tx
+export const registerDirectory = async (params: NewDirectory) => {
-        .insert(directory)
+  await db.transaction().execute(async (trx) => {
-        .values({
+    const mek = await trx
-          parentId: params.parentId === "root" ? null : params.parentId,
+      .selectFrom("master_encryption_key")
-          userId: params.userId,
+      .select("version")
-          mekVersion: params.mekVersion,
+      .where("user_id", "=", params.userId)
-          encDek: params.encDek,
+      .where("state", "=", "active")
-          dekVersion: params.dekVersion,
+      .limit(1)
-          encName: { ciphertext: params.encName, iv: params.encNameIv },
+      .forUpdate()
-        })
+      .executeTakeFirst();
-        .returning({ id: directory.id });
+    if (mek?.version !== params.mekVersion) {
-      const { id: directoryId } = newDirectories[0]!;
+      throw new IntegrityError("Inactive MEK version");
-      await tx.insert(directoryLog).values({
+    }
-        directoryId,
+
+    const { directoryId } = await trx
+      .insertInto("directory")
+      .values({
+        parent_id: params.parentId !== "root" ? params.parentId : null,
+        user_id: params.userId,
+        master_encryption_key_version: params.mekVersion,
+        encrypted_data_encryption_key: params.encDek,
+        data_encryption_key_version: params.dekVersion,
+        encrypted_name: params.encName,
+      })
+      .returning("id as directoryId")
+      .executeTakeFirstOrThrow();
+    await trx
+      .insertInto("directory_log")
+      .values({
+        directory_id: directoryId,
         timestamp: new Date(),
         action: "create",
-        newName: { ciphertext: params.encName, iv: params.encNameIv },
+        new_name: params.encName,
-      });
+      })
-    },
+      .execute();
-    { behavior: "exclusive" },
+  });
-  );
 };
 
 export const getAllDirectoriesByParent = async (userId: number, parentId: DirectoryId) => {
-  return await db
+  let query = db.selectFrom("directory").selectAll().where("user_id", "=", userId);
-    .select()
+  query =
-    .from(directory)
+    parentId === "root"
-    .where(
+      ? query.where("parent_id", "is", null)
-      and(
+      : query.where("parent_id", "=", parentId);
-        eq(directory.userId, userId),
+  const directories = await query.execute();
-        parentId === "root" ? isNull(directory.parentId) : eq(directory.parentId, parentId),
+  return directories.map(
-      ),
+    (directory) =>
-    );
+      ({
+        id: directory.id,
+        parentId: directory.parent_id ?? "root",
+        userId: directory.user_id,
+        mekVersion: directory.master_encryption_key_version,
+        encDek: directory.encrypted_data_encryption_key,
+        dekVersion: directory.data_encryption_key_version,
+        encName: directory.encrypted_name,
+      }) satisfies Directory,
+  );
 };
 
 export const getDirectory = async (userId: number, directoryId: number) => {
-  const res = await db
+  const directory = await db
-    .select()
+    .selectFrom("directory")
-    .from(directory)
+    .selectAll()
-    .where(and(eq(directory.userId, userId), eq(directory.id, directoryId)))
+    .where("id", "=", directoryId)
-    .limit(1);
+    .where("user_id", "=", userId)
-  return res[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return directory
+    ? ({
+        id: directory.id,
+        parentId: directory.parent_id ?? "root",
+        userId: directory.user_id,
+        mekVersion: directory.master_encryption_key_version,
+        encDek: directory.encrypted_data_encryption_key,
+        dekVersion: directory.data_encryption_key_version,
+        encName: directory.encrypted_name,
+      } satisfies Directory)
+    : null;
 };
 
 export const setDirectoryEncName = async (
   userId: number,
   directoryId: number,
   dekVersion: Date,
-  encName: string,
+  encName: Ciphertext,
-  encNameIv: string,
 ) => {
-  await db.transaction(
+  await db.transaction().execute(async (trx) => {
-    async (tx) => {
+    const directory = await trx
-      const directories = await tx
+      .selectFrom("directory")
-        .select({ version: directory.dekVersion })
+      .select("data_encryption_key_version")
-        .from(directory)
+      .where("id", "=", directoryId)
-        .where(and(eq(directory.userId, userId), eq(directory.id, directoryId)))
+      .where("user_id", "=", userId)
-        .limit(1);
+      .limit(1)
-      if (!directories[0]) {
+      .forUpdate()
-        throw new IntegrityError("Directory not found");
+      .executeTakeFirst();
-      } else if (directories[0].version.getTime() !== dekVersion.getTime()) {
+    if (!directory) {
-        throw new IntegrityError("Invalid DEK version");
+      throw new IntegrityError("Directory not found");
-      }
+    } else if (directory.data_encryption_key_version.getTime() !== dekVersion.getTime()) {
+      throw new IntegrityError("Invalid DEK version");
+    }
 
-      await tx
+    await trx
-        .update(directory)
+      .updateTable("directory")
-        .set({ encName: { ciphertext: encName, iv: encNameIv } })
+      .set({ encrypted_name: encName })
-        .where(and(eq(directory.userId, userId), eq(directory.id, directoryId)));
+      .where("id", "=", directoryId)
-      await tx.insert(directoryLog).values({
+      .where("user_id", "=", userId)
-        directoryId,
+      .execute();
+    await trx
+      .insertInto("directory_log")
+      .values({
+        directory_id: directoryId,
         timestamp: new Date(),
         action: "rename",
-        newName: { ciphertext: encName, iv: encNameIv },
+        new_name: encName,
-      });
+      })
-    },
+      .execute();
-    { behavior: "exclusive" },
+  });
-  );
 };
 
 export const unregisterDirectory = async (userId: number, directoryId: number) => {
-  return await db.transaction(
+  return await db
-    async (tx) => {
+    .transaction()
+    .setIsolationLevel("repeatable read") // TODO: Sufficient?
+    .execute(async (trx) => {
       const unregisterFiles = async (parentId: number) => {
-        return await tx
+        const files = await trx
-          .delete(file)
+          .selectFrom("file")
-          .where(and(eq(file.userId, userId), eq(file.parentId, parentId)))
+          .leftJoin("thumbnail", "file.id", "thumbnail.file_id")
-          .returning({ id: file.id, path: file.path });
+          .select(["file.id", "file.path", "thumbnail.path as thumbnailPath"])
+          .where("file.parent_id", "=", parentId)
+          .where("file.user_id", "=", userId)
+          .forUpdate("file")
+          .execute();
+        await trx
+          .deleteFrom("file")
+          .where("parent_id", "=", parentId)
+          .where("user_id", "=", userId)
+          .execute();
+        return files;
       };
       const unregisterDirectoryRecursively = async (
         directoryId: number,
-      ): Promise<{ id: number; path: string }[]> => {
+      ): Promise<{ id: number; path: string; thumbnailPath: string | null }[]> => {
         const files = await unregisterFiles(directoryId);
-        const subDirectories = await tx
+        const subDirectories = await trx
-          .select({ id: directory.id })
+          .selectFrom("directory")
-          .from(directory)
+          .select("id")
-          .where(and(eq(directory.userId, userId), eq(directory.parentId, directoryId)));
+          .where("parent_id", "=", directoryId)
+          .where("user_id", "=", userId)
+          .execute();
         const subDirectoryFilePaths = await Promise.all(
           subDirectories.map(async ({ id }) => await unregisterDirectoryRecursively(id)),
         );
 
-        const deleteRes = await tx.delete(directory).where(eq(directory.id, directoryId));
+        const deleteRes = await trx
-        if (deleteRes.changes === 0) {
+          .deleteFrom("directory")
+          .where("id", "=", directoryId)
+          .where("user_id", "=", userId)
+          .executeTakeFirst();
+        if (deleteRes.numDeletedRows === 0n) {
           throw new IntegrityError("Directory not found");
         }
         return files.concat(...subDirectoryFilePaths);
       };
       return await unregisterDirectoryRecursively(directoryId);
-    },
+    });
-    { behavior: "exclusive" },
-  );
 };
 
-export const registerFile = async (params: NewFileParams) => {
+export const registerFile = async (params: NewFile) => {
-  if (
+  if ((params.hskVersion && !params.contentHmac) || (!params.hskVersion && params.contentHmac)) {
-    (params.hskVersion && !params.contentHmac) ||
-    (!params.hskVersion && params.contentHmac) ||
-    (params.encCreatedAt && !params.encCreatedAtIv) ||
-    (!params.encCreatedAt && params.encCreatedAtIv)
-  ) {
     throw new Error("Invalid arguments");
   }
 
-  await db.transaction(
+  return await db.transaction().execute(async (trx) => {
-    async (tx) => {
+    const mek = await trx
-      const meks = await tx
+      .selectFrom("master_encryption_key")
-        .select({ version: mek.version })
+      .select("version")
-        .from(mek)
+      .where("user_id", "=", params.userId)
-        .where(and(eq(mek.userId, params.userId), eq(mek.state, "active")))
+      .where("state", "=", "active")
-        .limit(1);
+      .limit(1)
-      if (meks[0]?.version !== params.mekVersion) {
+      .forUpdate()
-        throw new IntegrityError("Inactive MEK version");
+      .executeTakeFirst();
-      }
+    if (mek?.version !== params.mekVersion) {
+      throw new IntegrityError("Inactive MEK version");
+    }
 
-      if (params.hskVersion) {
+    if (params.hskVersion) {
-        const hsks = await tx
+      const hsk = await trx
-          .select({ version: hsk.version })
+        .selectFrom("hmac_secret_key")
-          .from(hsk)
+        .select("version")
-          .where(and(eq(hsk.userId, params.userId), eq(hsk.state, "active")))
+        .where("user_id", "=", params.userId)
-          .limit(1);
+        .where("state", "=", "active")
-        if (hsks[0]?.version !== params.hskVersion) {
+        .limit(1)
-          throw new IntegrityError("Inactive HSK version");
+        .forUpdate()
-        }
+        .executeTakeFirst();
+      if (hsk?.version !== params.hskVersion) {
+        throw new IntegrityError("Inactive HSK version");
       }
+    }
 
-      const newFiles = await tx
+    const { fileId } = await trx
-        .insert(file)
+      .insertInto("file")
-        .values({
+      .values({
-          path: params.path,
+        parent_id: params.parentId !== "root" ? params.parentId : null,
-          parentId: params.parentId === "root" ? null : params.parentId,
+        user_id: params.userId,
-          userId: params.userId,
+        path: params.path,
-          mekVersion: params.mekVersion,
+        master_encryption_key_version: params.mekVersion,
-          hskVersion: params.hskVersion,
+        encrypted_data_encryption_key: params.encDek,
-          contentHmac: params.contentHmac,
+        data_encryption_key_version: params.dekVersion,
-          contentType: params.contentType,
+        hmac_secret_key_version: params.hskVersion,
-          encDek: params.encDek,
+        content_hmac: params.contentHmac,
-          dekVersion: params.dekVersion,
+        content_type: params.contentType,
-          encContentIv: params.encContentIv,
+        encrypted_content_iv: params.encContentIv,
-          encName: { ciphertext: params.encName, iv: params.encNameIv },
+        encrypted_content_hash: params.encContentHash,
-          encCreatedAt:
+        encrypted_name: params.encName,
-            params.encCreatedAt && params.encCreatedAtIv
+        encrypted_created_at: params.encCreatedAt,
-              ? { ciphertext: params.encCreatedAt, iv: params.encCreatedAtIv }
+        encrypted_last_modified_at: params.encLastModifiedAt,
-              : null,
+      })
-          encLastModifiedAt: {
+      .returning("id as fileId")
-            ciphertext: params.encLastModifiedAt,
+      .executeTakeFirstOrThrow();
-            iv: params.encLastModifiedAtIv,
+    await trx
-          },
+      .insertInto("file_log")
-        })
+      .values({
-        .returning({ id: file.id });
+        file_id: fileId,
-      const { id: fileId } = newFiles[0]!;
-      await tx.insert(fileLog).values({
-        fileId,
         timestamp: new Date(),
         action: "create",
-        newName: { ciphertext: params.encName, iv: params.encNameIv },
+        new_name: params.encName,
-      });
+      })
-    },
+      .execute();
-    { behavior: "exclusive" },
+    return { id: fileId };
-  );
+  });
 };
 
 export const getAllFilesByParent = async (userId: number, parentId: DirectoryId) => {
-  return await db
+  let query = db.selectFrom("file").selectAll().where("user_id", "=", userId);
-    .select()
+  query =
-    .from(file)
+    parentId === "root"
-    .where(
+      ? query.where("parent_id", "is", null)
-      and(
+      : query.where("parent_id", "=", parentId);
-        eq(file.userId, userId),
+  const files = await query.execute();
-        parentId === "root" ? isNull(file.parentId) : eq(file.parentId, parentId),
+  return files.map(
-      ),
+    (file) =>
-    );
+      ({
+        id: file.id,
+        parentId: file.parent_id ?? "root",
+        userId: file.user_id,
+        path: file.path,
+        mekVersion: file.master_encryption_key_version,
+        encDek: file.encrypted_data_encryption_key,
+        dekVersion: file.data_encryption_key_version,
+        hskVersion: file.hmac_secret_key_version,
+        contentHmac: file.content_hmac,
+        contentType: file.content_type,
+        encContentIv: file.encrypted_content_iv,
+        encContentHash: file.encrypted_content_hash,
+        encName: file.encrypted_name,
+        encCreatedAt: file.encrypted_created_at,
+        encLastModifiedAt: file.encrypted_last_modified_at,
+      }) satisfies File,
+  );
+};
+
+export const getAllFilesByCategory = async (
+  userId: number,
+  categoryId: number,
+  recurse: boolean,
+) => {
+  const files = await db
+    .withRecursive("cte", (db) =>
+      db
+        .selectFrom("category")
+        .leftJoin("file_category", "category.id", "file_category.category_id")
+        .select(["id", "parent_id", "user_id", "file_category.file_id"])
+        .select(sql<number>`0`.as("depth"))
+        .where("id", "=", categoryId)
+        .$if(recurse, (qb) =>
+          qb.unionAll((db) =>
+            db
+              .selectFrom("category")
+              .leftJoin("file_category", "category.id", "file_category.category_id")
+              .innerJoin("cte", "category.parent_id", "cte.id")
+              .select([
+                "category.id",
+                "category.parent_id",
+                "category.user_id",
+                "file_category.file_id",
+              ])
+              .select(sql<number>`cte.depth + 1`.as("depth")),
+          ),
+        ),
+    )
+    .selectFrom("cte")
+    .select(["file_id", "depth"])
+    .distinctOn("file_id")
+    .where("user_id", "=", userId)
+    .where("file_id", "is not", null)
+    .$narrowType<{ file_id: NotNull }>()
+    .orderBy("file_id")
+    .orderBy("depth")
+    .execute();
+  return files.map(({ file_id, depth }) => ({ id: file_id, isRecursive: depth > 0 }));
+};
+
+export const getAllFileIds = async (userId: number) => {
+  const files = await db.selectFrom("file").select("id").where("user_id", "=", userId).execute();
+  return files.map(({ id }) => id);
 };
 
 export const getAllFileIdsByContentHmac = async (
@@ -243,69 +351,156 @@ export const getAllFileIdsByContentHmac = async (
   hskVersion: number,
   contentHmac: string,
 ) => {
-  return await db
+  const files = await db
-    .select({ id: file.id })
+    .selectFrom("file")
-    .from(file)
+    .select("id")
-    .where(
+    .where("user_id", "=", userId)
-      and(
+    .where("hmac_secret_key_version", "=", hskVersion)
-        eq(file.userId, userId),
+    .where("content_hmac", "=", contentHmac)
-        eq(file.hskVersion, hskVersion),
+    .execute();
-        eq(file.contentHmac, contentHmac),
+  return files.map(({ id }) => id);
-      ),
-    );
 };
 
 export const getFile = async (userId: number, fileId: number) => {
-  const res = await db
+  const file = await db
-    .select()
+    .selectFrom("file")
-    .from(file)
+    .selectAll()
-    .where(and(eq(file.userId, userId), eq(file.id, fileId)))
+    .where("id", "=", fileId)
-    .limit(1);
+    .where("user_id", "=", userId)
-  return res[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return file
+    ? ({
+        id: file.id,
+        parentId: file.parent_id ?? "root",
+        userId: file.user_id,
+        path: file.path,
+        mekVersion: file.master_encryption_key_version,
+        encDek: file.encrypted_data_encryption_key,
+        dekVersion: file.data_encryption_key_version,
+        hskVersion: file.hmac_secret_key_version,
+        contentHmac: file.content_hmac,
+        contentType: file.content_type,
+        encContentIv: file.encrypted_content_iv,
+        encContentHash: file.encrypted_content_hash,
+        encName: file.encrypted_name,
+        encCreatedAt: file.encrypted_created_at,
+        encLastModifiedAt: file.encrypted_last_modified_at,
+      } satisfies File)
+    : null;
 };
 
 export const setFileEncName = async (
   userId: number,
   fileId: number,
   dekVersion: Date,
-  encName: string,
+  encName: Ciphertext,
-  encNameIv: string,
 ) => {
-  await db.transaction(
+  await db.transaction().execute(async (trx) => {
-    async (tx) => {
+    const file = await trx
-      const files = await tx
+      .selectFrom("file")
-        .select({ version: file.dekVersion })
+      .select("data_encryption_key_version")
-        .from(file)
+      .where("id", "=", fileId)
-        .where(and(eq(file.userId, userId), eq(file.id, fileId)))
+      .where("user_id", "=", userId)
-        .limit(1);
+      .limit(1)
-      if (!files[0]) {
+      .forUpdate()
-        throw new IntegrityError("File not found");
+      .executeTakeFirst();
-      } else if (files[0].version.getTime() !== dekVersion.getTime()) {
+    if (!file) {
-        throw new IntegrityError("Invalid DEK version");
+      throw new IntegrityError("File not found");
-      }
+    } else if (file.data_encryption_key_version.getTime() !== dekVersion.getTime()) {
+      throw new IntegrityError("Invalid DEK version");
+    }
 
-      await tx
+    await trx
-        .update(file)
+      .updateTable("file")
-        .set({ encName: { ciphertext: encName, iv: encNameIv } })
+      .set({ encrypted_name: encName })
-        .where(and(eq(file.userId, userId), eq(file.id, fileId)));
+      .where("id", "=", fileId)
-      await tx.insert(fileLog).values({
+      .where("user_id", "=", userId)
-        fileId,
+      .execute();
+    await trx
+      .insertInto("file_log")
+      .values({
+        file_id: fileId,
         timestamp: new Date(),
         action: "rename",
-        newName: { ciphertext: encName, iv: encNameIv },
+        new_name: encName,
-      });
+      })
-    },
+      .execute();
-    { behavior: "exclusive" },
+  });
-  );
 };
 
 export const unregisterFile = async (userId: number, fileId: number) => {
-  const files = await db
+  return await db.transaction().execute(async (trx) => {
-    .delete(file)
+    const file = await trx
-    .where(and(eq(file.userId, userId), eq(file.id, fileId)))
+      .selectFrom("file")
-    .returning({ path: file.path });
+      .leftJoin("thumbnail", "file.id", "thumbnail.file_id")
-  if (!files[0]) {
+      .select(["file.path", "thumbnail.path as thumbnailPath"])
-    throw new IntegrityError("File not found");
+      .where("file.id", "=", fileId)
-  }
+      .where("file.user_id", "=", userId)
-  return files[0].path;
+      .forUpdate("file")
+      .executeTakeFirst();
+    if (!file) {
+      throw new IntegrityError("File not found");
+    }
+
+    await trx.deleteFrom("file").where("id", "=", fileId).execute();
+    return file;
+  });
+};
+
+export const addFileToCategory = async (fileId: number, categoryId: number) => {
+  await db.transaction().execute(async (trx) => {
+    try {
+      await trx
+        .insertInto("file_category")
+        .values({ file_id: fileId, category_id: categoryId })
+        .execute();
+      await trx
+        .insertInto("file_log")
+        .values({
+          file_id: fileId,
+          timestamp: new Date(),
+          action: "add-to-category",
+          category_id: categoryId,
+        })
+        .execute();
+    } catch (e) {
+      if (e instanceof pg.DatabaseError && e.code === "23505") {
+        throw new IntegrityError("File already added to category");
+      }
+      throw e;
+    }
+  });
+};
+
+export const getAllFileCategories = async (fileId: number) => {
+  const categories = await db
+    .selectFrom("file_category")
+    .select("category_id")
+    .where("file_id", "=", fileId)
+    .execute();
+  return categories.map(({ category_id }) => ({ id: category_id }));
+};
+
+export const removeFileFromCategory = async (fileId: number, categoryId: number) => {
+  await db.transaction().execute(async (trx) => {
+    const res = await trx
+      .deleteFrom("file_category")
+      .where("file_id", "=", fileId)
+      .where("category_id", "=", categoryId)
+      .executeTakeFirst();
+    if (res.numDeletedRows === 0n) {
+      throw new IntegrityError("File not found in category");
+    }
+
+    await trx
+      .insertInto("file_log")
+      .values({
+        file_id: fileId,
+        timestamp: new Date(),
+        action: "remove-from-category",
+        category_id: categoryId,
+      })
+      .execute();
+  });
 };

src/lib/server/db/hsk.ts

@@ -1,8 +1,15 @@
-import { SqliteError } from "better-sqlite3";
+import pg from "pg";
-import { and, eq } from "drizzle-orm";
-import db from "./drizzle";
 import { IntegrityError } from "./error";
-import { hsk, hskLog } from "./schema";
+import db from "./kysely";
+import type { HskState } from "./schema";
+
+interface Hsk {
+  userId: number;
+  version: number;
+  state: HskState;
+  mekVersion: number;
+  encHsk: string;
+}
 
 export const registerInitialHsk = async (
   userId: number,
@@ -10,37 +17,52 @@ export const registerInitialHsk = async (
   mekVersion: number,
   encHsk: string,
 ) => {
-  await db.transaction(
+  await db.transaction().execute(async (trx) => {
-    async (tx) => {
+    try {
-      try {
+      await trx
-        await tx.insert(hsk).values({
+        .insertInto("hmac_secret_key")
-          userId,
+        .values({
+          user_id: userId,
           version: 1,
           state: "active",
-          mekVersion,
+          master_encryption_key_version: mekVersion,
-          encHsk,
+          encrypted_key: encHsk,
-        });
+        })
-        await tx.insert(hskLog).values({
+        .execute();
-          userId,
+      await trx
-          hskVersion: 1,
+        .insertInto("hmac_secret_key_log")
+        .values({
+          user_id: userId,
+          hmac_secret_key_version: 1,
           timestamp: new Date(),
           action: "create",
-          actionBy: createdBy,
+          action_by: createdBy,
-        });
+        })
-      } catch (e) {
+        .execute();
-        if (e instanceof SqliteError && e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    } catch (e) {
-          throw new IntegrityError("HSK already registered");
+      if (e instanceof pg.DatabaseError && e.code === "23505") {
-        }
+        throw new IntegrityError("HSK already registered");
-        throw e;
       }
-    },
+      throw e;
-    { behavior: "exclusive" },
+    }
-  );
+  });
 };
 
 export const getAllValidHsks = async (userId: number) => {
-  return await db
+  const hsks = await db
-    .select()
+    .selectFrom("hmac_secret_key")
-    .from(hsk)
+    .selectAll()
-    .where(and(eq(hsk.userId, userId), eq(hsk.state, "active")));
+    .where("user_id", "=", userId)
+    .where("state", "=", "active")
+    .execute();
+  return hsks.map(
+    ({ user_id, version, state, master_encryption_key_version, encrypted_key }) =>
+      ({
+        userId: user_id,
+        version,
+        state: state as "active",
+        mekVersion: master_encryption_key_version,
+        encHsk: encrypted_key,
+      }) satisfies Hsk,
+  );
 };

src/lib/server/db/kysely.ts

@@ -0,0 +1,47 @@
+import { Kysely, PostgresDialect, Migrator } from "kysely";
+import pg from "pg";
+import env from "$lib/server/loadenv";
+import migrations from "./migrations";
+import type { Database } from "./schema";
+
+const dialect = new PostgresDialect({
+  pool: new pg.Pool({
+    host: env.database.host,
+    port: env.database.port,
+    user: env.database.user,
+    password: env.database.password,
+    database: env.database.name,
+  }),
+});
+
+const db = new Kysely<Database>({ dialect });
+
+export const migrateDB = async () => {
+  if (env.nodeEnv !== "production") return;
+
+  const migrator = new Migrator({
+    db,
+    provider: {
+      async getMigrations() {
+        return migrations;
+      },
+    },
+  });
+  const { error, results } = await migrator.migrateToLatest();
+  if (error) {
+    const migration = results?.find(({ status }) => status === "Error");
+    if (migration) {
+      console.error(`Migration "${migration.migrationName}" failed.`);
+    }
+    console.error(error);
+    process.exit(1);
+  }
+
+  if (results?.length === 0) {
+    console.log("Database is up-to-date.");
+  } else {
+    console.log("Database migration completed.");
+  }
+};
+
+export default db;

src/lib/server/db/media.ts

@@ -0,0 +1,110 @@
+import type { NotNull } from "kysely";
+import { IntegrityError } from "./error";
+import db from "./kysely";
+
+interface Thumbnail {
+  id: number;
+  path: string;
+  updatedAt: Date;
+  encContentIv: string;
+}
+
+interface FileThumbnail extends Thumbnail {
+  fileId: number;
+}
+
+export const updateFileThumbnail = async (
+  userId: number,
+  fileId: number,
+  dekVersion: Date,
+  path: string,
+  encContentIv: string,
+) => {
+  return await db.transaction().execute(async (trx) => {
+    const file = await trx
+      .selectFrom("file")
+      .select("data_encryption_key_version")
+      .where("id", "=", fileId)
+      .where("user_id", "=", userId)
+      .limit(1)
+      .forUpdate()
+      .executeTakeFirst();
+    if (!file) {
+      throw new IntegrityError("File not found");
+    } else if (file.data_encryption_key_version.getTime() !== dekVersion.getTime()) {
+      throw new IntegrityError("Invalid DEK version");
+    }
+
+    const thumbnail = await trx
+      .selectFrom("thumbnail")
+      .select("path as oldPath")
+      .where("file_id", "=", fileId)
+      .limit(1)
+      .forUpdate()
+      .executeTakeFirst();
+    const now = new Date();
+
+    await trx
+      .insertInto("thumbnail")
+      .values({
+        file_id: fileId,
+        path,
+        updated_at: now,
+        encrypted_content_iv: encContentIv,
+      })
+      .onConflict((oc) =>
+        oc.column("file_id").doUpdateSet({
+          path,
+          updated_at: now,
+          encrypted_content_iv: encContentIv,
+        }),
+      )
+      .execute();
+    return thumbnail?.oldPath ?? null;
+  });
+};
+
+export const getFileThumbnail = async (userId: number, fileId: number) => {
+  const thumbnail = await db
+    .selectFrom("thumbnail")
+    .innerJoin("file", "thumbnail.file_id", "file.id")
+    .selectAll("thumbnail")
+    .where("file.id", "=", fileId)
+    .where("file.user_id", "=", userId)
+    .$narrowType<{ file_id: NotNull }>()
+    .limit(1)
+    .executeTakeFirst();
+  return thumbnail
+    ? ({
+        id: thumbnail.id,
+        fileId: thumbnail.file_id,
+        path: thumbnail.path,
+        encContentIv: thumbnail.encrypted_content_iv,
+        updatedAt: thumbnail.updated_at,
+      } satisfies FileThumbnail)
+    : null;
+};
+
+export const getMissingFileThumbnails = async (userId: number, limit: number = 100) => {
+  const files = await db
+    .selectFrom("file")
+    .select("id")
+    .where("user_id", "=", userId)
+    .where((eb) =>
+      eb.or([eb("content_type", "like", "image/%"), eb("content_type", "like", "video/%")]),
+    )
+    .where((eb) =>
+      eb.not(
+        eb.exists(
+          eb
+            .selectFrom("thumbnail")
+            .select("thumbnail.id")
+            .whereRef("thumbnail.file_id", "=", "file.id")
+            .limit(1),
+        ),
+      ),
+    )
+    .limit(limit)
+    .execute();
+  return files.map(({ id }) => id);
+};

src/lib/server/db/mek.ts

@@ -1,8 +1,19 @@
-import { SqliteError } from "better-sqlite3";
+import pg from "pg";
-import { and, or, eq } from "drizzle-orm";
-import db from "./drizzle";
 import { IntegrityError } from "./error";
-import { mek, mekLog, clientMek } from "./schema";
+import db from "./kysely";
+import type { MekState } from "./schema";
+
+interface Mek {
+  userId: number;
+  version: number;
+  state: MekState;
+}
+
+interface ClientMekWithDetails extends Mek {
+  clientId: number;
+  encMek: string;
+  encMekSig: string;
+}
 
 export const registerInitialMek = async (
   userId: number,
@@ -10,58 +21,80 @@ export const registerInitialMek = async (
   encMek: string,
   encMekSig: string,
 ) => {
-  await db.transaction(
+  await db.transaction().execute(async (trx) => {
-    async (tx) => {
+    try {
-      try {
+      await trx
-        await tx.insert(mek).values({
+        .insertInto("master_encryption_key")
-          userId,
+        .values({
+          user_id: userId,
           version: 1,
           state: "active",
-        });
+        })
-        await tx.insert(clientMek).values({
+        .execute();
-          userId,
+      await trx
-          clientId: createdBy,
+        .insertInto("client_master_encryption_key")
-          mekVersion: 1,
+        .values({
-          encMek,
+          user_id: userId,
-          encMekSig,
+          client_id: createdBy,
-        });
+          version: 1,
-        await tx.insert(mekLog).values({
+          encrypted_key: encMek,
-          userId,
+          encrypted_key_signature: encMekSig,
-          mekVersion: 1,
+        })
+        .execute();
+      await trx
+        .insertInto("master_encryption_key_log")
+        .values({
+          user_id: userId,
+          master_encryption_key_version: 1,
           timestamp: new Date(),
           action: "create",
-          actionBy: createdBy,
+          action_by: createdBy,
-        });
+        })
-      } catch (e) {
+        .execute();
-        if (e instanceof SqliteError && e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    } catch (e) {
-          throw new IntegrityError("MEK already registered");
+      if (e instanceof pg.DatabaseError && e.code === "23505") {
-        }
+        throw new IntegrityError("MEK already registered");
-        throw e;
       }
-    },
+      throw e;
-    { behavior: "exclusive" },
+    }
-  );
+  });
 };
 
 export const getInitialMek = async (userId: number) => {
-  const meks = await db
+  const mek = await db
-    .select()
+    .selectFrom("master_encryption_key")
-    .from(mek)
+    .selectAll()
-    .where(and(eq(mek.userId, userId), eq(mek.version, 1)))
+    .where("user_id", "=", userId)
-    .limit(1);
+    .where("version", "=", 1)
-  return meks[0] ?? null;
+    .limit(1)
+    .executeTakeFirst();
+  return mek
+    ? ({ userId: mek.user_id, version: mek.version, state: mek.state } satisfies Mek)
+    : null;
 };
 
 export const getAllValidClientMeks = async (userId: number, clientId: number) => {
-  return await db
+  const clientMeks = await db
-    .select()
+    .selectFrom("client_master_encryption_key")
-    .from(clientMek)
+    .innerJoin("master_encryption_key", (join) =>
-    .innerJoin(mek, and(eq(clientMek.userId, mek.userId), eq(clientMek.mekVersion, mek.version)))
+      join
-    .where(
+        .onRef("client_master_encryption_key.user_id", "=", "master_encryption_key.user_id")
-      and(
+        .onRef("client_master_encryption_key.version", "=", "master_encryption_key.version"),
-        eq(clientMek.userId, userId),
+    )
-        eq(clientMek.clientId, clientId),
+    .selectAll()
-        or(eq(mek.state, "active"), eq(mek.state, "retired")),
+    .where("client_master_encryption_key.user_id", "=", userId)
-      ),
+    .where("client_master_encryption_key.client_id", "=", clientId)
-    );
+    .where((eb) => eb.or([eb("state", "=", "active"), eb("state", "=", "retired")]))
+    .execute();
+  return clientMeks.map(
+    ({ user_id, client_id, version, state, encrypted_key, encrypted_key_signature }) =>
+      ({
+        userId: user_id,
+        version,
+        state: state as "active" | "retired",
+        clientId: client_id,
+        encMek: encrypted_key,
+        encMekSig: encrypted_key_signature,
+      }) satisfies ClientMekWithDetails,
+  );
 };

src/lib/server/db/migrations/1737357000-Initial.ts

@@ -0,0 +1,224 @@
+import { Kysely } from "kysely";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const up = async (db: Kysely<any>) => {
+  // user.ts
+  await db.schema
+    .createTable("user")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("email", "text", (col) => col.unique().notNull())
+    .addColumn("nickname", "text", (col) => col.notNull())
+    .addColumn("password", "text", (col) => col.notNull())
+    .execute();
+
+  // client.ts
+  await db.schema
+    .createTable("client")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("encryption_public_key", "text", (col) => col.unique().notNull())
+    .addColumn("signature_public_key", "text", (col) => col.unique().notNull())
+    .addUniqueConstraint("client_ak01", ["encryption_public_key", "signature_public_key"])
+    .execute();
+  await db.schema
+    .createTable("user_client")
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("client_id", "integer", (col) => col.references("client.id").notNull())
+    .addColumn("state", "text", (col) => col.notNull().defaultTo("challenging"))
+    .addPrimaryKeyConstraint("user_client_pk", ["user_id", "client_id"])
+    .execute();
+  await db.schema
+    .createTable("user_client_challenge")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("client_id", "integer", (col) => col.references("client.id").notNull())
+    .addColumn("answer", "text", (col) => col.unique().notNull())
+    .addColumn("allowed_ip", "text", (col) => col.notNull())
+    .addColumn("expires_at", "timestamp(3)", (col) => col.notNull())
+    .addForeignKeyConstraint(
+      "user_client_challenge_fk01",
+      ["user_id", "client_id"],
+      "user_client",
+      ["user_id", "client_id"],
+    )
+    .execute();
+
+  // session.ts
+  await db.schema
+    .createTable("session")
+    .addColumn("id", "text", (col) => col.primaryKey())
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("client_id", "integer", (col) => col.references("client.id"))
+    .addColumn("created_at", "timestamp(3)", (col) => col.notNull())
+    .addColumn("last_used_at", "timestamp(3)", (col) => col.notNull())
+    .addColumn("last_used_by_ip", "text")
+    .addColumn("last_used_by_agent", "text")
+    .addUniqueConstraint("session_ak01", ["user_id", "client_id"])
+    .execute();
+  await db.schema
+    .createTable("session_upgrade_challenge")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("session_id", "text", (col) => col.references("session.id").unique().notNull())
+    .addColumn("client_id", "integer", (col) => col.references("client.id").notNull())
+    .addColumn("answer", "text", (col) => col.unique().notNull())
+    .addColumn("allowed_ip", "text", (col) => col.notNull())
+    .addColumn("expires_at", "timestamp(3)", (col) => col.notNull())
+    .execute();
+
+  // mek.ts
+  await db.schema
+    .createTable("master_encryption_key")
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("version", "integer", (col) => col.notNull())
+    .addColumn("state", "text", (col) => col.notNull())
+    .addPrimaryKeyConstraint("master_encryption_key_pk", ["user_id", "version"])
+    .execute();
+  await db.schema
+    .createTable("master_encryption_key_log")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("master_encryption_key_version", "integer", (col) => col.notNull())
+    .addColumn("timestamp", "timestamp(3)", (col) => col.notNull())
+    .addColumn("action", "text", (col) => col.notNull())
+    .addColumn("action_by", "integer", (col) => col.references("client.id"))
+    .addForeignKeyConstraint(
+      "master_encryption_key_log_fk01",
+      ["user_id", "master_encryption_key_version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .execute();
+  await db.schema
+    .createTable("client_master_encryption_key")
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("client_id", "integer", (col) => col.references("client.id").notNull())
+    .addColumn("version", "integer", (col) => col.notNull())
+    .addColumn("encrypted_key", "text", (col) => col.notNull())
+    .addColumn("encrypted_key_signature", "text", (col) => col.notNull())
+    .addPrimaryKeyConstraint("client_master_encryption_key_pk", ["user_id", "client_id", "version"])
+    .addForeignKeyConstraint(
+      "client_master_encryption_key_fk01",
+      ["user_id", "version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .execute();
+
+  // hsk.ts
+  await db.schema
+    .createTable("hmac_secret_key")
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("version", "integer", (col) => col.notNull())
+    .addColumn("state", "text", (col) => col.notNull())
+    .addColumn("master_encryption_key_version", "integer", (col) => col.notNull())
+    .addColumn("encrypted_key", "text", (col) => col.unique().notNull())
+    .addPrimaryKeyConstraint("hmac_secret_key_pk", ["user_id", "version"])
+    .addForeignKeyConstraint(
+      "hmac_secret_key_fk01",
+      ["user_id", "master_encryption_key_version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .execute();
+  await db.schema
+    .createTable("hmac_secret_key_log")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("hmac_secret_key_version", "integer", (col) => col.notNull())
+    .addColumn("timestamp", "timestamp(3)", (col) => col.notNull())
+    .addColumn("action", "text", (col) => col.notNull())
+    .addColumn("action_by", "integer", (col) => col.references("client.id"))
+    .addForeignKeyConstraint(
+      "hmac_secret_key_log_fk01",
+      ["user_id", "hmac_secret_key_version"],
+      "hmac_secret_key",
+      ["user_id", "version"],
+    )
+    .execute();
+
+  // file.ts
+  await db.schema
+    .createTable("directory")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("parent_id", "integer", (col) => col.references("directory.id"))
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("master_encryption_key_version", "integer", (col) => col.notNull())
+    .addColumn("encrypted_data_encryption_key", "text", (col) => col.unique().notNull())
+    .addColumn("data_encryption_key_version", "timestamp(3)", (col) => col.notNull())
+    .addColumn("encrypted_name", "json", (col) => col.notNull())
+    .addForeignKeyConstraint(
+      "directory_fk01",
+      ["user_id", "master_encryption_key_version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .execute();
+  await db.schema
+    .createTable("directory_log")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("directory_id", "integer", (col) =>
+      col.references("directory.id").onDelete("cascade").notNull(),
+    )
+    .addColumn("timestamp", "timestamp(3)", (col) => col.notNull())
+    .addColumn("action", "text", (col) => col.notNull())
+    .addColumn("new_name", "json")
+    .execute();
+  await db.schema
+    .createTable("file")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("parent_id", "integer", (col) => col.references("directory.id"))
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("path", "text", (col) => col.unique().notNull())
+    .addColumn("master_encryption_key_version", "integer", (col) => col.notNull())
+    .addColumn("encrypted_data_encryption_key", "text", (col) => col.unique().notNull())
+    .addColumn("data_encryption_key_version", "timestamp(3)", (col) => col.notNull())
+    .addColumn("hmac_secret_key_version", "integer")
+    .addColumn("content_hmac", "text")
+    .addColumn("content_type", "text", (col) => col.notNull())
+    .addColumn("encrypted_content_iv", "text", (col) => col.notNull())
+    .addColumn("encrypted_content_hash", "text", (col) => col.notNull())
+    .addColumn("encrypted_name", "json", (col) => col.notNull())
+    .addColumn("encrypted_created_at", "json")
+    .addColumn("encrypted_last_modified_at", "json", (col) => col.notNull())
+    .addForeignKeyConstraint(
+      "file_fk01",
+      ["user_id", "master_encryption_key_version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .addForeignKeyConstraint(
+      "file_fk02",
+      ["user_id", "hmac_secret_key_version"],
+      "hmac_secret_key",
+      ["user_id", "version"],
+    )
+    .execute();
+  await db.schema
+    .createTable("file_log")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("file_id", "integer", (col) =>
+      col.references("file.id").onDelete("cascade").notNull(),
+    )
+    .addColumn("timestamp", "timestamp(3)", (col) => col.notNull())
+    .addColumn("action", "text", (col) => col.notNull())
+    .addColumn("new_name", "json")
+    .execute();
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const down = async (db: Kysely<any>) => {
+  await db.schema.dropTable("file_log").execute();
+  await db.schema.dropTable("file").execute();
+  await db.schema.dropTable("directory_log").execute();
+  await db.schema.dropTable("directory").execute();
+  await db.schema.dropTable("hmac_secret_key_log").execute();
+  await db.schema.dropTable("hmac_secret_key").execute();
+  await db.schema.dropTable("client_master_encryption_key").execute();
+  await db.schema.dropTable("master_encryption_key_log").execute();
+  await db.schema.dropTable("master_encryption_key").execute();
+  await db.schema.dropTable("session_upgrade_challenge").execute();
+  await db.schema.dropTable("session").execute();
+  await db.schema.dropTable("user_client_challenge").execute();
+  await db.schema.dropTable("user_client").execute();
+  await db.schema.dropTable("client").execute();
+  await db.schema.dropTable("user").execute();
+};

src/lib/server/db/migrations/1737422340-AddFileCategory.ts

@@ -0,0 +1,65 @@
+import { Kysely } from "kysely";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const up = async (db: Kysely<any>) => {
+  // category.ts
+  await db.schema
+    .createTable("category")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("parent_id", "integer", (col) => col.references("category.id").onDelete("cascade"))
+    .addColumn("user_id", "integer", (col) => col.references("user.id").notNull())
+    .addColumn("master_encryption_key_version", "integer", (col) => col.notNull())
+    .addColumn("encrypted_data_encryption_key", "text", (col) => col.unique().notNull())
+    .addColumn("data_encryption_key_version", "timestamp(3)", (col) => col.notNull())
+    .addColumn("encrypted_name", "json", (col) => col.notNull())
+    .addForeignKeyConstraint(
+      "category_fk01",
+      ["user_id", "master_encryption_key_version"],
+      "master_encryption_key",
+      ["user_id", "version"],
+    )
+    .execute();
+  await db.schema
+    .createTable("category_log")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("category_id", "integer", (col) =>
+      col.references("category.id").onDelete("cascade").notNull(),
+    )
+    .addColumn("timestamp", "timestamp(3)", (col) => col.notNull())
+    .addColumn("action", "text", (col) => col.notNull())
+    .addColumn("new_name", "json")
+    .execute();
+
+  // file.ts
+  await db.schema
+    .alterTable("file_log")
+    .addColumn("category_id", "integer", (col) =>
+      col.references("category.id").onDelete("set null"),
+    )
+    .execute();
+  await db.schema
+    .createTable("file_category")
+    .addColumn("file_id", "integer", (col) =>
+      col.references("file.id").onDelete("cascade").notNull(),
+    )
+    .addColumn("category_id", "integer", (col) =>
+      col.references("category.id").onDelete("cascade").notNull(),
+    )
+    .addPrimaryKeyConstraint("file_category_pk", ["file_id", "category_id"])
+    .execute();
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const down = async (db: Kysely<any>) => {
+  await db
+    .deleteFrom("file_log")
+    .where((eb) =>
+      eb.or([eb("action", "=", "add-to-category"), eb("action", "=", "remove-from-category")]),
+    )
+    .execute();
+
+  await db.schema.dropTable("file_category").execute();
+  await db.schema.alterTable("file_log").dropColumn("category_id").execute();
+  await db.schema.dropTable("category_log").execute();
+  await db.schema.dropTable("category").execute();
+};

src/lib/server/db/migrations/1738409340-AddThumbnail.ts

@@ -0,0 +1,31 @@
+import { Kysely, sql } from "kysely";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const up = async (db: Kysely<any>) => {
+  // media.ts
+  await db.schema
+    .createTable("thumbnail")
+    .addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity())
+    .addColumn("directory_id", "integer", (col) =>
+      col.references("directory.id").onDelete("cascade").unique(),
+    )
+    .addColumn("file_id", "integer", (col) =>
+      col.references("file.id").onDelete("cascade").unique(),
+    )
+    .addColumn("category_id", "integer", (col) =>
+      col.references("category.id").onDelete("cascade").unique(),
+    )
+    .addColumn("path", "text", (col) => col.unique().notNull())
+    .addColumn("updated_at", "timestamp(3)", (col) => col.notNull())
+    .addColumn("encrypted_content_iv", "text", (col) => col.notNull())
+    .addCheckConstraint(
+      "thumbnail_ck01",
+      sql`(file_id IS NOT NULL)::integer + (directory_id IS NOT NULL)::integer + (category_id IS NOT NULL)::integer = 1`,
+    )
+    .execute();
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const down = async (db: Kysely<any>) => {
+  await db.schema.dropTable("thumbnail").execute();
+};

src/lib/server/db/migrations/index.ts

@@ -0,0 +1,9 @@
+import * as Initial1737357000 from "./1737357000-Initial";
+import * as AddFileCategory1737422340 from "./1737422340-AddFileCategory";
+import * as AddThumbnail1738409340 from "./1738409340-AddThumbnail";
+
+export default {
+  "1737357000-Initial": Initial1737357000,
+  "1737422340-AddFileCategory": AddFileCategory1737422340,
+  "1738409340-AddThumbnail": AddThumbnail1738409340,
+};

src/lib/server/db/schema/category.ts

@@ -0,0 +1,27 @@
+import type { Generated } from "kysely";
+import type { Ciphertext } from "./util";
+
+interface CategoryTable {
+  id: Generated<number>;
+  parent_id: number | null;
+  user_id: number;
+  master_encryption_key_version: number;
+  encrypted_data_encryption_key: string; // Base64
+  data_encryption_key_version: Date;
+  encrypted_name: Ciphertext;
+}
+
+interface CategoryLogTable {
+  id: Generated<number>;
+  category_id: number;
+  timestamp: Date;
+  action: "create" | "rename";
+  new_name: Ciphertext | null;
+}
+
+declare module "./index" {
+  interface Database {
+    category: CategoryTable;
+    category_log: CategoryLogTable;
+  }
+}

src/lib/server/db/schema/client.ts

@@ -1,61 +1,32 @@
-import {
+import type { ColumnType, Generated } from "kysely";
-  sqliteTable,
-  text,
-  integer,
-  primaryKey,
-  foreignKey,
-  unique,
-} from "drizzle-orm/sqlite-core";
-import { user } from "./user";
 
-export const client = sqliteTable(
+interface ClientTable {
-  "client",
+  id: Generated<number>;
-  {
+  encryption_public_key: string; // Base64
-    id: integer("id").primaryKey({ autoIncrement: true }),
+  signature_public_key: string; // Base64
-    encPubKey: text("encryption_public_key").notNull().unique(), // Base64
+}
-    sigPubKey: text("signature_public_key").notNull().unique(), // Base64
-  },
-  (t) => ({
-    unq: unique().on(t.encPubKey, t.sigPubKey),
-  }),
-);
 
-export const userClient = sqliteTable(
+export type UserClientState = "challenging" | "pending" | "active";
-  "user_client",
-  {
-    userId: integer("user_id")
-      .notNull()
-      .references(() => user.id),
-    clientId: integer("client_id")
-      .notNull()
-      .references(() => client.id),
-    state: text("state", { enum: ["challenging", "pending", "active"] })
-      .notNull()
-      .default("challenging"),
-  },
-  (t) => ({
-    pk: primaryKey({ columns: [t.userId, t.clientId] }),
-  }),
-);
 
-export const userClientChallenge = sqliteTable(
+interface UserClientTable {
-  "user_client_challenge",
+  user_id: number;
-  {
+  client_id: number;
-    id: integer("id").primaryKey(),
+  state: ColumnType<UserClientState, UserClientState | undefined>;
-    userId: integer("user_id")
+}
-      .notNull()
+
-      .references(() => user.id),
+interface UserClientChallengeTable {
-    clientId: integer("client_id")
+  id: Generated<number>;
-      .notNull()
+  user_id: number;
-      .references(() => client.id),
+  client_id: number;
-    answer: text("answer").notNull().unique(), // Base64
+  answer: string; // Base64
-    allowedIp: text("allowed_ip").notNull(),
+  allowed_ip: string;
-    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+  expires_at: ColumnType<Date, Date, never>;
-  },
+}
-  (t) => ({
+
-    ref: foreignKey({
+declare module "./index" {
-      columns: [t.userId, t.clientId],
+  interface Database {
-      foreignColumns: [userClient.userId, userClient.clientId],
+    client: ClientTable;
-    }),
+    user_client: UserClientTable;
-  }),
+    user_client_challenge: UserClientChallengeTable;
-);
+  }
+}

src/lib/server/db/schema/file.ts

@@ -1,87 +1,62 @@
-import { sqliteTable, text, integer, foreignKey } from "drizzle-orm/sqlite-core";
+import type { ColumnType, Generated } from "kysely";
-import { hsk } from "./hsk";
+import type { Ciphertext } from "./util";
-import { mek } from "./mek";
-import { user } from "./user";
 
-const ciphertext = (name: string) =>
+interface DirectoryTable {
-  text(name, { mode: "json" }).$type<{
+  id: Generated<number>;
-    ciphertext: string; // Base64
+  parent_id: number | null;
-    iv: string; // Base64
+  user_id: number;
-  }>();
+  master_encryption_key_version: number;
+  encrypted_data_encryption_key: string; // Base64
+  data_encryption_key_version: Date;
+  encrypted_name: Ciphertext;
+}
 
-export const directory = sqliteTable(
+interface DirectoryLogTable {
-  "directory",
+  id: Generated<number>;
-  {
+  directory_id: number;
-    id: integer("id").primaryKey({ autoIncrement: true }),
+  timestamp: ColumnType<Date, Date, never>;
-    parentId: integer("parent_id"),
+  action: "create" | "rename";
-    userId: integer("user_id")
+  new_name: Ciphertext | null;
-      .notNull()
+}
-      .references(() => user.id),
-    mekVersion: integer("master_encryption_key_version").notNull(),
-    encDek: text("encrypted_data_encryption_key").notNull().unique(), // Base64
-    dekVersion: integer("data_encryption_key_version", { mode: "timestamp_ms" }).notNull(),
-    encName: ciphertext("encrypted_name").notNull(),
-  },
-  (t) => ({
-    ref1: foreignKey({
-      columns: [t.parentId],
-      foreignColumns: [t.id],
-    }),
-    ref2: foreignKey({
-      columns: [t.userId, t.mekVersion],
-      foreignColumns: [mek.userId, mek.version],
-    }),
-  }),
-);
 
-export const directoryLog = sqliteTable("directory_log", {
+interface FileTable {
-  id: integer("id").primaryKey({ autoIncrement: true }),
+  id: Generated<number>;
-  directoryId: integer("directory_id")
+  parent_id: number | null;
-    .notNull()
+  user_id: number;
-    .references(() => directory.id, { onDelete: "cascade" }),
+  path: string;
-  timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull(),
+  master_encryption_key_version: number;
-  action: text("action", { enum: ["create", "rename"] }).notNull(),
+  encrypted_data_encryption_key: string; // Base64
-  newName: ciphertext("new_name"),
+  data_encryption_key_version: Date;
-});
+  hmac_secret_key_version: number | null;
+  content_hmac: string | null; // Base64
+  content_type: string;
+  encrypted_content_iv: string; // Base64
+  encrypted_content_hash: string; // Base64
+  encrypted_name: Ciphertext;
+  encrypted_created_at: Ciphertext | null;
+  encrypted_last_modified_at: Ciphertext;
+}
 
-export const file = sqliteTable(
+interface FileLogTable {
-  "file",
+  id: Generated<number>;
-  {
+  file_id: number;
-    id: integer("id").primaryKey({ autoIncrement: true }),
+  timestamp: ColumnType<Date, Date, never>;
-    parentId: integer("parent_id").references(() => directory.id),
+  action: "create" | "rename" | "add-to-category" | "remove-from-category";
-    userId: integer("user_id")
+  new_name: Ciphertext | null;
-      .notNull()
+  category_id: number | null;
-      .references(() => user.id),
+}
-    path: text("path").notNull().unique(),
-    mekVersion: integer("master_encryption_key_version").notNull(),
-    encDek: text("encrypted_data_encryption_key").notNull().unique(), // Base64
-    dekVersion: integer("data_encryption_key_version", { mode: "timestamp_ms" }).notNull(),
-    hskVersion: integer("hmac_secret_key_version"),
-    contentHmac: text("content_hmac"), // Base64
-    contentType: text("content_type").notNull(),
-    encContentIv: text("encrypted_content_iv").notNull(), // Base64
-    encName: ciphertext("encrypted_name").notNull(),
-    encCreatedAt: ciphertext("encrypted_created_at"),
-    encLastModifiedAt: ciphertext("encrypted_last_modified_at").notNull(),
-  },
-  (t) => ({
-    ref1: foreignKey({
-      columns: [t.userId, t.mekVersion],
-      foreignColumns: [mek.userId, mek.version],
-    }),
-    ref2: foreignKey({
-      columns: [t.userId, t.hskVersion],
-      foreignColumns: [hsk.userId, hsk.version],
-    }),
-  }),
-);
 
-export const fileLog = sqliteTable("file_log", {
+interface FileCategoryTable {
-  id: integer("id").primaryKey({ autoIncrement: true }),
+  file_id: number;
-  fileId: integer("file_id")
+  category_id: number;
-    .notNull()
+}
-    .references(() => file.id, { onDelete: "cascade" }),
+
-  timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull(),
+declare module "./index" {
-  action: text("action", { enum: ["create", "rename"] }).notNull(),
+  interface Database {
-  newName: ciphertext("new_name"),
+    directory: DirectoryTable;
-});
+    directory_log: DirectoryLogTable;
+    file: FileTable;
+    file_log: FileLogTable;
+    file_category: FileCategoryTable;
+  }
+}

src/lib/server/db/schema/hsk.ts

@@ -1,43 +1,27 @@
-import { sqliteTable, text, integer, primaryKey, foreignKey } from "drizzle-orm/sqlite-core";
+import type { ColumnType, Generated } from "kysely";
-import { mek } from "./mek";
-import { user } from "./user";
 
-export const hsk = sqliteTable(
+export type HskState = "active";
-  "hmac_secret_key",
-  {
-    userId: integer("user_id")
-      .notNull()
-      .references(() => user.id),
-    version: integer("version").notNull(),
-    state: text("state", { enum: ["active"] }).notNull(),
-    mekVersion: integer("master_encryption_key_version").notNull(),
-    encHsk: text("encrypted_key").notNull().unique(), // Base64
-  },
-  (t) => ({
-    pk: primaryKey({ columns: [t.userId, t.version] }),
-    ref: foreignKey({
-      columns: [t.userId, t.mekVersion],
-      foreignColumns: [mek.userId, mek.version],
-    }),
-  }),
-);
 
-export const hskLog = sqliteTable(
+interface HskTable {
-  "hmac_secret_key_log",
+  user_id: number;
-  {
+  version: number;
-    id: integer("id").primaryKey({ autoIncrement: true }),
+  state: HskState;
-    userId: integer("user_id")
+  master_encryption_key_version: number;
-      .notNull()
+  encrypted_key: string; // Base64
-      .references(() => user.id),
+}
-    hskVersion: integer("hmac_secret_key_version").notNull(),
+
-    timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull(),
+interface HskLogTable {
-    action: text("action", { enum: ["create"] }).notNull(),
+  id: Generated<number>;
-    actionBy: integer("action_by").references(() => user.id),
+  user_id: number;
-  },
+  hmac_secret_key_version: number;
-  (t) => ({
+  timestamp: ColumnType<Date, Date, never>;
-    ref: foreignKey({
+  action: "create";
-      columns: [t.userId, t.hskVersion],
+  action_by: number | null;
-      foreignColumns: [hsk.userId, hsk.version],
+}
-    }),
+
-  }),
+declare module "./index" {
-);
+  interface Database {
+    hmac_secret_key: HskTable;
+    hmac_secret_key_log: HskLogTable;
+  }
+}

src/lib/server/db/schema/index.ts

@@ -1,6 +1,12 @@
+export * from "./category";
 export * from "./client";
 export * from "./file";
 export * from "./hsk";
+export * from "./media";
 export * from "./mek";
 export * from "./session";
 export * from "./user";
+export * from "./util";
+
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export interface Database {}

src/lib/server/db/schema/media.ts

@@ -0,0 +1,17 @@
+import type { Generated } from "kysely";
+
+interface ThumbnailTable {
+  id: Generated<number>;
+  directory_id: number | null;
+  file_id: number | null;
+  category_id: number | null;
+  path: string;
+  updated_at: Date;
+  encrypted_content_iv: string; // Base64
+}
+
+declare module "./index" {
+  interface Database {
+    thumbnail: ThumbnailTable;
+  }
+}

src/lib/server/db/schema/mek.ts

@@ -1,60 +1,34 @@
-import { sqliteTable, text, integer, primaryKey, foreignKey } from "drizzle-orm/sqlite-core";
+import type { ColumnType, Generated } from "kysely";
-import { client } from "./client";
-import { user } from "./user";
 
-export const mek = sqliteTable(
+export type MekState = "active" | "retired" | "dead";
-  "master_encryption_key",
-  {
-    userId: integer("user_id")
-      .notNull()
-      .references(() => user.id),
-    version: integer("version").notNull(),
-    state: text("state", { enum: ["active", "retired", "dead"] }).notNull(),
-    retiredAt: integer("retired_at", { mode: "timestamp_ms" }),
-  },
-  (t) => ({
-    pk: primaryKey({ columns: [t.userId, t.version] }),
-  }),
-);
 
-export const mekLog = sqliteTable(
+interface MekTable {
-  "master_encryption_key_log",
+  user_id: number;
-  {
+  version: number;
-    id: integer("id").primaryKey({ autoIncrement: true }),
+  state: MekState;
-    userId: integer("user_id")
+}
-      .notNull()
-      .references(() => user.id),
-    mekVersion: integer("master_encryption_key_version").notNull(),
-    timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull(),
-    action: text("action", { enum: ["create"] }).notNull(),
-    actionBy: integer("action_by").references(() => client.id),
-  },
-  (t) => ({
-    ref: foreignKey({
-      columns: [t.userId, t.mekVersion],
-      foreignColumns: [mek.userId, mek.version],
-    }),
-  }),
-);
 
-export const clientMek = sqliteTable(
+interface MekLogTable {
-  "client_master_encryption_key",
+  id: Generated<number>;
-  {
+  user_id: number;
-    userId: integer("user_id")
+  master_encryption_key_version: number;
-      .notNull()
+  timestamp: ColumnType<Date, Date, never>;
-      .references(() => user.id),
+  action: "create";
-    clientId: integer("client_id")
+  action_by: number | null;
-      .notNull()
+}
-      .references(() => client.id),
+
-    mekVersion: integer("version").notNull(),
+interface ClientMekTable {
-    encMek: text("encrypted_key").notNull(), // Base64
+  user_id: number;
-    encMekSig: text("encrypted_key_signature").notNull(), // Base64
+  client_id: number;
-  },
+  version: number;
-  (t) => ({
+  encrypted_key: string; // Base64
-    pk: primaryKey({ columns: [t.userId, t.clientId, t.mekVersion] }),
+  encrypted_key_signature: string; // Base64
-    ref: foreignKey({
+}
-      columns: [t.userId, t.mekVersion],
+
-      foreignColumns: [mek.userId, mek.version],
+declare module "./index" {
-    }),
+  interface Database {
-  }),
+    master_encryption_key: MekTable;
-);
+    master_encryption_key_log: MekLogTable;
+    client_master_encryption_key: ClientMekTable;
+  }
+}