♻️ Still don't know what I am doing. But basically the microservices are done.

.gitignore

@@ -1,6 +1,7 @@
 bin/
 obj/
 /packages/
+/Certificates/
 riderModule.iml
 /_ReSharper.Caches/
 .idea

DysonNetwork.Drive/AppDatabase.cs

@@ -0,0 +1,179 @@
+using System.Linq.Expressions;
+using System.Reflection;
+using DysonNetwork.Drive.Storage;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Design;
+using Microsoft.EntityFrameworkCore.Query;
+using NodaTime;
+using Quartz;
+
+namespace DysonNetwork.Drive;
+
+public class AppDatabase(
+    DbContextOptions<AppDatabase> options,
+    IConfiguration configuration
+) : DbContext(options)
+{
+    public DbSet<CloudFile> Files { get; set; } = null!;
+    public DbSet<CloudFileReference> FileReferences { get; set; } = null!;
+    
+    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
+    {
+        optionsBuilder.UseNpgsql(
+            configuration.GetConnectionString("App"),
+            opt => opt
+                .ConfigureDataSource(optSource => optSource.EnableDynamicJson())
+                .UseQuerySplittingBehavior(QuerySplittingBehavior.SplitQuery)
+                .UseNetTopologySuite()
+                .UseNodaTime()
+        ).UseSnakeCaseNamingConvention();
+
+        base.OnConfiguring(optionsBuilder);
+    }
+
+    protected override void OnModelCreating(ModelBuilder modelBuilder)
+    {
+        base.OnModelCreating(modelBuilder);
+
+        // Automatically apply soft-delete filter to all entities inheriting BaseModel
+        foreach (var entityType in modelBuilder.Model.GetEntityTypes())
+        {
+            if (!typeof(ModelBase).IsAssignableFrom(entityType.ClrType)) continue;
+            var method = typeof(AppDatabase)
+                .GetMethod(nameof(SetSoftDeleteFilter),
+                    BindingFlags.NonPublic | BindingFlags.Static)!
+                .MakeGenericMethod(entityType.ClrType);
+
+            method.Invoke(null, [modelBuilder]);
+        }
+    }
+
+    private static void SetSoftDeleteFilter<TEntity>(ModelBuilder modelBuilder)
+        where TEntity : ModelBase
+    {
+        modelBuilder.Entity<TEntity>().HasQueryFilter(e => e.DeletedAt == null);
+    }
+
+    public override async Task<int> SaveChangesAsync(CancellationToken cancellationToken = default)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+
+        foreach (var entry in ChangeTracker.Entries<ModelBase>())
+        {
+            switch (entry.State)
+            {
+                case EntityState.Added:
+                    entry.Entity.CreatedAt = now;
+                    entry.Entity.UpdatedAt = now;
+                    break;
+                case EntityState.Modified:
+                    entry.Entity.UpdatedAt = now;
+                    break;
+                case EntityState.Deleted:
+                    entry.State = EntityState.Modified;
+                    entry.Entity.DeletedAt = now;
+                    break;
+                case EntityState.Detached:
+                case EntityState.Unchanged:
+                default:
+                    break;
+            }
+        }
+
+        return await base.SaveChangesAsync(cancellationToken);
+    }
+}
+
+public class AppDatabaseRecyclingJob(AppDatabase db, ILogger<AppDatabaseRecyclingJob> logger) : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+
+        logger.LogInformation("Deleting soft-deleted records...");
+
+        var threshold = now - Duration.FromDays(7);
+
+        var entityTypes = db.Model.GetEntityTypes()
+            .Where(t => typeof(ModelBase).IsAssignableFrom(t.ClrType) && t.ClrType != typeof(ModelBase))
+            .Select(t => t.ClrType);
+
+        foreach (var entityType in entityTypes)
+        {
+            var set = (IQueryable)db.GetType().GetMethod(nameof(DbContext.Set), Type.EmptyTypes)!
+                .MakeGenericMethod(entityType).Invoke(db, null)!;
+            var parameter = Expression.Parameter(entityType, "e");
+            var property = Expression.Property(parameter, nameof(ModelBase.DeletedAt));
+            var condition = Expression.LessThan(property, Expression.Constant(threshold, typeof(Instant?)));
+            var notNull = Expression.NotEqual(property, Expression.Constant(null, typeof(Instant?)));
+            var finalCondition = Expression.AndAlso(notNull, condition);
+            var lambda = Expression.Lambda(finalCondition, parameter);
+
+            var queryable = set.Provider.CreateQuery(
+                Expression.Call(
+                    typeof(Queryable),
+                    "Where",
+                    [entityType],
+                    set.Expression,
+                    Expression.Quote(lambda)
+                )
+            );
+
+            var toListAsync = typeof(EntityFrameworkQueryableExtensions)
+                .GetMethod(nameof(EntityFrameworkQueryableExtensions.ToListAsync))!
+                .MakeGenericMethod(entityType);
+
+            var items = await (dynamic)toListAsync.Invoke(null, [queryable, CancellationToken.None])!;
+            db.RemoveRange(items);
+        }
+
+        await db.SaveChangesAsync();
+    }
+}
+
+public class AppDatabaseFactory : IDesignTimeDbContextFactory<AppDatabase>
+{
+    public AppDatabase CreateDbContext(string[] args)
+    {
+        var configuration = new ConfigurationBuilder()
+            .SetBasePath(Directory.GetCurrentDirectory())
+            .AddJsonFile("appsettings.json")
+            .Build();
+
+        var optionsBuilder = new DbContextOptionsBuilder<AppDatabase>();
+        return new AppDatabase(optionsBuilder.Options, configuration);
+    }
+}
+
+public static class OptionalQueryExtensions
+{
+    public static IQueryable<T> If<T>(
+        this IQueryable<T> source,
+        bool condition,
+        Func<IQueryable<T>, IQueryable<T>> transform
+    )
+    {
+        return condition ? transform(source) : source;
+    }
+
+    public static IQueryable<T> If<T, TP>(
+        this IIncludableQueryable<T, TP> source,
+        bool condition,
+        Func<IIncludableQueryable<T, TP>, IQueryable<T>> transform
+    )
+        where T : class
+    {
+        return condition ? transform(source) : source;
+    }
+
+    public static IQueryable<T> If<T, TP>(
+        this IIncludableQueryable<T, IEnumerable<TP>> source,
+        bool condition,
+        Func<IIncludableQueryable<T, IEnumerable<TP>>, IQueryable<T>> transform
+    )
+        where T : class
+    {
+        return condition ? transform(source) : source;
+    }
+}

DysonNetwork.Drive/Dockerfile

@@ -0,0 +1,23 @@
+FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
+USER $APP_UID
+WORKDIR /app
+EXPOSE 8080
+EXPOSE 8081
+
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+ARG BUILD_CONFIGURATION=Release
+WORKDIR /src
+COPY ["DysonNetwork.Drive/DysonNetwork.Drive.csproj", "DysonNetwork.Drive/"]
+RUN dotnet restore "DysonNetwork.Drive/DysonNetwork.Drive.csproj"
+COPY . .
+WORKDIR "/src/DysonNetwork.Drive"
+RUN dotnet build "./DysonNetwork.Drive.csproj" -c $BUILD_CONFIGURATION -o /app/build
+
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "./DysonNetwork.Drive.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
+
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "DysonNetwork.Drive.dll"]

DysonNetwork.Drive/DysonNetwork.Drive.csproj

@@ -0,0 +1,70 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+    <PropertyGroup>
+        <TargetFramework>net9.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <DockerDefaultTargetOS>Linux</DockerDefaultTargetOS>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="BlurHashSharp.SkiaSharp" Version="1.3.4" />
+        <PackageReference Include="FFMpegCore" Version="5.2.0" />
+        <PackageReference Include="Grpc.AspNetCore.Server" Version="2.71.0" />
+        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.7" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.7">
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+          <PrivateAssets>all</PrivateAssets>
+        </PackageReference>
+        <PackageReference Include="MimeTypes" Version="2.5.2">
+          <PrivateAssets>all</PrivateAssets>
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+        <PackageReference Include="Minio" Version="6.0.5" />
+        <PackageReference Include="NetVips" Version="3.1.0" />
+        <PackageReference Include="NetVips.Native.linux-x64" Version="8.17.1" />
+        <PackageReference Include="NetVips.Native.osx-arm64" Version="8.17.1" />
+        <PackageReference Include="NodaTime" Version="3.2.2" />
+        <PackageReference Include="NodaTime.Serialization.JsonNet" Version="3.2.0" />
+        <PackageReference Include="NodaTime.Serialization.Protobuf" Version="2.0.2" />
+        <PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.0" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.Design" Version="1.1.0" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.NetTopologySuite" Version="9.0.4" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.NodaTime" Version="9.0.4" />
+        <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.12.0" />
+        <PackageReference Include="prometheus-net.AspNetCore" Version="8.2.1" />
+        <PackageReference Include="prometheus-net.AspNetCore.HealthChecks" Version="8.2.1" />
+        <PackageReference Include="prometheus-net.DotNetRuntime" Version="4.4.1" />
+        <PackageReference Include="prometheus-net.EntityFramework" Version="0.9.5" />
+        <PackageReference Include="prometheus-net.SystemMetrics" Version="3.1.0" />
+        <PackageReference Include="Quartz" Version="3.14.0" />
+        <PackageReference Include="Quartz.AspNetCore" Version="3.14.0" />
+        <PackageReference Include="Quartz.Extensions.Hosting" Version="3.14.0" />
+        <PackageReference Include="EFCore.BulkExtensions" Version="9.0.1" />
+        <PackageReference Include="EFCore.BulkExtensions.PostgreSql" Version="9.0.1" />
+        <PackageReference Include="EFCore.NamingConventions" Version="9.0.0" />
+        <PackageReference Include="SkiaSharp" Version="3.119.0" />
+        <PackageReference Include="SkiaSharp.NativeAssets.Linux" Version="3.119.0" />
+        <PackageReference Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="3.119.0" />
+        <PackageReference Include="SkiaSharp.NativeAssets.macOS" Version="3.119.0" />
+        <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.3" />
+        <PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="9.0.3" />
+        <PackageReference Include="tusdotnet" Version="2.10.0" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <Content Include="..\.dockerignore">
+        <Link>.dockerignore</Link>
+      </Content>
+    </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\DysonNetwork.Shared\DysonNetwork.Shared.csproj" />
+    </ItemGroup>
+
+</Project>

DysonNetwork.Drive/Migrations/20250713121317_InitialMigration.Designer.cs

@@ -0,0 +1,189 @@
+// <auto-generated />
+using System;
+using System.Collections.Generic;
+using DysonNetwork.Drive;
+using DysonNetwork.Drive.Storage;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using NodaTime;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DysonNetwork.Drive.Migrations
+{
+    [DbContext(typeof(AppDatabase))]
+    [Migration("20250713121317_InitialMigration")]
+    partial class InitialMigration
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "9.0.7")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "postgis");
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFile", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("account_id");
+
+                    b.Property<Instant>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<Instant?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)")
+                        .HasColumnName("description");
+
+                    b.Property<Dictionary<string, object>>("FileMeta")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("file_meta");
+
+                    b.Property<bool>("HasCompression")
+                        .HasColumnType("boolean")
+                        .HasColumnName("has_compression");
+
+                    b.Property<string>("Hash")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasColumnName("hash");
+
+                    b.Property<bool>("IsMarkedRecycle")
+                        .HasColumnType("boolean")
+                        .HasColumnName("is_marked_recycle");
+
+                    b.Property<string>("MimeType")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasColumnName("mime_type");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("name");
+
+                    b.Property<List<ContentSensitiveMark>>("SensitiveMarks")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("sensitive_marks");
+
+                    b.Property<long>("Size")
+                        .HasColumnType("bigint")
+                        .HasColumnName("size");
+
+                    b.Property<string>("StorageId")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("storage_id");
+
+                    b.Property<string>("StorageUrl")
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)")
+                        .HasColumnName("storage_url");
+
+                    b.Property<Instant>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<Instant?>("UploadedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("uploaded_at");
+
+                    b.Property<string>("UploadedTo")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasColumnName("uploaded_to");
+
+                    b.Property<Dictionary<string, object>>("UserMeta")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("user_meta");
+
+                    b.HasKey("Id")
+                        .HasName("pk_files");
+
+                    b.ToTable("files", (string)null);
+                });
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFileReference", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Instant>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<Instant?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at");
+
+                    b.Property<Instant?>("ExpiredAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("expired_at");
+
+                    b.Property<string>("FileId")
+                        .IsRequired()
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("file_id");
+
+                    b.Property<string>("ResourceId")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("resource_id");
+
+                    b.Property<Instant>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<string>("Usage")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("usage");
+
+                    b.HasKey("Id")
+                        .HasName("pk_file_references");
+
+                    b.HasIndex("FileId")
+                        .HasDatabaseName("ix_file_references_file_id");
+
+                    b.ToTable("file_references", (string)null);
+                });
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFileReference", b =>
+                {
+                    b.HasOne("DysonNetwork.Drive.Storage.CloudFile", "File")
+                        .WithMany()
+                        .HasForeignKey("FileId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_file_references_files_file_id");
+
+                    b.Navigation("File");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

DysonNetwork.Drive/Migrations/20250713121317_InitialMigration.cs

@@ -0,0 +1,89 @@
+using System;
+using System.Collections.Generic;
+using DysonNetwork.Drive.Storage;
+using Microsoft.EntityFrameworkCore.Migrations;
+using NodaTime;
+
+#nullable disable
+
+namespace DysonNetwork.Drive.Migrations
+{
+    /// <inheritdoc />
+    public partial class InitialMigration : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterDatabase()
+                .Annotation("Npgsql:PostgresExtension:postgis", ",,");
+
+            migrationBuilder.CreateTable(
+                name: "files",
+                columns: table => new
+                {
+                    id = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: false),
+                    name = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    description = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    file_meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    user_meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    sensitive_marks = table.Column<List<ContentSensitiveMark>>(type: "jsonb", nullable: true),
+                    mime_type = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    hash = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    size = table.Column<long>(type: "bigint", nullable: false),
+                    uploaded_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    uploaded_to = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: true),
+                    has_compression = table.Column<bool>(type: "boolean", nullable: false),
+                    is_marked_recycle = table.Column<bool>(type: "boolean", nullable: false),
+                    storage_id = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: true),
+                    storage_url = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_files", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "file_references",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    file_id = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: false),
+                    usage = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    resource_id = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_file_references", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_file_references_files_file_id",
+                        column: x => x.file_id,
+                        principalTable: "files",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_file_references_file_id",
+                table: "file_references",
+                column: "file_id");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "file_references");
+
+            migrationBuilder.DropTable(
+                name: "files");
+        }
+    }
+}

DysonNetwork.Drive/Migrations/AppDatabaseModelSnapshot.cs

@@ -0,0 +1,186 @@
+// <auto-generated />
+using System;
+using System.Collections.Generic;
+using DysonNetwork.Drive;
+using DysonNetwork.Drive.Storage;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using NodaTime;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DysonNetwork.Drive.Migrations
+{
+    [DbContext(typeof(AppDatabase))]
+    partial class AppDatabaseModelSnapshot : ModelSnapshot
+    {
+        protected override void BuildModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "9.0.7")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "postgis");
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFile", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("id");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("account_id");
+
+                    b.Property<Instant>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<Instant?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)")
+                        .HasColumnName("description");
+
+                    b.Property<Dictionary<string, object>>("FileMeta")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("file_meta");
+
+                    b.Property<bool>("HasCompression")
+                        .HasColumnType("boolean")
+                        .HasColumnName("has_compression");
+
+                    b.Property<string>("Hash")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasColumnName("hash");
+
+                    b.Property<bool>("IsMarkedRecycle")
+                        .HasColumnType("boolean")
+                        .HasColumnName("is_marked_recycle");
+
+                    b.Property<string>("MimeType")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)")
+                        .HasColumnName("mime_type");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("name");
+
+                    b.Property<List<ContentSensitiveMark>>("SensitiveMarks")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("sensitive_marks");
+
+                    b.Property<long>("Size")
+                        .HasColumnType("bigint")
+                        .HasColumnName("size");
+
+                    b.Property<string>("StorageId")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("storage_id");
+
+                    b.Property<string>("StorageUrl")
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)")
+                        .HasColumnName("storage_url");
+
+                    b.Property<Instant>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<Instant?>("UploadedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("uploaded_at");
+
+                    b.Property<string>("UploadedTo")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)")
+                        .HasColumnName("uploaded_to");
+
+                    b.Property<Dictionary<string, object>>("UserMeta")
+                        .HasColumnType("jsonb")
+                        .HasColumnName("user_meta");
+
+                    b.HasKey("Id")
+                        .HasName("pk_files");
+
+                    b.ToTable("files", (string)null);
+                });
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFileReference", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<Instant>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<Instant?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at");
+
+                    b.Property<Instant?>("ExpiredAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("expired_at");
+
+                    b.Property<string>("FileId")
+                        .IsRequired()
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)")
+                        .HasColumnName("file_id");
+
+                    b.Property<string>("ResourceId")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("resource_id");
+
+                    b.Property<Instant>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<string>("Usage")
+                        .IsRequired()
+                        .HasMaxLength(1024)
+                        .HasColumnType("character varying(1024)")
+                        .HasColumnName("usage");
+
+                    b.HasKey("Id")
+                        .HasName("pk_file_references");
+
+                    b.HasIndex("FileId")
+                        .HasDatabaseName("ix_file_references_file_id");
+
+                    b.ToTable("file_references", (string)null);
+                });
+
+            modelBuilder.Entity("DysonNetwork.Drive.Storage.CloudFileReference", b =>
+                {
+                    b.HasOne("DysonNetwork.Drive.Storage.CloudFile", "File")
+                        .WithMany()
+                        .HasForeignKey("FileId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_file_references_files_file_id");
+
+                    b.Navigation("File");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

DysonNetwork.Drive/Program.cs

@@ -0,0 +1,45 @@
+using DysonNetwork.Drive;
+using DysonNetwork.Drive.Startup;
+using DysonNetwork.Shared.Auth;
+using DysonNetwork.Shared.Http;
+using DysonNetwork.Shared.Registry;
+using Microsoft.EntityFrameworkCore;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Configure Kestrel and server options
+builder.ConfigureAppKestrel();
+
+// Add application services
+builder.Services.AddRegistryService(builder.Configuration);
+builder.Services.AddAppServices(builder.Configuration);
+builder.Services.AddAppRateLimiting();
+builder.Services.AddAppAuthentication();
+builder.Services.AddAppSwagger();
+builder.Services.AddDysonAuth(builder.Configuration);
+
+// Add flush handlers and websocket handlers
+builder.Services.AddAppFlushHandlers();
+
+// Add business services
+builder.Services.AddAppBusinessServices();
+
+// Add scheduled jobs
+builder.Services.AddAppScheduledJobs();
+
+var app = builder.Build();
+
+// Run database migrations
+using (var scope = app.Services.CreateScope())
+{
+    var db = scope.ServiceProvider.GetRequiredService<AppDatabase>();
+    await db.Database.MigrateAsync();
+}
+
+// Configure application middleware pipeline
+app.ConfigureAppMiddleware(builder.Configuration);
+
+// Configure gRPC
+app.ConfigureGrpcServices();
+
+app.Run();

DysonNetwork.Drive/Properties/launchSettings.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "http://localhost:5090",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "https://localhost:7092;http://localhost:5090",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

DysonNetwork.Drive/Startup/ApplicationBuilderExtensions.cs

@@ -0,0 +1,28 @@
+namespace DysonNetwork.Drive.Startup;
+
+public static class ApplicationBuilderExtensions
+{
+    public static WebApplication ConfigureAppMiddleware(this WebApplication app, IConfiguration configuration)
+    {
+        // Configure the HTTP request pipeline.
+        if (app.Environment.IsDevelopment())
+        {
+            app.UseSwagger();
+            app.UseSwaggerUI();
+        }
+
+        app.UseHttpsRedirection();
+        app.UseAuthorization();
+        app.MapControllers();
+
+        return app;
+    }
+
+    public static WebApplication ConfigureGrpcServices(this WebApplication app)
+    {
+        // Map your gRPC services here
+        // Example: app.MapGrpcService<MyGrpcService>();
+
+        return app;
+    }
+}

DysonNetwork.Drive/Startup/ScheduledJobsConfiguration.cs

@@ -0,0 +1,22 @@
+using Quartz;
+
+namespace DysonNetwork.Drive.Startup;
+
+public static class ScheduledJobsConfiguration
+{
+    public static IServiceCollection AddAppScheduledJobs(this IServiceCollection services)
+    {
+        services.AddQuartz(q =>
+        {
+            var appDatabaseRecyclingJob = new JobKey("AppDatabaseRecycling");
+            q.AddJob<AppDatabaseRecyclingJob>(opts => opts.WithIdentity(appDatabaseRecyclingJob));
+            q.AddTrigger(opts => opts
+                .ForJob(appDatabaseRecyclingJob)
+                .WithIdentity("AppDatabaseRecyclingTrigger")
+                .WithCronSchedule("0 0 0 * * ?"));
+        });
+        services.AddQuartzHostedService(q => q.WaitForJobsToComplete = true);
+
+        return services;
+    }
+}

DysonNetwork.Drive/Startup/ServiceCollectionExtensions.cs

@@ -0,0 +1,131 @@
+using System.Text.Json;
+using System.Threading.RateLimiting;
+using dotnet_etcd.interfaces;
+using DysonNetwork.Shared.Cache;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.OpenApi.Models;
+using NodaTime;
+using NodaTime.Serialization.SystemTextJson;
+using StackExchange.Redis;
+using DysonNetwork.Shared.Proto;
+
+namespace DysonNetwork.Drive.Startup;
+
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddAppServices(this IServiceCollection services, IConfiguration configuration)
+    {
+        services.AddDbContext<AppDatabase>(); // Assuming you'll have an AppDatabase
+        services.AddSingleton<IConnectionMultiplexer>(_ =>
+        {
+            var connection = configuration.GetConnectionString("FastRetrieve")!;
+            return ConnectionMultiplexer.Connect(connection);
+        });
+        services.AddSingleton<IClock>(SystemClock.Instance);
+        services.AddHttpContextAccessor();
+        services.AddSingleton<ICacheService, CacheServiceRedis>(); // Uncomment if you have CacheServiceRedis
+
+        services.AddHttpClient();
+
+        // Register gRPC services
+        services.AddGrpc(options =>
+        {
+            options.EnableDetailedErrors = true; // Will be adjusted in Program.cs
+            options.MaxReceiveMessageSize = 16 * 1024 * 1024; // 16MB
+            options.MaxSendMessageSize = 16 * 1024 * 1024; // 16MB
+        });
+
+        // Register gRPC reflection for service discovery
+        services.AddGrpc();
+
+        services.AddControllers().AddJsonOptions(options =>
+        {
+            options.JsonSerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.SnakeCaseLower;
+            options.JsonSerializerOptions.DictionaryKeyPolicy = JsonNamingPolicy.SnakeCaseLower;
+
+            options.JsonSerializerOptions.ConfigureForNodaTime(DateTimeZoneProviders.Tzdb);
+        });
+
+        return services;
+    }
+
+    public static IServiceCollection AddAppRateLimiting(this IServiceCollection services)
+    {
+        services.AddRateLimiter(o => o.AddFixedWindowLimiter(policyName: "fixed", opts =>
+        {
+            opts.Window = TimeSpan.FromMinutes(1);
+            opts.PermitLimit = 120;
+            opts.QueueLimit = 2;
+            opts.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+        }));
+
+        return services;
+    }
+
+    public static IServiceCollection AddAppAuthentication(this IServiceCollection services)
+    {
+        services.AddCors();
+        services.AddAuthorization();
+
+        return services;
+    }
+
+    public static IServiceCollection AddAppFlushHandlers(this IServiceCollection services)
+    {
+        services.AddSingleton<FlushBufferService>();
+
+        return services;
+    }
+
+    public static IServiceCollection AddAppSwagger(this IServiceCollection services)
+    {
+        services.AddEndpointsApiExplorer();
+        services.AddSwaggerGen(options =>
+        {
+            options.SwaggerDoc("v1", new OpenApiInfo
+            {
+                Version = "v1",
+                Title = "Dyson Drive",
+                Description =
+                    "The file service of the Dyson Network. Mainly handling file storage and sharing. Also provide image processing and media analysis. Powered the Solar Network Drive as well.",
+                TermsOfService = new Uri("https://solsynth.dev/terms"), // Update with actual terms
+                License = new OpenApiLicense
+                {
+                    Name = "APGLv3", // Update with actual license
+                    Url = new Uri("https://www.gnu.org/licenses/agpl-3.0.html")
+                }
+            });
+            options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
+            {
+                In = ParameterLocation.Header,
+                Description = "Please enter a valid token",
+                Name = "Authorization",
+                Type = SecuritySchemeType.Http,
+                BearerFormat = "JWT",
+                Scheme = "Bearer"
+            });
+            options.AddSecurityRequirement(new OpenApiSecurityRequirement
+            {
+                {
+                    new OpenApiSecurityScheme
+                    {
+                        Reference = new OpenApiReference
+                        {
+                            Type = ReferenceType.SecurityScheme,
+                            Id = "Bearer"
+                        }
+                    },
+                    []
+                }
+            });
+        });
+
+        return services;
+    }
+
+    public static IServiceCollection AddAppBusinessServices(this IServiceCollection services)
+    {
+        // Add your business services here
+        return services;
+    }
+}

DysonNetwork.Drive/Storage/CloudFile.cs

@@ -0,0 +1,131 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using DysonNetwork.Shared.Proto;
+using NodaTime;
+
+namespace DysonNetwork.Drive.Storage;
+
+public class RemoteStorageConfig
+{
+    public string Id { get; set; } = string.Empty;
+    public string Label { get; set; } = string.Empty;
+    public string Region { get; set; } = string.Empty;
+    public string Bucket { get; set; } = string.Empty;
+    public string Endpoint { get; set; } = string.Empty;
+    public string SecretId { get; set; } = string.Empty;
+    public string SecretKey { get; set; } = string.Empty;
+    public bool EnableSigned { get; set; }
+    public bool EnableSsl { get; set; }
+    public string? ImageProxy { get; set; }
+    public string? AccessProxy { get; set; }
+}
+
+/// <summary>
+/// The class that used in jsonb columns which referenced the cloud file.
+/// The aim of this class is to store some properties that won't change to a file to reduce the database load.
+/// </summary>
+public class CloudFileReferenceObject : ModelBase, ICloudFile
+{
+    public string Id { get; set; } = null!;
+    public string Name { get; set; } = string.Empty;
+    public Dictionary<string, object>? FileMeta { get; set; } = null!;
+    public Dictionary<string, object>? UserMeta { get; set; } = null!;
+    public string? MimeType { get; set; }
+    public string? Hash { get; set; }
+    public long Size { get; set; }
+    public bool HasCompression { get; set; } = false;
+}
+
+public class CloudFile : ModelBase, ICloudFile, IIdentifiedResource
+{
+    /// The id generated by TuS, basically just UUID remove the dash lines
+    [MaxLength(32)]
+    public string Id { get; set; } = Guid.NewGuid().ToString();
+
+    [MaxLength(1024)] public string Name { get; set; } = string.Empty;
+    [MaxLength(4096)] public string? Description { get; set; }
+    [Column(TypeName = "jsonb")] public Dictionary<string, object>? FileMeta { get; set; } = null!;
+    [Column(TypeName = "jsonb")] public Dictionary<string, object>? UserMeta { get; set; } = null!;
+    [Column(TypeName = "jsonb")] public List<ContentSensitiveMark>? SensitiveMarks { get; set; } = [];
+    [MaxLength(256)] public string? MimeType { get; set; }
+    [MaxLength(256)] public string? Hash { get; set; }
+    public long Size { get; set; }
+    public Instant? UploadedAt { get; set; }
+    [MaxLength(128)] public string? UploadedTo { get; set; }
+    public bool HasCompression { get; set; } = false;
+    
+    /// <summary>
+    /// The field is set to true if the recycling job plans to delete the file.
+    /// Due to the unstable of the recycling job, this doesn't really delete the file until a human verifies it.
+    /// </summary>
+    public bool IsMarkedRecycle { get; set; } = false;
+
+    /// The object name which stored remotely,
+    /// multiple cloud file may have same storage id to indicate they are the same file
+    /// 
+    /// If the storage id was null and the uploaded at is not null, means it is an embedding file,
+    /// The embedding file means the file is store on another site,
+    /// or it is a webpage (based on mimetype)
+    [MaxLength(32)]
+    public string? StorageId { get; set; }
+
+    /// This field should be null when the storage id is filled
+    /// Indicates the off-site accessible url of the file
+    [MaxLength(4096)]
+    public string? StorageUrl { get; set; }
+
+    public Guid AccountId { get; set; }
+
+    public CloudFileReferenceObject ToReferenceObject()
+    {
+        return new CloudFileReferenceObject
+        {
+            CreatedAt = CreatedAt,
+            UpdatedAt = UpdatedAt,
+            DeletedAt = DeletedAt,
+            Id = Id,
+            Name = Name,
+            FileMeta = FileMeta,
+            UserMeta = UserMeta,
+            MimeType = MimeType,
+            Hash = Hash,
+            Size = Size,
+            HasCompression = HasCompression
+        };
+    }
+
+    public string ResourceIdentifier => $"file/{Id}";
+}
+
+public enum ContentSensitiveMark
+{
+    Language,
+    SexualContent,
+    Violence,
+    Profanity,
+    HateSpeech,
+    Racism,
+    AdultContent,
+    DrugAbuse,
+    AlcoholAbuse,
+    Gambling,
+    SelfHarm,
+    ChildAbuse,
+    Other
+}
+
+public class CloudFileReference : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(32)] public string FileId { get; set; } = null!;
+    public CloudFile File { get; set; } = null!;
+    [MaxLength(1024)] public string Usage { get; set; } = null!;
+    [MaxLength(1024)] public string ResourceId { get; set; } = null!;
+
+    /// <summary>
+    /// Optional expiration date for the file reference
+    /// </summary>
+    public Instant? ExpiredAt { get; set; }
+}

DysonNetwork.Drive/Storage/CloudFileUnusedRecyclingJob.cs

@@ -0,0 +1,93 @@
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using Quartz;
+
+namespace DysonNetwork.Drive.Storage;
+
+public class CloudFileUnusedRecyclingJob(
+    AppDatabase db,
+    FileReferenceService fileRefService,
+    ILogger<CloudFileUnusedRecyclingJob> logger
+)
+    : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {
+        logger.LogInformation("Marking unused cloud files...");
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        const int batchSize = 1000; // Process larger batches for efficiency
+        var processedCount = 0;
+        var markedCount = 0;
+        var totalFiles = await db.Files.Where(f => !f.IsMarkedRecycle).CountAsync();
+
+        logger.LogInformation("Found {TotalFiles} files to check for unused status", totalFiles);
+
+        // Define a timestamp to limit the age of files we're processing in this run
+        // This spreads the processing across multiple job runs for very large databases
+        var ageThreshold = now - Duration.FromDays(30); // Process files up to 90 days old in this run
+
+        // Instead of loading all files at once, use pagination
+        var hasMoreFiles = true;
+        string? lastProcessedId = null;
+
+        while (hasMoreFiles)
+        {
+            // Query for the next batch of files using keyset pagination
+            var filesQuery = db.Files
+                .Where(f => !f.IsMarkedRecycle)
+                .Where(f => f.CreatedAt <= ageThreshold); // Only process older files first
+
+            if (lastProcessedId != null)
+            {
+                filesQuery = filesQuery.Where(f => string.Compare(f.Id, lastProcessedId) > 0);
+            }
+
+            var fileBatch = await filesQuery
+                .OrderBy(f => f.Id) // Ensure consistent ordering for pagination
+                .Take(batchSize)
+                .Select(f => f.Id)
+                .ToListAsync();
+
+            if (fileBatch.Count == 0)
+            {
+                hasMoreFiles = false;
+                continue;
+            }
+
+            processedCount += fileBatch.Count;
+            lastProcessedId = fileBatch.Last();
+
+            // Get all relevant file references for this batch
+            var fileReferences = await fileRefService.GetReferencesAsync(fileBatch);
+
+            // Filter to find files that have no references or all expired references
+            var filesToMark = fileBatch.Where(fileId =>
+                !fileReferences.TryGetValue(fileId, out var references) ||
+                references.Count == 0 ||
+                references.All(r => r.ExpiredAt.HasValue && r.ExpiredAt.Value <= now)
+            ).ToList();
+
+            if (filesToMark.Count > 0)
+            {
+                // Use a bulk update for better performance - mark all qualifying files at once
+                var updateCount = await db.Files
+                    .Where(f => filesToMark.Contains(f.Id))
+                    .ExecuteUpdateAsync(setter => setter
+                        .SetProperty(f => f.IsMarkedRecycle, true));
+
+                markedCount += updateCount;
+            }
+
+            // Log progress periodically
+            if (processedCount % 10000 == 0 || !hasMoreFiles)
+            {
+                logger.LogInformation(
+                    "Progress: processed {ProcessedCount}/{TotalFiles} files, marked {MarkedCount} for recycling",
+                    processedCount, totalFiles, markedCount);
+            }
+        }
+
+        logger.LogInformation("Completed marking {MarkedCount} files for recycling", markedCount);
+    }
+}

DysonNetwork.Drive/Storage/FileController.cs

@@ -0,0 +1,144 @@
+using DysonNetwork.Shared.Proto;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Minio.DataModel.Args;
+
+namespace DysonNetwork.Drive.Storage;
+
+[ApiController]
+[Route("/api/files")]
+public class FileController(
+    AppDatabase db,
+    FileService fs,
+    IConfiguration configuration,
+    IWebHostEnvironment env
+) : ControllerBase
+{
+    [HttpGet("{id}")]
+    public async Task<ActionResult> OpenFile(
+        string id,
+        [FromQuery] bool download = false,
+        [FromQuery] bool original = false,
+        [FromQuery] string? overrideMimeType = null
+    )
+    {
+        // Support the file extension for client side data recognize
+        string? fileExtension = null;
+        if (id.Contains('.'))
+        {
+            var splitId = id.Split('.');
+            id = splitId.First();
+            fileExtension = splitId.Last();
+        }
+
+        var file = await fs.GetFileAsync(id);
+        if (file is null) return NotFound();
+
+        if (!string.IsNullOrWhiteSpace(file.StorageUrl)) return Redirect(file.StorageUrl);
+
+        if (file.UploadedTo is null)
+        {
+            var tusStorePath = configuration.GetValue<string>("Tus:StorePath")!;
+            var filePath = Path.Combine(env.ContentRootPath, tusStorePath, file.Id);
+            if (!System.IO.File.Exists(filePath)) return new NotFoundResult();
+            return PhysicalFile(filePath, file.MimeType ?? "application/octet-stream", file.Name);
+        }
+
+        var dest = fs.GetRemoteStorageConfig(file.UploadedTo);
+        var fileName = string.IsNullOrWhiteSpace(file.StorageId) ? file.Id : file.StorageId;
+
+        if (!original && file.HasCompression)
+            fileName += ".compressed";
+
+        if (dest.ImageProxy is not null && (file.MimeType?.StartsWith("image/") ?? false))
+        {
+            var proxyUrl = dest.ImageProxy;
+            var baseUri = new Uri(proxyUrl.EndsWith('/') ? proxyUrl : $"{proxyUrl}/");
+            var fullUri = new Uri(baseUri, fileName);
+            return Redirect(fullUri.ToString());
+        }
+
+        if (dest.AccessProxy is not null)
+        {
+            var proxyUrl = dest.AccessProxy;
+            var baseUri = new Uri(proxyUrl.EndsWith('/') ? proxyUrl : $"{proxyUrl}/");
+            var fullUri = new Uri(baseUri, fileName);
+            return Redirect(fullUri.ToString());
+        }
+
+        if (dest.EnableSigned)
+        {
+            var client = fs.CreateMinioClient(dest);
+            if (client is null)
+                return BadRequest(
+                    "Failed to configure client for remote destination, file got an invalid storage remote.");
+
+            var headers = new Dictionary<string, string>();
+            if (fileExtension is not null)
+            {
+                if (MimeTypes.TryGetMimeType(fileExtension, out var mimeType))
+                    headers.Add("Response-Content-Type", mimeType);
+            }
+            else if (overrideMimeType is not null)
+            {
+                headers.Add("Response-Content-Type", overrideMimeType);
+            }
+            else if (file.MimeType is not null && !file.MimeType!.EndsWith("unknown"))
+            {
+                headers.Add("Response-Content-Type", file.MimeType);
+            }
+
+            if (download)
+            {
+                headers.Add("Response-Content-Disposition", $"attachment; filename=\"{file.Name}\"");
+            }
+
+            var bucket = dest.Bucket;
+            var openUrl = await client.PresignedGetObjectAsync(
+                new PresignedGetObjectArgs()
+                    .WithBucket(bucket)
+                    .WithObject(fileName)
+                    .WithExpiry(3600)
+                    .WithHeaders(headers)
+            );
+
+            return Redirect(openUrl);
+        }
+
+        // Fallback redirect to the S3 endpoint (public read)
+        var protocol = dest.EnableSsl ? "https" : "http";
+        // Use the path bucket lookup mode
+        return Redirect($"{protocol}://{dest.Endpoint}/{dest.Bucket}/{fileName}");
+    }
+
+    [HttpGet("{id}/info")]
+    public async Task<ActionResult<CloudFile>> GetFileInfo(string id)
+    {
+        var file = await db.Files.FindAsync(id);
+        if (file is null) return NotFound();
+
+        return file;
+    }
+
+    [Authorize]
+    [HttpDelete("{id}")]
+    public async Task<ActionResult> DeleteFile(string id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var userId = Guid.Parse(currentUser.Id);
+
+        var file = await db.Files
+            .Where(e => e.Id == id)
+            .Where(e => e.AccountId == userId)
+            .FirstOrDefaultAsync();
+        if (file is null) return NotFound();
+
+        await fs.DeleteFileAsync(file);
+
+        db.Files.Remove(file);
+        await db.SaveChangesAsync();
+
+        return NoContent();
+    }
+}

DysonNetwork.Drive/Storage/FileExpirationJob.cs

@@ -0,0 +1,66 @@
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using Quartz;
+
+namespace DysonNetwork.Drive.Storage;
+
+/// <summary>
+/// Job responsible for cleaning up expired file references
+/// </summary>
+public class FileExpirationJob(AppDatabase db, FileService fileService, ILogger<FileExpirationJob> logger) : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {        
+        var now = SystemClock.Instance.GetCurrentInstant();
+        logger.LogInformation("Running file reference expiration job at {now}", now);
+
+        // Find all expired references
+        var expiredReferences = await db.FileReferences
+            .Where(r => r.ExpiredAt < now && r.ExpiredAt != null)
+            .ToListAsync();
+
+        if (!expiredReferences.Any())
+        {
+            logger.LogInformation("No expired file references found");
+            return;
+        }
+
+        logger.LogInformation("Found {count} expired file references", expiredReferences.Count);
+
+        // Get unique file IDs
+        var fileIds = expiredReferences.Select(r => r.FileId).Distinct().ToList();
+        var filesAndReferenceCount = new Dictionary<string, int>();
+
+        // Delete expired references
+        db.FileReferences.RemoveRange(expiredReferences);
+        await db.SaveChangesAsync();
+
+        // Check remaining references for each file
+        foreach (var fileId in fileIds)
+        {            
+            var remainingReferences = await db.FileReferences
+                .Where(r => r.FileId == fileId)
+                .CountAsync();
+
+            filesAndReferenceCount[fileId] = remainingReferences;
+
+            // If no references remain, delete the file
+            if (remainingReferences == 0)
+            {
+                var file = await db.Files.FirstOrDefaultAsync(f => f.Id == fileId);
+                if (file != null)
+                {
+                    logger.LogInformation("Deleting file {fileId} as all references have expired", fileId);
+                    await fileService.DeleteFileAsync(file);
+                }
+            }
+            else
+            {
+                // Just purge the cache
+                await fileService._PurgeCacheAsync(fileId);
+            }
+        }
+
+        logger.LogInformation("Completed file reference expiration job");
+    }
+}

DysonNetwork.Drive/Storage/FileReferenceService.cs

@@ -0,0 +1,434 @@
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Drive.Storage;
+
+public class FileReferenceService(AppDatabase db, FileService fileService, ICacheService cache)
+{
+    private const string CacheKeyPrefix = "fileref:";
+    private static readonly TimeSpan CacheDuration = TimeSpan.FromMinutes(15);
+
+    /// <summary>
+    /// Creates a new reference to a file for a specific resource
+    /// </summary>
+    /// <param name="fileId">The ID of the file to reference</param>
+    /// <param name="usage">The usage context (e.g., "avatar", "post-attachment")</param>
+    /// <param name="resourceId">The ID of the resource using the file</param>
+    /// <param name="expiredAt">Optional expiration time for the file</param>
+    /// <param name="duration">Optional duration after which the file expires (alternative to expiredAt)</param>
+    /// <returns>The created file reference</returns>
+    public async Task<CloudFileReference> CreateReferenceAsync(
+        string fileId, 
+        string usage, 
+        string resourceId, 
+        Instant? expiredAt = null, 
+        Duration? duration = null)
+    {
+        // Calculate expiration time if needed
+        var finalExpiration = expiredAt;
+        if (duration.HasValue)
+            finalExpiration = SystemClock.Instance.GetCurrentInstant() + duration.Value;
+
+        var reference = new CloudFileReference
+        {
+            FileId = fileId,
+            Usage = usage,
+            ResourceId = resourceId,
+            ExpiredAt = finalExpiration
+        };
+
+        db.FileReferences.Add(reference);
+
+        await db.SaveChangesAsync();
+        await fileService._PurgeCacheAsync(fileId);
+
+        return reference;
+    }
+
+    /// <summary>
+    /// Gets all references to a file
+    /// </summary>
+    /// <param name="fileId">The ID of the file</param>
+    /// <returns>A list of all references to the file</returns>
+    public async Task<List<CloudFileReference>> GetReferencesAsync(string fileId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}list:{fileId}";
+
+        var cachedReferences = await cache.GetAsync<List<CloudFileReference>>(cacheKey);
+        if (cachedReferences is not null)
+            return cachedReferences;
+
+        var references = await db.FileReferences
+            .Where(r => r.FileId == fileId)
+            .ToListAsync();
+
+        await cache.SetAsync(cacheKey, references, CacheDuration);
+
+        return references;
+    }
+
+    public async Task<Dictionary<string, List<CloudFileReference>>> GetReferencesAsync(IEnumerable<string> fileId)
+    {
+        var references = await db.FileReferences
+            .Where(r => fileId.Contains(r.FileId))
+            .GroupBy(r => r.FileId)
+            .ToDictionaryAsync(r => r.Key, r => r.ToList());
+        return references;
+    }
+
+    /// <summary>
+    /// Gets the number of references to a file
+    /// </summary>
+    /// <param name="fileId">The ID of the file</param>
+    /// <returns>The number of references to the file</returns>
+    public async Task<int> GetReferenceCountAsync(string fileId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}count:{fileId}";
+
+        var cachedCount = await cache.GetAsync<int?>(cacheKey);
+        if (cachedCount.HasValue)
+            return cachedCount.Value;
+
+        var count = await db.FileReferences
+            .Where(r => r.FileId == fileId)
+            .CountAsync();
+
+        await cache.SetAsync(cacheKey, count, CacheDuration);
+
+        return count;
+    }
+
+    /// <summary>
+    /// Gets all references for a specific resource
+    /// </summary>
+    /// <param name="resourceId">The ID of the resource</param>
+    /// <returns>A list of file references associated with the resource</returns>
+    public async Task<List<CloudFileReference>> GetResourceReferencesAsync(string resourceId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}resource:{resourceId}";
+
+        var cachedReferences = await cache.GetAsync<List<CloudFileReference>>(cacheKey);
+        if (cachedReferences is not null)
+            return cachedReferences;
+
+        var references = await db.FileReferences
+            .Where(r => r.ResourceId == resourceId)
+            .ToListAsync();
+
+        await cache.SetAsync(cacheKey, references, CacheDuration);
+
+        return references;
+    }
+
+    /// <summary>
+    /// Gets all file references for a specific usage context
+    /// </summary>
+    /// <param name="usage">The usage context</param>
+    /// <returns>A list of file references with the specified usage</returns>
+    public async Task<List<CloudFileReference>> GetUsageReferencesAsync(string usage)
+    {
+        return await db.FileReferences
+            .Where(r => r.Usage == usage)
+            .ToListAsync();
+    }
+
+    /// <summary>
+    /// Deletes references for a specific resource
+    /// </summary>
+    /// <param name="resourceId">The ID of the resource</param>
+    /// <returns>The number of deleted references</returns>
+    public async Task<int> DeleteResourceReferencesAsync(string resourceId)
+    {
+        var references = await db.FileReferences
+            .Where(r => r.ResourceId == resourceId)
+            .ToListAsync();
+
+        var fileIds = references.Select(r => r.FileId).Distinct().ToList();
+
+        db.FileReferences.RemoveRange(references);
+        var deletedCount = await db.SaveChangesAsync();
+
+        // Purge caches
+        var tasks = fileIds.Select(fileService._PurgeCacheAsync).ToList();
+        tasks.Add(PurgeCacheForResourceAsync(resourceId));
+        await Task.WhenAll(tasks);
+
+        return deletedCount;
+    }
+
+    /// <summary>
+    /// Deletes references for a specific resource and usage
+    /// </summary>
+    /// <param name="resourceId">The ID of the resource</param>
+    /// <param name="usage">The usage context</param>
+    /// <returns>The number of deleted references</returns>
+    public async Task<int> DeleteResourceReferencesAsync(string resourceId, string usage)
+    {
+        var references = await db.FileReferences
+            .Where(r => r.ResourceId == resourceId && r.Usage == usage)
+            .ToListAsync();
+
+        if (!references.Any())
+        {
+            return 0;
+        }
+
+        var fileIds = references.Select(r => r.FileId).Distinct().ToList();
+
+        db.FileReferences.RemoveRange(references);
+        var deletedCount = await db.SaveChangesAsync();
+
+        // Purge caches
+        var tasks = fileIds.Select(fileService._PurgeCacheAsync).ToList();
+        tasks.Add(PurgeCacheForResourceAsync(resourceId));
+        await Task.WhenAll(tasks);
+
+        return deletedCount;
+    }
+
+    /// <summary>
+    /// Deletes a specific file reference
+    /// </summary>
+    /// <param name="referenceId">The ID of the reference to delete</param>
+    /// <returns>True if the reference was deleted, false otherwise</returns>
+    public async Task<bool> DeleteReferenceAsync(Guid referenceId)
+    {
+        var reference = await db.FileReferences
+            .FirstOrDefaultAsync(r => r.Id == referenceId);
+
+        if (reference == null)
+            return false;
+
+        db.FileReferences.Remove(reference);
+        await db.SaveChangesAsync();
+
+        // Purge caches
+        await fileService._PurgeCacheAsync(reference.FileId);
+        await PurgeCacheForResourceAsync(reference.ResourceId);
+        await PurgeCacheForFileAsync(reference.FileId);
+
+        return true;
+    }
+
+    /// <summary>
+    /// Updates the files referenced by a resource
+    /// </summary>
+    /// <param name="resourceId">The ID of the resource</param>
+    /// <param name="newFileIds">The new list of file IDs</param>
+    /// <param name="usage">The usage context</param>
+    /// <param name="expiredAt">Optional expiration time for newly added files</param>
+    /// <param name="duration">Optional duration after which newly added files expire</param>
+    /// <returns>A list of the updated file references</returns>
+    public async Task<List<CloudFileReference>> UpdateResourceFilesAsync(
+        string resourceId,
+        IEnumerable<string>? newFileIds,
+        string usage,
+        Instant? expiredAt = null,
+        Duration? duration = null)
+    {
+        if (newFileIds == null)
+            return new List<CloudFileReference>();
+
+        var existingReferences = await db.FileReferences
+            .Where(r => r.ResourceId == resourceId && r.Usage == usage)
+            .ToListAsync();
+
+        var existingFileIds = existingReferences.Select(r => r.FileId).ToHashSet();
+        var newFileIdsList = newFileIds.ToList();
+        var newFileIdsSet = newFileIdsList.ToHashSet();
+
+        // Files to remove
+        var toRemove = existingReferences
+            .Where(r => !newFileIdsSet.Contains(r.FileId))
+            .ToList();
+
+        // Files to add
+        var toAdd = newFileIdsList
+            .Where(id => !existingFileIds.Contains(id))
+            .Select(id => new CloudFileReference
+            {
+                FileId = id,
+                Usage = usage,
+                ResourceId = resourceId
+            })
+            .ToList();
+
+        // Apply changes
+        if (toRemove.Any())
+            db.FileReferences.RemoveRange(toRemove);
+
+        if (toAdd.Any())
+            db.FileReferences.AddRange(toAdd);
+
+        await db.SaveChangesAsync();
+
+        // Update expiration for newly added references if specified
+        if ((expiredAt.HasValue || duration.HasValue) && toAdd.Any())
+        {
+            var finalExpiration = expiredAt;
+            if (duration.HasValue)
+            {
+                finalExpiration = SystemClock.Instance.GetCurrentInstant() + duration.Value;
+            }
+
+            // Update newly added references with the expiration time
+            var referenceIds = await db.FileReferences
+                .Where(r => toAdd.Select(a => a.FileId).Contains(r.FileId) && 
+                            r.ResourceId == resourceId && 
+                            r.Usage == usage)
+                .Select(r => r.Id)
+                .ToListAsync();
+
+            await db.FileReferences
+                .Where(r => referenceIds.Contains(r.Id))
+                .ExecuteUpdateAsync(setter => setter.SetProperty(
+                    r => r.ExpiredAt,
+                    _ => finalExpiration
+                ));
+        }
+
+        // Purge caches
+        var allFileIds = existingFileIds.Union(newFileIdsSet).ToList();
+        var tasks = allFileIds.Select(fileService._PurgeCacheAsync).ToList();
+        tasks.Add(PurgeCacheForResourceAsync(resourceId));
+        await Task.WhenAll(tasks);
+
+        // Return updated references
+        return await db.FileReferences
+            .Where(r => r.ResourceId == resourceId && r.Usage == usage)
+            .ToListAsync();
+    }
+
+    /// <summary>
+    /// Gets all files referenced by a resource
+    /// </summary>
+    /// <param name="resourceId">The ID of the resource</param>
+    /// <param name="usage">Optional filter by usage context</param>
+    /// <returns>A list of files referenced by the resource</returns>
+    public async Task<List<CloudFile>> GetResourceFilesAsync(string resourceId, string? usage = null)
+    {
+        var query = db.FileReferences.Where(r => r.ResourceId == resourceId);
+
+        if (usage != null)
+            query = query.Where(r => r.Usage == usage);
+
+        var references = await query.ToListAsync();
+        var fileIds = references.Select(r => r.FileId).ToList();
+
+        return await db.Files
+            .Where(f => fileIds.Contains(f.Id))
+            .ToListAsync();
+    }
+
+    /// <summary>
+    /// Purges all caches related to a resource
+    /// </summary>
+    private async Task PurgeCacheForResourceAsync(string resourceId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}resource:{resourceId}";
+        await cache.RemoveAsync(cacheKey);
+    }
+
+    /// <summary>
+    /// Purges all caches related to a file
+    /// </summary>
+    private async Task PurgeCacheForFileAsync(string fileId)
+    {
+        var cacheKeys = new[]
+        {
+            $"{CacheKeyPrefix}list:{fileId}",
+            $"{CacheKeyPrefix}count:{fileId}"
+        };
+
+        var tasks = cacheKeys.Select(cache.RemoveAsync);
+        await Task.WhenAll(tasks);
+    }
+
+    /// <summary>
+    /// Updates the expiration time for a file reference
+    /// </summary>
+    /// <param name="referenceId">The ID of the reference</param>
+    /// <param name="expiredAt">The new expiration time, or null to remove expiration</param>
+    /// <returns>True if the reference was found and updated, false otherwise</returns>
+    public async Task<bool> SetReferenceExpirationAsync(Guid referenceId, Instant? expiredAt)
+    {
+        var reference = await db.FileReferences
+            .FirstOrDefaultAsync(r => r.Id == referenceId);
+
+        if (reference == null)
+            return false;
+
+        reference.ExpiredAt = expiredAt;
+        await db.SaveChangesAsync();
+
+        await PurgeCacheForFileAsync(reference.FileId);
+        await PurgeCacheForResourceAsync(reference.ResourceId);
+
+        return true;
+    }
+
+    /// <summary>
+    /// Updates the expiration time for all references to a file
+    /// </summary>
+    /// <param name="fileId">The ID of the file</param>
+    /// <param name="expiredAt">The new expiration time, or null to remove expiration</param>
+    /// <returns>The number of references updated</returns>
+    public async Task<int> SetFileReferencesExpirationAsync(string fileId, Instant? expiredAt)
+    {
+        var rowsAffected = await db.FileReferences
+            .Where(r => r.FileId == fileId)
+            .ExecuteUpdateAsync(setter => setter.SetProperty(
+                r => r.ExpiredAt,
+                _ => expiredAt
+            ));
+
+        if (rowsAffected > 0)
+        {
+            await fileService._PurgeCacheAsync(fileId);
+            await PurgeCacheForFileAsync(fileId);
+        }
+
+        return rowsAffected;
+    }
+
+    /// <summary>
+    /// Get all file references for a specific resource and usage type
+    /// </summary>
+    /// <param name="resourceId">The resource ID</param>
+    /// <param name="usageType">The usage type</param>
+    /// <returns>List of file references</returns>
+    public async Task<List<CloudFileReference>> GetResourceReferencesAsync(string resourceId, string usageType)
+    {
+        return await db.FileReferences
+            .Where(r => r.ResourceId == resourceId && r.Usage == usageType)
+            .ToListAsync();
+    }
+
+    /// <summary>
+    /// Check if a file has any references
+    /// </summary>
+    /// <param name="fileId">The file ID to check</param>
+    /// <returns>True if the file has references, false otherwise</returns>
+    public async Task<bool> HasFileReferencesAsync(string fileId)
+    {
+        return await db.FileReferences.AnyAsync(r => r.FileId == fileId);
+    }
+
+    /// <summary>
+    /// Updates the expiration time for a file reference using a duration from now
+    /// </summary>
+    /// <param name="referenceId">The ID of the reference</param>
+    /// <param name="duration">The duration after which the reference expires, or null to remove expiration</param>
+    /// <returns>True if the reference was found and updated, false otherwise</returns>
+    public async Task<bool> SetReferenceExpirationDurationAsync(Guid referenceId, Duration? duration)
+    {
+        Instant? expiredAt = null;
+        if (duration.HasValue)
+        {
+            expiredAt = SystemClock.Instance.GetCurrentInstant() + duration.Value;
+        }
+
+        return await SetReferenceExpirationAsync(referenceId, expiredAt);
+    }
+}

DysonNetwork.Drive/Storage/FileService.cs

@@ -0,0 +1,555 @@
+using System.Globalization;
+using FFMpegCore;
+using System.Security.Cryptography;
+using DysonNetwork.Shared.Cache;
+using DysonNetwork.Shared.Proto;
+using Microsoft.EntityFrameworkCore;
+using Minio;
+using Minio.DataModel.Args;
+using NetVips;
+using NodaTime;
+using tusdotnet.Stores;
+
+namespace DysonNetwork.Drive.Storage;
+
+public class FileService(
+    AppDatabase db,
+    IConfiguration configuration,
+    TusDiskStore store,
+    ILogger<FileService> logger,
+    IServiceScopeFactory scopeFactory,
+    ICacheService cache
+)
+{
+    private const string CacheKeyPrefix = "file:";
+    private static readonly TimeSpan CacheDuration = TimeSpan.FromMinutes(15);
+
+    /// <summary>
+    /// The api for getting file meta with cache,
+    /// the best use case is for accessing the file data.
+    ///
+    /// <b>This function won't load uploader's information, only keep minimal file meta</b>
+    /// </summary>
+    /// <param name="fileId">The id of the cloud file requested</param>
+    /// <returns>The minimal file meta</returns>
+    public async Task<CloudFile?> GetFileAsync(string fileId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}{fileId}";
+
+        var cachedFile = await cache.GetAsync<CloudFile>(cacheKey);
+        if (cachedFile is not null)
+            return cachedFile;
+
+        var file = await db.Files
+            .Where(f => f.Id == fileId)
+            .FirstOrDefaultAsync();
+
+        if (file != null)
+            await cache.SetAsync(cacheKey, file, CacheDuration);
+
+        return file;
+    }
+
+    private static readonly string TempFilePrefix = "dyn-cloudfile";
+
+    private static readonly string[] AnimatedImageTypes =
+        ["image/gif", "image/apng", "image/webp", "image/avif"];
+
+    // The analysis file method no longer will remove the GPS EXIF data
+    // It should be handled on the client side, and for some specific cases it should be keep
+    public async Task<CloudFile> ProcessNewFileAsync(
+        Account account,
+        string fileId,
+        Stream stream,
+        string fileName,
+        string? contentType
+    )
+    {
+        var result = new List<(string filePath, string suffix)>();
+
+        var ogFilePath = Path.GetFullPath(Path.Join(configuration.GetValue<string>("Tus:StorePath"), fileId));
+        var fileSize = stream.Length;
+        var hash = await HashFileAsync(stream, fileSize: fileSize);
+        contentType ??= !fileName.Contains('.') ? "application/octet-stream" : MimeTypes.GetMimeType(fileName);
+
+        var file = new CloudFile
+        {
+            Id = fileId,
+            Name = fileName,
+            MimeType = contentType,
+            Size = fileSize,
+            Hash = hash,
+            AccountId = Guid.Parse(account.Id)
+        };
+
+        var existingFile = await db.Files.FirstOrDefaultAsync(f => f.Hash == hash);
+        file.StorageId = existingFile is not null ? existingFile.StorageId : file.Id;
+
+        if (existingFile is not null)
+        {
+            file.FileMeta = existingFile.FileMeta;
+            file.HasCompression = existingFile.HasCompression;
+            file.SensitiveMarks = existingFile.SensitiveMarks;
+
+            db.Files.Add(file);
+            await db.SaveChangesAsync();
+            return file;
+        }
+
+        switch (contentType.Split('/')[0])
+        {
+            case "image":
+                var blurhash =
+                    BlurHashSharp.SkiaSharp.BlurHashEncoder.Encode(xComponent: 3, yComponent: 3, filename: ogFilePath);
+
+                // Rewind stream
+                stream.Position = 0;
+
+                // Use NetVips for the rest
+                using (var vipsImage = NetVips.Image.NewFromStream(stream))
+                {
+                    var width = vipsImage.Width;
+                    var height = vipsImage.Height;
+                    var format = vipsImage.Get("vips-loader") ?? "unknown";
+
+                    // Try to get orientation from exif data
+                    var orientation = 1;
+                    var meta = new Dictionary<string, object>
+                    {
+                        ["blur"] = blurhash,
+                        ["format"] = format,
+                        ["width"] = width,
+                        ["height"] = height,
+                        ["orientation"] = orientation,
+                    };
+                    Dictionary<string, object> exif = [];
+
+                    foreach (var field in vipsImage.GetFields())
+                    {
+                        var value = vipsImage.Get(field);
+
+                        // Skip GPS-related EXIF fields to remove location data
+                        if (IsIgnoredField(field))
+                            continue;
+
+                        if (field.StartsWith("exif-")) exif[field.Replace("exif-", "")] = value;
+                        else meta[field] = value;
+
+                        if (field == "orientation") orientation = (int)value;
+                    }
+
+                    if (orientation is 6 or 8)
+                        (width, height) = (height, width);
+
+                    var aspectRatio = height != 0 ? (double)width / height : 0;
+
+                    meta["exif"] = exif;
+                    meta["ratio"] = aspectRatio;
+                    file.FileMeta = meta;
+                }
+
+                break;
+            case "video":
+            case "audio":
+                try
+                {
+                    var mediaInfo = await FFProbe.AnalyseAsync(ogFilePath);
+                    file.FileMeta = new Dictionary<string, object>
+                    {
+                        ["duration"] = mediaInfo.Duration.TotalSeconds,
+                        ["format_name"] = mediaInfo.Format.FormatName,
+                        ["format_long_name"] = mediaInfo.Format.FormatLongName,
+                        ["start_time"] = mediaInfo.Format.StartTime.ToString(),
+                        ["bit_rate"] = mediaInfo.Format.BitRate.ToString(CultureInfo.InvariantCulture),
+                        ["tags"] = mediaInfo.Format.Tags ?? [],
+                        ["chapters"] = mediaInfo.Chapters,
+                    };
+                    if (mediaInfo.PrimaryVideoStream is not null)
+                        file.FileMeta["ratio"] =
+                            mediaInfo.PrimaryVideoStream.Width / mediaInfo.PrimaryVideoStream.Height;
+                }
+                catch (Exception ex)
+                {
+                    logger.LogError("File analyzed failed, unable collect video / audio information: {Message}",
+                        ex.Message);
+                }
+
+                break;
+        }
+
+        db.Files.Add(file);
+        await db.SaveChangesAsync();
+
+        _ = Task.Run(async () =>
+        {
+            using var scope = scopeFactory.CreateScope();
+            var nfs = scope.ServiceProvider.GetRequiredService<FileService>();
+
+            try
+            {
+                logger.LogInformation("Processed file {fileId}, now trying optimizing if possible...", fileId);
+
+                if (contentType.Split('/')[0] == "image")
+                {
+                    // Skip compression for animated image types
+                    var animatedMimeTypes = AnimatedImageTypes;
+                    if (Enumerable.Contains(animatedMimeTypes, contentType))
+                    {
+                        logger.LogInformation(
+                            "File {fileId} is an animated image (MIME: {mime}), skipping WebP conversion.", fileId,
+                            contentType
+                        );
+                        var tempFilePath = Path.Join(Path.GetTempPath(), $"{TempFilePrefix}#{file.Id}");
+                        result.Add((tempFilePath, string.Empty));
+                        return;
+                    }
+
+                    file.MimeType = "image/webp";
+
+                    using var vipsImage = Image.NewFromFile(ogFilePath);
+                    var imagePath = Path.Join(Path.GetTempPath(), $"{TempFilePrefix}#{file.Id}");
+                    vipsImage.Autorot().WriteToFile(imagePath + ".webp",
+                        new VOption { { "lossless", true }, { "strip", true } });
+                    result.Add((imagePath + ".webp", string.Empty));
+
+                    if (vipsImage.Width * vipsImage.Height >= 1024 * 1024)
+                    {
+                        var scale = 1024.0 / Math.Max(vipsImage.Width, vipsImage.Height);
+                        var imageCompressedPath =
+                            Path.Join(Path.GetTempPath(), $"{TempFilePrefix}#{file.Id}-compressed");
+
+                        // Create and save image within the same synchronous block to avoid disposal issues
+                        using var compressedImage = vipsImage.Resize(scale);
+                        compressedImage.Autorot().WriteToFile(imageCompressedPath + ".webp",
+                            new VOption { { "Q", 80 }, { "strip", true } });
+
+                        result.Add((imageCompressedPath + ".webp", ".compressed"));
+                        file.HasCompression = true;
+                    }
+                }
+                else
+                {
+                    // No extra process for video, add it to the upload queue.
+                    result.Add((ogFilePath, string.Empty));
+                }
+
+                logger.LogInformation("Optimized file {fileId}, now uploading...", fileId);
+
+                if (result.Count > 0)
+                {
+                    List<Task<CloudFile>> tasks = [];
+                    tasks.AddRange(result.Select(item =>
+                        nfs.UploadFileToRemoteAsync(file, item.filePath, null, item.suffix, true))
+                    );
+
+                    await Task.WhenAll(tasks);
+                    file = await tasks.First();
+                }
+                else
+                {
+                    file = await nfs.UploadFileToRemoteAsync(file, stream, null);
+                }
+
+                logger.LogInformation("Uploaded file {fileId} done!", fileId);
+
+                var scopedDb = scope.ServiceProvider.GetRequiredService<AppDatabase>();
+                await scopedDb.Files.Where(f => f.Id == file.Id).ExecuteUpdateAsync(setter => setter
+                    .SetProperty(f => f.UploadedAt, file.UploadedAt)
+                    .SetProperty(f => f.UploadedTo, file.UploadedTo)
+                    .SetProperty(f => f.MimeType, file.MimeType)
+                    .SetProperty(f => f.HasCompression, file.HasCompression)
+                );
+            }
+            catch (Exception err)
+            {
+                logger.LogError(err, "Failed to process {fileId}", fileId);
+            }
+
+            await stream.DisposeAsync();
+            await store.DeleteFileAsync(file.Id, CancellationToken.None);
+            await nfs._PurgeCacheAsync(file.Id);
+        });
+
+        return file;
+    }
+
+    private static async Task<string> HashFileAsync(Stream stream, int chunkSize = 1024 * 1024, long? fileSize = null)
+    {
+        fileSize ??= stream.Length;
+        if (fileSize > chunkSize * 1024 * 5)
+            return await HashFastApproximateAsync(stream, chunkSize);
+
+        using var md5 = MD5.Create();
+        var hashBytes = await md5.ComputeHashAsync(stream);
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+
+    private static async Task<string> HashFastApproximateAsync(Stream stream, int chunkSize = 1024 * 1024)
+    {
+        // Scale the chunk size to kB level
+        chunkSize *= 1024;
+
+        using var md5 = MD5.Create();
+
+        var buffer = new byte[chunkSize * 2];
+        var fileLength = stream.Length;
+
+        var bytesRead = await stream.ReadAsync(buffer.AsMemory(0, chunkSize));
+
+        if (fileLength > chunkSize)
+        {
+            stream.Seek(-chunkSize, SeekOrigin.End);
+            bytesRead += await stream.ReadAsync(buffer.AsMemory(chunkSize, chunkSize));
+        }
+
+        var hash = md5.ComputeHash(buffer, 0, bytesRead);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+
+    public async Task<CloudFile> UploadFileToRemoteAsync(CloudFile file, string filePath, string? targetRemote,
+        string? suffix = null, bool selfDestruct = false)
+    {
+        var fileStream = File.OpenRead(filePath);
+        var result = await UploadFileToRemoteAsync(file, fileStream, targetRemote, suffix);
+        if (selfDestruct) File.Delete(filePath);
+        return result;
+    }
+
+    public async Task<CloudFile> UploadFileToRemoteAsync(CloudFile file, Stream stream, string? targetRemote,
+        string? suffix = null)
+    {
+        if (file.UploadedAt.HasValue) return file;
+
+        file.UploadedTo = targetRemote ?? configuration.GetValue<string>("Storage:PreferredRemote")!;
+
+        var dest = GetRemoteStorageConfig(file.UploadedTo);
+        var client = CreateMinioClient(dest);
+        if (client is null)
+            throw new InvalidOperationException(
+                $"Failed to configure client for remote destination '{file.UploadedTo}'"
+            );
+
+        var bucket = dest.Bucket;
+        var contentType = file.MimeType ?? "application/octet-stream";
+
+        await client.PutObjectAsync(new PutObjectArgs()
+            .WithBucket(bucket)
+            .WithObject(string.IsNullOrWhiteSpace(suffix) ? file.Id : file.Id + suffix)
+            .WithStreamData(stream) // Fix this disposed
+            .WithObjectSize(stream.Length)
+            .WithContentType(contentType)
+        );
+
+        file.UploadedAt = Instant.FromDateTimeUtc(DateTime.UtcNow);
+        return file;
+    }
+
+    public async Task DeleteFileAsync(CloudFile file)
+    {
+        await DeleteFileDataAsync(file);
+
+        db.Remove(file);
+        await db.SaveChangesAsync();
+        await _PurgeCacheAsync(file.Id);
+    }
+
+    public async Task DeleteFileDataAsync(CloudFile file)
+    {
+        if (file.StorageId is null) return;
+        if (file.UploadedTo is null) return;
+
+        // Check if any other file with the same storage ID is referenced
+        var otherFilesWithSameStorageId = await db.Files
+            .Where(f => f.StorageId == file.StorageId && f.Id != file.Id)
+            .Select(f => f.Id)
+            .ToListAsync();
+
+        // Check if any of these files are referenced
+        var anyReferenced = false;
+        if (otherFilesWithSameStorageId.Any())
+        {
+            anyReferenced = await db.FileReferences
+                .Where(r => otherFilesWithSameStorageId.Contains(r.FileId))
+                .AnyAsync();
+        }
+
+        // If any other file with the same storage ID is referenced, don't delete the actual file data
+        if (anyReferenced) return;
+
+        var dest = GetRemoteStorageConfig(file.UploadedTo);
+        var client = CreateMinioClient(dest);
+        if (client is null)
+            throw new InvalidOperationException(
+                $"Failed to configure client for remote destination '{file.UploadedTo}'"
+            );
+
+        var bucket = dest.Bucket;
+        var objectId = file.StorageId ?? file.Id; // Use StorageId if available, otherwise fall back to Id
+
+        await client.RemoveObjectAsync(
+            new RemoveObjectArgs().WithBucket(bucket).WithObject(objectId)
+        );
+
+        if (file.HasCompression)
+        {
+            // Also remove the compressed version if it exists
+            try
+            {
+                await client.RemoveObjectAsync(
+                    new RemoveObjectArgs().WithBucket(bucket).WithObject(objectId + ".compressed")
+                );
+            }
+            catch
+            {
+                // Ignore errors when deleting compressed version
+                logger.LogWarning("Failed to delete compressed version of file {fileId}", file.Id);
+            }
+        }
+    }
+
+    public RemoteStorageConfig GetRemoteStorageConfig(string destination)
+    {
+        var destinations = configuration.GetSection("Storage:Remote").Get<List<RemoteStorageConfig>>()!;
+        var dest = destinations.FirstOrDefault(d => d.Id == destination);
+        if (dest is null) throw new InvalidOperationException($"Remote destination '{destination}' not found");
+        return dest;
+    }
+
+    public IMinioClient? CreateMinioClient(RemoteStorageConfig dest)
+    {
+        var client = new MinioClient()
+            .WithEndpoint(dest.Endpoint)
+            .WithRegion(dest.Region)
+            .WithCredentials(dest.SecretId, dest.SecretKey);
+        if (dest.EnableSsl) client = client.WithSSL();
+
+        return client.Build();
+    }
+
+    // Helper method to purge the cache for a specific file
+    // Made internal to allow FileReferenceService to use it
+    internal async Task _PurgeCacheAsync(string fileId)
+    {
+        var cacheKey = $"{CacheKeyPrefix}{fileId}";
+        await cache.RemoveAsync(cacheKey);
+    }
+
+    // Helper method to purge cache for multiple files
+    internal async Task _PurgeCacheRangeAsync(IEnumerable<string> fileIds)
+    {
+        var tasks = fileIds.Select(_PurgeCacheAsync);
+        await Task.WhenAll(tasks);
+    }
+
+    public async Task<List<CloudFile?>> LoadFromReference(List<CloudFileReferenceObject> references)
+    {
+        var cachedFiles = new Dictionary<string, CloudFile>();
+        var uncachedIds = new List<string>();
+
+        // Check cache first
+        foreach (var reference in references)
+        {
+            var cacheKey = $"{CacheKeyPrefix}{reference.Id}";
+            var cachedFile = await cache.GetAsync<CloudFile>(cacheKey);
+
+            if (cachedFile != null)
+            {
+                cachedFiles[reference.Id] = cachedFile;
+            }
+            else
+            {
+                uncachedIds.Add(reference.Id);
+            }
+        }
+
+        // Load uncached files from database
+        if (uncachedIds.Count > 0)
+        {
+            var dbFiles = await db.Files
+                .Where(f => uncachedIds.Contains(f.Id))
+                .ToListAsync();
+
+            // Add to cache
+            foreach (var file in dbFiles)
+            {
+                var cacheKey = $"{CacheKeyPrefix}{file.Id}";
+                await cache.SetAsync(cacheKey, file, CacheDuration);
+                cachedFiles[file.Id] = file;
+            }
+        }
+
+        // Preserve original order
+        return references
+            .Select(r => cachedFiles.GetValueOrDefault(r.Id))
+            .Where(f => f != null)
+            .ToList();
+    }
+
+    /// <summary>
+    /// Gets the number of references to a file based on CloudFileReference records
+    /// </summary>
+    /// <param name="fileId">The ID of the file</param>
+    /// <returns>The number of references to the file</returns>
+    public async Task<int> GetReferenceCountAsync(string fileId)
+    {
+        return await db.FileReferences
+            .Where(r => r.FileId == fileId)
+            .CountAsync();
+    }
+
+    /// <summary>
+    /// Checks if a file is referenced by any resource
+    /// </summary>
+    /// <param name="fileId">The ID of the file to check</param>
+    /// <returns>True if the file is referenced, false otherwise</returns>
+    public async Task<bool> IsReferencedAsync(string fileId)
+    {
+        return await db.FileReferences
+            .Where(r => r.FileId == fileId)
+            .AnyAsync();
+    }
+
+    /// <summary>
+    /// Checks if an EXIF field contains GPS location data
+    /// </summary>
+    /// <param name="fieldName">The EXIF field name</param>
+    /// <returns>True if the field contains GPS data, false otherwise</returns>
+    private static bool IsGpsExifField(string fieldName)
+    {
+        // Common GPS EXIF field names
+        var gpsFields = new[]
+        {
+            "gps-latitude",
+            "gps-longitude",
+            "gps-altitude",
+            "gps-latitude-ref",
+            "gps-longitude-ref",
+            "gps-altitude-ref",
+            "gps-timestamp",
+            "gps-datestamp",
+            "gps-speed",
+            "gps-speed-ref",
+            "gps-track",
+            "gps-track-ref",
+            "gps-img-direction",
+            "gps-img-direction-ref",
+            "gps-dest-latitude",
+            "gps-dest-longitude",
+            "gps-dest-latitude-ref",
+            "gps-dest-longitude-ref",
+            "gps-processing-method",
+            "gps-area-information"
+        };
+
+        return gpsFields.Any(gpsField =>
+            fieldName.Equals(gpsField, StringComparison.OrdinalIgnoreCase) ||
+            fieldName.StartsWith("gps", StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static bool IsIgnoredField(string fieldName)
+    {
+        if (IsGpsExifField(fieldName)) return true;
+        if (fieldName.EndsWith("-data")) return true;
+        return false;
+    }
+}

DysonNetwork.Drive/Storage/TusService.cs

@@ -0,0 +1,79 @@
+using System.Net;
+using System.Text;
+using System.Text.Json;
+using DysonNetwork.Shared.Proto;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using tusdotnet.Interfaces;
+using tusdotnet.Models;
+using tusdotnet.Models.Configuration;
+
+namespace DysonNetwork.Drive.Storage;
+
+public abstract class TusService
+{
+    public static DefaultTusConfiguration BuildConfiguration(ITusStore store) => new()
+    {
+        Store = store,
+        Events = new Events
+        {
+            OnAuthorizeAsync = async eventContext =>
+            {
+                if (eventContext.Intent == IntentType.DeleteFile)
+                {
+                    eventContext.FailRequest(
+                        HttpStatusCode.BadRequest,
+                        "Deleting files from this endpoint was disabled, please refer to the Dyson Network File API."
+                    );
+                    return;
+                }
+
+                var httpContext = eventContext.HttpContext;
+                if (httpContext.Items["CurrentUser"] is not Account user)
+                {
+                    eventContext.FailRequest(HttpStatusCode.Unauthorized);
+                    return;
+                }
+
+                if (!user.IsSuperuser)
+                {
+                    using var scope = httpContext.RequestServices.CreateScope();
+                    var pm = scope.ServiceProvider.GetRequiredService<PermissionService.PermissionServiceClient>();
+                    var allowed = await pm.HasPermissionAsync(new HasPermissionRequest
+                        { Actor = $"user:{user.Id}", Area = "global", Key = "files.create" });
+                    if (!allowed.HasPermission)
+                        eventContext.FailRequest(HttpStatusCode.Forbidden);
+                }
+            },
+            OnFileCompleteAsync = async eventContext =>
+            {
+                using var scope = eventContext.HttpContext.RequestServices.CreateScope();
+                var services = scope.ServiceProvider;
+
+                var httpContext = eventContext.HttpContext;
+                if (httpContext.Items["CurrentUser"] is not Account user) return;
+
+                var file = await eventContext.GetFileAsync();
+                var metadata = await file.GetMetadataAsync(eventContext.CancellationToken);
+                var fileName = metadata.TryGetValue("filename", out var fn)
+                    ? fn.GetString(Encoding.UTF8)
+                    : "uploaded_file";
+                var contentType = metadata.TryGetValue("content-type", out var ct) ? ct.GetString(Encoding.UTF8) : null;
+
+                var fileStream = await file.GetContentAsync(eventContext.CancellationToken);
+
+                var fileService = services.GetRequiredService<FileService>();
+                var info = await fileService.ProcessNewFileAsync(user, file.Id, fileStream, fileName, contentType);
+
+                using var finalScope = eventContext.HttpContext.RequestServices.CreateScope();
+                var jsonOptions = finalScope.ServiceProvider.GetRequiredService<IOptions<JsonOptions>>().Value
+                    .JsonSerializerOptions;
+                var infoJson = JsonSerializer.Serialize(info, jsonOptions);
+                eventContext.HttpContext.Response.Headers.Append("X-FileInfo", infoJson);
+
+                // Dispose the stream after all processing is complete
+                await fileStream.DisposeAsync();
+            }
+        }
+    };
+}

DysonNetwork.Drive/appsettings.json

@@ -0,0 +1,136 @@
+{
+  "Debug": true,
+  "BaseUrl": "http://localhost:5071",
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*",
+  "ConnectionStrings": {
+    "App": "Host=localhost;Port=5432;Database=dyson_drive;Username=postgres;Password=postgres;Include Error Detail=True;Maximum Pool Size=20;Connection Idle Lifetime=60",
+    "FastRetrieve": "localhost:6379",
+    "Etcd": "etcd.orb.local:2379"
+  },
+  "Authentication": {
+    "Schemes": {
+      "Bearer": {
+        "ValidAudiences": [
+          "http://localhost:5071",
+          "https://localhost:7099"
+        ],
+        "ValidIssuer": "solar-network"
+      }
+    }
+  },
+  "AuthToken": {
+    "PublicKeyPath": "Keys/PublicKey.pem",
+    "PrivateKeyPath": "Keys/PrivateKey.pem"
+  },
+  "OidcProvider": {
+    "IssuerUri": "https://nt.solian.app",
+    "PublicKeyPath": "Keys/PublicKey.pem",
+    "PrivateKeyPath": "Keys/PrivateKey.pem",
+    "AccessTokenLifetime": "01:00:00",
+    "RefreshTokenLifetime": "30.00:00:00",
+    "AuthorizationCodeLifetime": "00:30:00",
+    "RequireHttpsMetadata": true
+  },
+  "Tus": {
+    "StorePath": "Uploads"
+  },
+  "Storage": {
+    "PreferredRemote": "minio",
+    "Remote": [
+      {
+        "Id": "minio",
+        "Label": "Minio",
+        "Region": "auto",
+        "Bucket": "solar-network-development",
+        "Endpoint": "localhost:9000",
+        "SecretId": "littlesheep",
+        "SecretKey": "password",
+        "EnabledSigned": true,
+        "EnableSsl": false
+      },
+      {
+        "Id": "cloudflare",
+        "Label": "Cloudflare R2",
+        "Region": "auto",
+        "Bucket": "solar-network",
+        "Endpoint": "0a70a6d1b7128888c823359d0008f4e1.r2.cloudflarestorage.com",
+        "SecretId": "8ff5d06c7b1639829d60bc6838a542e6",
+        "SecretKey": "fd58158c5201be16d1872c9209d9cf199421dae3c2f9972f94b2305976580d67",
+        "EnableSigned": true,
+        "EnableSsl": true
+      }
+    ]
+  },
+  "Captcha": {
+    "Provider": "cloudflare",
+    "ApiKey": "0x4AAAAAABCDUdOujj4feOb_",
+    "ApiSecret": "0x4AAAAAABCDUWABiJQweqlB7tYq-IqIm8U"
+  },
+  "Notifications": {
+    "Topic": "dev.solsynth.solian",
+    "Endpoint": "http://localhost:8088"
+  },
+  "Email": {
+    "Server": "smtp4dev.orb.local",
+    "Port": 25,
+    "UseSsl": false,
+    "Username": "no-reply@mail.solsynth.dev",
+    "Password": "password",
+    "FromAddress": "no-reply@mail.solsynth.dev",
+    "FromName": "Alphabot",
+    "SubjectPrefix": "Solar Network"
+  },
+  "RealtimeChat": {
+    "Endpoint": "https://solar-network-im44o8gq.livekit.cloud",
+    "ApiKey": "APIs6TiL8wj3A4j",
+    "ApiSecret": "SffxRneIwTnlHPtEf3zicmmv3LUEl7xXael4PvWZrEhE"
+  },
+  "GeoIp": {
+    "DatabasePath": "./Keys/GeoLite2-City.mmdb"
+  },
+  "Oidc": {
+    "Google": {
+      "ClientId": "961776991058-963m1qin2vtp8fv693b5fdrab5hmpl89.apps.googleusercontent.com",
+      "ClientSecret": ""
+    },
+    "Apple": {
+      "ClientId": "dev.solsynth.solian",
+      "TeamId": "W7HPZ53V6B",
+      "KeyId": "B668YP4KBG",
+      "PrivateKeyPath": "./Keys/Solarpass.p8"
+    },
+    "Microsoft": {
+      "ClientId": "YOUR_MICROSOFT_CLIENT_ID",
+      "ClientSecret": "YOUR_MICROSOFT_CLIENT_SECRET",
+      "DiscoveryEndpoint": "YOUR_MICROSOFT_DISCOVERY_ENDPOINT"
+    }
+  },
+  "Payment": {
+    "Auth": {
+      "Afdian": "<token here>"
+    },
+    "Subscriptions": {
+      "Afdian": {
+        "7d17aae23c9611f0b5705254001e7c00": "solian.stellar.primary",
+        "7dfae4743c9611f0b3a55254001e7c00": "solian.stellar.nova",
+        "141713ee3d6211f085b352540025c377": "solian.stellar.supernova"
+      }
+    }
+  },
+  "KnownProxies": [
+    "127.0.0.1",
+    "::1"
+  ],
+  "Service": {
+    "Name": "DysonNetwork.Drive",
+    "Url": "https://localhost:7092",
+    "ClientCert": "../Certificates/client.crt",
+    "ClientKey": "../Certificates/client.key"
+  }
+}

DysonNetwork.Pass/Account/AbuseReport.cs

@@ -0,0 +1,31 @@
+using System.ComponentModel.DataAnnotations;
+using DysonNetwork.Shared.Data;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public enum AbuseReportType
+{
+    Copyright,
+    Harassment,
+    Impersonation,
+    OffensiveContent,
+    Spam,
+    PrivacyViolation,
+    IllegalContent,
+    Other
+}
+
+public class AbuseReport : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(4096)] public string ResourceIdentifier { get; set; } = null!;
+    public AbuseReportType Type { get; set; }
+    [MaxLength(8192)] public string Reason { get; set; } = null!;
+
+    public Instant? ResolvedAt { get; set; }
+    [MaxLength(8192)] public string? Resolution { get; set; }
+    
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+}

DysonNetwork.Pass/Account/Account.cs

@@ -0,0 +1,267 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using NodaTime.Serialization.Protobuf;
+using OtpNet;
+
+namespace DysonNetwork.Pass.Account;
+
+[Index(nameof(Name), IsUnique = true)]
+public class Account : ModelBase
+{
+    public Guid Id { get; set; }
+    [MaxLength(256)] public string Name { get; set; } = string.Empty;
+    [MaxLength(256)] public string Nick { get; set; } = string.Empty;
+    [MaxLength(32)] public string Language { get; set; } = string.Empty;
+    public Instant? ActivatedAt { get; set; }
+    public bool IsSuperuser { get; set; } = false;
+
+    public AccountProfile Profile { get; set; } = null!;
+    public ICollection<AccountContact> Contacts { get; set; } = new List<AccountContact>();
+    public ICollection<AccountBadge> Badges { get; set; } = new List<AccountBadge>();
+
+    [JsonIgnore] public ICollection<AccountAuthFactor> AuthFactors { get; set; } = new List<AccountAuthFactor>();
+    [JsonIgnore] public ICollection<AccountConnection> Connections { get; set; } = new List<AccountConnection>();
+    [JsonIgnore] public ICollection<Auth.AuthSession> Sessions { get; set; } = new List<Auth.AuthSession>();
+    [JsonIgnore] public ICollection<Auth.AuthChallenge> Challenges { get; set; } = new List<Auth.AuthChallenge>();
+
+    [JsonIgnore] public ICollection<Relationship> OutgoingRelationships { get; set; } = new List<Relationship>();
+    [JsonIgnore] public ICollection<Relationship> IncomingRelationships { get; set; } = new List<Relationship>();
+
+    public Shared.Proto.Account ToProtoValue()
+    {
+        var proto = new Shared.Proto.Account
+        {
+            Id = Id.ToString(),
+            Name = Name,
+            Nick = Nick,
+            Language = Language,
+            ActivatedAt = ActivatedAt?.ToTimestamp(),
+            IsSuperuser = IsSuperuser,
+            Profile = Profile.ToProtoValue()
+        };
+
+        // Add contacts
+        foreach (var contact in Contacts)
+            proto.Contacts.Add(contact.ToProtoValue());
+
+        // Add badges
+        foreach (var badge in Badges)
+            proto.Badges.Add(badge.ToProtoValue());
+
+        return proto;
+    }
+}
+
+public abstract class Leveling
+{
+    public static readonly List<int> ExperiencePerLevel =
+    [
+        0, // Level 0
+        100, // Level 1
+        250, // Level 2
+        500, // Level 3
+        1000, // Level 4
+        2000, // Level 5
+        4000, // Level 6
+        8000, // Level 7
+        16000, // Level 8
+        32000, // Level 9
+        64000, // Level 10
+        128000, // Level 11
+        256000, // Level 12
+        512000, // Level 13
+        1024000 // Level 14
+    ];
+}
+
+public class AccountProfile : ModelBase
+{
+    public Guid Id { get; set; }
+    [MaxLength(256)] public string? FirstName { get; set; }
+    [MaxLength(256)] public string? MiddleName { get; set; }
+    [MaxLength(256)] public string? LastName { get; set; }
+    [MaxLength(4096)] public string? Bio { get; set; }
+    [MaxLength(1024)] public string? Gender { get; set; }
+    [MaxLength(1024)] public string? Pronouns { get; set; }
+    [MaxLength(1024)] public string? TimeZone { get; set; }
+    [MaxLength(1024)] public string? Location { get; set; }
+    public Instant? Birthday { get; set; }
+    public Instant? LastSeenAt { get; set; }
+
+    [Column(TypeName = "jsonb")] public VerificationMark? Verification { get; set; }
+    [Column(TypeName = "jsonb")] public BadgeReferenceObject? ActiveBadge { get; set; }
+
+    public int Experience { get; set; } = 0;
+    [NotMapped] public int Level => Leveling.ExperiencePerLevel.Count(xp => Experience >= xp) - 1;
+
+    [NotMapped]
+    public double LevelingProgress => Level >= Leveling.ExperiencePerLevel.Count - 1
+        ? 100
+        : (Experience - Leveling.ExperiencePerLevel[Level]) * 100.0 /
+          (Leveling.ExperiencePerLevel[Level + 1] - Leveling.ExperiencePerLevel[Level]);
+
+    // Outdated fields, for backward compability
+    [MaxLength(32)] public string? PictureId { get; set; }
+    [MaxLength(32)] public string? BackgroundId { get; set; }
+
+    [Column(TypeName = "jsonb")] public CloudFileReferenceObject? Picture { get; set; }
+    [Column(TypeName = "jsonb")] public CloudFileReferenceObject? Background { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+
+    public Shared.Proto.AccountProfile ToProtoValue()
+    {
+        var proto = new Shared.Proto.AccountProfile
+        {
+            Id = Id.ToString(),
+            FirstName = FirstName ?? string.Empty,
+            MiddleName = MiddleName ?? string.Empty,
+            LastName = LastName ?? string.Empty,
+            Bio = Bio ?? string.Empty,
+            Gender = Gender ?? string.Empty,
+            Pronouns = Pronouns ?? string.Empty,
+            TimeZone = TimeZone ?? string.Empty,
+            Location = Location ?? string.Empty,
+            Birthday = Birthday?.ToTimestamp(),
+            LastSeenAt = LastSeenAt?.ToTimestamp(),
+            Experience = Experience,
+            Level = Level,
+            LevelingProgress = LevelingProgress,
+            PictureId = PictureId ?? string.Empty,
+            BackgroundId = BackgroundId ?? string.Empty,
+            Picture = Picture?.ToProtoValue(),
+            Background = Background?.ToProtoValue(),
+            AccountId = AccountId.ToString(),
+            Verification = Verification?.ToProtoValue(),
+            ActiveBadge = ActiveBadge?.ToProtoValue()
+        };
+
+        return proto;
+    }
+}
+
+public class AccountContact : ModelBase
+{
+    public Guid Id { get; set; }
+    public AccountContactType Type { get; set; }
+    public Instant? VerifiedAt { get; set; }
+    public bool IsPrimary { get; set; } = false;
+    [MaxLength(1024)] public string Content { get; set; } = string.Empty;
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+
+    public Shared.Proto.AccountContact ToProtoValue()
+    {
+        var proto = new Shared.Proto.AccountContact
+        {
+            Id = Id.ToString(),
+            Type = Type switch
+            {
+                AccountContactType.Email => Shared.Proto.AccountContactType.Email,
+                AccountContactType.PhoneNumber => Shared.Proto.AccountContactType.PhoneNumber,
+                AccountContactType.Address => Shared.Proto.AccountContactType.Address,
+                _ => Shared.Proto.AccountContactType.Unspecified
+            },
+            Content = Content,
+            IsPrimary = IsPrimary,
+            VerifiedAt = VerifiedAt?.ToTimestamp(),
+            AccountId = AccountId.ToString()
+        };
+
+        return proto;
+    }
+}
+
+public enum AccountContactType
+{
+    Email,
+    PhoneNumber,
+    Address
+}
+
+public class AccountAuthFactor : ModelBase
+{
+    public Guid Id { get; set; }
+    public AccountAuthFactorType Type { get; set; }
+    [JsonIgnore] [MaxLength(8196)] public string? Secret { get; set; }
+
+    [JsonIgnore]
+    [Column(TypeName = "jsonb")]
+    public Dictionary<string, object>? Config { get; set; } = new();
+
+    /// <summary>
+    /// The trustworthy stands for how safe is this auth factor.
+    /// Basically, it affects how many steps it can complete in authentication.
+    /// Besides, users may need to use some high-trustworthy level auth factors when confirming some dangerous operations.
+    /// </summary>
+    public int Trustworthy { get; set; } = 1;
+
+    public Instant? EnabledAt { get; set; }
+    public Instant? ExpiredAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+
+    public AccountAuthFactor HashSecret(int cost = 12)
+    {
+        if (Secret == null) return this;
+        Secret = BCrypt.Net.BCrypt.HashPassword(Secret, workFactor: cost);
+        return this;
+    }
+
+    public bool VerifyPassword(string password)
+    {
+        if (Secret == null)
+            throw new InvalidOperationException("Auth factor with no secret cannot be verified with password.");
+        switch (Type)
+        {
+            case AccountAuthFactorType.Password:
+            case AccountAuthFactorType.PinCode:
+                return BCrypt.Net.BCrypt.Verify(password, Secret);
+            case AccountAuthFactorType.TimedCode:
+                var otp = new Totp(Base32Encoding.ToBytes(Secret));
+                return otp.VerifyTotp(DateTime.UtcNow, password, out _, new VerificationWindow(previous: 5, future: 5));
+            case AccountAuthFactorType.EmailCode:
+            case AccountAuthFactorType.InAppCode:
+            default:
+                throw new InvalidOperationException("Unsupported verification type, use CheckDeliveredCode instead.");
+        }
+    }
+
+    /// <summary>
+    /// This dictionary will be returned to the client and should only be set when it just created.
+    /// Useful for passing the client some data to finishing setup and recovery code.
+    /// </summary>
+    [NotMapped]
+    public Dictionary<string, object>? CreatedResponse { get; set; }
+}
+
+public enum AccountAuthFactorType
+{
+    Password,
+    EmailCode,
+    InAppCode,
+    TimedCode,
+    PinCode,
+}
+
+public class AccountConnection : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(4096)] public string Provider { get; set; } = null!;
+    [MaxLength(8192)] public string ProvidedIdentifier { get; set; } = null!;
+    [Column(TypeName = "jsonb")] public Dictionary<string, object>? Meta { get; set; } = new();
+
+    [JsonIgnore] [MaxLength(4096)] public string? AccessToken { get; set; }
+    [JsonIgnore] [MaxLength(4096)] public string? RefreshToken { get; set; }
+    public Instant? LastUsedAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+}

DysonNetwork.Pass/Account/AccountController.cs

@@ -0,0 +1,178 @@
+using System.ComponentModel.DataAnnotations;
+using DysonNetwork.Pass.Auth;
+using DysonNetwork.Pass;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using NodaTime.Extensions;
+using System.Collections.Generic;
+using DysonNetwork.Pass.Account;
+
+namespace DysonNetwork.Pass.Account;
+
+[ApiController]
+[Route("/api/accounts")]
+public class AccountController(
+    AppDatabase db,
+    AuthService auth,
+    AccountService accounts,
+    AccountEventService events
+) : ControllerBase
+{
+    [HttpGet("{name}")]
+    [ProducesResponseType<Account>(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<Account?>> GetByName(string name)
+    {
+        var account = await db.Accounts
+            .Include(e => e.Badges)
+            .Include(e => e.Profile)
+            .Where(a => a.Name == name)
+            .FirstOrDefaultAsync();
+        return account is null ? new NotFoundResult() : account;
+    }
+
+    [HttpGet("{name}/badges")]
+    [ProducesResponseType<List<AccountBadge>>(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<List<AccountBadge>>> GetBadgesByName(string name)
+    {
+        var account = await db.Accounts
+            .Include(e => e.Badges)
+            .Where(a => a.Name == name)
+            .FirstOrDefaultAsync();
+        return account is null ? NotFound() : account.Badges.ToList();
+    }
+
+    public class AccountCreateRequest
+    {
+        [Required]
+        [MinLength(2)]
+        [MaxLength(256)]
+        [RegularExpression(@"^[A-Za-z0-9_-]+$",
+            ErrorMessage = "Name can only contain letters, numbers, underscores, and hyphens.")
+        ]
+        public string Name { get; set; } = string.Empty;
+
+        [Required] [MaxLength(256)] public string Nick { get; set; } = string.Empty;
+
+        [EmailAddress]
+        [RegularExpression(@"^[^+]+@[^@]+\.[^@]+$", ErrorMessage = "Email address cannot contain '+' symbol.")]
+        [Required]
+        [MaxLength(1024)]
+        public string Email { get; set; } = string.Empty;
+
+        [Required]
+        [MinLength(4)]
+        [MaxLength(128)]
+        public string Password { get; set; } = string.Empty;
+
+        [MaxLength(128)] public string Language { get; set; } = "en-us";
+
+        [Required] public string CaptchaToken { get; set; } = string.Empty;
+    }
+
+    [HttpPost]
+    [ProducesResponseType<Account>(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<Account>> CreateAccount([FromBody] AccountCreateRequest request)
+    {
+        if (!await auth.ValidateCaptcha(request.CaptchaToken)) return BadRequest("Invalid captcha token.");
+
+        try
+        {
+            var account = await accounts.CreateAccount(
+                request.Name,
+                request.Nick,
+                request.Email,
+                request.Password,
+                request.Language
+            );
+            return Ok(account);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    public class RecoveryPasswordRequest
+    {
+        [Required] public string Account { get; set; } = null!;
+        [Required] public string CaptchaToken { get; set; } = null!;
+    }
+
+    [HttpPost("recovery/password")]
+    public async Task<ActionResult> RequestResetPassword([FromBody] RecoveryPasswordRequest request)
+    {
+        if (!await auth.ValidateCaptcha(request.CaptchaToken)) return BadRequest("Invalid captcha token.");
+
+        var account = await accounts.LookupAccount(request.Account);
+        if (account is null) return BadRequest("Unable to find the account.");
+
+        try
+        {
+            await accounts.RequestPasswordReset(account);
+        }
+        catch (InvalidOperationException)
+        {
+            return BadRequest("You already requested password reset within 24 hours.");
+        }
+
+        return Ok();
+    }
+
+    public class StatusRequest
+    {
+        public StatusAttitude Attitude { get; set; }
+        public bool IsInvisible { get; set; }
+        public bool IsNotDisturb { get; set; }
+        [MaxLength(1024)] public string? Label { get; set; }
+        public Instant? ClearedAt { get; set; }
+    }
+
+    [HttpGet("{name}/statuses")]
+    public async Task<ActionResult<Status>> GetOtherStatus(string name)
+    {
+        var account = await db.Accounts.FirstOrDefaultAsync(a => a.Name == name);
+        if (account is null) return BadRequest();
+        var status = await events.GetStatus(account.Id);
+        status.IsInvisible = false; // Keep the invisible field not available for other users
+        return Ok(status);
+    }
+
+    [HttpGet("{name}/calendar")]
+    public async Task<ActionResult<List<DailyEventResponse>>> GetOtherEventCalendar(
+        string name,
+        [FromQuery] int? month,
+        [FromQuery] int? year
+    )
+    {
+        var currentDate = SystemClock.Instance.GetCurrentInstant().InUtc().Date;
+        month ??= currentDate.Month;
+        year ??= currentDate.Year;
+
+        if (month is < 1 or > 12) return BadRequest("Invalid month.");
+        if (year < 1) return BadRequest("Invalid year.");
+
+        var account = await db.Accounts.FirstOrDefaultAsync(a => a.Name == name);
+        if (account is null) return BadRequest();
+
+        var calendar = await events.GetEventCalendar(account, month.Value, year.Value, replaceInvisible: true);
+        return Ok(calendar);
+    }
+
+    [HttpGet("search")]
+    public async Task<List<Account>> Search([FromQuery] string query, [FromQuery] int take = 20)
+    {
+        if (string.IsNullOrWhiteSpace(query))
+            return [];
+        return await db.Accounts
+            .Include(e => e.Profile)
+            .Where(a => EF.Functions.ILike(a.Name, $"%{query}%") ||
+                        EF.Functions.ILike(a.Nick, $"%{query}%"))
+            .Take(take)
+            .ToListAsync();
+    }
+}

DysonNetwork.Pass/Account/AccountCurrentController.cs

@@ -0,0 +1,654 @@
+using System.ComponentModel.DataAnnotations;
+using DysonNetwork.Pass.Auth;
+using DysonNetwork.Pass.Permission;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+[Authorize]
+[ApiController]
+[Route("/api/accounts/me")]
+public class AccountCurrentController(
+    AppDatabase db,
+    AccountService accounts,
+    AccountEventService events,
+    AuthService auth
+) : ControllerBase
+{
+    [HttpGet]
+    [ProducesResponseType<Account>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<Account>> GetCurrentIdentity()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var userId = currentUser.Id;
+
+        var account = await db.Accounts
+            .Include(e => e.Badges)
+            .Include(e => e.Profile)
+            .Where(e => e.Id == userId)
+            .FirstOrDefaultAsync();
+
+        return Ok(account);
+    }
+
+    public class BasicInfoRequest
+    {
+        [MaxLength(256)] public string? Nick { get; set; }
+        [MaxLength(32)] public string? Language { get; set; }
+    }
+
+    [HttpPatch]
+    public async Task<ActionResult<Account>> UpdateBasicInfo([FromBody] BasicInfoRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var account = await db.Accounts.FirstAsync(a => a.Id == currentUser.Id);
+
+        if (request.Nick is not null) account.Nick = request.Nick;
+        if (request.Language is not null) account.Language = request.Language;
+
+        await db.SaveChangesAsync();
+        await accounts.PurgeAccountCache(currentUser);
+        return currentUser;
+    }
+
+    public class ProfileRequest
+    {
+        [MaxLength(256)] public string? FirstName { get; set; }
+        [MaxLength(256)] public string? MiddleName { get; set; }
+        [MaxLength(256)] public string? LastName { get; set; }
+        [MaxLength(1024)] public string? Gender { get; set; }
+        [MaxLength(1024)] public string? Pronouns { get; set; }
+        [MaxLength(1024)] public string? TimeZone { get; set; }
+        [MaxLength(1024)] public string? Location { get; set; }
+        [MaxLength(4096)] public string? Bio { get; set; }
+        public Instant? Birthday { get; set; }
+
+        [MaxLength(32)] public string? PictureId { get; set; }
+        [MaxLength(32)] public string? BackgroundId { get; set; }
+    }
+
+    [HttpPatch("profile")]
+    public async Task<ActionResult<AccountProfile>> UpdateProfile([FromBody] ProfileRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var userId = currentUser.Id;
+
+        var profile = await db.AccountProfiles
+            .Where(p => p.Account.Id == userId)
+            .FirstOrDefaultAsync();
+        if (profile is null) return BadRequest("Unable to get your account.");
+
+        if (request.FirstName is not null) profile.FirstName = request.FirstName;
+        if (request.MiddleName is not null) profile.MiddleName = request.MiddleName;
+        if (request.LastName is not null) profile.LastName = request.LastName;
+        if (request.Bio is not null) profile.Bio = request.Bio;
+        if (request.Gender is not null) profile.Gender = request.Gender;
+        if (request.Pronouns is not null) profile.Pronouns = request.Pronouns;
+        if (request.Birthday is not null) profile.Birthday = request.Birthday;
+        if (request.Location is not null) profile.Location = request.Location;
+        if (request.TimeZone is not null) profile.TimeZone = request.TimeZone;
+
+        if (request.PictureId is not null)
+        {
+           // TODO: Create reference, set profile picture
+        }
+
+        if (request.BackgroundId is not null)
+        {
+            // TODO: Create reference, set profile background
+        }
+
+        db.Update(profile);
+        await db.SaveChangesAsync();
+
+        await accounts.PurgeAccountCache(currentUser);
+
+        return profile;
+    }
+
+    [HttpDelete]
+    public async Task<ActionResult> RequestDeleteAccount()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            await accounts.RequestAccountDeletion(currentUser);
+        }
+        catch (InvalidOperationException)
+        {
+            return BadRequest("You already requested account deletion within 24 hours.");
+        }
+
+        return Ok();
+    }
+
+    [HttpGet("statuses")]
+    public async Task<ActionResult<Status>> GetCurrentStatus()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var status = await events.GetStatus(currentUser.Id);
+        return Ok(status);
+    }
+
+    [HttpPatch("statuses")]
+    [RequiredPermission("global", "accounts.statuses.update")]
+    public async Task<ActionResult<Status>> UpdateStatus([FromBody] AccountController.StatusRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var status = await db.AccountStatuses
+            .Where(e => e.AccountId == currentUser.Id)
+            .Where(e => e.ClearedAt == null || e.ClearedAt > now)
+            .OrderByDescending(e => e.CreatedAt)
+            .FirstOrDefaultAsync();
+        if (status is null) return NotFound();
+
+        status.Attitude = request.Attitude;
+        status.IsInvisible = request.IsInvisible;
+        status.IsNotDisturb = request.IsNotDisturb;
+        status.Label = request.Label;
+        status.ClearedAt = request.ClearedAt;
+
+        db.Update(status);
+        await db.SaveChangesAsync();
+        events.PurgeStatusCache(currentUser.Id);
+
+        return status;
+    }
+
+    [HttpPost("statuses")]
+    [RequiredPermission("global", "accounts.statuses.create")]
+    public async Task<ActionResult<Status>> CreateStatus([FromBody] AccountController.StatusRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var status = new Status
+        {
+            AccountId = currentUser.Id,
+            Attitude = request.Attitude,
+            IsInvisible = request.IsInvisible,
+            IsNotDisturb = request.IsNotDisturb,
+            Label = request.Label,
+            ClearedAt = request.ClearedAt
+        };
+
+        return await events.CreateStatus(currentUser, status);
+    }
+
+    [HttpDelete("me/statuses")]
+    public async Task<ActionResult> DeleteStatus()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var status = await db.AccountStatuses
+            .Where(s => s.AccountId == currentUser.Id)
+            .Where(s => s.ClearedAt == null || s.ClearedAt > now)
+            .OrderByDescending(s => s.CreatedAt)
+            .FirstOrDefaultAsync();
+        if (status is null) return NotFound();
+
+        await events.ClearStatus(currentUser, status);
+        return NoContent();
+    }
+
+    [HttpGet("check-in")]
+    public async Task<ActionResult<CheckInResult>> GetCheckInResult()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var userId = currentUser.Id;
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var today = now.InUtc().Date;
+        var startOfDay = today.AtStartOfDayInZone(DateTimeZone.Utc).ToInstant();
+        var endOfDay = today.PlusDays(1).AtStartOfDayInZone(DateTimeZone.Utc).ToInstant();
+
+        var result = await db.AccountCheckInResults
+            .Where(x => x.AccountId == userId)
+            .Where(x => x.CreatedAt >= startOfDay && x.CreatedAt < endOfDay)
+            .OrderByDescending(x => x.CreatedAt)
+            .FirstOrDefaultAsync();
+
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost("check-in")]
+    public async Task<ActionResult<CheckInResult>> DoCheckIn([FromBody] string? captchaToken)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var isAvailable = await events.CheckInDailyIsAvailable(currentUser);
+        if (!isAvailable)
+            return BadRequest("Check-in is not available for today.");
+
+        try
+        {
+            var needsCaptcha = await events.CheckInDailyDoAskCaptcha(currentUser);
+            return needsCaptcha switch
+            {
+                true when string.IsNullOrWhiteSpace(captchaToken) => StatusCode(423,
+                    "Captcha is required for this check-in."),
+                true when !await auth.ValidateCaptcha(captchaToken!) => BadRequest("Invalid captcha token."),
+                _ => await events.CheckInDaily(currentUser)
+            };
+        }
+        catch (InvalidOperationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpGet("calendar")]
+    public async Task<ActionResult<List<DailyEventResponse>>> GetEventCalendar([FromQuery] int? month,
+        [FromQuery] int? year)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var currentDate = SystemClock.Instance.GetCurrentInstant().InUtc().Date;
+        month ??= currentDate.Month;
+        year ??= currentDate.Year;
+
+        if (month is < 1 or > 12) return BadRequest("Invalid month.");
+        if (year < 1) return BadRequest("Invalid year.");
+
+        var calendar = await events.GetEventCalendar(currentUser, month.Value, year.Value);
+        return Ok(calendar);
+    }
+
+    [HttpGet("actions")]
+    [ProducesResponseType<List<ActionLog>>(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<ActionResult<List<ActionLog>>> GetActionLogs(
+        [FromQuery] int take = 20,
+        [FromQuery] int offset = 0
+    )
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var query = db.ActionLogs
+            .Where(log => log.AccountId == currentUser.Id)
+            .OrderByDescending(log => log.CreatedAt);
+
+        var total = await query.CountAsync();
+        Response.Headers.Append("X-Total", total.ToString());
+
+        var logs = await query
+            .Skip(offset)
+            .Take(take)
+            .ToListAsync();
+
+        return Ok(logs);
+    }
+
+    [HttpGet("factors")]
+    public async Task<ActionResult<List<AccountAuthFactor>>> GetAuthFactors()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var factors = await db.AccountAuthFactors
+            .Include(f => f.Account)
+            .Where(f => f.Account.Id == currentUser.Id)
+            .ToListAsync();
+
+        return Ok(factors);
+    }
+
+    public class AuthFactorRequest
+    {
+        public AccountAuthFactorType Type { get; set; }
+        public string? Secret { get; set; }
+    }
+
+    [HttpPost("factors")]
+    [Authorize]
+    public async Task<ActionResult<AccountAuthFactor>> CreateAuthFactor([FromBody] AuthFactorRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        if (await accounts.CheckAuthFactorExists(currentUser, request.Type))
+            return BadRequest($"Auth factor with type {request.Type} is already exists.");
+
+        var factor = await accounts.CreateAuthFactor(currentUser, request.Type, request.Secret);
+        return Ok(factor);
+    }
+
+    [HttpPost("factors/{id:guid}/enable")]
+    [Authorize]
+    public async Task<ActionResult<AccountAuthFactor>> EnableAuthFactor(Guid id, [FromBody] string? code)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var factor = await db.AccountAuthFactors
+            .Where(f => f.AccountId == currentUser.Id && f.Id == id)
+            .FirstOrDefaultAsync();
+        if (factor is null) return NotFound();
+
+        try
+        {
+            factor = await accounts.EnableAuthFactor(factor, code);
+            return Ok(factor);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpPost("factors/{id:guid}/disable")]
+    [Authorize]
+    public async Task<ActionResult<AccountAuthFactor>> DisableAuthFactor(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var factor = await db.AccountAuthFactors
+            .Where(f => f.AccountId == currentUser.Id && f.Id == id)
+            .FirstOrDefaultAsync();
+        if (factor is null) return NotFound();
+
+        try
+        {
+            factor = await accounts.DisableAuthFactor(factor);
+            return Ok(factor);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpDelete("factors/{id:guid}")]
+    [Authorize]
+    public async Task<ActionResult<AccountAuthFactor>> DeleteAuthFactor(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var factor = await db.AccountAuthFactors
+            .Where(f => f.AccountId == currentUser.Id && f.Id == id)
+            .FirstOrDefaultAsync();
+        if (factor is null) return NotFound();
+
+        try
+        {
+            await accounts.DeleteAuthFactor(factor);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    public class AuthorizedDevice
+    {
+        public string? Label { get; set; }
+        public string UserAgent { get; set; } = null!;
+        public string DeviceId { get; set; } = null!;
+        public ChallengePlatform Platform { get; set; }
+        public List<AuthSession> Sessions { get; set; } = [];
+    }
+
+    [HttpGet("devices")]
+    [Authorize]
+    public async Task<ActionResult<List<AuthorizedDevice>>> GetDevices()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser ||
+            HttpContext.Items["CurrentSession"] is not AuthSession currentSession) return Unauthorized();
+
+        Response.Headers.Append("X-Auth-Session", currentSession.Id.ToString());
+
+        // Group sessions by the related DeviceId, then create an AuthorizedDevice for each group.
+        var deviceGroups = await db.AuthSessions
+            .Where(s => s.Account.Id == currentUser.Id)
+            .Include(s => s.Challenge)
+            .GroupBy(s => s.Challenge.DeviceId!)
+            .Select(g => new AuthorizedDevice
+            {
+                DeviceId = g.Key!,
+                UserAgent = g.First(x => x.Challenge.UserAgent != null).Challenge.UserAgent!,
+                Platform = g.First().Challenge.Platform!,
+                Label = g.Where(x => !string.IsNullOrWhiteSpace(x.Label)).Select(x => x.Label).FirstOrDefault(),
+                Sessions = g
+                    .OrderByDescending(x => x.LastGrantedAt)
+                    .ToList()
+            })
+            .ToListAsync();
+        deviceGroups = deviceGroups
+            .OrderByDescending(s => s.Sessions.First().LastGrantedAt)
+            .ToList();
+
+        return Ok(deviceGroups);
+    }
+
+    [HttpGet("sessions")]
+    [Authorize]
+    public async Task<ActionResult<List<AuthSession>>> GetSessions(
+        [FromQuery] int take = 20,
+        [FromQuery] int offset = 0
+    )
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser ||
+            HttpContext.Items["CurrentSession"] is not AuthSession currentSession) return Unauthorized();
+
+        var query = db.AuthSessions
+            .Include(session => session.Account)
+            .Include(session => session.Challenge)
+            .Where(session => session.Account.Id == currentUser.Id);
+
+        var total = await query.CountAsync();
+        Response.Headers.Append("X-Total", total.ToString());
+        Response.Headers.Append("X-Auth-Session", currentSession.Id.ToString());
+
+        var sessions = await query
+            .OrderByDescending(x => x.LastGrantedAt)
+            .Skip(offset)
+            .Take(take)
+            .ToListAsync();
+
+        return Ok(sessions);
+    }
+
+    [HttpDelete("sessions/{id:guid}")]
+    [Authorize]
+    public async Task<ActionResult<AuthSession>> DeleteSession(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            await accounts.DeleteSession(currentUser, id);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpDelete("sessions/current")]
+    [Authorize]
+    public async Task<ActionResult<AuthSession>> DeleteCurrentSession()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser ||
+            HttpContext.Items["CurrentSession"] is not AuthSession currentSession) return Unauthorized();
+
+        try
+        {
+            await accounts.DeleteSession(currentUser, currentSession.Id);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpPatch("sessions/{id:guid}/label")]
+    public async Task<ActionResult<AuthSession>> UpdateSessionLabel(Guid id, [FromBody] string label)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            await accounts.UpdateSessionLabel(currentUser, id, label);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpPatch("sessions/current/label")]
+    public async Task<ActionResult<AuthSession>> UpdateCurrentSessionLabel([FromBody] string label)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser ||
+            HttpContext.Items["CurrentSession"] is not AuthSession currentSession) return Unauthorized();
+
+        try
+        {
+            await accounts.UpdateSessionLabel(currentUser, currentSession.Id, label);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpGet("contacts")]
+    [Authorize]
+    public async Task<ActionResult<List<AccountContact>>> GetContacts()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var contacts = await db.AccountContacts
+            .Where(c => c.AccountId == currentUser.Id)
+            .ToListAsync();
+
+        return Ok(contacts);
+    }
+
+    public class AccountContactRequest
+    {
+        [Required] public AccountContactType Type { get; set; }
+        [Required] public string Content { get; set; } = null!;
+    }
+
+    [HttpPost("contacts")]
+    [Authorize]
+    public async Task<ActionResult<AccountContact>> CreateContact([FromBody] AccountContactRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            var contact = await accounts.CreateContactMethod(currentUser, request.Type, request.Content);
+            return Ok(contact);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpPost("contacts/{id:guid}/verify")]
+    [Authorize]
+    public async Task<ActionResult<AccountContact>> VerifyContact(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var contact = await db.AccountContacts
+            .Where(c => c.AccountId == currentUser.Id && c.Id == id)
+            .FirstOrDefaultAsync();
+        if (contact is null) return NotFound();
+
+        try
+        {
+            await accounts.VerifyContactMethod(currentUser, contact);
+            return Ok(contact);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpPost("contacts/{id:guid}/primary")]
+    [Authorize]
+    public async Task<ActionResult<AccountContact>> SetPrimaryContact(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var contact = await db.AccountContacts
+            .Where(c => c.AccountId == currentUser.Id && c.Id == id)
+            .FirstOrDefaultAsync();
+        if (contact is null) return NotFound();
+
+        try
+        {
+            contact = await accounts.SetContactMethodPrimary(currentUser, contact);
+            return Ok(contact);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpDelete("contacts/{id:guid}")]
+    [Authorize]
+    public async Task<ActionResult<AccountContact>> DeleteContact(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var contact = await db.AccountContacts
+            .Where(c => c.AccountId == currentUser.Id && c.Id == id)
+            .FirstOrDefaultAsync();
+        if (contact is null) return NotFound();
+
+        try
+        {
+            await accounts.DeleteContactMethod(currentUser, contact);
+            return NoContent();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+
+    [HttpGet("badges")]
+    [ProducesResponseType<List<AccountBadge>>(StatusCodes.Status200OK)]
+    [Authorize]
+    public async Task<ActionResult<List<AccountBadge>>> GetBadges()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var badges = await db.Badges
+            .Where(b => b.AccountId == currentUser.Id)
+            .ToListAsync();
+        return Ok(badges);
+    }
+
+    [HttpPost("badges/{id:guid}/active")]
+    [Authorize]
+    public async Task<ActionResult<AccountBadge>> ActivateBadge(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            await accounts.ActiveBadge(currentUser, id);
+            return Ok();
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+    }
+}

DysonNetwork.Pass/Account/AccountEventService.cs

@@ -0,0 +1,335 @@
+using System.Globalization;
+using DysonNetwork.Pass.Wallet;
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Localization;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public class AccountEventService(
+    AppDatabase db,
+    PaymentService payment,
+    ICacheService cache,
+    IStringLocalizer<Localization.AccountEventResource> localizer
+)
+{
+    private static readonly Random Random = new();
+    private const string StatusCacheKey = "AccountStatus_";
+
+    public void PurgeStatusCache(Guid userId)
+    {
+        var cacheKey = $"{StatusCacheKey}{userId}";
+        cache.RemoveAsync(cacheKey);
+    }
+
+    public async Task<Status> GetStatus(Guid userId)
+    {
+        var cacheKey = $"{StatusCacheKey}{userId}";
+        var cachedStatus = await cache.GetAsync<Status>(cacheKey);
+        if (cachedStatus is not null)
+        {
+            cachedStatus!.IsOnline = !cachedStatus.IsInvisible; // && ws.GetAccountIsConnected(userId);
+            return cachedStatus;
+        }
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var status = await db.AccountStatuses
+            .Where(e => e.AccountId == userId)
+            .Where(e => e.ClearedAt == null || e.ClearedAt > now)
+            .OrderByDescending(e => e.CreatedAt)
+            .FirstOrDefaultAsync();
+        var isOnline = false; // TODO: Get connection status
+        if (status is not null)
+        {
+            status.IsOnline = !status.IsInvisible && isOnline;
+            await cache.SetWithGroupsAsync(cacheKey, status, [$"{AccountService.AccountCachePrefix}{status.AccountId}"],
+                TimeSpan.FromMinutes(5));
+            return status;
+        }
+
+        if (isOnline)
+        {
+            return new Status
+            {
+                Attitude = StatusAttitude.Neutral,
+                IsOnline = true,
+                IsCustomized = false,
+                Label = "Online",
+                AccountId = userId,
+            };
+        }
+
+        return new Status
+        {
+            Attitude = StatusAttitude.Neutral,
+            IsOnline = false,
+            IsCustomized = false,
+            Label = "Offline",
+            AccountId = userId,
+        };
+    }
+
+    public async Task<Dictionary<Guid, Status>> GetStatuses(List<Guid> userIds)
+    {
+        var results = new Dictionary<Guid, Status>();
+        var cacheMissUserIds = new List<Guid>();
+
+        foreach (var userId in userIds)
+        {
+            var cacheKey = $"{StatusCacheKey}{userId}";
+            var cachedStatus = await cache.GetAsync<Status>(cacheKey);
+            if (cachedStatus != null)
+            {
+                cachedStatus.IsOnline = !cachedStatus.IsInvisible /* && ws.GetAccountIsConnected(userId) */;
+                results[userId] = cachedStatus;
+            }
+            else
+            {
+                cacheMissUserIds.Add(userId);
+            }
+        }
+
+        if (cacheMissUserIds.Any())
+        {
+            var now = SystemClock.Instance.GetCurrentInstant();
+            var statusesFromDb = await db.AccountStatuses
+                .Where(e => cacheMissUserIds.Contains(e.AccountId))
+                .Where(e => e.ClearedAt == null || e.ClearedAt > now)
+                .GroupBy(e => e.AccountId)
+                .Select(g => g.OrderByDescending(e => e.CreatedAt).First())
+                .ToListAsync();
+
+            var foundUserIds = new HashSet<Guid>();
+
+            foreach (var status in statusesFromDb)
+            {
+                var isOnline = false; // ws.GetAccountIsConnected(status.AccountId);
+                status.IsOnline = !status.IsInvisible && isOnline;
+                results[status.AccountId] = status;
+                var cacheKey = $"{StatusCacheKey}{status.AccountId}";
+                await cache.SetAsync(cacheKey, status, TimeSpan.FromMinutes(5));
+                foundUserIds.Add(status.AccountId);
+            }
+
+            var usersWithoutStatus = cacheMissUserIds.Except(foundUserIds).ToList();
+            if (usersWithoutStatus.Any())
+            {
+                foreach (var userId in usersWithoutStatus)
+                {
+                    var isOnline = false; // ws.GetAccountIsConnected(userId);
+                    var defaultStatus = new Status
+                    {
+                        Attitude = StatusAttitude.Neutral,
+                        IsOnline = isOnline,
+                        IsCustomized = false,
+                        Label = isOnline ? "Online" : "Offline",
+                        AccountId = userId,
+                    };
+                    results[userId] = defaultStatus;
+                }
+            }
+        }
+
+        return results;
+    }
+
+    public async Task<Status> CreateStatus(Account user, Status status)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+        await db.AccountStatuses
+            .Where(x => x.AccountId == user.Id && (x.ClearedAt == null || x.ClearedAt > now))
+            .ExecuteUpdateAsync(s => s.SetProperty(x => x.ClearedAt, now));
+
+        db.AccountStatuses.Add(status);
+        await db.SaveChangesAsync();
+
+        return status;
+    }
+
+    public async Task ClearStatus(Account user, Status status)
+    {
+        status.ClearedAt = SystemClock.Instance.GetCurrentInstant();
+        db.Update(status);
+        await db.SaveChangesAsync();
+        PurgeStatusCache(user.Id);
+    }
+
+    private const int FortuneTipCount = 7; // This will be the max index for each type (positive/negative)
+    private const string CaptchaCacheKey = "CheckInCaptcha_";
+    private const int CaptchaProbabilityPercent = 20;
+
+    public async Task<bool> CheckInDailyDoAskCaptcha(Account user)
+    {
+        var cacheKey = $"{CaptchaCacheKey}{user.Id}";
+        var needsCaptcha = await cache.GetAsync<bool?>(cacheKey);
+        if (needsCaptcha is not null)
+            return needsCaptcha!.Value;
+
+        var result = Random.Next(100) < CaptchaProbabilityPercent;
+        await cache.SetAsync(cacheKey, result, TimeSpan.FromHours(24));
+        return result;
+    }
+
+    public async Task<bool> CheckInDailyIsAvailable(Account user)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var lastCheckIn = await db.AccountCheckInResults
+            .Where(x => x.AccountId == user.Id)
+            .OrderByDescending(x => x.CreatedAt)
+            .FirstOrDefaultAsync();
+
+        if (lastCheckIn == null)
+            return true;
+
+        var lastDate = lastCheckIn.CreatedAt.InUtc().Date;
+        var currentDate = now.InUtc().Date;
+
+        return lastDate < currentDate;
+    }
+
+    public const string CheckInLockKey = "CheckInLock_";
+
+    public async Task<CheckInResult> CheckInDaily(Account user)
+    {
+        var lockKey = $"{CheckInLockKey}{user.Id}";
+
+        try
+        {
+            var lk = await cache.AcquireLockAsync(lockKey, TimeSpan.FromMinutes(1), TimeSpan.FromMilliseconds(100));
+
+            if (lk != null)
+                await lk.ReleaseAsync();
+        }
+        catch
+        {
+            // Ignore errors from this pre-check
+        }
+
+        // Now try to acquire the lock properly
+        await using var lockObj =
+            await cache.AcquireLockAsync(lockKey, TimeSpan.FromMinutes(1), TimeSpan.FromSeconds(5));
+        if (lockObj is null) throw new InvalidOperationException("Check-in was in progress.");
+
+        var cultureInfo = new CultureInfo(user.Language, false);
+        CultureInfo.CurrentCulture = cultureInfo;
+        CultureInfo.CurrentUICulture = cultureInfo;
+
+        // Generate 2 positive tips
+        var positiveIndices = Enumerable.Range(1, FortuneTipCount)
+            .OrderBy(_ => Random.Next())
+            .Take(2)
+            .ToList();
+        var tips = positiveIndices.Select(index => new FortuneTip
+        {
+            IsPositive = true, Title = localizer[$"FortuneTipPositiveTitle_{index}"].Value,
+            Content = localizer[$"FortuneTipPositiveContent_{index}"].Value
+        }).ToList();
+
+        // Generate 2 negative tips
+        var negativeIndices = Enumerable.Range(1, FortuneTipCount)
+            .Except(positiveIndices)
+            .OrderBy(_ => Random.Next())
+            .Take(2)
+            .ToList();
+        tips.AddRange(negativeIndices.Select(index => new FortuneTip
+        {
+            IsPositive = false, Title = localizer[$"FortuneTipNegativeTitle_{index}"].Value,
+            Content = localizer[$"FortuneTipNegativeContent_{index}"].Value
+        }));
+
+        var result = new CheckInResult
+        {
+            Tips = tips,
+            Level = (CheckInResultLevel)Random.Next(Enum.GetValues<CheckInResultLevel>().Length),
+            AccountId = user.Id,
+            RewardExperience = 100,
+            RewardPoints = 10,
+        };
+
+        var now = SystemClock.Instance.GetCurrentInstant().InUtc().Date;
+        try
+        {
+            if (result.RewardPoints.HasValue)
+                await payment.CreateTransactionWithAccountAsync(
+                    null,
+                    user.Id,
+                    WalletCurrency.SourcePoint,
+                    result.RewardPoints.Value,
+                    $"Check-in reward on {now:yyyy/MM/dd}"
+                );
+        }
+        catch
+        {
+            result.RewardPoints = null;
+        }
+
+        await db.AccountProfiles
+            .Where(p => p.AccountId == user.Id)
+            .ExecuteUpdateAsync(s =>
+                s.SetProperty(b => b.Experience, b => b.Experience + result.RewardExperience)
+            );
+        db.AccountCheckInResults.Add(result);
+        await db.SaveChangesAsync(); // Don't forget to save changes to the database
+
+        // The lock will be automatically released by the await using statement
+        return result;
+    }
+
+    public async Task<List<DailyEventResponse>> GetEventCalendar(Account user, int month, int year = 0,
+        bool replaceInvisible = false)
+    {
+        if (year == 0)
+            year = SystemClock.Instance.GetCurrentInstant().InUtc().Date.Year;
+
+        // Create start and end dates for the specified month
+        var startOfMonth = new LocalDate(year, month, 1).AtStartOfDayInZone(DateTimeZone.Utc).ToInstant();
+        var endOfMonth = startOfMonth.Plus(Duration.FromDays(DateTime.DaysInMonth(year, month)));
+
+        var statuses = await db.AccountStatuses
+            .AsNoTracking()
+            .TagWith("GetEventCalendar_Statuses")
+            .Where(x => x.AccountId == user.Id && x.CreatedAt >= startOfMonth && x.CreatedAt < endOfMonth)
+            .Select(x => new Status
+            {
+                Id = x.Id,
+                Attitude = x.Attitude,
+                IsInvisible = !replaceInvisible && x.IsInvisible,
+                IsNotDisturb = x.IsNotDisturb,
+                Label = x.Label,
+                ClearedAt = x.ClearedAt,
+                AccountId = x.AccountId,
+                CreatedAt = x.CreatedAt
+            })
+            .OrderBy(x => x.CreatedAt)
+            .ToListAsync();
+
+        var checkIn = await db.AccountCheckInResults
+            .AsNoTracking()
+            .TagWith("GetEventCalendar_CheckIn")
+            .Where(x => x.AccountId == user.Id && x.CreatedAt >= startOfMonth && x.CreatedAt < endOfMonth)
+            .ToListAsync();
+
+        var dates = Enumerable.Range(1, DateTime.DaysInMonth(year, month))
+            .Select(day => new LocalDate(year, month, day).AtStartOfDayInZone(DateTimeZone.Utc).ToInstant())
+            .ToList();
+
+        var statusesByDate = statuses
+            .GroupBy(s => s.CreatedAt.InUtc().Date)
+            .ToDictionary(g => g.Key, g => g.ToList());
+
+        var checkInByDate = checkIn
+            .ToDictionary(c => c.CreatedAt.InUtc().Date);
+
+        return dates.Select(date =>
+        {
+            var utcDate = date.InUtc().Date;
+            return new DailyEventResponse
+            {
+                Date = date,
+                CheckInResult = checkInByDate.GetValueOrDefault(utcDate),
+                Statuses = statusesByDate.GetValueOrDefault(utcDate, new List<Status>())
+            };
+        }).ToList();
+    }
+}

DysonNetwork.Pass/Account/AccountService.cs

@@ -0,0 +1,667 @@
+using System.Globalization;
+using DysonNetwork.Pass.Auth;
+using DysonNetwork.Pass.Auth.OpenId;
+using DysonNetwork.Pass.Email;
+using DysonNetwork.Pass.Localization;
+using DysonNetwork.Pass.Permission;
+using DysonNetwork.Shared.Cache;
+using DysonNetwork.Shared.Proto;
+using EFCore.BulkExtensions;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Localization;
+using NodaTime;
+using OtpNet;
+using AuthSession = DysonNetwork.Pass.Auth.AuthSession;
+
+namespace DysonNetwork.Pass.Account;
+
+public class AccountService(
+    AppDatabase db,
+    MagicSpellService spells,
+    AccountUsernameService uname,
+    EmailService mailer,
+    PusherService.PusherServiceClient pusher,
+    IStringLocalizer<NotificationResource> localizer,
+    ICacheService cache,
+    ILogger<AccountService> logger
+)
+{
+    public static void SetCultureInfo(Account account)
+    {
+        SetCultureInfo(account.Language);
+    }
+
+    public static void SetCultureInfo(string? languageCode)
+    {
+        var info = new CultureInfo(languageCode ?? "en-us", false);
+        CultureInfo.CurrentCulture = info;
+        CultureInfo.CurrentUICulture = info;
+    }
+
+    public const string AccountCachePrefix = "account:";
+
+    public async Task PurgeAccountCache(Account account)
+    {
+        await cache.RemoveGroupAsync($"{AccountCachePrefix}{account.Id}");
+    }
+
+    public async Task<Account?> LookupAccount(string probe)
+    {
+        var account = await db.Accounts.Where(a => a.Name == probe).FirstOrDefaultAsync();
+        if (account is not null) return account;
+
+        var contact = await db.AccountContacts
+            .Where(c => c.Content == probe)
+            .Include(c => c.Account)
+            .FirstOrDefaultAsync();
+        return contact?.Account;
+    }
+
+    public async Task<Account?> LookupAccountByConnection(string identifier, string provider)
+    {
+        var connection = await db.AccountConnections
+            .Where(c => c.ProvidedIdentifier == identifier && c.Provider == provider)
+            .Include(c => c.Account)
+            .FirstOrDefaultAsync();
+        return connection?.Account;
+    }
+
+    public async Task<int?> GetAccountLevel(Guid accountId)
+    {
+        var profile = await db.AccountProfiles
+            .Where(a => a.AccountId == accountId)
+            .FirstOrDefaultAsync();
+        return profile?.Level;
+    }
+
+    public async Task<Account> CreateAccount(
+        string name,
+        string nick,
+        string email,
+        string? password,
+        string language = "en-US",
+        bool isEmailVerified = false,
+        bool isActivated = false
+    )
+    {
+        await using var transaction = await db.Database.BeginTransactionAsync();
+        try
+        {
+            var dupeNameCount = await db.Accounts.Where(a => a.Name == name).CountAsync();
+            if (dupeNameCount > 0)
+                throw new InvalidOperationException("Account name has already been taken.");
+
+            var account = new Account
+            {
+                Name = name,
+                Nick = nick,
+                Language = language,
+                Contacts = new List<AccountContact>
+                {
+                    new()
+                    {
+                        Type = AccountContactType.Email,
+                        Content = email,
+                        VerifiedAt = isEmailVerified ? SystemClock.Instance.GetCurrentInstant() : null,
+                        IsPrimary = true
+                    }
+                },
+                AuthFactors = password is not null
+                    ? new List<AccountAuthFactor>
+                    {
+                        new AccountAuthFactor
+                        {
+                            Type = AccountAuthFactorType.Password,
+                            Secret = password,
+                            EnabledAt = SystemClock.Instance.GetCurrentInstant()
+                        }.HashSecret()
+                    }
+                    : [],
+                Profile = new AccountProfile()
+            };
+
+            if (isActivated)
+            {
+                account.ActivatedAt = SystemClock.Instance.GetCurrentInstant();
+                var defaultGroup = await db.PermissionGroups.FirstOrDefaultAsync(g => g.Key == "default");
+                if (defaultGroup is not null)
+                {
+                    db.PermissionGroupMembers.Add(new PermissionGroupMember
+                    {
+                        Actor = $"user:{account.Id}",
+                        Group = defaultGroup
+                    });
+                }
+            }
+            else
+            {
+                var spell = await spells.CreateMagicSpell(
+                    account,
+                    MagicSpellType.AccountActivation,
+                    new Dictionary<string, object>
+                    {
+                        { "contact_method", account.Contacts.First().Content }
+                    }
+                );
+                await spells.NotifyMagicSpell(spell, true);
+            }
+
+            db.Accounts.Add(account);
+            await db.SaveChangesAsync();
+
+            await transaction.CommitAsync();
+            return account;
+        }
+        catch
+        {
+            await transaction.RollbackAsync();
+            throw;
+        }
+    }
+
+    public async Task<Account> CreateAccount(OidcUserInfo userInfo)
+    {
+        if (string.IsNullOrEmpty(userInfo.Email))
+            throw new ArgumentException("Email is required for account creation");
+
+        var displayName = !string.IsNullOrEmpty(userInfo.DisplayName)
+            ? userInfo.DisplayName
+            : $"{userInfo.FirstName} {userInfo.LastName}".Trim();
+
+        // Generate username from email
+        var username = await uname.GenerateUsernameFromEmailAsync(userInfo.Email);
+
+        return await CreateAccount(
+            username,
+            displayName,
+            userInfo.Email,
+            null,
+            "en-US",
+            userInfo.EmailVerified,
+            userInfo.EmailVerified
+        );
+    }
+
+    public async Task RequestAccountDeletion(Account account)
+    {
+        var spell = await spells.CreateMagicSpell(
+            account,
+            MagicSpellType.AccountRemoval,
+            new Dictionary<string, object>(),
+            SystemClock.Instance.GetCurrentInstant().Plus(Duration.FromHours(24)),
+            preventRepeat: true
+        );
+        await spells.NotifyMagicSpell(spell);
+    }
+
+    public async Task RequestPasswordReset(Account account)
+    {
+        var spell = await spells.CreateMagicSpell(
+            account,
+            MagicSpellType.AuthPasswordReset,
+            new Dictionary<string, object>(),
+            SystemClock.Instance.GetCurrentInstant().Plus(Duration.FromHours(24)),
+            preventRepeat: true
+        );
+        await spells.NotifyMagicSpell(spell);
+    }
+
+    public async Task<bool> CheckAuthFactorExists(Account account, AccountAuthFactorType type)
+    {
+        var isExists = await db.AccountAuthFactors
+            .Where(x => x.AccountId == account.Id && x.Type == type)
+            .AnyAsync();
+        return isExists;
+    }
+
+    public async Task<AccountAuthFactor?> CreateAuthFactor(Account account, AccountAuthFactorType type, string? secret)
+    {
+        AccountAuthFactor? factor = null;
+        switch (type)
+        {
+            case AccountAuthFactorType.Password:
+                if (string.IsNullOrWhiteSpace(secret)) throw new ArgumentNullException(nameof(secret));
+                factor = new AccountAuthFactor
+                {
+                    Type = AccountAuthFactorType.Password,
+                    Trustworthy = 1,
+                    AccountId = account.Id,
+                    Secret = secret,
+                    EnabledAt = SystemClock.Instance.GetCurrentInstant(),
+                }.HashSecret();
+                break;
+            case AccountAuthFactorType.EmailCode:
+                factor = new AccountAuthFactor
+                {
+                    Type = AccountAuthFactorType.EmailCode,
+                    Trustworthy = 2,
+                    EnabledAt = SystemClock.Instance.GetCurrentInstant(),
+                };
+                break;
+            case AccountAuthFactorType.InAppCode:
+                factor = new AccountAuthFactor
+                {
+                    Type = AccountAuthFactorType.InAppCode,
+                    Trustworthy = 1,
+                    EnabledAt = SystemClock.Instance.GetCurrentInstant()
+                };
+                break;
+            case AccountAuthFactorType.TimedCode:
+                var skOtp = KeyGeneration.GenerateRandomKey(20);
+                var skOtp32 = Base32Encoding.ToString(skOtp);
+                factor = new AccountAuthFactor
+                {
+                    Secret = skOtp32,
+                    Type = AccountAuthFactorType.TimedCode,
+                    Trustworthy = 2,
+                    EnabledAt = null, // It needs to be tired once to enable
+                    CreatedResponse = new Dictionary<string, object>
+                    {
+                        ["uri"] = new OtpUri(
+                            OtpType.Totp,
+                            skOtp32,
+                            account.Id.ToString(),
+                            "Solar Network"
+                        ).ToString(),
+                    }
+                };
+                break;
+            case AccountAuthFactorType.PinCode:
+                if (string.IsNullOrWhiteSpace(secret)) throw new ArgumentNullException(nameof(secret));
+                if (!secret.All(char.IsDigit) || secret.Length != 6)
+                    throw new ArgumentException("PIN code must be exactly 6 digits");
+                factor = new AccountAuthFactor
+                {
+                    Type = AccountAuthFactorType.PinCode,
+                    Trustworthy = 0, // Only for confirming, can't be used for login
+                    Secret = secret,
+                    EnabledAt = SystemClock.Instance.GetCurrentInstant(),
+                }.HashSecret();
+                break;
+            default:
+                throw new ArgumentOutOfRangeException(nameof(type), type, null);
+        }
+
+        if (factor is null) throw new InvalidOperationException("Unable to create auth factor.");
+        factor.AccountId = account.Id;
+        db.AccountAuthFactors.Add(factor);
+        await db.SaveChangesAsync();
+        return factor;
+    }
+
+    public async Task<AccountAuthFactor> EnableAuthFactor(AccountAuthFactor factor, string? code)
+    {
+        if (factor.EnabledAt is not null) throw new ArgumentException("The factor has been enabled.");
+        if (factor.Type is AccountAuthFactorType.Password or AccountAuthFactorType.TimedCode)
+        {
+            if (code is null || !factor.VerifyPassword(code))
+                throw new InvalidOperationException(
+                    "Invalid code, you need to enter the correct code to enable the factor."
+                );
+        }
+
+        factor.EnabledAt = SystemClock.Instance.GetCurrentInstant();
+        db.Update(factor);
+        await db.SaveChangesAsync();
+
+        return factor;
+    }
+
+    public async Task<AccountAuthFactor> DisableAuthFactor(AccountAuthFactor factor)
+    {
+        if (factor.EnabledAt is null) throw new ArgumentException("The factor has been disabled.");
+
+        var count = await db.AccountAuthFactors
+            .Where(f => f.AccountId == factor.AccountId && f.EnabledAt != null)
+            .CountAsync();
+        if (count <= 1)
+            throw new InvalidOperationException(
+                "Disabling this auth factor will cause you have no active auth factors.");
+
+        factor.EnabledAt = null;
+        db.Update(factor);
+        await db.SaveChangesAsync();
+
+        return factor;
+    }
+
+    public async Task DeleteAuthFactor(AccountAuthFactor factor)
+    {
+        var count = await db.AccountAuthFactors
+            .Where(f => f.AccountId == factor.AccountId)
+            .If(factor.EnabledAt is not null, q => q.Where(f => f.EnabledAt != null))
+            .CountAsync();
+        if (count <= 1)
+            throw new InvalidOperationException("Deleting this auth factor will cause you have no auth factor.");
+
+        db.AccountAuthFactors.Remove(factor);
+        await db.SaveChangesAsync();
+    }
+
+    /// <summary>
+    /// Send the auth factor verification code to users, for factors like in-app code and email.
+    /// Sometimes it requires a hint, like a part of the user's email address to ensure the user is who own the account.
+    /// </summary>
+    /// <param name="account">The owner of the auth factor</param>
+    /// <param name="factor">The auth factor needed to send code</param>
+    /// <param name="hint">The part of the contact method for verification</param>
+    public async Task SendFactorCode(Account account, AccountAuthFactor factor, string? hint = null)
+    {
+        var code = new Random().Next(100000, 999999).ToString("000000");
+
+        switch (factor.Type)
+        {
+            case AccountAuthFactorType.InAppCode:
+                if (await _GetFactorCode(factor) is not null)
+                    throw new InvalidOperationException("A factor code has been sent and in active duration.");
+
+                await pusher.SendPushNotificationToUserAsync(
+                    new SendPushNotificationToUserRequest
+                    {
+                        UserId = account.Id.ToString(),
+                        Notification = new PushNotification
+                        {
+                            Topic = "auth.verification",
+                            Title = localizer["AuthCodeTitle"],
+                            Body = localizer["AuthCodeBody", code],
+                            IsSavable = false
+                        }
+                    }
+                );
+                await _SetFactorCode(factor, code, TimeSpan.FromMinutes(5));
+                break;
+            case AccountAuthFactorType.EmailCode:
+                if (await _GetFactorCode(factor) is not null)
+                    throw new InvalidOperationException("A factor code has been sent and in active duration.");
+
+                ArgumentNullException.ThrowIfNull(hint);
+                hint = hint.Replace("@", "").Replace(".", "").Replace("+", "").Replace("%", "");
+                if (string.IsNullOrWhiteSpace(hint))
+                {
+                    logger.LogWarning(
+                        "Unable to send factor code to #{FactorId} with hint {Hint}, due to invalid hint...",
+                        factor.Id,
+                        hint
+                    );
+                    return;
+                }
+
+                var contact = await db.AccountContacts
+                    .Where(c => c.Type == AccountContactType.Email)
+                    .Where(c => c.VerifiedAt != null)
+                    .Where(c => EF.Functions.ILike(c.Content, $"%{hint}%"))
+                    .Include(c => c.Account)
+                    .FirstOrDefaultAsync();
+                if (contact is null)
+                {
+                    logger.LogWarning(
+                        "Unable to send factor code to #{FactorId} with hint {Hint}, due to no contact method found according to hint...",
+                        factor.Id,
+                        hint
+                    );
+                    return;
+                }
+
+                await mailer
+                    .SendTemplatedEmailAsync<Pages.Emails.VerificationEmail, VerificationEmailModel>(
+                        account.Nick,
+                        contact.Content,
+                        localizer["VerificationEmail"],
+                        new VerificationEmailModel
+                        {
+                            Name = account.Name,
+                            Code = code
+                        }
+                    );
+
+                await _SetFactorCode(factor, code, TimeSpan.FromMinutes(30));
+                break;
+            case AccountAuthFactorType.Password:
+            case AccountAuthFactorType.TimedCode:
+            default:
+                // No need to send, such as password etc...
+                return;
+        }
+    }
+
+    public async Task<bool> VerifyFactorCode(AccountAuthFactor factor, string code)
+    {
+        switch (factor.Type)
+        {
+            case AccountAuthFactorType.EmailCode:
+            case AccountAuthFactorType.InAppCode:
+                var correctCode = await _GetFactorCode(factor);
+                var isCorrect = correctCode is not null &&
+                                string.Equals(correctCode, code, StringComparison.OrdinalIgnoreCase);
+                await cache.RemoveAsync($"{AuthFactorCachePrefix}{factor.Id}:code");
+                return isCorrect;
+            case AccountAuthFactorType.Password:
+            case AccountAuthFactorType.TimedCode:
+            default:
+                return factor.VerifyPassword(code);
+        }
+    }
+
+    private const string AuthFactorCachePrefix = "authfactor:";
+
+    private async Task _SetFactorCode(AccountAuthFactor factor, string code, TimeSpan expires)
+    {
+        await cache.SetAsync(
+            $"{AuthFactorCachePrefix}{factor.Id}:code",
+            code,
+            expires
+        );
+    }
+
+    private async Task<string?> _GetFactorCode(AccountAuthFactor factor)
+    {
+        return await cache.GetAsync<string?>(
+            $"{AuthFactorCachePrefix}{factor.Id}:code"
+        );
+    }
+
+    public async Task<AuthSession> UpdateSessionLabel(Account account, Guid sessionId, string label)
+    {
+        var session = await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.Id == sessionId && s.AccountId == account.Id)
+            .FirstOrDefaultAsync();
+        if (session is null) throw new InvalidOperationException("Session was not found.");
+
+        await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.Challenge.DeviceId == session.Challenge.DeviceId)
+            .ExecuteUpdateAsync(p => p.SetProperty(s => s.Label, label));
+
+        var sessions = await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.AccountId == session.Id && s.Challenge.DeviceId == session.Challenge.DeviceId)
+            .ToListAsync();
+        foreach (var item in sessions)
+            await cache.RemoveAsync($"{DysonTokenAuthHandler.AuthCachePrefix}{item.Id}");
+
+        return session;
+    }
+
+    public async Task DeleteSession(Account account, Guid sessionId)
+    {
+        var session = await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.Id == sessionId && s.AccountId == account.Id)
+            .FirstOrDefaultAsync();
+        if (session is null) throw new InvalidOperationException("Session was not found.");
+
+        var sessions = await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.AccountId == session.Id && s.Challenge.DeviceId == session.Challenge.DeviceId)
+            .ToListAsync();
+
+        if (session.Challenge.DeviceId is not null)
+            await pusher.UnsubscribePushNotificationsAsync(new UnsubscribePushNotificationsRequest()
+            {
+                DeviceId = session.Challenge.DeviceId
+            });
+
+        // The current session should be included in the sessions' list
+        await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.Challenge.DeviceId == session.Challenge.DeviceId)
+            .ExecuteDeleteAsync();
+
+        foreach (var item in sessions)
+            await cache.RemoveAsync($"{DysonTokenAuthHandler.AuthCachePrefix}{item.Id}");
+    }
+
+    public async Task<AccountContact> CreateContactMethod(Account account, AccountContactType type, string content)
+    {
+        var contact = new AccountContact
+        {
+            Type = type,
+            Content = content,
+            AccountId = account.Id,
+        };
+
+        db.AccountContacts.Add(contact);
+        await db.SaveChangesAsync();
+
+        return contact;
+    }
+
+    public async Task VerifyContactMethod(Account account, AccountContact contact)
+    {
+        var spell = await spells.CreateMagicSpell(
+            account,
+            MagicSpellType.ContactVerification,
+            new Dictionary<string, object> { { "contact_method", contact.Content } },
+            expiredAt: SystemClock.Instance.GetCurrentInstant().Plus(Duration.FromHours(24)),
+            preventRepeat: true
+        );
+        await spells.NotifyMagicSpell(spell);
+    }
+
+    public async Task<AccountContact> SetContactMethodPrimary(Account account, AccountContact contact)
+    {
+        if (contact.AccountId != account.Id)
+            throw new InvalidOperationException("Contact method does not belong to this account.");
+        if (contact.VerifiedAt is null)
+            throw new InvalidOperationException("Cannot set unverified contact method as primary.");
+
+        await using var transaction = await db.Database.BeginTransactionAsync();
+
+        try
+        {
+            await db.AccountContacts
+                .Where(c => c.AccountId == account.Id && c.Type == contact.Type)
+                .ExecuteUpdateAsync(s => s.SetProperty(x => x.IsPrimary, false));
+
+            contact.IsPrimary = true;
+            db.AccountContacts.Update(contact);
+            await db.SaveChangesAsync();
+
+            await transaction.CommitAsync();
+            return contact;
+        }
+        catch
+        {
+            await transaction.RollbackAsync();
+            throw;
+        }
+    }
+
+    public async Task DeleteContactMethod(Account account, AccountContact contact)
+    {
+        if (contact.AccountId != account.Id)
+            throw new InvalidOperationException("Contact method does not belong to this account.");
+        if (contact.IsPrimary)
+            throw new InvalidOperationException("Cannot delete primary contact method.");
+
+        db.AccountContacts.Remove(contact);
+        await db.SaveChangesAsync();
+    }
+
+    /// <summary>
+    /// This method will grant a badge to the account.
+    /// Shouldn't be exposed to normal user and the user itself.
+    /// </summary>
+    public async Task<AccountBadge> GrantBadge(Account account, AccountBadge badge)
+    {
+        badge.AccountId = account.Id;
+        db.Badges.Add(badge);
+        await db.SaveChangesAsync();
+        return badge;
+    }
+
+    /// <summary>
+    /// This method will revoke a badge from the account.
+    /// Shouldn't be exposed to normal user and the user itself.
+    /// </summary>
+    public async Task RevokeBadge(Account account, Guid badgeId)
+    {
+        var badge = await db.Badges
+            .Where(b => b.AccountId == account.Id && b.Id == badgeId)
+            .OrderByDescending(b => b.CreatedAt)
+            .FirstOrDefaultAsync();
+        if (badge is null) throw new InvalidOperationException("Badge was not found.");
+
+        var profile = await db.AccountProfiles
+            .Where(p => p.AccountId == account.Id)
+            .FirstOrDefaultAsync();
+        if (profile?.ActiveBadge is not null && profile.ActiveBadge.Id == badge.Id)
+            profile.ActiveBadge = null;
+
+        db.Remove(badge);
+        await db.SaveChangesAsync();
+    }
+
+    public async Task ActiveBadge(Account account, Guid badgeId)
+    {
+        await using var transaction = await db.Database.BeginTransactionAsync();
+
+        try
+        {
+            var badge = await db.Badges
+                .Where(b => b.AccountId == account.Id && b.Id == badgeId)
+                .OrderByDescending(b => b.CreatedAt)
+                .FirstOrDefaultAsync();
+            if (badge is null) throw new InvalidOperationException("Badge was not found.");
+
+            await db.Badges
+                .Where(b => b.AccountId == account.Id && b.Id != badgeId)
+                .ExecuteUpdateAsync(s => s.SetProperty(p => p.ActivatedAt, p => null));
+
+            badge.ActivatedAt = SystemClock.Instance.GetCurrentInstant();
+            db.Update(badge);
+            await db.SaveChangesAsync();
+
+            await db.AccountProfiles
+                .Where(p => p.AccountId == account.Id)
+                .ExecuteUpdateAsync(s => s.SetProperty(p => p.ActiveBadge, badge.ToReference()));
+            await PurgeAccountCache(account);
+
+            await transaction.CommitAsync();
+        }
+        catch
+        {
+            await transaction.RollbackAsync();
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// The maintenance method for server administrator.
+    /// To check every user has an account profile and to create them if it isn't having one.
+    /// </summary>
+    public async Task EnsureAccountProfileCreated()
+    {
+        var accountsId = await db.Accounts.Select(a => a.Id).ToListAsync();
+        var existingId = await db.AccountProfiles.Select(p => p.AccountId).ToListAsync();
+        var missingId = accountsId.Except(existingId).ToList();
+
+        if (missingId.Count != 0)
+        {
+            var newProfiles = missingId.Select(id => new AccountProfile { Id = Guid.NewGuid(), AccountId = id })
+                .ToList();
+            await db.BulkInsertAsync(newProfiles);
+        }
+    }
+}

DysonNetwork.Pass/Account/AccountServiceGrpc.cs

@@ -0,0 +1,362 @@
+using DysonNetwork.Shared.Proto;
+using Google.Protobuf.WellKnownTypes;
+using Grpc.Core;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using NodaTime.Serialization.Protobuf;
+
+namespace DysonNetwork.Pass.Account;
+
+public class AccountServiceGrpc(
+    AppDatabase db,
+    IClock clock,
+    ILogger<AccountServiceGrpc> logger
+)
+    : Shared.Proto.AccountService.AccountServiceBase
+{
+    private readonly AppDatabase _db = db ?? throw new ArgumentNullException(nameof(db));
+    private readonly IClock _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+
+    private readonly ILogger<AccountServiceGrpc>
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    
+    public override async Task<Shared.Proto.Account> GetAccount(GetAccountRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.Id, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var account = await _db.Accounts
+            .AsNoTracking()
+            .Include(a => a.Profile)
+            .FirstOrDefaultAsync(a => a.Id == accountId);
+
+        if (account == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, $"Account {request.Id} not found"));
+
+        return account.ToProtoValue();
+    }
+
+    public override async Task<GetAccountBatchResponse> GetAccountBatch(GetAccountBatchRequest request, ServerCallContext context)
+    {
+        var accountIds = request.Id
+            .Select(id => Guid.TryParse(id, out var accountId) ? accountId : (Guid?)null)
+            .Where(id => id.HasValue)
+            .Select(id => id!.Value)
+            .ToList();
+
+        var accounts = await _db.Accounts
+            .AsNoTracking()
+            .Where(a => accountIds.Contains(a.Id))
+            .ToListAsync();
+
+        var response = new GetAccountBatchResponse();
+        response.Accounts.AddRange(accounts.Select(a => a.ToProtoValue()));
+        return response;
+    }
+
+    public override async Task<Shared.Proto.Account> CreateAccount(CreateAccountRequest request,
+        ServerCallContext context)
+    {
+        // Map protobuf request to domain model
+        var account = new Account
+        {
+            Name = request.Name,
+            Nick = request.Nick,
+            Language = request.Language,
+            IsSuperuser = request.IsSuperuser,
+            ActivatedAt = request.Profile != null ? null : _clock.GetCurrentInstant(),
+            Profile = new AccountProfile
+            {
+                FirstName = request.Profile?.FirstName,
+                LastName = request.Profile?.LastName,
+                // Initialize other profile fields as needed
+            }
+        };
+
+        // Add to database
+        _db.Accounts.Add(account);
+        await _db.SaveChangesAsync();
+
+        _logger.LogInformation("Created new account with ID {AccountId}", account.Id);
+        return account.ToProtoValue();
+    }
+
+    public override async Task<Shared.Proto.Account> UpdateAccount(UpdateAccountRequest request,
+        ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.Id, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var account = await _db.Accounts.FindAsync(accountId);
+        if (account == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, $"Account {request.Id} not found"));
+
+        // Update fields if they are provided in the request
+        if (request.Name != null) account.Name = request.Name;
+        if (request.Nick != null) account.Nick = request.Nick;
+        if (request.Language != null) account.Language = request.Language;
+        if (request.IsSuperuser != null) account.IsSuperuser = request.IsSuperuser.Value;
+
+        await _db.SaveChangesAsync();
+        return account.ToProtoValue();
+    }
+
+    public override async Task<Empty> DeleteAccount(DeleteAccountRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.Id, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var account = await _db.Accounts.FindAsync(accountId);
+        if (account == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, $"Account {request.Id} not found"));
+
+        _db.Accounts.Remove(account);
+
+        await _db.SaveChangesAsync();
+        return new Empty();
+    }
+
+    public override async Task<ListAccountsResponse> ListAccounts(ListAccountsRequest request,
+        ServerCallContext context)
+    {
+        var query = _db.Accounts.AsNoTracking();
+
+        // Apply filters if provided
+        if (!string.IsNullOrEmpty(request.Filter))
+        {
+            // Implement filtering logic based on request.Filter
+            // This is a simplified example
+            query = query.Where(a => a.Name.Contains(request.Filter) || a.Nick.Contains(request.Filter));
+        }
+
+        // Apply ordering
+        query = request.OrderBy switch
+        {
+            "name" => query.OrderBy(a => a.Name),
+            "name_desc" => query.OrderByDescending(a => a.Name),
+            _ => query.OrderBy(a => a.Id)
+        };
+
+        // Get total count for pagination
+        var totalCount = await query.CountAsync();
+
+        // Apply pagination
+        var accounts = await query
+            .Skip(request.PageSize * (request.PageToken != null ? int.Parse(request.PageToken) : 0))
+            .Take(request.PageSize)
+            .Include(a => a.Profile)
+            .ToListAsync();
+
+        var response = new ListAccountsResponse
+        {
+            TotalSize = totalCount,
+            NextPageToken = (accounts.Count == request.PageSize)
+                ? ((request.PageToken != null ? int.Parse(request.PageToken) : 0) + 1).ToString()
+                : ""
+        };
+
+        response.Accounts.AddRange(accounts.Select(x => x.ToProtoValue()));
+        return response;
+    }
+
+// Implement other service methods following the same pattern...
+
+// Profile operations
+    public override async Task<Shared.Proto.AccountProfile> GetProfile(GetProfileRequest request,
+        ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var profile = await _db.AccountProfiles
+            .AsNoTracking()
+            .FirstOrDefaultAsync(p => p.AccountId == accountId);
+
+        if (profile == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound,
+                $"Profile for account {request.AccountId} not found"));
+
+        return profile.ToProtoValue();
+    }
+
+    public override async Task<Shared.Proto.AccountProfile> UpdateProfile(UpdateProfileRequest request,
+        ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var profile = await _db.AccountProfiles
+            .FirstOrDefaultAsync(p => p.AccountId == accountId);
+
+        if (profile == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound,
+                $"Profile for account {request.AccountId} not found"));
+
+        // Update only the fields specified in the field mask
+        if (request.UpdateMask == null || request.UpdateMask.Paths.Contains("first_name"))
+            profile.FirstName = request.Profile.FirstName;
+
+        if (request.UpdateMask == null || request.UpdateMask.Paths.Contains("last_name"))
+            profile.LastName = request.Profile.LastName;
+
+        // Update other fields similarly...
+
+        await _db.SaveChangesAsync();
+        return profile.ToProtoValue();
+    }
+
+// Contact operations
+    public override async Task<Shared.Proto.AccountContact> AddContact(AddContactRequest request,
+        ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var contact = new AccountContact
+        {
+            AccountId = accountId,
+            Type = (AccountContactType)request.Type,
+            Content = request.Content,
+            IsPrimary = request.IsPrimary,
+            VerifiedAt = null
+        };
+
+        _db.AccountContacts.Add(contact);
+        await _db.SaveChangesAsync();
+
+        return contact.ToProtoValue();
+    }
+
+    public override async Task<Empty> RemoveContact(RemoveContactRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        if (!Guid.TryParse(request.Id, out var contactId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid contact ID format"));
+
+        var contact = await _db.AccountContacts.FirstOrDefaultAsync(c => c.Id == contactId && c.AccountId == accountId);
+        if (contact == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, "Contact not found."));
+
+        _db.AccountContacts.Remove(contact);
+        await _db.SaveChangesAsync();
+
+        return new Empty();
+    }
+
+    public override async Task<ListContactsResponse> ListContacts(ListContactsRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var query = _db.AccountContacts.AsNoTracking().Where(c => c.AccountId == accountId);
+
+        if (request.VerifiedOnly)
+            query = query.Where(c => c.VerifiedAt != null);
+
+        var contacts = await query.ToListAsync();
+
+        var response = new ListContactsResponse();
+        response.Contacts.AddRange(contacts.Select(c => c.ToProtoValue()));
+
+        return response;
+    }
+
+    public override async Task<Shared.Proto.AccountContact> VerifyContact(VerifyContactRequest request, ServerCallContext context)
+    {
+        // This is a placeholder implementation. In a real-world scenario, you would
+        // have a more robust verification mechanism (e.g., sending a code to the
+        // user's email or phone).
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        if (!Guid.TryParse(request.Id, out var contactId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid contact ID format"));
+
+        var contact = await _db.AccountContacts.FirstOrDefaultAsync(c => c.Id == contactId && c.AccountId == accountId);
+        if (contact == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, "Contact not found."));
+
+        contact.VerifiedAt = _clock.GetCurrentInstant();
+        await _db.SaveChangesAsync();
+
+        return contact.ToProtoValue();
+    }
+
+// Badge operations
+    public override async Task<Shared.Proto.AccountBadge> AddBadge(AddBadgeRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var badge = new AccountBadge
+        {
+            AccountId = accountId,
+            Type = request.Type,
+            Label = request.Label,
+            Caption = request.Caption,
+            ActivatedAt = _clock.GetCurrentInstant(),
+            ExpiredAt = request.ExpiredAt?.ToInstant(),
+            Meta = request.Meta.ToDictionary(kvp => kvp.Key, kvp => (object)kvp.Value)
+        };
+
+        _db.Badges.Add(badge);
+        await _db.SaveChangesAsync();
+
+        return badge.ToProtoValue();
+    }
+
+    public override async Task<Empty> RemoveBadge(RemoveBadgeRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        if (!Guid.TryParse(request.Id, out var badgeId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid badge ID format"));
+
+        var badge = await _db.Badges.FirstOrDefaultAsync(b => b.Id == badgeId && b.AccountId == accountId);
+        if (badge == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, "Badge not found."));
+
+        _db.Badges.Remove(badge);
+        await _db.SaveChangesAsync();
+
+        return new Empty();
+    }
+
+    public override async Task<ListBadgesResponse> ListBadges(ListBadgesRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var query = _db.Badges.AsNoTracking().Where(b => b.AccountId == accountId);
+
+        if (request.ActiveOnly)
+            query = query.Where(b => b.ExpiredAt == null || b.ExpiredAt > _clock.GetCurrentInstant());
+
+        var badges = await query.ToListAsync();
+
+        var response = new ListBadgesResponse();
+        response.Badges.AddRange(badges.Select(b => b.ToProtoValue()));
+
+        return response;
+    }
+
+    public override async Task<Shared.Proto.AccountProfile> SetActiveBadge(SetActiveBadgeRequest request, ServerCallContext context)
+    {
+        if (!Guid.TryParse(request.AccountId, out var accountId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid account ID format"));
+
+        var profile = await _db.AccountProfiles.FirstOrDefaultAsync(p => p.AccountId == accountId);
+        if (profile == null)
+            throw new RpcException(new Grpc.Core.Status(StatusCode.NotFound, "Profile not found."));
+
+        if (!string.IsNullOrEmpty(request.BadgeId) && !Guid.TryParse(request.BadgeId, out var badgeId))
+            throw new RpcException(new Grpc.Core.Status(StatusCode.InvalidArgument, "Invalid badge ID format"));
+
+        await _db.SaveChangesAsync();
+
+        return profile.ToProtoValue();
+    }
+}

DysonNetwork.Pass/Account/AccountUsernameService.cs

@@ -0,0 +1,105 @@
+using System.Text.RegularExpressions;
+using Microsoft.EntityFrameworkCore;
+
+namespace DysonNetwork.Pass.Account;
+
+/// <summary>
+/// Service for handling username generation and validation
+/// </summary>
+public class AccountUsernameService(AppDatabase db)
+{
+    private readonly Random _random = new();
+
+    /// <summary>
+    /// Generates a unique username based on the provided base name
+    /// </summary>
+    /// <param name="baseName">The preferred username</param>
+    /// <returns>A unique username</returns>
+    public async Task<string> GenerateUniqueUsernameAsync(string baseName)
+    {
+        // Sanitize the base name
+        var sanitized = SanitizeUsername(baseName);
+
+        // If the base name is empty after sanitization, use a default
+        if (string.IsNullOrEmpty(sanitized))
+        {
+            sanitized = "user";
+        }
+
+        // Check if the sanitized name is available
+        if (!await IsUsernameExistsAsync(sanitized))
+        {
+            return sanitized;
+        }
+
+        // Try up to 10 times with random numbers
+        for (int i = 0; i < 10; i++)
+        {
+            var suffix = _random.Next(1000, 9999);
+            var candidate = $"{sanitized}{suffix}";
+
+            if (!await IsUsernameExistsAsync(candidate))
+            {
+                return candidate;
+            }
+        }
+
+        // If all attempts fail, use a timestamp
+        var timestamp = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
+        return $"{sanitized}{timestamp}";
+    }
+
+    /// <summary>
+    /// Sanitizes a username by removing invalid characters and converting to lowercase
+    /// </summary>
+    public string SanitizeUsername(string username)
+    {
+        if (string.IsNullOrEmpty(username))
+            return string.Empty;
+
+        // Replace spaces and special characters with underscores
+        var sanitized = Regex.Replace(username, @"[^a-zA-Z0-9_\-]", "");
+
+        // Convert to lowercase
+        sanitized = sanitized.ToLowerInvariant();
+
+        // Ensure it starts with a letter
+        if (sanitized.Length > 0 && !char.IsLetter(sanitized[0]))
+        {
+            sanitized = "u" + sanitized;
+        }
+
+        // Truncate if too long
+        if (sanitized.Length > 30)
+        {
+            sanitized = sanitized[..30];
+        }
+
+        return sanitized;
+    }
+
+    /// <summary>
+    /// Checks if a username already exists
+    /// </summary>
+    public async Task<bool> IsUsernameExistsAsync(string username)
+    {
+        return await db.Accounts.AnyAsync(a => a.Name == username);
+    }
+
+    /// <summary>
+    /// Generates a username from an email address
+    /// </summary>
+    /// <param name="email">The email address to generate a username from</param>
+    /// <returns>A unique username derived from the email</returns>
+    public async Task<string> GenerateUsernameFromEmailAsync(string email)
+    {
+        if (string.IsNullOrEmpty(email))
+            return await GenerateUniqueUsernameAsync("user");
+
+        // Extract the local part of the email (before the @)
+        var localPart = email.Split('@')[0];
+
+        // Use the local part as the base for username generation
+        return await GenerateUniqueUsernameAsync(localPart);
+    }
+}

DysonNetwork.Pass/Account/ActionLog.cs

@@ -0,0 +1,59 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using DysonNetwork.Shared.Data;
+using Point = NetTopologySuite.Geometries.Point;
+
+namespace DysonNetwork.Pass.Account;
+
+public abstract class ActionLogType
+{
+    public const string NewLogin = "login";
+    public const string ChallengeAttempt = "challenges.attempt";
+    public const string ChallengeSuccess = "challenges.success";
+    public const string ChallengeFailure = "challenges.failure";
+    public const string PostCreate = "posts.create";
+    public const string PostUpdate = "posts.update";
+    public const string PostDelete = "posts.delete";
+    public const string PostReact = "posts.react";
+    public const string MessageCreate = "messages.create";
+    public const string MessageUpdate = "messages.update";
+    public const string MessageDelete = "messages.delete";
+    public const string MessageReact = "messages.react";
+    public const string PublisherCreate = "publishers.create";
+    public const string PublisherUpdate = "publishers.update";
+    public const string PublisherDelete = "publishers.delete";
+    public const string PublisherMemberInvite = "publishers.members.invite";
+    public const string PublisherMemberJoin = "publishers.members.join";
+    public const string PublisherMemberLeave = "publishers.members.leave";
+    public const string PublisherMemberKick = "publishers.members.kick";
+    public const string RealmCreate = "realms.create";
+    public const string RealmUpdate = "realms.update";
+    public const string RealmDelete = "realms.delete";
+    public const string RealmInvite = "realms.invite";
+    public const string RealmJoin = "realms.join";
+    public const string RealmLeave = "realms.leave";
+    public const string RealmKick = "realms.kick";
+    public const string RealmAdjustRole = "realms.role.edit";
+    public const string ChatroomCreate = "chatrooms.create";
+    public const string ChatroomUpdate = "chatrooms.update";
+    public const string ChatroomDelete = "chatrooms.delete";
+    public const string ChatroomInvite = "chatrooms.invite";
+    public const string ChatroomJoin = "chatrooms.join";
+    public const string ChatroomLeave = "chatrooms.leave";
+    public const string ChatroomKick = "chatrooms.kick";
+    public const string ChatroomAdjustRole = "chatrooms.role.edit";
+}
+
+public class ActionLog : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(4096)] public string Action { get; set; } = null!;
+    [Column(TypeName = "jsonb")] public Dictionary<string, object> Meta { get; set; } = new();
+    [MaxLength(512)] public string? UserAgent { get; set; }
+    [MaxLength(128)] public string? IpAddress { get; set; }
+    public Point? Location { get; set; }
+
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+    public Guid? SessionId { get; set; }
+}

DysonNetwork.Pass/Account/ActionLogService.cs

@@ -0,0 +1,44 @@
+using DysonNetwork.Shared.Cache;
+using DysonNetwork.Shared.GeoIp;
+
+namespace DysonNetwork.Pass.Account;
+
+public class ActionLogService(GeoIpService geo, FlushBufferService fbs)
+{
+    public void CreateActionLog(Guid accountId, string action, Dictionary<string, object> meta)
+    {
+        var log = new ActionLog
+        {
+            Action = action,
+            AccountId = accountId,
+            Meta = meta,
+        };
+
+        fbs.Enqueue(log);
+    }
+
+    public void CreateActionLogFromRequest(string action, Dictionary<string, object> meta, HttpRequest request,
+        Account? account = null)
+    {
+        var log = new ActionLog
+        {
+            Action = action,
+            Meta = meta,
+            UserAgent = request.Headers.UserAgent,
+            IpAddress = request.HttpContext.Connection.RemoteIpAddress?.ToString(),
+            Location = geo.GetPointFromIp(request.HttpContext.Connection.RemoteIpAddress?.ToString())
+        };
+        
+        if (request.HttpContext.Items["CurrentUser"] is Account currentUser)
+            log.AccountId = currentUser.Id;
+        else if (account != null)
+            log.AccountId = account.Id;
+        else
+            throw new ArgumentException("No user context was found");
+        
+        if (request.HttpContext.Items["CurrentSession"] is Auth.AuthSession currentSession)
+            log.SessionId = currentSession.Id;
+
+        fbs.Enqueue(log);
+    }
+}

DysonNetwork.Pass/Account/Badge.cs

@@ -0,0 +1,86 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using DysonNetwork.Shared.Proto;
+using Google.Protobuf.WellKnownTypes;
+using NodaTime;
+using NodaTime.Serialization.Protobuf;
+
+namespace DysonNetwork.Pass.Account;
+
+public class AccountBadge : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Type { get; set; } = null!;
+    [MaxLength(1024)] public string? Label { get; set; }
+    [MaxLength(4096)] public string? Caption { get; set; }
+    [Column(TypeName = "jsonb")] public Dictionary<string, object> Meta { get; set; } = new();
+    public Instant? ActivatedAt { get; set; }
+    public Instant? ExpiredAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+
+    public BadgeReferenceObject ToReference()
+    {
+        return new BadgeReferenceObject
+        {
+            Id = Id,
+            Type = Type,
+            Label = Label,
+            Caption = Caption,
+            Meta = Meta,
+            ActivatedAt = ActivatedAt,
+            ExpiredAt = ExpiredAt,
+            AccountId = AccountId
+        };
+    }
+
+    public Shared.Proto.AccountBadge ToProtoValue()
+    {
+        var proto = new Shared.Proto.AccountBadge
+        {
+            Id = Id.ToString(),
+            Type = Type,
+            Label = Label ?? string.Empty,
+            Caption = Caption ?? string.Empty,
+            ActivatedAt = ActivatedAt?.ToTimestamp(),
+            ExpiredAt = ExpiredAt?.ToTimestamp(),
+            AccountId = AccountId.ToString(),
+        };
+        proto.Meta.Add(GrpcTypeHelper.ConvertToValueMap(Meta));
+
+        return proto;
+    }
+}
+
+public class BadgeReferenceObject : ModelBase
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = null!;
+    public string? Label { get; set; }
+    public string? Caption { get; set; }
+    public Dictionary<string, object>? Meta { get; set; }
+    public Instant? ActivatedAt { get; set; }
+    public Instant? ExpiredAt { get; set; }
+    public Guid AccountId { get; set; }
+
+    public Shared.Proto.BadgeReferenceObject ToProtoValue()
+    {
+        var proto = new Shared.Proto.BadgeReferenceObject
+        {
+            Id = Id.ToString(),
+            Type = Type,
+            Label = Label ?? string.Empty,
+            Caption = Caption ?? string.Empty,
+            ActivatedAt = ActivatedAt?.ToTimestamp(),
+            ExpiredAt = ExpiredAt?.ToTimestamp(),
+            AccountId = AccountId.ToString()
+        };
+        if (Meta is not null)
+            proto.Meta.Add(GrpcTypeHelper.ConvertToValueMap(Meta!));
+
+        return proto;
+    }
+}

DysonNetwork.Pass/Account/Event.cs

@@ -0,0 +1,66 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using DysonNetwork.Shared.Data;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public enum StatusAttitude
+{
+    Positive,
+    Negative,
+    Neutral
+}
+
+public class Status : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public StatusAttitude Attitude { get; set; }
+    [NotMapped] public bool IsOnline { get; set; }
+    [NotMapped] public bool IsCustomized { get; set; } = true;
+    public bool IsInvisible { get; set; }
+    public bool IsNotDisturb { get; set; }
+    [MaxLength(1024)] public string? Label { get; set; }
+    public Instant? ClearedAt { get; set; }
+    
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+}
+
+public enum CheckInResultLevel
+{
+    Worst,
+    Worse,
+    Normal,
+    Better,
+    Best
+}
+
+public class CheckInResult : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public CheckInResultLevel Level { get; set; }
+    public decimal? RewardPoints { get; set; }
+    public int? RewardExperience { get; set; }
+    [Column(TypeName = "jsonb")] public ICollection<FortuneTip> Tips { get; set; } = new List<FortuneTip>();
+    
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+}
+
+public class FortuneTip
+{
+    public bool IsPositive { get; set; }
+    public string Title { get; set; } = null!;
+    public string Content { get; set; } = null!;
+}
+
+/// <summary>
+/// This method should not be mapped. Used to generate the daily event calendar.
+/// </summary>
+public class DailyEventResponse
+{
+    public Instant Date { get; set; }
+    public CheckInResult? CheckInResult { get; set; }
+    public ICollection<Status> Statuses { get; set; } = new List<Status>();
+}

DysonNetwork.Pass/Account/MagicSpell.cs

@@ -0,0 +1,31 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public enum MagicSpellType
+{
+    AccountActivation,
+    AccountDeactivation,
+    AccountRemoval,
+    AuthPasswordReset,
+    ContactVerification,
+}
+
+[Index(nameof(Spell), IsUnique = true)]
+public class MagicSpell : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [JsonIgnore] [MaxLength(1024)] public string Spell { get; set; } = null!;
+    public MagicSpellType Type { get; set; }
+    public Instant? ExpiresAt { get; set; }
+    public Instant? AffectedAt { get; set; }
+    [Column(TypeName = "jsonb")] public Dictionary<string, object> Meta { get; set; } = new();
+
+    public Guid? AccountId { get; set; }
+    public Account? Account { get; set; }
+}

DysonNetwork.Pass/Account/MagicSpellController.cs

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace DysonNetwork.Pass.Account;
+
+[ApiController]
+[Route("/api/spells")]
+public class MagicSpellController(AppDatabase db, MagicSpellService sp) : ControllerBase
+{
+    [HttpPost("{spellId:guid}/resend")]
+    public async Task<ActionResult> ResendMagicSpell(Guid spellId)
+    {
+        var spell = db.MagicSpells.FirstOrDefault(x => x.Id == spellId);
+        if (spell == null)
+            return NotFound();
+    
+        await sp.NotifyMagicSpell(spell, true);
+        return Ok();
+    }
+}

DysonNetwork.Pass/Account/MagicSpellService.cs

@@ -0,0 +1,247 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+using DysonNetwork.Pass.Permission;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Localization;
+using NodaTime;
+using EmailResource = DysonNetwork.Pass.Localization.EmailResource;
+
+namespace DysonNetwork.Pass.Account;
+
+public class MagicSpellService(
+    AppDatabase db,
+    IConfiguration configuration,
+    ILogger<MagicSpellService> logger,
+    IStringLocalizer<EmailResource> localizer
+)
+{
+    public async Task<MagicSpell> CreateMagicSpell(
+        Account account,
+        MagicSpellType type,
+        Dictionary<string, object> meta,
+        Instant? expiredAt = null,
+        Instant? affectedAt = null,
+        bool preventRepeat = false
+    )
+    {
+        if (preventRepeat)
+        {
+            var now = SystemClock.Instance.GetCurrentInstant();
+            var existingSpell = await db.MagicSpells
+                .Where(s => s.AccountId == account.Id)
+                .Where(s => s.Type == type)
+                .Where(s => s.ExpiresAt == null || s.ExpiresAt > now)
+                .FirstOrDefaultAsync();
+
+            if (existingSpell != null)
+            {
+                throw new InvalidOperationException($"Account already has an active magic spell of type {type}");
+            }
+        }
+
+        var spellWord = _GenerateRandomString(128);
+        var spell = new MagicSpell
+        {
+            Spell = spellWord,
+            Type = type,
+            ExpiresAt = expiredAt,
+            AffectedAt = affectedAt,
+            AccountId = account.Id,
+            Meta = meta
+        };
+
+        db.MagicSpells.Add(spell);
+        await db.SaveChangesAsync();
+
+        return spell;
+    }
+
+    public async Task NotifyMagicSpell(MagicSpell spell, bool bypassVerify = false)
+    {
+        var contact = await db.AccountContacts
+            .Where(c => c.Account.Id == spell.AccountId)
+            .Where(c => c.Type == AccountContactType.Email)
+            .Where(c => c.VerifiedAt != null || bypassVerify)
+            .OrderByDescending(c => c.IsPrimary)
+            .Include(c => c.Account)
+            .FirstOrDefaultAsync();
+        if (contact is null) throw new ArgumentException("Account has no contact method that can use");
+
+        var link = $"{configuration.GetValue<string>("BaseUrl")}/spells/{Uri.EscapeDataString(spell.Spell)}";
+
+        logger.LogInformation("Sending magic spell... {Link}", link);
+
+        var accountLanguage = await db.Accounts
+            .Where(a => a.Id == spell.AccountId)
+            .Select(a => a.Language)
+            .FirstOrDefaultAsync();
+        AccountService.SetCultureInfo(accountLanguage);
+
+        try
+        {
+            // switch (spell.Type)
+            // {
+            //     case MagicSpellType.AccountActivation:
+            //         await email.SendTemplatedEmailAsync<LandingEmail, LandingEmailModel>(
+            //             contact.Account.Nick,
+            //             contact.Content,
+            //             localizer["EmailLandingTitle"],
+            //             new LandingEmailModel
+            //             {
+            //                 Name = contact.Account.Name,
+            //                 Link = link
+            //             }
+            //         );
+            //         break;
+            //     case MagicSpellType.AccountRemoval:
+            //         await email.SendTemplatedEmailAsync<AccountDeletionEmail, AccountDeletionEmailModel>(
+            //             contact.Account.Nick,
+            //             contact.Content,
+            //             localizer["EmailAccountDeletionTitle"],
+            //             new AccountDeletionEmailModel
+            //             {
+            //                 Name = contact.Account.Name,
+            //                 Link = link
+            //             }
+            //         );
+            //         break;
+            //     case MagicSpellType.AuthPasswordReset:
+            //         await email.SendTemplatedEmailAsync<PasswordResetEmail, PasswordResetEmailModel>(
+            //             contact.Account.Nick,
+            //             contact.Content,
+            //             localizer["EmailAccountDeletionTitle"],
+            //             new PasswordResetEmailModel
+            //             {
+            //                 Name = contact.Account.Name,
+            //                 Link = link
+            //             }
+            //         );
+            //         break;
+            //     case MagicSpellType.ContactVerification:
+            //         if (spell.Meta["contact_method"] is not string contactMethod)
+            //             throw new InvalidOperationException("Contact method is not found.");
+            //         await email.SendTemplatedEmailAsync<ContactVerificationEmail, ContactVerificationEmailModel>(
+            //             contact.Account.Nick,
+            //             contactMethod!,
+            //             localizer["EmailContactVerificationTitle"],
+            //             new ContactVerificationEmailModel
+            //             {
+            //                 Name = contact.Account.Name,
+            //                 Link = link
+            //             }
+            //         );
+            //         break;
+            //     default:
+            //         throw new ArgumentOutOfRangeException();
+            // }
+        }
+        catch (Exception err)
+        {
+            logger.LogError($"Error sending magic spell (${spell.Spell})... {err}");
+        }
+    }
+
+    public async Task ApplyMagicSpell(MagicSpell spell)
+    {
+        switch (spell.Type)
+        {
+            case MagicSpellType.AuthPasswordReset:
+                throw new ArgumentException(
+                    "For password reset spell, please use the ApplyPasswordReset method instead."
+                );
+            case MagicSpellType.AccountRemoval:
+                var account = await db.Accounts.FirstOrDefaultAsync(c => c.Id == spell.AccountId);
+                if (account is null) break;
+                db.Accounts.Remove(account);
+                break;
+            case MagicSpellType.AccountActivation:
+                var contactMethod = (spell.Meta["contact_method"] as JsonElement? ?? default).ToString();
+                var contact = await
+                    db.AccountContacts.FirstOrDefaultAsync(c =>
+                        c.Content == contactMethod
+                    );
+                if (contact is not null)
+                {
+                    contact.VerifiedAt = SystemClock.Instance.GetCurrentInstant();
+                    db.Update(contact);
+                }
+
+                account = await db.Accounts.FirstOrDefaultAsync(c => c.Id == spell.AccountId);
+                if (account is not null)
+                {
+                    account.ActivatedAt = SystemClock.Instance.GetCurrentInstant();
+                    db.Update(account);
+                }
+
+                var defaultGroup = await db.PermissionGroups.FirstOrDefaultAsync(g => g.Key == "default");
+                if (defaultGroup is not null && account is not null)
+                {
+                    db.PermissionGroupMembers.Add(new PermissionGroupMember
+                    {
+                        Actor = $"user:{account.Id}",
+                        Group = defaultGroup
+                    });
+                }
+
+                break;
+            case MagicSpellType.ContactVerification:
+                var verifyContactMethod = (spell.Meta["contact_method"] as JsonElement? ?? default).ToString();
+                var verifyContact = await db.AccountContacts
+                    .FirstOrDefaultAsync(c => c.Content == verifyContactMethod);
+                if (verifyContact is not null)
+                {
+                    verifyContact.VerifiedAt = SystemClock.Instance.GetCurrentInstant();
+                    db.Update(verifyContact);
+                }
+
+                break;
+            default:
+                throw new ArgumentOutOfRangeException();
+        }
+
+        db.Remove(spell);
+        await db.SaveChangesAsync();
+    }
+
+    public async Task ApplyPasswordReset(MagicSpell spell, string newPassword)
+    {
+        if (spell.Type != MagicSpellType.AuthPasswordReset)
+            throw new ArgumentException("This spell is not a password reset spell.");
+
+        var passwordFactor = await db.AccountAuthFactors
+            .Include(f => f.Account)
+            .Where(f => f.Type == AccountAuthFactorType.Password && f.Account.Id == spell.AccountId)
+            .FirstOrDefaultAsync();
+        if (passwordFactor is null)
+        {
+            var account = await db.Accounts.FirstOrDefaultAsync(c => c.Id == spell.AccountId);
+            if (account is null) throw new InvalidOperationException("Both account and auth factor was not found.");
+            passwordFactor = new AccountAuthFactor
+            {
+                Type = AccountAuthFactorType.Password,
+                Account = account,
+                Secret = newPassword
+            }.HashSecret();
+            db.AccountAuthFactors.Add(passwordFactor);
+        }
+        else
+        {
+            passwordFactor.Secret = newPassword;
+            passwordFactor.HashSecret();
+            db.Update(passwordFactor);
+        }
+
+        await db.SaveChangesAsync();
+    }
+
+    private static string _GenerateRandomString(int length)
+    {
+        using var rng = RandomNumberGenerator.Create();
+        var randomBytes = new byte[length];
+        rng.GetBytes(randomBytes);
+
+        var base64String = Convert.ToBase64String(randomBytes);
+
+        return base64String.Substring(0, length);
+    }
+}

DysonNetwork.Pass/Account/Notification.cs

@@ -0,0 +1,42 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public class Notification : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Topic { get; set; } = null!;
+    [MaxLength(1024)] public string? Title { get; set; }
+    [MaxLength(2048)] public string? Subtitle { get; set; }
+    [MaxLength(4096)] public string? Content { get; set; }
+    [Column(TypeName = "jsonb")] public Dictionary<string, object>? Meta { get; set; }
+    public int Priority { get; set; } = 10;
+    public Instant? ViewedAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+}
+
+public enum NotificationPushProvider
+{
+    Apple,
+    Google
+}
+
+[Index(nameof(DeviceToken), nameof(DeviceId), nameof(AccountId), IsUnique = true)]
+public class NotificationPushSubscription : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(4096)] public string DeviceId { get; set; } = null!;
+    [MaxLength(4096)] public string DeviceToken { get; set; } = null!;
+    public NotificationPushProvider Provider { get; set; }
+    public Instant? LastUsedAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account Account { get; set; } = null!;
+}

DysonNetwork.Pass/Account/Relationship.cs

@@ -0,0 +1,23 @@
+using DysonNetwork.Shared.Data;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public enum RelationshipStatus : short
+{
+    Friends = 100,
+    Pending = 0,
+    Blocked = -100
+}
+
+public class Relationship : ModelBase
+{
+    public Guid AccountId { get; set; }
+    public Account Account { get; set; } = null!;
+    public Guid RelatedId { get; set; }
+    public Account Related { get; set; } = null!;
+
+    public Instant? ExpiredAt { get; set; }
+
+    public RelationshipStatus Status { get; set; } = RelationshipStatus.Pending;
+}

DysonNetwork.Pass/Account/RelationshipController.cs

@@ -0,0 +1,253 @@
+using System.ComponentModel.DataAnnotations;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+[ApiController]
+[Route("/api/relationships")]
+public class RelationshipController(AppDatabase db, RelationshipService rels) : ControllerBase
+{
+    [HttpGet]
+    [Authorize]
+    public async Task<ActionResult<List<Relationship>>> ListRelationships([FromQuery] int offset = 0,
+        [FromQuery] int take = 20)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+        var userId = currentUser.Id;
+
+        var query = db.AccountRelationships.AsQueryable()
+            .Where(r => r.RelatedId == userId);
+        var totalCount = await query.CountAsync();
+        var relationships = await query
+            .Include(r => r.Related)
+            .Include(r => r.Related.Profile)
+            .Include(r => r.Account)
+            .Include(r => r.Account.Profile)
+            .Skip(offset)
+            .Take(take)
+            .ToListAsync();
+
+        var statuses = await db.AccountRelationships
+            .Where(r => r.AccountId == userId)
+            .ToDictionaryAsync(r => r.RelatedId);
+        foreach (var relationship in relationships)
+            if (statuses.TryGetValue(relationship.RelatedId, out var status))
+                relationship.Status = status.Status;
+
+        Response.Headers["X-Total"] = totalCount.ToString();
+
+        return relationships;
+    }
+
+    [HttpGet("requests")]
+    [Authorize]
+    public async Task<ActionResult<List<Relationship>>> ListSentRequests()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relationships = await db.AccountRelationships
+            .Where(r => r.AccountId == currentUser.Id && r.Status == RelationshipStatus.Pending)
+            .Include(r => r.Related)
+            .Include(r => r.Related.Profile)
+            .Include(r => r.Account)
+            .Include(r => r.Account.Profile)
+            .ToListAsync();
+
+        return relationships;
+    }
+
+    public class RelationshipRequest
+    {
+        [Required] public RelationshipStatus Status { get; set; }
+    }
+
+    [HttpPost("{userId:guid}")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> CreateRelationship(Guid userId,
+        [FromBody] RelationshipRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relatedUser = await db.Accounts.FindAsync(userId);
+        if (relatedUser is null) return NotFound("Account was not found.");
+
+        try
+        {
+            var relationship = await rels.CreateRelationship(
+                currentUser, relatedUser, request.Status
+            );
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+
+    [HttpPatch("{userId:guid}")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> UpdateRelationship(Guid userId,
+        [FromBody] RelationshipRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            var relationship = await rels.UpdateRelationship(currentUser.Id, userId, request.Status);
+            return relationship;
+        }
+        catch (ArgumentException err)
+        {
+            return NotFound(err.Message);
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+
+    [HttpGet("{userId:guid}")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> GetRelationship(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var now = Instant.FromDateTimeUtc(DateTime.UtcNow);
+        var queries = db.AccountRelationships.AsQueryable()
+            .Where(r => r.AccountId == currentUser.Id && r.RelatedId == userId)
+            .Where(r => r.ExpiredAt == null || r.ExpiredAt > now);
+        var relationship = await queries
+            .Include(r => r.Related)
+            .Include(r => r.Related.Profile)
+            .FirstOrDefaultAsync();
+        if (relationship is null) return NotFound();
+
+        relationship.Account = currentUser;
+        return Ok(relationship);
+    }
+
+    [HttpPost("{userId:guid}/friends")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> SendFriendRequest(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relatedUser = await db.Accounts.FindAsync(userId);
+        if (relatedUser is null) return NotFound("Account was not found.");
+
+        var existing = await db.AccountRelationships.FirstOrDefaultAsync(r =>
+            (r.AccountId == currentUser.Id && r.RelatedId == userId) ||
+            (r.AccountId == userId && r.RelatedId == currentUser.Id));
+        if (existing != null) return BadRequest("Relationship already exists.");
+
+        try
+        {
+            var relationship = await rels.SendFriendRequest(currentUser, relatedUser);
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+
+    [HttpDelete("{userId:guid}/friends")]
+    [Authorize]
+    public async Task<ActionResult> DeleteFriendRequest(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        try
+        {
+            await rels.DeleteFriendRequest(currentUser.Id, userId);
+            return NoContent();
+        }
+        catch (ArgumentException err)
+        {
+            return NotFound(err.Message);
+        }
+    }
+
+    [HttpPost("{userId:guid}/friends/accept")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> AcceptFriendRequest(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relationship = await rels.GetRelationship(userId, currentUser.Id, RelationshipStatus.Pending);
+        if (relationship is null) return NotFound("Friend request was not found.");
+
+        try
+        {
+            relationship = await rels.AcceptFriendRelationship(relationship);
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+
+    [HttpPost("{userId:guid}/friends/decline")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> DeclineFriendRequest(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relationship = await rels.GetRelationship(userId, currentUser.Id, RelationshipStatus.Pending);
+        if (relationship is null) return NotFound("Friend request was not found.");
+
+        try
+        {
+            relationship = await rels.AcceptFriendRelationship(relationship, status: RelationshipStatus.Blocked);
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+
+    [HttpPost("{userId:guid}/block")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> BlockUser(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relatedUser = await db.Accounts.FindAsync(userId);
+        if (relatedUser is null) return NotFound("Account was not found.");
+
+        try
+        {
+            var relationship = await rels.BlockAccount(currentUser, relatedUser);
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+    
+    [HttpDelete("{userId:guid}/block")]
+    [Authorize]
+    public async Task<ActionResult<Relationship>> UnblockUser(Guid userId)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account currentUser) return Unauthorized();
+
+        var relatedUser = await db.Accounts.FindAsync(userId);
+        if (relatedUser is null) return NotFound("Account was not found.");
+
+        try
+        {
+            var relationship = await rels.UnblockAccount(currentUser, relatedUser);
+            return relationship;
+        }
+        catch (InvalidOperationException err)
+        {
+            return BadRequest(err.Message);
+        }
+    }
+}

DysonNetwork.Pass/Account/RelationshipService.cs

@@ -0,0 +1,207 @@
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Account;
+
+public class RelationshipService(AppDatabase db, ICacheService cache)
+{
+    private const string UserFriendsCacheKeyPrefix = "accounts:friends:";
+    private const string UserBlockedCacheKeyPrefix = "accounts:blocked:";
+    
+    public async Task<bool> HasExistingRelationship(Guid accountId, Guid relatedId)
+    {
+        var count = await db.AccountRelationships
+            .Where(r => (r.AccountId == accountId && r.RelatedId == relatedId) ||
+                        (r.AccountId == relatedId && r.AccountId == accountId))
+            .CountAsync();
+        return count > 0;
+    }
+
+    public async Task<Relationship?> GetRelationship(
+        Guid accountId,
+        Guid relatedId,
+        RelationshipStatus? status = null,
+        bool ignoreExpired = false
+    )
+    {
+        var now = Instant.FromDateTimeUtc(DateTime.UtcNow);
+        var queries = db.AccountRelationships.AsQueryable()
+            .Where(r => r.AccountId == accountId && r.RelatedId == relatedId);
+        if (!ignoreExpired) queries = queries.Where(r => r.ExpiredAt == null || r.ExpiredAt > now);
+        if (status is not null) queries = queries.Where(r => r.Status == status);
+        var relationship = await queries.FirstOrDefaultAsync();
+        return relationship;
+    }
+
+    public async Task<Relationship> CreateRelationship(Account sender, Account target, RelationshipStatus status)
+    {
+        if (status == RelationshipStatus.Pending)
+            throw new InvalidOperationException(
+                "Cannot create relationship with pending status, use SendFriendRequest instead.");
+        if (await HasExistingRelationship(sender.Id, target.Id))
+            throw new InvalidOperationException("Found existing relationship between you and target user.");
+
+        var relationship = new Relationship
+        {
+            AccountId = sender.Id,
+            RelatedId = target.Id,
+            Status = status
+        };
+
+        db.AccountRelationships.Add(relationship);
+        await db.SaveChangesAsync();
+        
+        await PurgeRelationshipCache(sender.Id, target.Id);
+
+        return relationship;
+    }
+
+    public async Task<Relationship> BlockAccount(Account sender, Account target)
+    {
+        if (await HasExistingRelationship(sender.Id, target.Id))
+            return await UpdateRelationship(sender.Id, target.Id, RelationshipStatus.Blocked);
+        return await CreateRelationship(sender, target, RelationshipStatus.Blocked);
+    }
+    
+    public async Task<Relationship> UnblockAccount(Account sender, Account target)
+    {
+        var relationship = await GetRelationship(sender.Id, target.Id, RelationshipStatus.Blocked);
+        if (relationship is null) throw new ArgumentException("There is no relationship between you and the user.");
+        db.Remove(relationship);
+        await db.SaveChangesAsync();
+        
+        await PurgeRelationshipCache(sender.Id, target.Id);
+        
+        return relationship;
+    }
+
+    public async Task<Relationship> SendFriendRequest(Account sender, Account target)
+    {
+        if (await HasExistingRelationship(sender.Id, target.Id))
+            throw new InvalidOperationException("Found existing relationship between you and target user.");
+
+        var relationship = new Relationship
+        {
+            AccountId = sender.Id,
+            RelatedId = target.Id,
+            Status = RelationshipStatus.Pending,
+            ExpiredAt = Instant.FromDateTimeUtc(DateTime.UtcNow.AddDays(7))
+        };
+
+        db.AccountRelationships.Add(relationship);
+        await db.SaveChangesAsync();
+
+        return relationship;
+    }
+    
+    public async Task DeleteFriendRequest(Guid accountId, Guid relatedId)
+    {
+        var relationship = await GetRelationship(accountId, relatedId, RelationshipStatus.Pending);
+        if (relationship is null) throw new ArgumentException("Friend request was not found.");
+    
+        await db.AccountRelationships
+            .Where(r => r.AccountId == accountId && r.RelatedId == relatedId && r.Status == RelationshipStatus.Pending)
+            .ExecuteDeleteAsync();
+        
+        await PurgeRelationshipCache(relationship.AccountId, relationship.RelatedId);
+    }
+    
+    public async Task<Relationship> AcceptFriendRelationship(
+        Relationship relationship,
+        RelationshipStatus status = RelationshipStatus.Friends
+    )
+    {
+        if (relationship.Status != RelationshipStatus.Pending)
+            throw new ArgumentException("Cannot accept friend request that not in pending status.");
+        if (status == RelationshipStatus.Pending)
+            throw new ArgumentException("Cannot accept friend request by setting the new status to pending.");
+
+        // Whatever the receiver decides to apply which status to the relationship,
+        // the sender should always see the user as a friend since the sender ask for it
+        relationship.Status = RelationshipStatus.Friends;
+        relationship.ExpiredAt = null;
+        db.Update(relationship);
+
+        var relationshipBackward = new Relationship
+        {
+            AccountId = relationship.RelatedId,
+            RelatedId = relationship.AccountId,
+            Status = status
+        };
+        db.AccountRelationships.Add(relationshipBackward);
+
+        await db.SaveChangesAsync();
+
+        await PurgeRelationshipCache(relationship.AccountId, relationship.RelatedId);
+
+        return relationshipBackward;
+    }
+
+    public async Task<Relationship> UpdateRelationship(Guid accountId, Guid relatedId, RelationshipStatus status)
+    {
+        var relationship = await GetRelationship(accountId, relatedId);
+        if (relationship is null) throw new ArgumentException("There is no relationship between you and the user.");
+        if (relationship.Status == status) return relationship;
+        relationship.Status = status;
+        db.Update(relationship);
+        await db.SaveChangesAsync();
+        
+        await PurgeRelationshipCache(accountId, relatedId);
+        
+        return relationship;
+    }
+
+    public async Task<List<Guid>> ListAccountFriends(Account account)
+    {
+        var cacheKey = $"{UserFriendsCacheKeyPrefix}{account.Id}";
+        var friends = await cache.GetAsync<List<Guid>>(cacheKey);
+        
+        if (friends == null)
+        {
+            friends = await db.AccountRelationships
+                .Where(r => r.RelatedId == account.Id)
+                .Where(r => r.Status == RelationshipStatus.Friends)
+                .Select(r => r.AccountId)
+                .ToListAsync();
+                
+            await cache.SetAsync(cacheKey, friends, TimeSpan.FromHours(1));
+        }
+
+        return friends ?? [];
+    }
+    
+    public async Task<List<Guid>> ListAccountBlocked(Account account)
+    {
+        var cacheKey = $"{UserBlockedCacheKeyPrefix}{account.Id}";
+        var blocked = await cache.GetAsync<List<Guid>>(cacheKey);
+        
+        if (blocked == null)
+        {
+            blocked = await db.AccountRelationships
+                .Where(r => r.RelatedId == account.Id)
+                .Where(r => r.Status == RelationshipStatus.Blocked)
+                .Select(r => r.AccountId)
+                .ToListAsync();
+                
+            await cache.SetAsync(cacheKey, blocked, TimeSpan.FromHours(1));
+        }
+
+        return blocked ?? [];
+    }
+
+    public async Task<bool> HasRelationshipWithStatus(Guid accountId, Guid relatedId,
+        RelationshipStatus status = RelationshipStatus.Friends)
+    {
+        var relationship = await GetRelationship(accountId, relatedId, status);
+        return relationship is not null;
+    }
+    
+    private async Task PurgeRelationshipCache(Guid accountId, Guid relatedId)
+    {
+        await cache.RemoveAsync($"{UserFriendsCacheKeyPrefix}{accountId}");
+        await cache.RemoveAsync($"{UserFriendsCacheKeyPrefix}{relatedId}");
+        await cache.RemoveAsync($"{UserBlockedCacheKeyPrefix}{accountId}");
+        await cache.RemoveAsync($"{UserBlockedCacheKeyPrefix}{relatedId}");
+    }
+}

DysonNetwork.Pass/Account/VerificationMark.cs

@@ -0,0 +1,50 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace DysonNetwork.Pass.Account;
+
+/// <summary>
+/// The verification info of a resource
+/// stands, for it is really an individual or organization or a company in the real world.
+/// Besides, it can also be use for mark parody or fake.
+/// </summary>
+public class VerificationMark
+{
+    public VerificationMarkType Type { get; set; }
+    [MaxLength(1024)] public string? Title { get; set; }
+    [MaxLength(8192)] public string? Description { get; set; }
+    [MaxLength(1024)] public string? VerifiedBy { get; set; }
+
+    public Shared.Proto.VerificationMark ToProtoValue()
+    {
+        var proto = new Shared.Proto.VerificationMark
+        {
+            Type = Type switch
+            {
+                VerificationMarkType.Official => Shared.Proto.VerificationMarkType.Official,
+                VerificationMarkType.Individual => Shared.Proto.VerificationMarkType.Individual,
+                VerificationMarkType.Organization => Shared.Proto.VerificationMarkType.Organization,
+                VerificationMarkType.Government => Shared.Proto.VerificationMarkType.Government,
+                VerificationMarkType.Creator => Shared.Proto.VerificationMarkType.Creator,
+                VerificationMarkType.Developer => Shared.Proto.VerificationMarkType.Developer,
+                VerificationMarkType.Parody => Shared.Proto.VerificationMarkType.Parody,
+                _ => Shared.Proto.VerificationMarkType.Unspecified
+            },
+            Title = Title ?? string.Empty,
+            Description = Description ?? string.Empty,
+            VerifiedBy = VerifiedBy ?? string.Empty
+        };
+
+        return proto;
+    }
+}
+
+public enum VerificationMarkType
+{
+    Official,
+    Individual,
+    Organization,
+    Government,
+    Creator,
+    Developer,
+    Parody
+}

DysonNetwork.Pass/AppDatabase.cs

@@ -0,0 +1,276 @@
+using System.Linq.Expressions;
+using System.Reflection;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Pass.Auth;
+using DysonNetwork.Pass.Developer;
+using DysonNetwork.Pass.Permission;
+using DysonNetwork.Pass.Wallet;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Design;
+using Microsoft.EntityFrameworkCore.Query;
+using NodaTime;
+using Quartz;
+
+namespace DysonNetwork.Pass;
+
+public class AppDatabase(
+    DbContextOptions<AppDatabase> options,
+    IConfiguration configuration
+) : DbContext(options)
+{
+    public DbSet<PermissionNode> PermissionNodes { get; set; }
+    public DbSet<PermissionGroup> PermissionGroups { get; set; }
+    public DbSet<PermissionGroupMember> PermissionGroupMembers { get; set; }
+
+    public DbSet<MagicSpell> MagicSpells { get; set; }
+    public DbSet<Account.Account> Accounts { get; set; }
+    public DbSet<AccountConnection> AccountConnections { get; set; }
+    public DbSet<AccountProfile> AccountProfiles { get; set; }
+    public DbSet<AccountContact> AccountContacts { get; set; }
+    public DbSet<AccountAuthFactor> AccountAuthFactors { get; set; }
+    public DbSet<Relationship> AccountRelationships { get; set; }
+    public DbSet<Status> AccountStatuses { get; set; }
+    public DbSet<CheckInResult> AccountCheckInResults { get; set; }
+    public DbSet<Notification> Notifications { get; set; }
+    public DbSet<NotificationPushSubscription> NotificationPushSubscriptions { get; set; }
+    public DbSet<AccountBadge> Badges { get; set; }
+    public DbSet<ActionLog> ActionLogs { get; set; }
+    public DbSet<AbuseReport> AbuseReports { get; set; }
+
+    public DbSet<AuthSession> AuthSessions { get; set; }
+    public DbSet<AuthChallenge> AuthChallenges { get; set; }
+    
+    public DbSet<Wallet.Wallet> Wallets { get; set; }
+    public DbSet<WalletPocket> WalletPockets { get; set; }
+    public DbSet<Order> PaymentOrders { get; set; }
+    public DbSet<Transaction> PaymentTransactions { get; set; }
+    public DbSet<Subscription> WalletSubscriptions { get; set; }
+    public DbSet<Coupon> WalletCoupons { get; set; }
+    
+    public DbSet<CustomApp> CustomApps { get; set; }
+    public DbSet<CustomAppSecret> CustomAppSecrets { get; set; }
+
+    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
+    {
+        optionsBuilder.UseNpgsql(
+            configuration.GetConnectionString("App"),
+            opt => opt
+                .ConfigureDataSource(optSource => optSource.EnableDynamicJson())
+                .UseQuerySplittingBehavior(QuerySplittingBehavior.SplitQuery)
+                .UseNetTopologySuite()
+                .UseNodaTime()
+        ).UseSnakeCaseNamingConvention();
+
+        optionsBuilder.UseAsyncSeeding(async (context, _, cancellationToken) =>
+        {
+            var defaultPermissionGroup = await context.Set<PermissionGroup>()
+                .FirstOrDefaultAsync(g => g.Key == "default", cancellationToken);
+            if (defaultPermissionGroup is null)
+            {
+                context.Set<PermissionGroup>().Add(new PermissionGroup
+                {
+                    Key = "default",
+                    Nodes = new List<string>
+                        {
+                            "posts.create",
+                            "posts.react",
+                            "publishers.create",
+                            "files.create",
+                            "chat.create",
+                            "chat.messages.create",
+                            "chat.realtime.create",
+                            "accounts.statuses.create",
+                            "accounts.statuses.update",
+                            "stickers.packs.create",
+                            "stickers.create"
+                        }.Select(permission =>
+                            PermissionService.NewPermissionNode("group:default", "global", permission, true))
+                        .ToList()
+                });
+                await context.SaveChangesAsync(cancellationToken);
+            }
+        });
+
+        optionsBuilder.UseSeeding((context, _) => {});
+
+        base.OnConfiguring(optionsBuilder);
+    }
+
+    protected override void OnModelCreating(ModelBuilder modelBuilder)
+    {
+        base.OnModelCreating(modelBuilder);
+
+        modelBuilder.Entity<PermissionGroupMember>()
+            .HasKey(pg => new { pg.GroupId, pg.Actor });
+        modelBuilder.Entity<PermissionGroupMember>()
+            .HasOne(pg => pg.Group)
+            .WithMany(g => g.Members)
+            .HasForeignKey(pg => pg.GroupId)
+            .OnDelete(DeleteBehavior.Cascade);
+
+        modelBuilder.Entity<Relationship>()
+            .HasKey(r => new { FromAccountId = r.AccountId, ToAccountId = r.RelatedId });
+        modelBuilder.Entity<Relationship>()
+            .HasOne(r => r.Account)
+            .WithMany(a => a.OutgoingRelationships)
+            .HasForeignKey(r => r.AccountId);
+        modelBuilder.Entity<Relationship>()
+            .HasOne(r => r.Related)
+            .WithMany(a => a.IncomingRelationships)
+            .HasForeignKey(r => r.RelatedId);
+
+        // Automatically apply soft-delete filter to all entities inheriting BaseModel
+        foreach (var entityType in modelBuilder.Model.GetEntityTypes())
+        {
+            if (!typeof(ModelBase).IsAssignableFrom(entityType.ClrType)) continue;
+            var method = typeof(AppDatabase)
+                .GetMethod(nameof(SetSoftDeleteFilter),
+                    BindingFlags.NonPublic | BindingFlags.Static)!
+                .MakeGenericMethod(entityType.ClrType);
+
+            method.Invoke(null, [modelBuilder]);
+        }
+    }
+
+    private static void SetSoftDeleteFilter<TEntity>(ModelBuilder modelBuilder)
+        where TEntity : ModelBase
+    {
+        modelBuilder.Entity<TEntity>().HasQueryFilter(e => e.DeletedAt == null);
+    }
+
+    public override async Task<int> SaveChangesAsync(CancellationToken cancellationToken = default)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+
+        foreach (var entry in ChangeTracker.Entries<ModelBase>())
+        {
+            switch (entry.State)
+            {
+                case EntityState.Added:
+                    entry.Entity.CreatedAt = now;
+                    entry.Entity.UpdatedAt = now;
+                    break;
+                case EntityState.Modified:
+                    entry.Entity.UpdatedAt = now;
+                    break;
+                case EntityState.Deleted:
+                    entry.State = EntityState.Modified;
+                    entry.Entity.DeletedAt = now;
+                    break;
+                case EntityState.Detached:
+                case EntityState.Unchanged:
+                default:
+                    break;
+            }
+        }
+
+        return await base.SaveChangesAsync(cancellationToken);
+    }
+}
+
+public class AppDatabaseRecyclingJob(AppDatabase db, ILogger<AppDatabaseRecyclingJob> logger) : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+
+        logger.LogInformation("Cleaning up expired records...");
+
+        // Expired relationships
+        var affectedRows = await db.AccountRelationships
+            .Where(x => x.ExpiredAt != null && x.ExpiredAt <= now)
+            .ExecuteDeleteAsync();
+        logger.LogDebug("Removed {Count} records of expired relationships.", affectedRows);
+        // Expired permission group members
+        affectedRows = await db.PermissionGroupMembers
+            .Where(x => x.ExpiredAt != null && x.ExpiredAt <= now)
+            .ExecuteDeleteAsync();
+        logger.LogDebug("Removed {Count} records of expired permission group members.", affectedRows);
+
+        logger.LogInformation("Deleting soft-deleted records...");
+
+        var threshold = now - Duration.FromDays(7);
+
+        var entityTypes = db.Model.GetEntityTypes()
+            .Where(t => typeof(ModelBase).IsAssignableFrom(t.ClrType) && t.ClrType != typeof(ModelBase))
+            .Select(t => t.ClrType);
+
+        foreach (var entityType in entityTypes)
+        {
+            var set = (IQueryable)db.GetType().GetMethod(nameof(DbContext.Set), Type.EmptyTypes)!
+                .MakeGenericMethod(entityType).Invoke(db, null)!;
+            var parameter = Expression.Parameter(entityType, "e");
+            var property = Expression.Property(parameter, nameof(ModelBase.DeletedAt));
+            var condition = Expression.LessThan(property, Expression.Constant(threshold, typeof(Instant?)));
+            var notNull = Expression.NotEqual(property, Expression.Constant(null, typeof(Instant?)));
+            var finalCondition = Expression.AndAlso(notNull, condition);
+            var lambda = Expression.Lambda(finalCondition, parameter);
+
+            var queryable = set.Provider.CreateQuery(
+                Expression.Call(
+                    typeof(Queryable),
+                    "Where",
+                    [entityType],
+                    set.Expression,
+                    Expression.Quote(lambda)
+                )
+            );
+
+            var toListAsync = typeof(EntityFrameworkQueryableExtensions)
+                .GetMethod(nameof(EntityFrameworkQueryableExtensions.ToListAsync))!
+                .MakeGenericMethod(entityType);
+
+            var items = await (dynamic)toListAsync.Invoke(null, [queryable, CancellationToken.None])!;
+            db.RemoveRange(items);
+        }
+
+        await db.SaveChangesAsync();
+    }
+}
+
+public class AppDatabaseFactory : IDesignTimeDbContextFactory<AppDatabase>
+{
+    public AppDatabase CreateDbContext(string[] args)
+    {
+        var configuration = new ConfigurationBuilder()
+            .SetBasePath(Directory.GetCurrentDirectory())
+            .AddJsonFile("appsettings.json")
+            .Build();
+
+        var optionsBuilder = new DbContextOptionsBuilder<AppDatabase>();
+        return new AppDatabase(optionsBuilder.Options, configuration);
+    }
+}
+
+public static class OptionalQueryExtensions
+{
+    public static IQueryable<T> If<T>(
+        this IQueryable<T> source,
+        bool condition,
+        Func<IQueryable<T>, IQueryable<T>> transform
+    )
+    {
+        return condition ? transform(source) : source;
+    }
+
+    public static IQueryable<T> If<T, TP>(
+        this IIncludableQueryable<T, TP> source,
+        bool condition,
+        Func<IIncludableQueryable<T, TP>, IQueryable<T>> transform
+    )
+        where T : class
+    {
+        return condition ? transform(source) : source;
+    }
+
+    public static IQueryable<T> If<T, TP>(
+        this IIncludableQueryable<T, IEnumerable<TP>> source,
+        bool condition,
+        Func<IIncludableQueryable<T, IEnumerable<TP>>, IQueryable<T>> transform
+    )
+        where T : class
+    {
+        return condition ? transform(source) : source;
+    }
+}

DysonNetwork.Pass/Auth/Auth.cs

@@ -0,0 +1,273 @@
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text.Encodings.Web;
+using DysonNetwork.Pass.Account;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+using DysonNetwork.Pass.Auth.OidcProvider.Services;
+using DysonNetwork.Pass.Handlers;
+using DysonNetwork.Shared.Cache;
+using SystemClock = NodaTime.SystemClock;
+
+namespace DysonNetwork.Pass.Auth;
+
+public static class AuthConstants
+{
+    public const string SchemeName = "DysonToken";
+    public const string TokenQueryParamName = "tk";
+    public const string CookieTokenName = "AuthToken";
+}
+
+public enum TokenType
+{
+    AuthKey,
+    ApiKey,
+    OidcKey,
+    Unknown
+}
+
+public class TokenInfo
+{
+    public string Token { get; set; } = string.Empty;
+    public TokenType Type { get; set; } = TokenType.Unknown;
+}
+
+public class DysonTokenAuthOptions : AuthenticationSchemeOptions;
+
+public class DysonTokenAuthHandler(
+    IOptionsMonitor<DysonTokenAuthOptions> options,
+    IConfiguration configuration,
+    ILoggerFactory logger,
+    UrlEncoder encoder,
+    AppDatabase database,
+    OidcProviderService oidc,
+    ICacheService cache,
+    FlushBufferService fbs
+)
+    : AuthenticationHandler<DysonTokenAuthOptions>(options, logger, encoder)
+{
+    public const string AuthCachePrefix = "auth:";
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        var tokenInfo = _ExtractToken(Request);
+
+        if (tokenInfo == null || string.IsNullOrEmpty(tokenInfo.Token))
+            return AuthenticateResult.Fail("No token was provided.");
+
+        try
+        {
+            var now = SystemClock.Instance.GetCurrentInstant();
+
+            // Validate token and extract session ID
+            if (!ValidateToken(tokenInfo.Token, out var sessionId))
+                return AuthenticateResult.Fail("Invalid token.");
+
+            // Try to get session from cache first
+            var session = await cache.GetAsync<AuthSession>($"{AuthCachePrefix}{sessionId}");
+
+            // If not in cache, load from database
+            if (session is null)
+            {
+                session = await database.AuthSessions
+                    .Where(e => e.Id == sessionId)
+                    .Include(e => e.Challenge)
+                    .Include(e => e.Account)
+                    .ThenInclude(e => e.Profile)
+                    .FirstOrDefaultAsync();
+
+                if (session is not null)
+                {
+                    // Store in cache for future requests
+                    await cache.SetWithGroupsAsync(
+                        $"auth:{sessionId}",
+                        session,
+                        [$"{AccountService.AccountCachePrefix}{session.Account.Id}"],
+                        TimeSpan.FromHours(1)
+                    );
+                }
+            }
+
+            // Check if the session exists
+            if (session == null)
+                return AuthenticateResult.Fail("Session not found.");
+
+            // Check if the session is expired
+            if (session.ExpiredAt.HasValue && session.ExpiredAt.Value < now)
+                return AuthenticateResult.Fail("Session expired.");
+
+            // Store user and session in the HttpContext.Items for easy access in controllers
+            Context.Items["CurrentUser"] = session.Account;
+            Context.Items["CurrentSession"] = session;
+            Context.Items["CurrentTokenType"] = tokenInfo.Type.ToString();
+
+            // Create claims from the session
+            var claims = new List<Claim>
+            {
+                new("user_id", session.Account.Id.ToString()),
+                new("session_id", session.Id.ToString()),
+                new("token_type", tokenInfo.Type.ToString())
+            };
+
+            // Add scopes as claims
+            session.Challenge.Scopes.ForEach(scope => claims.Add(new Claim("scope", scope)));
+
+            // Add superuser claim if applicable
+            if (session.Account.IsSuperuser)
+                claims.Add(new Claim("is_superuser", "1"));
+
+            // Create the identity and principal
+            var identity = new ClaimsIdentity(claims, AuthConstants.SchemeName);
+            var principal = new ClaimsPrincipal(identity);
+
+            var ticket = new AuthenticationTicket(principal, AuthConstants.SchemeName);
+
+            var lastInfo = new LastActiveInfo
+            {
+                Account = session.Account,
+                Session = session,
+                SeenAt = SystemClock.Instance.GetCurrentInstant(),
+            };
+            fbs.Enqueue(lastInfo);
+
+            return AuthenticateResult.Success(ticket);
+        }
+        catch (Exception ex)
+        {
+            return AuthenticateResult.Fail($"Authentication failed: {ex.Message}");
+        }
+    }
+
+    private bool ValidateToken(string token, out Guid sessionId)
+    {
+        sessionId = Guid.Empty;
+
+        try
+        {
+            var parts = token.Split('.');
+
+            switch (parts.Length)
+            {
+                // Handle JWT tokens (3 parts)
+                case 3:
+                {
+                    var (isValid, jwtResult) = oidc.ValidateToken(token);
+                    if (!isValid) return false;
+                    var jti = jwtResult?.Claims.FirstOrDefault(c => c.Type == "jti")?.Value;
+                    if (jti is null) return false;
+
+                    return Guid.TryParse(jti, out sessionId);
+                }
+                // Handle compact tokens (2 parts)
+                case 2:
+                    // Original compact token validation logic
+                    try
+                    {
+                        // Decode the payload
+                        var payloadBytes = Base64UrlDecode(parts[0]);
+
+                        // Extract session ID
+                        sessionId = new Guid(payloadBytes);
+
+                        // Load public key for verification
+                        var publicKeyPem = File.ReadAllText(configuration["AuthToken:PublicKeyPath"]!);
+                        using var rsa = RSA.Create();
+                        rsa.ImportFromPem(publicKeyPem);
+
+                        // Verify signature
+                        var signature = Base64UrlDecode(parts[1]);
+                        return rsa.VerifyData(payloadBytes, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+                    }
+                    catch
+                    {
+                        return false;
+                    }
+
+                    break;
+                default:
+                    return false;
+            }
+        }
+        catch (Exception ex)
+        {
+            Logger.LogWarning(ex, "Token validation failed");
+            return false;
+        }
+    }
+
+    private static byte[] Base64UrlDecode(string base64Url)
+    {
+        var padded = base64Url
+            .Replace('-', '+')
+            .Replace('_', '/');
+
+        switch (padded.Length % 4)
+        {
+            case 2: padded += "=="; break;
+            case 3: padded += "="; break;
+        }
+
+        return Convert.FromBase64String(padded);
+    }
+
+    private TokenInfo? _ExtractToken(HttpRequest request)
+    {
+        // Check for token in query parameters
+        if (request.Query.TryGetValue(AuthConstants.TokenQueryParamName, out var queryToken))
+        {
+            return new TokenInfo
+            {
+                Token = queryToken.ToString(),
+                Type = TokenType.AuthKey
+            };
+        }
+
+
+        // Check for token in Authorization header
+        var authHeader = request.Headers.Authorization.ToString();
+        if (!string.IsNullOrEmpty(authHeader))
+        {
+            if (authHeader.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            {
+                var token = authHeader["Bearer ".Length..].Trim();
+                var parts = token.Split('.');
+                
+                return new TokenInfo
+                {
+                    Token = token,
+                    Type = parts.Length == 3 ? TokenType.OidcKey : TokenType.AuthKey
+                };
+            }
+            else if (authHeader.StartsWith("AtField ", StringComparison.OrdinalIgnoreCase))
+            {
+                return new TokenInfo
+                {
+                    Token = authHeader["AtField ".Length..].Trim(),
+                    Type = TokenType.AuthKey
+                };
+            }
+            else if (authHeader.StartsWith("AkField ", StringComparison.OrdinalIgnoreCase))
+            {
+                return new TokenInfo
+                {
+                    Token = authHeader["AkField ".Length..].Trim(),
+                    Type = TokenType.ApiKey
+                };
+            }
+        }
+
+        // Check for token in cookies
+        if (request.Cookies.TryGetValue(AuthConstants.CookieTokenName, out var cookieToken))
+        {
+            return new TokenInfo
+            {
+                Token = cookieToken,
+                Type = cookieToken.Count(c => c == '.') == 2 ? TokenType.OidcKey : TokenType.AuthKey
+            };
+        }
+
+
+        return null;
+    }
+}

DysonNetwork.Pass/Auth/AuthController.cs

@@ -0,0 +1,266 @@
+using System.ComponentModel.DataAnnotations;
+using Microsoft.AspNetCore.Mvc;
+using NodaTime;
+using Microsoft.EntityFrameworkCore;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.GeoIp;
+
+namespace DysonNetwork.Pass.Auth;
+
+[ApiController]
+[Route("/api/auth")]
+public class AuthController(
+    AppDatabase db,
+    AccountService accounts,
+    AuthService auth,
+    GeoIpService geo,
+    ActionLogService als
+) : ControllerBase
+{
+    public class ChallengeRequest
+    {
+        [Required] public ChallengePlatform Platform { get; set; }
+        [Required] [MaxLength(256)] public string Account { get; set; } = null!;
+        [Required] [MaxLength(512)] public string DeviceId { get; set; } = null!;
+        public List<string> Audiences { get; set; } = new();
+        public List<string> Scopes { get; set; } = new();
+    }
+
+    [HttpPost("challenge")]
+    public async Task<ActionResult<AuthChallenge>> StartChallenge([FromBody] ChallengeRequest request)
+    {
+        var account = await accounts.LookupAccount(request.Account);
+        if (account is null) return NotFound("Account was not found.");
+
+        var ipAddress = HttpContext.Connection.RemoteIpAddress?.ToString();
+        var userAgent = HttpContext.Request.Headers.UserAgent.ToString();
+
+        var now = Instant.FromDateTimeUtc(DateTime.UtcNow);
+
+        // Trying to pick up challenges from the same IP address and user agent
+        var existingChallenge = await db.AuthChallenges
+            .Where(e => e.Account == account)
+            .Where(e => e.IpAddress == ipAddress)
+            .Where(e => e.UserAgent == userAgent)
+            .Where(e => e.StepRemain > 0)
+            .Where(e => e.ExpiredAt != null && now < e.ExpiredAt)
+            .FirstOrDefaultAsync();
+        if (existingChallenge is not null) return existingChallenge;
+
+        var challenge = new AuthChallenge
+        {
+            ExpiredAt = Instant.FromDateTimeUtc(DateTime.UtcNow.AddHours(1)),
+            StepTotal = await auth.DetectChallengeRisk(Request, account),
+            Platform = request.Platform,
+            Audiences = request.Audiences,
+            Scopes = request.Scopes,
+            IpAddress = ipAddress,
+            UserAgent = userAgent,
+            Location = geo.GetPointFromIp(ipAddress),
+            DeviceId = request.DeviceId,
+            AccountId = account.Id
+        }.Normalize();
+
+        await db.AuthChallenges.AddAsync(challenge);
+        await db.SaveChangesAsync();
+
+        als.CreateActionLogFromRequest(ActionLogType.ChallengeAttempt,
+            new Dictionary<string, object> { { "challenge_id", challenge.Id } }, Request, account
+        );
+
+        return challenge;
+    }
+
+    [HttpGet("challenge/{id:guid}")]
+    public async Task<ActionResult<AuthChallenge>> GetChallenge([FromRoute] Guid id)
+    {
+        var challenge = await db.AuthChallenges
+            .Include(e => e.Account)
+            .ThenInclude(e => e.Profile)
+            .FirstOrDefaultAsync(e => e.Id == id);
+
+        return challenge is null 
+            ? NotFound("Auth challenge was not found.") 
+            : challenge;
+    }
+
+    [HttpGet("challenge/{id:guid}/factors")]
+    public async Task<ActionResult<List<AccountAuthFactor>>> GetChallengeFactors([FromRoute] Guid id)
+    {
+        var challenge = await db.AuthChallenges
+            .Include(e => e.Account)
+            .Include(e => e.Account.AuthFactors)
+            .Where(e => e.Id == id)
+            .FirstOrDefaultAsync();
+        return challenge is null
+            ? NotFound("Auth challenge was not found.")
+            : challenge.Account.AuthFactors.Where(e => e is { EnabledAt: not null, Trustworthy: >= 1 }).ToList();
+    }
+
+    [HttpPost("challenge/{id:guid}/factors/{factorId:guid}")]
+    public async Task<ActionResult> RequestFactorCode(
+        [FromRoute] Guid id,
+        [FromRoute] Guid factorId,
+        [FromBody] string? hint
+    )
+    {
+        var challenge = await db.AuthChallenges
+            .Include(e => e.Account)
+            .Where(e => e.Id == id).FirstOrDefaultAsync();
+        if (challenge is null) return NotFound("Auth challenge was not found.");
+        var factor = await db.AccountAuthFactors
+            .Where(e => e.Id == factorId)
+            .Where(e => e.Account == challenge.Account).FirstOrDefaultAsync();
+        if (factor is null) return NotFound("Auth factor was not found.");
+
+        try
+        {
+            await accounts.SendFactorCode(challenge.Account, factor, hint);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest(ex.Message);
+        }
+
+        return Ok();
+    }
+
+    public class PerformChallengeRequest
+    {
+        [Required] public Guid FactorId { get; set; }
+        [Required] public string Password { get; set; } = string.Empty;
+    }
+
+    [HttpPatch("challenge/{id:guid}")]
+    public async Task<ActionResult<AuthChallenge>> DoChallenge(
+        [FromRoute] Guid id,
+        [FromBody] PerformChallengeRequest request
+    )
+    {
+        var challenge = await db.AuthChallenges.Include(e => e.Account).FirstOrDefaultAsync(e => e.Id == id);
+        if (challenge is null) return NotFound("Auth challenge was not found.");
+
+        var factor = await db.AccountAuthFactors.FindAsync(request.FactorId);
+        if (factor is null) return NotFound("Auth factor was not found.");
+        if (factor.EnabledAt is null) return BadRequest("Auth factor is not enabled.");
+        if (factor.Trustworthy <= 0) return BadRequest("Auth factor is not trustworthy.");
+
+        if (challenge.StepRemain == 0) return challenge;
+        if (challenge.ExpiredAt.HasValue && challenge.ExpiredAt.Value < Instant.FromDateTimeUtc(DateTime.UtcNow))
+            return BadRequest();
+
+        try
+        {
+            if (await accounts.VerifyFactorCode(factor, request.Password))
+            {
+                challenge.StepRemain -= factor.Trustworthy;
+                challenge.StepRemain = Math.Max(0, challenge.StepRemain);
+                challenge.BlacklistFactors.Add(factor.Id);
+                db.Update(challenge);
+                als.CreateActionLogFromRequest(ActionLogType.ChallengeSuccess,
+                    new Dictionary<string, object>
+                    {
+                        { "challenge_id", challenge.Id },
+                        { "factor_id", factor.Id }
+                    }, Request, challenge.Account
+                );
+            }
+            else
+            {
+                throw new ArgumentException("Invalid password.");
+            }
+        }
+        catch
+        {
+            challenge.FailedAttempts++;
+            db.Update(challenge);
+            als.CreateActionLogFromRequest(ActionLogType.ChallengeFailure,
+                new Dictionary<string, object>
+                {
+                    { "challenge_id", challenge.Id },
+                    { "factor_id", factor.Id }
+                }, Request, challenge.Account
+            );
+            await db.SaveChangesAsync();
+            return BadRequest("Invalid password.");
+        }
+
+        if (challenge.StepRemain == 0)
+        {
+            als.CreateActionLogFromRequest(ActionLogType.NewLogin,
+                new Dictionary<string, object>
+                {
+                    { "challenge_id", challenge.Id },
+                    { "account_id", challenge.AccountId }
+                }, Request, challenge.Account
+            );
+        }
+
+        await db.SaveChangesAsync();
+        return challenge;
+    }
+
+    public class TokenExchangeRequest
+    {
+        public string GrantType { get; set; } = string.Empty;
+        public string? RefreshToken { get; set; }
+        public string? Code { get; set; }
+    }
+
+    public class TokenExchangeResponse
+    {
+        public string Token { get; set; } = string.Empty;
+    }
+
+    [HttpPost("token")]
+    public async Task<ActionResult<TokenExchangeResponse>> ExchangeToken([FromBody] TokenExchangeRequest request)
+    {
+        switch (request.GrantType)
+        {
+            case "authorization_code":
+                var code = Guid.TryParse(request.Code, out var codeId) ? codeId : Guid.Empty;
+                if (code == Guid.Empty)
+                    return BadRequest("Invalid or missing authorization code.");
+                var challenge = await db.AuthChallenges
+                    .Include(e => e.Account)
+                    .Where(e => e.Id == code)
+                    .FirstOrDefaultAsync();
+                if (challenge is null)
+                    return BadRequest("Authorization code not found or expired.");
+                if (challenge.StepRemain != 0)
+                    return BadRequest("Challenge not yet completed.");
+
+                var session = await db.AuthSessions
+                    .Where(e => e.Challenge == challenge)
+                    .FirstOrDefaultAsync();
+                if (session is not null)
+                    return BadRequest("Session already exists for this challenge.");
+
+                session = new AuthSession
+                {
+                    LastGrantedAt = Instant.FromDateTimeUtc(DateTime.UtcNow),
+                    ExpiredAt = Instant.FromDateTimeUtc(DateTime.UtcNow.AddDays(30)),
+                    Account = challenge.Account,
+                    Challenge = challenge,
+                };
+
+                db.AuthSessions.Add(session);
+                await db.SaveChangesAsync();
+
+                var tk = auth.CreateToken(session);
+                return Ok(new TokenExchangeResponse { Token = tk });
+            case "refresh_token":
+            // Since we no longer need the refresh token
+            // This case is blank for now, thinking to mock it if the OIDC standard requires it
+            default:
+                return BadRequest("Unsupported grant type.");
+        }
+    }
+
+    [HttpPost("captcha")]
+    public async Task<ActionResult> ValidateCaptcha([FromBody] string token)
+    {
+        var result = await auth.ValidateCaptcha(token);
+        return result ? Ok() : BadRequest();
+    }
+}

DysonNetwork.Pass/Auth/AuthService.cs

@@ -0,0 +1,304 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth;
+
+public class AuthService(
+    AppDatabase db,
+    IConfiguration config,
+    IHttpClientFactory httpClientFactory,
+    IHttpContextAccessor httpContextAccessor,
+    ICacheService cache
+)
+{
+    private HttpContext HttpContext => httpContextAccessor.HttpContext!;
+
+    /// <summary>
+    /// Detect the risk of the current request to login
+    /// and returns the required steps to login.
+    /// </summary>
+    /// <param name="request">The request context</param>
+    /// <param name="account">The account to login</param>
+    /// <returns>The required steps to login</returns>
+    public async Task<int> DetectChallengeRisk(HttpRequest request, Account.Account account)
+    {
+        // 1) Find out how many authentication factors the account has enabled.
+        var maxSteps = await db.AccountAuthFactors
+            .Where(f => f.AccountId == account.Id)
+            .Where(f => f.EnabledAt != null)
+            .CountAsync();
+
+        // We’ll accumulate a “risk score” based on various factors.
+        // Then we can decide how many total steps are required for the challenge.
+        var riskScore = 0;
+
+        // 2) Get the remote IP address from the request (if any).
+        var ipAddress = request.HttpContext.Connection.RemoteIpAddress?.ToString();
+        var lastActiveInfo = await db.AuthSessions
+            .OrderByDescending(s => s.LastGrantedAt)
+            .Include(s => s.Challenge)
+            .Where(s => s.AccountId == account.Id)
+            .FirstOrDefaultAsync();
+
+        // Example check: if IP is missing or in an unusual range, increase the risk.
+        // (This is just a placeholder; in reality, you’d integrate with GeoIpService or a custom check.)
+        if (string.IsNullOrWhiteSpace(ipAddress))
+            riskScore += 1;
+        else
+        {
+            if (!string.IsNullOrEmpty(lastActiveInfo?.Challenge.IpAddress) &&
+                !lastActiveInfo.Challenge.IpAddress.Equals(ipAddress, StringComparison.OrdinalIgnoreCase))
+                riskScore += 1;
+        }
+
+        // 3) (Optional) Check how recent the last login was.
+        // If it was a long time ago, the risk might be higher.
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var daysSinceLastActive = lastActiveInfo?.LastGrantedAt is not null
+            ? (now - lastActiveInfo.LastGrantedAt.Value).TotalDays
+            : double.MaxValue;
+        if (daysSinceLastActive > 30)
+            riskScore += 1;
+
+        // 4) Combine base “maxSteps” (the number of enabled factors) with any accumulated risk score.
+        const int totalRiskScore = 3;
+        var totalRequiredSteps = (int)Math.Round((float)maxSteps * riskScore / totalRiskScore);
+        // Clamp the steps
+        totalRequiredSteps = Math.Max(Math.Min(totalRequiredSteps, maxSteps), 1);
+
+        return totalRequiredSteps;
+    }
+
+    public async Task<AuthSession> CreateSessionForOidcAsync(Account.Account account, Instant time, Guid? customAppId = null)
+    {
+        var challenge = new AuthChallenge
+        {
+            AccountId = account.Id,
+            IpAddress = HttpContext.Connection.RemoteIpAddress?.ToString(),
+            UserAgent = HttpContext.Request.Headers.UserAgent,
+            StepRemain = 1,
+            StepTotal = 1,
+            Type = customAppId is not null ? ChallengeType.OAuth : ChallengeType.Oidc
+        };
+
+        var session = new AuthSession
+        {
+            AccountId = account.Id,
+            CreatedAt = time,
+            LastGrantedAt = time,
+            Challenge = challenge,
+            AppId = customAppId
+        };
+
+        db.AuthChallenges.Add(challenge);
+        db.AuthSessions.Add(session);
+        await db.SaveChangesAsync();
+
+        return session;
+    }
+
+    public async Task<bool> ValidateCaptcha(string token)
+    {
+        if (string.IsNullOrWhiteSpace(token)) return false;
+
+        var provider = config.GetSection("Captcha")["Provider"]?.ToLower();
+        var apiSecret = config.GetSection("Captcha")["ApiSecret"];
+
+        var client = httpClientFactory.CreateClient();
+
+        var jsonOpts = new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.SnakeCaseLower,
+            DictionaryKeyPolicy = JsonNamingPolicy.SnakeCaseLower
+        };
+
+        switch (provider)
+        {
+            case "cloudflare":
+                var content = new StringContent($"secret={apiSecret}&response={token}", System.Text.Encoding.UTF8,
+                    "application/x-www-form-urlencoded");
+                var response = await client.PostAsync("https://challenges.cloudflare.com/turnstile/v0/siteverify",
+                    content);
+                response.EnsureSuccessStatusCode();
+
+                var json = await response.Content.ReadAsStringAsync();
+                var result = JsonSerializer.Deserialize<CaptchaVerificationResponse>(json, options: jsonOpts);
+
+                return result?.Success == true;
+            case "google":
+                content = new StringContent($"secret={apiSecret}&response={token}", System.Text.Encoding.UTF8,
+                    "application/x-www-form-urlencoded");
+                response = await client.PostAsync("https://www.google.com/recaptcha/siteverify", content);
+                response.EnsureSuccessStatusCode();
+
+                json = await response.Content.ReadAsStringAsync();
+                result = JsonSerializer.Deserialize<CaptchaVerificationResponse>(json, options: jsonOpts);
+
+                return result?.Success == true;
+            case "hcaptcha":
+                content = new StringContent($"secret={apiSecret}&response={token}", System.Text.Encoding.UTF8,
+                    "application/x-www-form-urlencoded");
+                response = await client.PostAsync("https://hcaptcha.com/siteverify", content);
+                response.EnsureSuccessStatusCode();
+
+                json = await response.Content.ReadAsStringAsync();
+                result = JsonSerializer.Deserialize<CaptchaVerificationResponse>(json, options: jsonOpts);
+
+                return result?.Success == true;
+            default:
+                throw new ArgumentException("The server misconfigured for the captcha.");
+        }
+    }
+
+    public string CreateToken(AuthSession session)
+    {
+        // Load the private key for signing
+        var privateKeyPem = File.ReadAllText(config["AuthToken:PrivateKeyPath"]!);
+        using var rsa = RSA.Create();
+        rsa.ImportFromPem(privateKeyPem);
+
+        // Create and return a single token
+        return CreateCompactToken(session.Id, rsa);
+    }
+
+    private string CreateCompactToken(Guid sessionId, RSA rsa)
+    {
+        // Create the payload: just the session ID
+        var payloadBytes = sessionId.ToByteArray();
+
+        // Base64Url encode the payload
+        var payloadBase64 = Base64UrlEncode(payloadBytes);
+
+        // Sign the payload with RSA-SHA256
+        var signature = rsa.SignData(payloadBytes, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+
+        // Base64Url encode the signature
+        var signatureBase64 = Base64UrlEncode(signature);
+
+        // Combine payload and signature with a dot
+        return $"{payloadBase64}.{signatureBase64}";
+    }
+
+    public async Task<bool> ValidateSudoMode(AuthSession session, string? pinCode)
+    {
+        // Check if the session is already in sudo mode (cached)
+        var sudoModeKey = $"accounts:{session.Id}:sudo";
+        var (found, _) = await cache.GetAsyncWithStatus<bool>(sudoModeKey);
+        
+        if (found)
+        {
+            // Session is already in sudo mode
+            return true;
+        }
+        
+        // Check if the user has a pin code
+        var hasPinCode = await db.AccountAuthFactors
+            .Where(f => f.AccountId == session.AccountId)
+            .Where(f => f.EnabledAt != null)
+            .Where(f => f.Type == AccountAuthFactorType.PinCode)
+            .AnyAsync();
+            
+        if (!hasPinCode)
+        {
+            // User doesn't have a pin code, no validation needed
+            return true;
+        }
+        
+        // If pin code is not provided, we can't validate
+        if (string.IsNullOrEmpty(pinCode))
+        {
+            return false;
+        }
+        
+        try
+        {
+            // Validate the pin code
+            var isValid = await ValidatePinCode(session.AccountId, pinCode);
+            
+            if (isValid)
+            {
+                // Set session in sudo mode for 5 minutes
+                await cache.SetAsync(sudoModeKey, true, TimeSpan.FromMinutes(5));
+            }
+            
+            return isValid;
+        }
+        catch (InvalidOperationException)
+        {
+            // No pin code enabled for this account, so validation is successful
+            return true;
+        }
+    }
+
+    public async Task<bool> ValidatePinCode(Guid accountId, string pinCode)
+    {
+        var factor = await db.AccountAuthFactors
+            .Where(f => f.AccountId == accountId)
+            .Where(f => f.EnabledAt != null)
+            .Where(f => f.Type == AccountAuthFactorType.PinCode)
+            .FirstOrDefaultAsync();
+        if (factor is null) throw new InvalidOperationException("No pin code enabled for this account.");
+
+        return factor.VerifyPassword(pinCode);
+    }
+
+    public bool ValidateToken(string token, out Guid sessionId)
+    {
+        sessionId = Guid.Empty;
+
+        try
+        {
+            // Split the token
+            var parts = token.Split('.');
+            if (parts.Length != 2)
+                return false;
+
+            // Decode the payload
+            var payloadBytes = Base64UrlDecode(parts[0]);
+
+            // Extract session ID
+            sessionId = new Guid(payloadBytes);
+
+            // Load public key for verification
+            var publicKeyPem = File.ReadAllText(config["AuthToken:PublicKeyPath"]!);
+            using var rsa = RSA.Create();
+            rsa.ImportFromPem(publicKeyPem);
+
+            // Verify signature
+            var signature = Base64UrlDecode(parts[1]);
+            return rsa.VerifyData(payloadBytes, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    // Helper methods for Base64Url encoding/decoding
+    private static string Base64UrlEncode(byte[] data)
+    {
+        return Convert.ToBase64String(data)
+            .TrimEnd('=')
+            .Replace('+', '-')
+            .Replace('/', '_');
+    }
+
+    private static byte[] Base64UrlDecode(string base64Url)
+    {
+        string padded = base64Url
+            .Replace('-', '+')
+            .Replace('_', '/');
+
+        switch (padded.Length % 4)
+        {
+            case 2: padded += "=="; break;
+            case 3: padded += "="; break;
+        }
+
+        return Convert.FromBase64String(padded);
+    }
+}

DysonNetwork.Pass/Auth/AuthServiceGrpc.cs

@@ -0,0 +1,49 @@
+using DysonNetwork.Shared.Cache;
+using DysonNetwork.Shared.Proto;
+using Grpc.Core;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth;
+
+public class AuthServiceGrpc(
+    AuthService authService,
+    ICacheService cache,
+    AppDatabase db
+)
+    : Shared.Proto.AuthService.AuthServiceBase
+{
+    public override async Task<AuthenticateResponse> Authenticate(
+        AuthenticateRequest request,
+        ServerCallContext context
+    )
+    {
+        if (!authService.ValidateToken(request.Token, out var sessionId))
+            return new AuthenticateResponse { Valid = false, Message = "Invalid token." };
+        
+        var session = await cache.GetAsync<AuthSession>($"{DysonTokenAuthHandler.AuthCachePrefix}{sessionId}");
+        if (session is not null)
+            return new AuthenticateResponse { Valid = true, Session = session.ToProtoValue() };
+
+        session = await db.AuthSessions
+            .AsNoTracking()
+            .Include(e => e.Challenge)
+            .Include(e => e.Account)
+            .ThenInclude(e => e.Profile)
+            .FirstOrDefaultAsync(s => s.Id == sessionId);
+        if (session == null)
+            return new AuthenticateResponse { Valid = false, Message = "Session was not found." };
+        var now = SystemClock.Instance.GetCurrentInstant();
+        if (session.ExpiredAt.HasValue && session.ExpiredAt < now)
+            return new AuthenticateResponse { Valid = false, Message = "Session has been expired." };
+        
+        await cache.SetWithGroupsAsync(
+            $"auth:{sessionId}",
+            session,
+            [$"{Account.AccountService.AccountCachePrefix}{session.Account.Id}"],
+            TimeSpan.FromHours(1)
+        );
+
+        return new AuthenticateResponse { Valid = true, Session = session.ToProtoValue() };
+    }
+}

DysonNetwork.Pass/Auth/CheckpointModel.cs

@@ -0,0 +1,6 @@
+namespace DysonNetwork.Pass.Auth;
+
+public class CaptchaVerificationResponse
+{
+    public bool Success { get; set; }
+}

DysonNetwork.Pass/Auth/CompactTokenService.cs

@@ -0,0 +1,94 @@
+using System.Security.Cryptography;
+
+namespace DysonNetwork.Pass.Auth;
+
+public class CompactTokenService(IConfiguration config)
+{
+    private readonly string _privateKeyPath = config["AuthToken:PrivateKeyPath"] 
+        ?? throw new InvalidOperationException("AuthToken:PrivateKeyPath configuration is missing");
+    
+    public string CreateToken(AuthSession session)
+    {
+        // Load the private key for signing
+        var privateKeyPem = File.ReadAllText(_privateKeyPath);
+        using var rsa = RSA.Create();
+        rsa.ImportFromPem(privateKeyPem);
+        
+        // Create and return a single token
+        return CreateCompactToken(session.Id, rsa);
+    }
+
+    private string CreateCompactToken(Guid sessionId, RSA rsa)
+    {
+        // Create the payload: just the session ID
+        var payloadBytes = sessionId.ToByteArray();
+        
+        // Base64Url encode the payload
+        var payloadBase64 = Base64UrlEncode(payloadBytes);
+        
+        // Sign the payload with RSA-SHA256
+        var signature = rsa.SignData(payloadBytes, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        
+        // Base64Url encode the signature
+        var signatureBase64 = Base64UrlEncode(signature);
+        
+        // Combine payload and signature with a dot
+        return $"{payloadBase64}.{signatureBase64}";
+    }
+    
+    public bool ValidateToken(string token, out Guid sessionId)
+    {
+        sessionId = Guid.Empty;
+        
+        try
+        {
+            // Split the token
+            var parts = token.Split('.');
+            if (parts.Length != 2)
+                return false;
+            
+            // Decode the payload
+            var payloadBytes = Base64UrlDecode(parts[0]);
+            
+            // Extract session ID
+            sessionId = new Guid(payloadBytes);
+            
+            // Load public key for verification
+            var publicKeyPem = File.ReadAllText(config["AuthToken:PublicKeyPath"]!);
+            using var rsa = RSA.Create();
+            rsa.ImportFromPem(publicKeyPem);
+            
+            // Verify signature
+            var signature = Base64UrlDecode(parts[1]);
+            return rsa.VerifyData(payloadBytes, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        }
+        catch
+        {
+            return false;
+        }
+    }
+    
+    // Helper methods for Base64Url encoding/decoding
+    private static string Base64UrlEncode(byte[] data)
+    {
+        return Convert.ToBase64String(data)
+            .TrimEnd('=')
+            .Replace('+', '-')
+            .Replace('/', '_');
+    }
+    
+    private static byte[] Base64UrlDecode(string base64Url)
+    {
+        string padded = base64Url
+            .Replace('-', '+')
+            .Replace('_', '/');
+            
+        switch (padded.Length % 4)
+        {
+            case 2: padded += "=="; break;
+            case 3: padded += "="; break;
+        }
+        
+        return Convert.FromBase64String(padded);
+    }
+}

DysonNetwork.Pass/Auth/OidcProvider/Controllers/OidcProviderController.cs

@@ -0,0 +1,241 @@
+using System.Security.Cryptography;
+using DysonNetwork.Pass.Auth.OidcProvider.Responses;
+using DysonNetwork.Pass.Auth.OidcProvider.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using System.Text.Json.Serialization;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Pass.Auth.OidcProvider.Options;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Tokens;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Controllers;
+
+[Route("/api/auth/open")]
+[ApiController]
+public class OidcProviderController(
+    AppDatabase db,
+    OidcProviderService oidcService,
+    IConfiguration configuration,
+    IOptions<OidcProviderOptions> options,
+    ILogger<OidcProviderController> logger
+)
+    : ControllerBase
+{
+    [HttpPost("token")]
+    [Consumes("application/x-www-form-urlencoded")]
+    public async Task<IActionResult> Token([FromForm] TokenRequest request)
+    {
+        switch (request.GrantType)
+        {
+            // Validate client credentials
+            case "authorization_code" when request.ClientId == null || string.IsNullOrEmpty(request.ClientSecret):
+                return BadRequest("Client credentials are required");
+            case "authorization_code" when request.Code == null:
+                return BadRequest("Authorization code is required");
+            case "authorization_code":
+            {
+                var client = await oidcService.FindClientByIdAsync(request.ClientId.Value);
+                if (client == null ||
+                    !await oidcService.ValidateClientCredentialsAsync(request.ClientId.Value, request.ClientSecret))
+                    return BadRequest(new ErrorResponse
+                        { Error = "invalid_client", ErrorDescription = "Invalid client credentials" });
+
+                // Generate tokens
+                var tokenResponse = await oidcService.GenerateTokenResponseAsync(
+                    clientId: request.ClientId.Value,
+                    authorizationCode: request.Code!,
+                    redirectUri: request.RedirectUri,
+                    codeVerifier: request.CodeVerifier
+                );
+
+                return Ok(tokenResponse);
+            }
+            case "refresh_token" when string.IsNullOrEmpty(request.RefreshToken):
+                return BadRequest(new ErrorResponse
+                    { Error = "invalid_request", ErrorDescription = "Refresh token is required" });
+            case "refresh_token":
+            {
+                try
+                {
+                    // Decode the base64 refresh token to get the session ID
+                    var sessionIdBytes = Convert.FromBase64String(request.RefreshToken);
+                    var sessionId = new Guid(sessionIdBytes);
+
+                    // Find the session and related data
+                    var session = await oidcService.FindSessionByIdAsync(sessionId);
+                    var now = SystemClock.Instance.GetCurrentInstant();
+                    if (session?.App is null || session.ExpiredAt < now)
+                    {
+                        return BadRequest(new ErrorResponse
+                        {
+                            Error = "invalid_grant",
+                            ErrorDescription = "Invalid or expired refresh token"
+                        });
+                    }
+
+                    // Get the client
+                    var client = session.App;
+                    if (client == null)
+                    {
+                        return BadRequest(new ErrorResponse
+                        {
+                            Error = "invalid_client",
+                            ErrorDescription = "Client not found"
+                        });
+                    }
+
+                    // Generate new tokens
+                    var tokenResponse = await oidcService.GenerateTokenResponseAsync(
+                        clientId: session.AppId!.Value,
+                        sessionId: session.Id
+                    );
+
+                    return Ok(tokenResponse);
+                }
+                catch (FormatException)
+                {
+                    return BadRequest(new ErrorResponse
+                    {
+                        Error = "invalid_grant",
+                        ErrorDescription = "Invalid refresh token format"
+                    });
+                }
+            }
+            default:
+                return BadRequest(new ErrorResponse { Error = "unsupported_grant_type" });
+        }
+    }
+
+    [HttpGet("userinfo")]
+    [Authorize]
+    public async Task<IActionResult> GetUserInfo()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account.Account currentUser ||
+            HttpContext.Items["CurrentSession"] is not AuthSession currentSession) return Unauthorized();
+
+        // Get requested scopes from the token
+        var scopes = currentSession.Challenge.Scopes;
+
+        var userInfo = new Dictionary<string, object>
+        {
+            ["sub"] = currentUser.Id
+        };
+
+        // Include standard claims based on scopes
+        if (scopes.Contains("profile") || scopes.Contains("name"))
+        {
+            userInfo["name"] = currentUser.Name;
+            userInfo["preferred_username"] = currentUser.Nick;
+        }
+
+        var userEmail = await db.AccountContacts
+            .Where(c => c.Type == AccountContactType.Email && c.AccountId == currentUser.Id)
+            .FirstOrDefaultAsync();
+        if (scopes.Contains("email") && userEmail is not null)
+        {
+            userInfo["email"] = userEmail.Content;
+            userInfo["email_verified"] = userEmail.VerifiedAt is not null;
+        }
+
+        return Ok(userInfo);
+    }
+
+    [HttpGet("/.well-known/openid-configuration")]
+    public IActionResult GetConfiguration()
+    {
+        var baseUrl = configuration["BaseUrl"];
+        var issuer = options.Value.IssuerUri.TrimEnd('/');
+
+        return Ok(new
+        {
+            issuer = issuer,
+            authorization_endpoint = $"{baseUrl}/auth/authorize",
+            token_endpoint = $"{baseUrl}/auth/open/token",
+            userinfo_endpoint = $"{baseUrl}/auth/open/userinfo",
+            jwks_uri = $"{baseUrl}/.well-known/jwks",
+            scopes_supported = new[] { "openid", "profile", "email" },
+            response_types_supported = new[]
+                { "code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token" },
+            grant_types_supported = new[] { "authorization_code", "refresh_token" },
+            token_endpoint_auth_methods_supported = new[] { "client_secret_basic", "client_secret_post" },
+            id_token_signing_alg_values_supported = new[] { "HS256" },
+            subject_types_supported = new[] { "public" },
+            claims_supported = new[] { "sub", "name", "email", "email_verified" },
+            code_challenge_methods_supported = new[] { "S256" },
+            response_modes_supported = new[] { "query", "fragment", "form_post" },
+            request_parameter_supported = true,
+            request_uri_parameter_supported = true,
+            require_request_uri_registration = false
+        });
+    }
+
+    [HttpGet("/.well-known/jwks")]
+    public IActionResult GetJwks()
+    {
+        using var rsa = options.Value.GetRsaPublicKey();
+        if (rsa == null)
+        {
+            return BadRequest("Public key is not configured");
+        }
+
+        var parameters = rsa.ExportParameters(false);
+        var keyId = Convert.ToBase64String(SHA256.HashData(parameters.Modulus!)[..8])
+            .Replace("+", "-")
+            .Replace("/", "_")
+            .Replace("=", "");
+
+        return Ok(new
+        {
+            keys = new[]
+            {
+                new
+                {
+                    kty = "RSA",
+                    use = "sig",
+                    kid = keyId,
+                    n = Base64UrlEncoder.Encode(parameters.Modulus!),
+                    e = Base64UrlEncoder.Encode(parameters.Exponent!),
+                    alg = "RS256"
+                }
+            }
+        });
+    }
+}
+
+public class TokenRequest
+{
+    [JsonPropertyName("grant_type")]
+    [FromForm(Name = "grant_type")]
+    public string? GrantType { get; set; }
+
+    [JsonPropertyName("code")]
+    [FromForm(Name = "code")]
+    public string? Code { get; set; }
+
+    [JsonPropertyName("redirect_uri")]
+    [FromForm(Name = "redirect_uri")]
+    public string? RedirectUri { get; set; }
+
+    [JsonPropertyName("client_id")]
+    [FromForm(Name = "client_id")]
+    public Guid? ClientId { get; set; }
+
+    [JsonPropertyName("client_secret")]
+    [FromForm(Name = "client_secret")]
+    public string? ClientSecret { get; set; }
+
+    [JsonPropertyName("refresh_token")]
+    [FromForm(Name = "refresh_token")]
+    public string? RefreshToken { get; set; }
+
+    [JsonPropertyName("scope")]
+    [FromForm(Name = "scope")]
+    public string? Scope { get; set; }
+
+    [JsonPropertyName("code_verifier")]
+    [FromForm(Name = "code_verifier")]
+    public string? CodeVerifier { get; set; }
+}

DysonNetwork.Pass/Auth/OidcProvider/Models/AuthorizationCodeInfo.cs

@@ -0,0 +1,17 @@
+using System;
+using System.Collections.Generic;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Models;
+
+public class AuthorizationCodeInfo
+{
+    public Guid ClientId { get; set; }
+    public Guid AccountId { get; set; }
+    public string RedirectUri { get; set; } = string.Empty;
+    public List<string> Scopes { get; set; } = new();
+    public string? CodeChallenge { get; set; }
+    public string? CodeChallengeMethod { get; set; }
+    public string? Nonce { get; set; }
+    public Instant CreatedAt { get; set; }
+}

DysonNetwork.Pass/Auth/OidcProvider/Options/OidcProviderOptions.cs

@@ -0,0 +1,36 @@
+using System.Security.Cryptography;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Options;
+
+public class OidcProviderOptions
+{
+    public string IssuerUri { get; set; } = "https://your-issuer-uri.com";
+    public string? PublicKeyPath { get; set; }
+    public string? PrivateKeyPath { get; set; }
+    public TimeSpan AccessTokenLifetime { get; set; } = TimeSpan.FromHours(1);
+    public TimeSpan RefreshTokenLifetime { get; set; } = TimeSpan.FromDays(30);
+    public TimeSpan AuthorizationCodeLifetime { get; set; } = TimeSpan.FromMinutes(5);
+    public bool RequireHttpsMetadata { get; set; } = true;
+
+    public RSA? GetRsaPrivateKey()
+    {
+        if (string.IsNullOrEmpty(PrivateKeyPath) || !File.Exists(PrivateKeyPath))
+            return null;
+
+        var privateKey = File.ReadAllText(PrivateKeyPath);
+        var rsa = RSA.Create();
+        rsa.ImportFromPem(privateKey.AsSpan());
+        return rsa;
+    }
+
+    public RSA? GetRsaPublicKey()
+    {
+        if (string.IsNullOrEmpty(PublicKeyPath) || !File.Exists(PublicKeyPath))
+            return null;
+
+        var publicKey = File.ReadAllText(PublicKeyPath);
+        var rsa = RSA.Create();
+        rsa.ImportFromPem(publicKey.AsSpan());
+        return rsa;
+    }
+}

DysonNetwork.Pass/Auth/OidcProvider/Responses/AuthorizationResponse.cs

@@ -0,0 +1,23 @@
+using System.Text.Json.Serialization;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Responses;
+
+public class AuthorizationResponse
+{
+    [JsonPropertyName("code")]
+    public string Code { get; set; } = null!;
+
+    [JsonPropertyName("state")]
+    public string? State { get; set; }
+
+    [JsonPropertyName("scope")]
+    public string? Scope { get; set; }
+
+
+    [JsonPropertyName("session_state")]
+    public string? SessionState { get; set; }
+
+
+    [JsonPropertyName("iss")]
+    public string? Issuer { get; set; }
+}

DysonNetwork.Pass/Auth/OidcProvider/Responses/ErrorResponse.cs

@@ -0,0 +1,20 @@
+using System.Text.Json.Serialization;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Responses;
+
+public class ErrorResponse
+{
+    [JsonPropertyName("error")]
+    public string Error { get; set; } = null!;
+
+    [JsonPropertyName("error_description")]
+    public string? ErrorDescription { get; set; }
+
+
+    [JsonPropertyName("error_uri")]
+    public string? ErrorUri { get; set; }
+
+
+    [JsonPropertyName("state")]
+    public string? State { get; set; }
+}

DysonNetwork.Pass/Auth/OidcProvider/Responses/TokenResponse.cs

@@ -0,0 +1,26 @@
+using System.Text.Json.Serialization;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Responses;
+
+public class TokenResponse
+{
+    [JsonPropertyName("access_token")]
+    public string AccessToken { get; set; } = null!;
+
+    [JsonPropertyName("expires_in")]
+    public int ExpiresIn { get; set; }
+
+    [JsonPropertyName("token_type")]
+    public string TokenType { get; set; } = "Bearer";
+
+    [JsonPropertyName("refresh_token")]
+    public string? RefreshToken { get; set; }
+
+
+    [JsonPropertyName("scope")]
+    public string? Scope { get; set; }
+
+
+    [JsonPropertyName("id_token")]
+    public string? IdToken { get; set; }
+}

DysonNetwork.Pass/Auth/OidcProvider/Services/OidcProviderService.cs

@@ -0,0 +1,395 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text;
+using DysonNetwork.Pass.Auth.OidcProvider.Models;
+using DysonNetwork.Pass.Auth.OidcProvider.Options;
+using DysonNetwork.Pass.Auth.OidcProvider.Responses;
+using DysonNetwork.Pass.Developer;
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OidcProvider.Services;
+
+public class OidcProviderService(
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache,
+    IOptions<OidcProviderOptions> options,
+    ILogger<OidcProviderService> logger
+)
+{
+    private readonly OidcProviderOptions _options = options.Value;
+
+    public async Task<CustomApp?> FindClientByIdAsync(Guid clientId)
+    {
+        return await db.CustomApps
+            .Include(c => c.Secrets)
+            .FirstOrDefaultAsync(c => c.Id == clientId);
+    }
+
+    public async Task<CustomApp?> FindClientByAppIdAsync(Guid appId)
+    {
+        return await db.CustomApps
+            .Include(c => c.Secrets)
+            .FirstOrDefaultAsync(c => c.Id == appId);
+    }
+
+    public async Task<AuthSession?> FindValidSessionAsync(Guid accountId, Guid clientId)
+    {
+        var now = SystemClock.Instance.GetCurrentInstant();
+
+        return await db.AuthSessions
+            .Include(s => s.Challenge)
+            .Where(s => s.AccountId == accountId &&
+                        s.AppId == clientId &&
+                        (s.ExpiredAt == null || s.ExpiredAt > now) &&
+                        s.Challenge.Type == ChallengeType.OAuth)
+            .OrderByDescending(s => s.CreatedAt)
+            .FirstOrDefaultAsync();
+    }
+
+    public async Task<bool> ValidateClientCredentialsAsync(Guid clientId, string clientSecret)
+    {
+        var client = await FindClientByIdAsync(clientId);
+        if (client == null) return false;
+
+        var clock = SystemClock.Instance;
+        var secret = client.Secrets
+            .Where(s => s.IsOidc && (s.ExpiredAt == null || s.ExpiredAt > clock.GetCurrentInstant()))
+            .FirstOrDefault(s => s.Secret == clientSecret); // In production, use proper hashing
+
+        return secret != null;
+    }
+
+    public async Task<TokenResponse> GenerateTokenResponseAsync(
+        Guid clientId,
+        string? authorizationCode = null,
+        string? redirectUri = null,
+        string? codeVerifier = null,
+        Guid? sessionId = null
+    )
+    {
+        var client = await FindClientByIdAsync(clientId);
+        if (client == null)
+            throw new InvalidOperationException("Client not found");
+
+        AuthSession session;
+        var clock = SystemClock.Instance;
+        var now = clock.GetCurrentInstant();
+
+        List<string>? scopes = null;
+        if (authorizationCode != null)
+        {
+            // Authorization code flow
+            var authCode = await ValidateAuthorizationCodeAsync(authorizationCode, clientId, redirectUri, codeVerifier);
+            if (authCode is null) throw new InvalidOperationException("Invalid authorization code");
+            var account = await db.Accounts.Where(a => a.Id == authCode.AccountId).FirstOrDefaultAsync();
+            if (account is null) throw new InvalidOperationException("Account was not found");
+
+            session = await auth.CreateSessionForOidcAsync(account, now, client.Id);
+            scopes = authCode.Scopes;
+        }
+        else if (sessionId.HasValue)
+        {
+            // Refresh token flow
+            session = await FindSessionByIdAsync(sessionId.Value) ??
+                      throw new InvalidOperationException("Invalid session");
+
+            // Verify the session is still valid
+            if (session.ExpiredAt < now)
+                throw new InvalidOperationException("Session has expired");
+        }
+        else
+        {
+            throw new InvalidOperationException("Either authorization code or session ID must be provided");
+        }
+
+        var expiresIn = (int)_options.AccessTokenLifetime.TotalSeconds;
+        var expiresAt = now.Plus(Duration.FromSeconds(expiresIn));
+
+        // Generate an access token
+        var accessToken = GenerateJwtToken(client, session, expiresAt, scopes);
+        var refreshToken = GenerateRefreshToken(session);
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            ExpiresIn = expiresIn,
+            TokenType = "Bearer",
+            RefreshToken = refreshToken,
+            Scope = scopes != null ? string.Join(" ", scopes) : null
+        };
+    }
+
+    private string GenerateJwtToken(
+        CustomApp client,
+        AuthSession session,
+        Instant expiresAt,
+        IEnumerable<string>? scopes = null
+    )
+    {
+        var tokenHandler = new JwtSecurityTokenHandler();
+        var clock = SystemClock.Instance;
+        var now = clock.GetCurrentInstant();
+
+        var tokenDescriptor = new SecurityTokenDescriptor
+        {
+            Subject = new ClaimsIdentity([
+                new Claim(JwtRegisteredClaimNames.Sub, session.AccountId.ToString()),
+                new Claim(JwtRegisteredClaimNames.Jti, session.Id.ToString()),
+                new Claim(JwtRegisteredClaimNames.Iat, now.ToUnixTimeSeconds().ToString(),
+                    ClaimValueTypes.Integer64),
+                new Claim("client_id", client.Id.ToString())
+            ]),
+            Expires = expiresAt.ToDateTimeUtc(),
+            Issuer = _options.IssuerUri,
+            Audience = client.Id.ToString()
+        };
+
+        // Try to use RSA signing if keys are available, fall back to HMAC
+        var rsaPrivateKey = _options.GetRsaPrivateKey();
+        tokenDescriptor.SigningCredentials = new SigningCredentials(
+            new RsaSecurityKey(rsaPrivateKey),
+            SecurityAlgorithms.RsaSha256
+        );
+
+        // Add scopes as claims if provided
+        var effectiveScopes = scopes?.ToList() ?? client.OauthConfig!.AllowedScopes?.ToList() ?? [];
+        if (effectiveScopes.Count != 0)
+        {
+            tokenDescriptor.Subject.AddClaims(
+                effectiveScopes.Select(scope => new Claim("scope", scope)));
+        }
+
+        var token = tokenHandler.CreateToken(tokenDescriptor);
+        return tokenHandler.WriteToken(token);
+    }
+
+    public (bool isValid, JwtSecurityToken? token) ValidateToken(string token)
+    {
+        try
+        {
+            var tokenHandler = new JwtSecurityTokenHandler();
+            var validationParameters = new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidIssuer = _options.IssuerUri,
+                ValidateAudience = false,
+                ValidateLifetime = true,
+                ClockSkew = TimeSpan.Zero
+            };
+
+            // Try to use RSA validation if public key is available
+            var rsaPublicKey = _options.GetRsaPublicKey();
+            validationParameters.IssuerSigningKey = new RsaSecurityKey(rsaPublicKey);
+            validationParameters.ValidateIssuerSigningKey = true;
+            validationParameters.ValidAlgorithms = new[] { SecurityAlgorithms.RsaSha256 };
+
+
+            tokenHandler.ValidateToken(token, validationParameters, out var validatedToken);
+            return (true, (JwtSecurityToken)validatedToken);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Token validation failed");
+            return (false, null);
+        }
+    }
+
+    public async Task<AuthSession?> FindSessionByIdAsync(Guid sessionId)
+    {
+        return await db.AuthSessions
+            .Include(s => s.Account)
+            .Include(s => s.Challenge)
+            .Include(s => s.App)
+            .FirstOrDefaultAsync(s => s.Id == sessionId);
+    }
+
+    private static string GenerateRefreshToken(AuthSession session)
+    {
+        return Convert.ToBase64String(session.Id.ToByteArray());
+    }
+
+    private static bool VerifyHashedSecret(string secret, string hashedSecret)
+    {
+        // In a real implementation, you'd use a proper password hashing algorithm like PBKDF2, bcrypt, or Argon2
+        // For now, we'll do a simple comparison, but you should replace this with proper hashing
+        return string.Equals(secret, hashedSecret, StringComparison.Ordinal);
+    }
+
+    public async Task<string> GenerateAuthorizationCodeForReuseSessionAsync(
+        AuthSession session,
+        Guid clientId,
+        string redirectUri,
+        IEnumerable<string> scopes,
+        string? codeChallenge = null,
+        string? codeChallengeMethod = null,
+        string? nonce = null)
+    {
+        var clock = SystemClock.Instance;
+        var now = clock.GetCurrentInstant();
+        var code = Guid.NewGuid().ToString("N");
+
+        // Update the session's last activity time
+        await db.AuthSessions.Where(s => s.Id == session.Id)
+            .ExecuteUpdateAsync(s => s.SetProperty(s => s.LastGrantedAt, now));
+
+        // Create the authorization code info
+        var authCodeInfo = new AuthorizationCodeInfo
+        {
+            ClientId = clientId,
+            AccountId = session.AccountId,
+            RedirectUri = redirectUri,
+            Scopes = scopes.ToList(),
+            CodeChallenge = codeChallenge,
+            CodeChallengeMethod = codeChallengeMethod,
+            Nonce = nonce,
+            CreatedAt = now
+        };
+        
+        // Store the code with its metadata in the cache
+        var cacheKey = $"auth:code:{code}";
+        await cache.SetAsync(cacheKey, authCodeInfo, _options.AuthorizationCodeLifetime);
+
+        logger.LogInformation("Generated authorization code for client {ClientId} and user {UserId}", clientId, session.AccountId);
+        return code;
+    }
+
+    public async Task<string> GenerateAuthorizationCodeAsync(
+        Guid clientId,
+        Guid userId,
+        string redirectUri,
+        IEnumerable<string> scopes,
+        string? codeChallenge = null,
+        string? codeChallengeMethod = null,
+        string? nonce = null
+    )
+    {
+        // Generate a random code
+        var clock = SystemClock.Instance;
+        var code = GenerateRandomString(32);
+        var now = clock.GetCurrentInstant();
+
+        // Create the authorization code info
+        var authCodeInfo = new AuthorizationCodeInfo
+        {
+            ClientId = clientId,
+            AccountId = userId,
+            RedirectUri = redirectUri,
+            Scopes = scopes.ToList(),
+            CodeChallenge = codeChallenge,
+            CodeChallengeMethod = codeChallengeMethod,
+            Nonce = nonce,
+            CreatedAt = now
+        };
+
+        // Store the code with its metadata in the cache
+        var cacheKey = $"auth:code:{code}";
+        await cache.SetAsync(cacheKey, authCodeInfo, _options.AuthorizationCodeLifetime);
+
+        logger.LogInformation("Generated authorization code for client {ClientId} and user {UserId}", clientId, userId);
+        return code;
+    }
+
+    private async Task<AuthorizationCodeInfo?> ValidateAuthorizationCodeAsync(
+        string code,
+        Guid clientId,
+        string? redirectUri = null,
+        string? codeVerifier = null
+    )
+    {
+        var cacheKey = $"auth:code:{code}";
+        var (found, authCode) = await cache.GetAsyncWithStatus<AuthorizationCodeInfo>(cacheKey);
+
+        if (!found || authCode == null)
+        {
+            logger.LogWarning("Authorization code not found: {Code}", code);
+            return null;
+        }
+
+        // Verify client ID matches
+        if (authCode.ClientId != clientId)
+        {
+            logger.LogWarning(
+                "Client ID mismatch for code {Code}. Expected: {ExpectedClientId}, Actual: {ActualClientId}",
+                code, authCode.ClientId, clientId);
+            return null;
+        }
+
+        // Verify redirect URI if provided
+        if (!string.IsNullOrEmpty(redirectUri) && authCode.RedirectUri != redirectUri)
+        {
+            logger.LogWarning("Redirect URI mismatch for code {Code}", code);
+            return null;
+        }
+
+        // Verify PKCE code challenge if one was provided during authorization
+        if (!string.IsNullOrEmpty(authCode.CodeChallenge))
+        {
+            if (string.IsNullOrEmpty(codeVerifier))
+            {
+                logger.LogWarning("PKCE code verifier is required but not provided for code {Code}", code);
+                return null;
+            }
+
+            var isValid = authCode.CodeChallengeMethod?.ToUpperInvariant() switch
+            {
+                "S256" => VerifyCodeChallenge(codeVerifier, authCode.CodeChallenge, "S256"),
+                "PLAIN" => VerifyCodeChallenge(codeVerifier, authCode.CodeChallenge, "PLAIN"),
+                _ => false // Unsupported code challenge method
+            };
+
+            if (!isValid)
+            {
+                logger.LogWarning("PKCE code verifier validation failed for code {Code}", code);
+                return null;
+            }
+        }
+
+        // Code is valid, remove it from the cache (codes are single-use)
+        await cache.RemoveAsync(cacheKey);
+
+        return authCode;
+    }
+
+    private static string GenerateRandomString(int length)
+    {
+        const string chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
+        var random = RandomNumberGenerator.Create();
+        var result = new char[length];
+
+        for (int i = 0; i < length; i++)
+        {
+            var randomNumber = new byte[4];
+            random.GetBytes(randomNumber);
+            var index = (int)(BitConverter.ToUInt32(randomNumber, 0) % chars.Length);
+            result[i] = chars[index];
+        }
+
+        return new string(result);
+    }
+
+    private static bool VerifyCodeChallenge(string codeVerifier, string codeChallenge, string method)
+    {
+        if (string.IsNullOrEmpty(codeVerifier)) return false;
+
+        if (method == "S256")
+        {
+            using var sha256 = SHA256.Create();
+            var hash = sha256.ComputeHash(Encoding.UTF8.GetBytes(codeVerifier));
+            var base64 = Base64UrlEncoder.Encode(hash);
+            return string.Equals(base64, codeChallenge, StringComparison.Ordinal);
+        }
+
+        if (method == "PLAIN")
+        {
+            return string.Equals(codeVerifier, codeChallenge, StringComparison.Ordinal);
+        }
+
+        return false;
+    }
+}

DysonNetwork.Pass/Auth/OpenId/AfdianOidcService.cs

@@ -0,0 +1,95 @@
+using System.Net.Http.Json;
+using System.Text.Json;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class AfdianOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache,
+    ILogger<AfdianOidcService> logger
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    public override string ProviderName => "Afdian";
+    protected override string DiscoveryEndpoint => ""; // Afdian doesn't have a standard OIDC discovery endpoint
+    protected override string ConfigSectionName => "Afdian";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "redirect_uri", config.RedirectUri },
+            { "response_type", "code" },
+            { "scope", "basic" },
+            { "state", state },
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"https://afdian.com/oauth2/authorize?{queryString}";
+    }
+
+    protected override Task<OidcDiscoveryDocument?> GetDiscoveryDocumentAsync()
+    {
+        return Task.FromResult(new OidcDiscoveryDocument
+        {
+            AuthorizationEndpoint = "https://afdian.com/oauth2/authorize",
+            TokenEndpoint = "https://afdian.com/oauth2/access_token",
+            UserinfoEndpoint = null,
+            JwksUri = null
+        })!;
+    }
+
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        try
+        {
+            var config = GetProviderConfig();
+            var content = new FormUrlEncodedContent(new Dictionary<string, string>
+            {
+                { "client_id", config.ClientId },
+                { "client_secret", config.ClientSecret },
+                { "grant_type", "authorization_code" },
+                { "code", callbackData.Code },
+                { "redirect_uri", config.RedirectUri },
+            });
+
+            var client = HttpClientFactory.CreateClient();
+            var request = new HttpRequestMessage(HttpMethod.Post, "https://afdian.com/oauth2/access_token");
+            request.Content = content;
+            
+            var response = await client.SendAsync(request);
+            response.EnsureSuccessStatusCode();
+            
+            var json = await response.Content.ReadAsStringAsync();
+            logger.LogInformation("Trying get userinfo from afdian, response: {Response}", json);
+            var afdianResponse = JsonDocument.Parse(json).RootElement;
+
+            var user = afdianResponse.TryGetProperty("data", out var dataElement) ? dataElement : default;
+            var userId = user.TryGetProperty("user_id", out var userIdElement) ? userIdElement.GetString() ?? "" : "";
+            var avatar = user.TryGetProperty("avatar", out var avatarElement) ? avatarElement.GetString() : null;
+
+            return new OidcUserInfo
+            {
+                UserId = userId,
+                DisplayName = (user.TryGetProperty("name", out var nameElement)
+                    ? nameElement.GetString()
+                    : null) ?? "",
+                ProfilePictureUrl = avatar,
+                Provider = ProviderName
+            };
+        }
+        catch (Exception ex)
+        {
+            // Due to afidan's API isn't compliant with OAuth2, we want more logs from it to investigate.
+            logger.LogError(ex, "Failed to get user info from Afdian");
+            throw;
+        }
+    }
+}

DysonNetwork.Pass/Auth/OpenId/AppleMobileSignInRequest.cs

@@ -0,0 +1,19 @@
+
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class AppleMobileConnectRequest
+{
+    [Required]
+    public required string IdentityToken { get; set; }
+    [Required]
+    public required string AuthorizationCode { get; set; }
+}
+
+public class AppleMobileSignInRequest : AppleMobileConnectRequest
+{
+    [Required]
+    public required string DeviceId { get; set; }
+}

DysonNetwork.Pass/Auth/OpenId/AppleOidcService.cs

@@ -0,0 +1,280 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+using Microsoft.IdentityModel.Tokens;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+/// <summary>
+/// Implementation of OpenID Connect service for Apple Sign In
+/// </summary>
+public class AppleOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    private readonly IConfiguration _configuration = configuration;
+    private readonly IHttpClientFactory _httpClientFactory = httpClientFactory;
+
+    public override string ProviderName => "apple";
+    protected override string DiscoveryEndpoint => "https://appleid.apple.com/.well-known/openid-configuration";
+    protected override string ConfigSectionName => "Apple";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "redirect_uri", config.RedirectUri },
+            { "response_type", "code id_token" },
+            { "scope", "name email" },
+            { "response_mode", "form_post" },
+            { "state", state },
+            { "nonce", nonce }
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"https://appleid.apple.com/auth/authorize?{queryString}";
+    }
+
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        // Verify and decode the id_token
+        var userInfo = await ValidateTokenAsync(callbackData.IdToken);
+
+        // If user data is provided in first login, parse it
+        if (!string.IsNullOrEmpty(callbackData.RawData))
+        {
+            var userData = JsonSerializer.Deserialize<AppleUserData>(callbackData.RawData);
+            if (userData?.Name != null)
+            {
+                userInfo.FirstName = userData.Name.FirstName ?? "";
+                userInfo.LastName = userData.Name.LastName ?? "";
+                userInfo.DisplayName = $"{userInfo.FirstName} {userInfo.LastName}".Trim();
+            }
+        }
+
+        // Exchange authorization code for access token (optional, if you need the access token)
+        if (string.IsNullOrEmpty(callbackData.Code)) return userInfo;
+        var tokenResponse = await ExchangeCodeForTokensAsync(callbackData.Code);
+        if (tokenResponse == null) return userInfo;
+        userInfo.AccessToken = tokenResponse.AccessToken;
+        userInfo.RefreshToken = tokenResponse.RefreshToken;
+
+        return userInfo;
+    }
+
+    private async Task<OidcUserInfo> ValidateTokenAsync(string idToken)
+    {
+        // Get Apple's public keys
+        var jwksJson = await GetAppleJwksAsync();
+        var jwks = JsonSerializer.Deserialize<AppleJwks>(jwksJson) ?? new AppleJwks { Keys = new List<AppleKey>() };
+
+        // Parse the JWT header to get the key ID
+        var handler = new JwtSecurityTokenHandler();
+        var jwtToken = handler.ReadJwtToken(idToken);
+        var kid = jwtToken.Header.Kid;
+
+        // Find the matching key
+        var key = jwks.Keys.FirstOrDefault(k => k.Kid == kid);
+        if (key == null)
+        {
+            throw new SecurityTokenValidationException("Unable to find matching key in Apple's JWKS");
+        }
+
+        // Create the validation parameters
+        var validationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = "https://appleid.apple.com",
+            ValidateAudience = true,
+            ValidAudience = GetProviderConfig().ClientId,
+            ValidateLifetime = true,
+            IssuerSigningKey = key.ToSecurityKey()
+        };
+
+        return ValidateAndExtractIdToken(idToken, validationParameters);
+    }
+
+    protected override Dictionary<string, string> BuildTokenRequestParameters(
+        string code,
+        ProviderConfiguration config,
+        string? codeVerifier
+    )
+    {
+        var parameters = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "client_secret", GenerateClientSecret() },
+            { "code", code },
+            { "grant_type", "authorization_code" },
+            { "redirect_uri", config.RedirectUri }
+        };
+
+        return parameters;
+    }
+
+    private async Task<string> GetAppleJwksAsync()
+    {
+        var client = _httpClientFactory.CreateClient();
+        var response = await client.GetAsync("https://appleid.apple.com/auth/keys");
+        response.EnsureSuccessStatusCode();
+
+        return await response.Content.ReadAsStringAsync();
+    }
+
+    /// <summary>
+    /// Generates a client secret for Apple Sign In using JWT
+    /// </summary>
+    private string GenerateClientSecret()
+    {
+        var now = DateTime.UtcNow;
+        var teamId = _configuration["Oidc:Apple:TeamId"];
+        var clientId = _configuration["Oidc:Apple:ClientId"];
+        var keyId = _configuration["Oidc:Apple:KeyId"];
+        var privateKeyPath = _configuration["Oidc:Apple:PrivateKeyPath"];
+
+        if (string.IsNullOrEmpty(teamId) || string.IsNullOrEmpty(clientId) || string.IsNullOrEmpty(keyId) ||
+            string.IsNullOrEmpty(privateKeyPath))
+        {
+            throw new InvalidOperationException("Apple OIDC configuration is missing required values (TeamId, ClientId, KeyId, PrivateKeyPath).");
+        }
+        
+        // Read the private key
+        var privateKey = File.ReadAllText(privateKeyPath);
+
+        // Create the JWT header
+        var header = new Dictionary<string, object>
+        {
+            { "alg", "ES256" },
+            { "kid", keyId }
+        };
+
+        // Create the JWT payload
+        var payload = new Dictionary<string, object>
+        {
+            { "iss", teamId },
+            { "iat", ToUnixTimeSeconds(now) },
+            { "exp", ToUnixTimeSeconds(now.AddMinutes(5)) },
+            { "aud", "https://appleid.apple.com" },
+            { "sub", clientId }
+        };
+
+        // Convert header and payload to Base64Url
+        var headerJson = JsonSerializer.Serialize(header);
+        var payloadJson = JsonSerializer.Serialize(payload);
+        var headerBase64 = Base64UrlEncode(Encoding.UTF8.GetBytes(headerJson));
+        var payloadBase64 = Base64UrlEncode(Encoding.UTF8.GetBytes(payloadJson));
+
+        // Create the signature
+        var dataToSign = $"{headerBase64}.{payloadBase64}";
+        var signature = SignWithECDsa(dataToSign, privateKey);
+
+        // Combine all parts
+        return $"{headerBase64}.{payloadBase64}.{signature}";
+    }
+
+    private long ToUnixTimeSeconds(DateTime dateTime)
+    {
+        return new DateTimeOffset(dateTime).ToUnixTimeSeconds();
+    }
+
+    private string SignWithECDsa(string dataToSign, string privateKey)
+    {
+        using var ecdsa = ECDsa.Create();
+        ecdsa.ImportFromPem(privateKey);
+
+        var bytes = Encoding.UTF8.GetBytes(dataToSign);
+        var signature = ecdsa.SignData(bytes, HashAlgorithmName.SHA256);
+
+        return Base64UrlEncode(signature);
+    }
+
+    private string Base64UrlEncode(byte[] data)
+    {
+        return Convert.ToBase64String(data)
+            .Replace('+', '-')
+            .Replace('/', '_')
+            .TrimEnd('=');
+    }
+}
+
+public class AppleUserData
+{
+    [JsonPropertyName("name")] public AppleNameData? Name { get; set; }
+
+    [JsonPropertyName("email")] public string? Email { get; set; }
+}
+
+public class AppleNameData
+{
+    [JsonPropertyName("firstName")] public string? FirstName { get; set; }
+
+    [JsonPropertyName("lastName")] public string? LastName { get; set; }
+}
+
+public class AppleJwks
+{
+    [JsonPropertyName("keys")] public List<AppleKey> Keys { get; set; } = new List<AppleKey>();
+}
+
+public class AppleKey
+{
+    [JsonPropertyName("kty")] public string? Kty { get; set; }
+
+    [JsonPropertyName("kid")] public string? Kid { get; set; }
+
+    [JsonPropertyName("use")] public string? Use { get; set; }
+
+    [JsonPropertyName("alg")] public string? Alg { get; set; }
+
+    [JsonPropertyName("n")] public string? N { get; set; }
+
+    [JsonPropertyName("e")] public string? E { get; set; }
+
+    public SecurityKey ToSecurityKey()
+    {
+        if (Kty != "RSA" || string.IsNullOrEmpty(N) || string.IsNullOrEmpty(E))
+        {
+            throw new InvalidOperationException("Invalid key data");
+        }
+
+        var parameters = new RSAParameters
+        {
+            Modulus = Base64UrlDecode(N),
+            Exponent = Base64UrlDecode(E)
+        };
+
+        var rsa = RSA.Create();
+        rsa.ImportParameters(parameters);
+
+        return new RsaSecurityKey(rsa);
+    }
+
+    private byte[] Base64UrlDecode(string input)
+    {
+        var output = input
+            .Replace('-', '+')
+            .Replace('_', '/');
+
+        switch (output.Length % 4)
+        {
+            case 0: break;
+            case 2: output += "=="; break;
+            case 3: output += "="; break;
+            default: throw new InvalidOperationException("Invalid base64url string");
+        }
+
+        return Convert.FromBase64String(output);
+    }
+}

DysonNetwork.Pass/Auth/OpenId/ConnectionController.cs

@@ -0,0 +1,409 @@
+using DysonNetwork.Pass.Account;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DysonNetwork.Shared.Cache;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+[ApiController]
+[Route("/api/accounts/me/connections")]
+[Authorize]
+public class ConnectionController(
+    AppDatabase db,
+    IEnumerable<OidcService> oidcServices,
+    AccountService accounts,
+    AuthService auth,
+    ICacheService cache
+) : ControllerBase
+{
+    private const string StateCachePrefix = "oidc-state:";
+    private const string ReturnUrlCachePrefix = "oidc-returning:";
+    private static readonly TimeSpan StateExpiration = TimeSpan.FromMinutes(15);
+
+    [HttpGet]
+    public async Task<ActionResult<List<AccountConnection>>> GetConnections()
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account.Account currentUser)
+            return Unauthorized();
+
+        var connections = await db.AccountConnections
+            .Where(c => c.AccountId == currentUser.Id)
+            .Select(c => new
+            {
+                c.Id,
+                c.AccountId,
+                c.Provider,
+                c.ProvidedIdentifier,
+                c.Meta,
+                c.LastUsedAt,
+                c.CreatedAt,
+                c.UpdatedAt,
+            })
+            .ToListAsync();
+        return Ok(connections);
+    }
+
+    [HttpDelete("{id:guid}")]
+    public async Task<ActionResult> RemoveConnection(Guid id)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account.Account currentUser)
+            return Unauthorized();
+
+        var connection = await db.AccountConnections
+            .Where(c => c.Id == id && c.AccountId == currentUser.Id)
+            .FirstOrDefaultAsync();
+        if (connection == null)
+            return NotFound();
+
+        db.AccountConnections.Remove(connection);
+        await db.SaveChangesAsync();
+
+        return Ok();
+    }
+
+    [HttpPost("/auth/connect/apple/mobile")]
+    public async Task<ActionResult> ConnectAppleMobile([FromBody] AppleMobileConnectRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account.Account currentUser)
+            return Unauthorized();
+
+        if (GetOidcService("apple") is not AppleOidcService appleService)
+            return StatusCode(503, "Apple OIDC service not available");
+
+        var callbackData = new OidcCallbackData
+        {
+            IdToken = request.IdentityToken,
+            Code = request.AuthorizationCode,
+        };
+
+        OidcUserInfo userInfo;
+        try
+        {
+            userInfo = await appleService.ProcessCallbackAsync(callbackData);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest($"Error processing Apple token: {ex.Message}");
+        }
+
+        var existingConnection = await db.AccountConnections
+            .FirstOrDefaultAsync(c =>
+                c.Provider == "apple" &&
+                c.ProvidedIdentifier == userInfo.UserId);
+
+        if (existingConnection != null)
+        {
+            return BadRequest(
+                $"This Apple account is already linked to {(existingConnection.AccountId == currentUser.Id ? "your account" : "another user")}.");
+        }
+
+        db.AccountConnections.Add(new AccountConnection
+        {
+            AccountId = currentUser.Id,
+            Provider = "apple",
+            ProvidedIdentifier = userInfo.UserId!,
+            AccessToken = userInfo.AccessToken,
+            RefreshToken = userInfo.RefreshToken,
+            LastUsedAt = SystemClock.Instance.GetCurrentInstant(),
+            Meta = userInfo.ToMetadata(),
+        });
+
+        await db.SaveChangesAsync();
+
+        return Ok(new { message = "Successfully connected Apple account." });
+    }
+
+    private OidcService? GetOidcService(string provider)
+    {
+        return oidcServices.FirstOrDefault(s => s.ProviderName.Equals(provider, StringComparison.OrdinalIgnoreCase));
+    }
+
+    public class ConnectProviderRequest
+    {
+        public string Provider { get; set; } = null!;
+        public string? ReturnUrl { get; set; }
+    }
+
+    /// <summary>
+    /// Initiates manual connection to an OAuth provider for the current user
+    /// </summary>
+    [HttpPost("connect")]
+    public async Task<ActionResult<object>> InitiateConnection([FromBody] ConnectProviderRequest request)
+    {
+        if (HttpContext.Items["CurrentUser"] is not Account.Account currentUser)
+            return Unauthorized();
+
+        var oidcService = GetOidcService(request.Provider);
+        if (oidcService == null)
+            return BadRequest($"Provider '{request.Provider}' is not supported");
+
+        var existingConnection = await db.AccountConnections
+            .AnyAsync(c => c.AccountId == currentUser.Id && c.Provider == oidcService.ProviderName);
+
+        if (existingConnection)
+            return BadRequest($"You already have a {request.Provider} connection");
+
+        var state = Guid.NewGuid().ToString("N");
+        var nonce = Guid.NewGuid().ToString("N");
+        var stateValue = $"{currentUser.Id}|{request.Provider}|{nonce}";
+        var finalReturnUrl = !string.IsNullOrEmpty(request.ReturnUrl) ? request.ReturnUrl : "/settings/connections";
+
+        // Store state and return URL in cache
+        await cache.SetAsync($"{StateCachePrefix}{state}", stateValue, StateExpiration);
+        await cache.SetAsync($"{ReturnUrlCachePrefix}{state}", finalReturnUrl, StateExpiration);
+
+        var authUrl = oidcService.GetAuthorizationUrl(state, nonce);
+
+        return Ok(new
+        {
+            authUrl,
+            message = $"Redirect to this URL to connect your {request.Provider} account"
+        });
+    }
+
+    [AllowAnonymous]
+    [Route("/api/auth/callback/{provider}")]
+    [HttpGet, HttpPost]
+    public async Task<IActionResult> HandleCallback([FromRoute] string provider)
+    {
+        var oidcService = GetOidcService(provider);
+        if (oidcService == null)
+            return BadRequest($"Provider '{provider}' is not supported.");
+
+        var callbackData = await ExtractCallbackData(Request);
+        if (callbackData.State == null)
+            return BadRequest("State parameter is missing.");
+
+        // Get the state from the cache
+        var stateKey = $"{StateCachePrefix}{callbackData.State}";
+        
+        // Try to get the state as OidcState first (new format)
+        var oidcState = await cache.GetAsync<OidcState>(stateKey);
+        
+        // If not found, try to get as string (legacy format)
+        if (oidcState == null)
+        {
+            var stateValue = await cache.GetAsync<string>(stateKey);
+            if (string.IsNullOrEmpty(stateValue) || !OidcState.TryParse(stateValue, out oidcState) || oidcState == null)
+                return BadRequest("Invalid or expired state parameter");
+        }
+        
+        // Remove the state from cache to prevent replay attacks
+        await cache.RemoveAsync(stateKey);
+
+        // Handle the flow based on state type
+        if (oidcState.FlowType == OidcFlowType.Connect && oidcState.AccountId.HasValue)
+        {
+            // Connection flow
+            if (oidcState.DeviceId != null)
+            {
+                callbackData.State = oidcState.DeviceId;
+            }
+            return await HandleManualConnection(provider, oidcService, callbackData, oidcState.AccountId.Value);
+        }
+        else if (oidcState.FlowType == OidcFlowType.Login)
+        {
+            // Login/Registration flow
+            if (!string.IsNullOrEmpty(oidcState.DeviceId))
+            {
+                callbackData.State = oidcState.DeviceId;
+            }
+
+            // Store return URL if provided
+            if (!string.IsNullOrEmpty(oidcState.ReturnUrl) && oidcState.ReturnUrl != "/")
+            {
+                var returnUrlKey = $"{ReturnUrlCachePrefix}{callbackData.State}";
+                await cache.SetAsync(returnUrlKey, oidcState.ReturnUrl, StateExpiration);
+            }
+
+            return await HandleLoginOrRegistration(provider, oidcService, callbackData);
+        }
+
+        return BadRequest("Unsupported flow type");
+    }
+
+    private async Task<IActionResult> HandleManualConnection(
+        string provider,
+        OidcService oidcService,
+        OidcCallbackData callbackData,
+        Guid accountId
+    )
+    {
+        provider = provider.ToLower();
+
+        OidcUserInfo userInfo;
+        try
+        {
+            userInfo = await oidcService.ProcessCallbackAsync(callbackData);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest($"Error processing {provider} authentication: {ex.Message}");
+        }
+
+        if (string.IsNullOrEmpty(userInfo.UserId))
+        {
+            return BadRequest($"{provider} did not return a valid user identifier.");
+        }
+
+        // Extract device ID from the callback state if available
+        var deviceId = !string.IsNullOrEmpty(callbackData.State) ? callbackData.State : string.Empty;
+
+        // Check if this provider account is already connected to any user
+        var existingConnection = await db.AccountConnections
+            .FirstOrDefaultAsync(c =>
+                c.Provider == provider &&
+                c.ProvidedIdentifier == userInfo.UserId);
+
+        // If it's connected to a different user, return error
+        if (existingConnection != null && existingConnection.AccountId != accountId)
+        {
+            return BadRequest($"This {provider} account is already linked to another user.");
+        }
+
+        // Check if the current user already has this provider connected
+        var userHasProvider = await db.AccountConnections
+            .AnyAsync(c =>
+                c.AccountId == accountId &&
+                c.Provider == provider);
+
+        if (userHasProvider)
+        {
+            // Update existing connection with new tokens
+            var connection = await db.AccountConnections
+                .FirstOrDefaultAsync(c =>
+                    c.AccountId == accountId &&
+                    c.Provider == provider);
+
+            if (connection != null)
+            {
+                connection.AccessToken = userInfo.AccessToken;
+                connection.RefreshToken = userInfo.RefreshToken;
+                connection.LastUsedAt = SystemClock.Instance.GetCurrentInstant();
+                connection.Meta = userInfo.ToMetadata();
+            }
+        }
+        else
+        {
+            // Create new connection
+            db.AccountConnections.Add(new AccountConnection
+            {
+                AccountId = accountId,
+                Provider = provider,
+                ProvidedIdentifier = userInfo.UserId!,
+                AccessToken = userInfo.AccessToken,
+                RefreshToken = userInfo.RefreshToken,
+                LastUsedAt = SystemClock.Instance.GetCurrentInstant(),
+                Meta = userInfo.ToMetadata(),
+            });
+        }
+
+        try
+        {
+            await db.SaveChangesAsync();
+        }
+        catch (DbUpdateException)
+        {
+            return StatusCode(500, $"Failed to save {provider} connection. Please try again.");
+        }
+
+        // Clean up and redirect
+        var returnUrlKey = $"{ReturnUrlCachePrefix}{callbackData.State}";
+        var returnUrl = await cache.GetAsync<string>(returnUrlKey);
+        await cache.RemoveAsync(returnUrlKey);
+
+        return Redirect(string.IsNullOrEmpty(returnUrl) ? "/auth/callback" : returnUrl);
+    }
+
+    private async Task<IActionResult> HandleLoginOrRegistration(
+        string provider,
+        OidcService oidcService,
+        OidcCallbackData callbackData
+    )
+    {
+        OidcUserInfo userInfo;
+        try
+        {
+            userInfo = await oidcService.ProcessCallbackAsync(callbackData);
+        }
+        catch (Exception ex)
+        {
+            return BadRequest($"Error processing callback: {ex.Message}");
+        }
+
+        if (string.IsNullOrEmpty(userInfo.Email) || string.IsNullOrEmpty(userInfo.UserId))
+        {
+            return BadRequest($"Email or user ID is missing from {provider}'s response");
+        }
+
+        var connection = await db.AccountConnections
+            .Include(c => c.Account)
+            .FirstOrDefaultAsync(c => c.Provider == provider && c.ProvidedIdentifier == userInfo.UserId);
+
+        var clock = SystemClock.Instance;
+        if (connection != null)
+        {
+            // Login existing user
+            var deviceId = !string.IsNullOrEmpty(callbackData.State) ? 
+                callbackData.State.Split('|').FirstOrDefault() : 
+                string.Empty;
+                
+            var challenge = await oidcService.CreateChallengeForUserAsync(
+                userInfo, 
+                connection.Account, 
+                HttpContext, 
+                deviceId ?? string.Empty);
+            return Redirect($"/auth/callback?challenge={challenge.Id}");
+        }
+
+        // Register new user
+        var account = await accounts.LookupAccount(userInfo.Email) ?? await accounts.CreateAccount(userInfo);
+
+        // Create connection for new or existing user
+        var newConnection = new AccountConnection
+        {
+            Account = account,
+            Provider = provider,
+            ProvidedIdentifier = userInfo.UserId!,
+            AccessToken = userInfo.AccessToken,
+            RefreshToken = userInfo.RefreshToken,
+            LastUsedAt = clock.GetCurrentInstant(),
+            Meta = userInfo.ToMetadata()
+        };
+        db.AccountConnections.Add(newConnection);
+
+        await db.SaveChangesAsync();
+
+        var loginSession = await auth.CreateSessionForOidcAsync(account, clock.GetCurrentInstant());
+        var loginToken = auth.CreateToken(loginSession);
+        return Redirect($"/auth/token?token={loginToken}");
+    }
+
+    private static async Task<OidcCallbackData> ExtractCallbackData(HttpRequest request)
+    {
+        var data = new OidcCallbackData();
+        switch (request.Method)
+        {
+            case "GET":
+                data.Code = Uri.UnescapeDataString(request.Query["code"].FirstOrDefault() ?? "");
+                data.IdToken = Uri.UnescapeDataString(request.Query["id_token"].FirstOrDefault() ?? "");
+                data.State = Uri.UnescapeDataString(request.Query["state"].FirstOrDefault() ?? "");
+                break;
+            case "POST" when request.HasFormContentType:
+            {
+                var form = await request.ReadFormAsync();
+                data.Code = Uri.UnescapeDataString(form["code"].FirstOrDefault() ?? "");
+                data.IdToken = Uri.UnescapeDataString(form["id_token"].FirstOrDefault() ?? ""); 
+                data.State = Uri.UnescapeDataString(form["state"].FirstOrDefault() ?? "");
+                if (form.ContainsKey("user"))
+                    data.RawData = Uri.UnescapeDataString(form["user"].FirstOrDefault() ?? "");
+
+                break;
+            }
+        }
+
+        return data;
+    }
+}

DysonNetwork.Pass/Auth/OpenId/DiscordOidcService.cs

@@ -0,0 +1,116 @@
+using System.Net.Http.Json;
+using System.Text.Json;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class DiscordOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    public override string ProviderName => "Discord";
+    protected override string DiscoveryEndpoint => ""; // Discord doesn't have a standard OIDC discovery endpoint
+    protected override string ConfigSectionName => "Discord";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "redirect_uri", config.RedirectUri },
+            { "response_type", "code" },
+            { "scope", "identify email" },
+            { "state", state },
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"https://discord.com/oauth2/authorize?{queryString}";
+    }
+    
+    protected override Task<OidcDiscoveryDocument?> GetDiscoveryDocumentAsync()
+    {
+        return Task.FromResult(new OidcDiscoveryDocument
+        {
+            AuthorizationEndpoint = "https://discord.com/oauth2/authorize",
+            TokenEndpoint = "https://discord.com/oauth2/token",
+            UserinfoEndpoint = "https://discord.com/users/@me",
+            JwksUri = null
+        })!;
+    }
+    
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        var tokenResponse = await ExchangeCodeForTokensAsync(callbackData.Code);
+        if (tokenResponse?.AccessToken == null)
+        {
+            throw new InvalidOperationException("Failed to obtain access token from Discord");
+        }
+
+        var userInfo = await GetUserInfoAsync(tokenResponse.AccessToken);
+
+        userInfo.AccessToken = tokenResponse.AccessToken;
+        userInfo.RefreshToken = tokenResponse.RefreshToken;
+
+        return userInfo;
+    }
+
+    protected override async Task<OidcTokenResponse?> ExchangeCodeForTokensAsync(string code,
+        string? codeVerifier = null)
+    {
+        var config = GetProviderConfig();
+        var client = HttpClientFactory.CreateClient();
+
+        var content = new FormUrlEncodedContent(new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "client_secret", config.ClientSecret },
+            { "grant_type", "authorization_code" },
+            { "code", code },
+            { "redirect_uri", config.RedirectUri },
+        });
+
+        var response = await client.PostAsync("https://discord.com/oauth2/token", content);
+        response.EnsureSuccessStatusCode();
+
+        return await response.Content.ReadFromJsonAsync<OidcTokenResponse>();
+    }
+
+    private async Task<OidcUserInfo> GetUserInfoAsync(string accessToken)
+    {
+        var client = HttpClientFactory.CreateClient();
+        var request = new HttpRequestMessage(HttpMethod.Get, "https://discord.com/users/@me");
+        request.Headers.Add("Authorization", $"Bearer {accessToken}");
+
+        var response = await client.SendAsync(request);
+        response.EnsureSuccessStatusCode();
+
+        var json = await response.Content.ReadAsStringAsync();
+        var discordUser = JsonDocument.Parse(json).RootElement;
+
+        var userId = discordUser.GetProperty("id").GetString() ?? "";
+        var avatar = discordUser.TryGetProperty("avatar", out var avatarElement) ? avatarElement.GetString() : null;
+
+        return new OidcUserInfo
+        {
+            UserId = userId,
+            Email = (discordUser.TryGetProperty("email", out var emailElement) ? emailElement.GetString() : null) ?? "",
+            EmailVerified = discordUser.TryGetProperty("verified", out var verifiedElement) &&
+                            verifiedElement.GetBoolean(),
+            DisplayName = (discordUser.TryGetProperty("global_name", out var globalNameElement)
+                ? globalNameElement.GetString()
+                : null) ?? "",
+            PreferredUsername = discordUser.GetProperty("username").GetString() ?? "",
+            ProfilePictureUrl = !string.IsNullOrEmpty(avatar)
+                ? $"https://cdn.discordapp.com/avatars/{userId}/{avatar}.png"
+                : "",
+            Provider = ProviderName
+        };
+    }
+}

DysonNetwork.Pass/Auth/OpenId/GitHubOidcService.cs

@@ -0,0 +1,128 @@
+using System.Net.Http.Json;
+using System.Text.Json;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class GitHubOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    public override string ProviderName => "GitHub";
+    protected override string DiscoveryEndpoint => ""; // GitHub doesn't have a standard OIDC discovery endpoint
+    protected override string ConfigSectionName => "GitHub";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "redirect_uri", config.RedirectUri },
+            { "scope", "user:email" },
+            { "state", state },
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"https://github.com/login/oauth/authorize?{queryString}";
+    }
+
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        var tokenResponse = await ExchangeCodeForTokensAsync(callbackData.Code);
+        if (tokenResponse?.AccessToken == null)
+        {
+            throw new InvalidOperationException("Failed to obtain access token from GitHub");
+        }
+
+        var userInfo = await GetUserInfoAsync(tokenResponse.AccessToken);
+
+        userInfo.AccessToken = tokenResponse.AccessToken;
+        userInfo.RefreshToken = tokenResponse.RefreshToken;
+
+        return userInfo;
+    }
+
+    protected override async Task<OidcTokenResponse?> ExchangeCodeForTokensAsync(string code,
+        string? codeVerifier = null)
+    {
+        var config = GetProviderConfig();
+        var client = HttpClientFactory.CreateClient();
+
+        var tokenRequest = new HttpRequestMessage(HttpMethod.Post, "https://github.com/login/oauth/access_token")
+        {
+            Content = new FormUrlEncodedContent(new Dictionary<string, string>
+            {
+                { "client_id", config.ClientId },
+                { "client_secret", config.ClientSecret },
+                { "code", code },
+                { "redirect_uri", config.RedirectUri },
+            })
+        };
+        tokenRequest.Headers.Add("Accept", "application/json");
+
+        var response = await client.SendAsync(tokenRequest);
+        response.EnsureSuccessStatusCode();
+
+        return await response.Content.ReadFromJsonAsync<OidcTokenResponse>();
+    }
+
+    private async Task<OidcUserInfo> GetUserInfoAsync(string accessToken)
+    {
+        var client = HttpClientFactory.CreateClient();
+        var request = new HttpRequestMessage(HttpMethod.Get, "https://api.github.com/user");
+        request.Headers.Add("Authorization", $"Bearer {accessToken}");
+        request.Headers.Add("User-Agent", "DysonNetwork.Pass");
+
+        var response = await client.SendAsync(request);
+        response.EnsureSuccessStatusCode();
+
+        var json = await response.Content.ReadAsStringAsync();
+        var githubUser = JsonDocument.Parse(json).RootElement;
+
+        var email = githubUser.TryGetProperty("email", out var emailElement) ? emailElement.GetString() : null;
+        if (string.IsNullOrEmpty(email))
+        {
+            email = await GetPrimaryEmailAsync(accessToken);
+        }
+
+        return new OidcUserInfo
+        {
+            UserId = githubUser.GetProperty("id").GetInt64().ToString(),
+            Email = email,
+            DisplayName = githubUser.TryGetProperty("name", out var nameElement) ? nameElement.GetString() ?? "" : "",
+            PreferredUsername = githubUser.GetProperty("login").GetString() ?? "",
+            ProfilePictureUrl = githubUser.TryGetProperty("avatar_url", out var avatarElement)
+                ? avatarElement.GetString() ?? ""
+                : "",
+            Provider = ProviderName
+        };
+    }
+
+    private async Task<string?> GetPrimaryEmailAsync(string accessToken)
+    {
+        var client = HttpClientFactory.CreateClient();
+        var request = new HttpRequestMessage(HttpMethod.Get, "https://api.github.com/user/emails");
+        request.Headers.Add("Authorization", $"Bearer {accessToken}");
+        request.Headers.Add("User-Agent", "DysonNetwork.Pass");
+
+        var response = await client.SendAsync(request);
+        if (!response.IsSuccessStatusCode) return null;
+
+        var emails = await response.Content.ReadFromJsonAsync<List<GitHubEmail>>();
+        return emails?.FirstOrDefault(e => e.Primary)?.Email;
+    }
+
+    private class GitHubEmail
+    {
+        public string Email { get; set; } = "";
+        public bool Primary { get; set; }
+        public bool Verified { get; set; }
+    }
+}

DysonNetwork.Pass/Auth/OpenId/GoogleOidcService.cs

@@ -0,0 +1,137 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Net.Http.Json;
+using System.Security.Cryptography;
+using System.Text;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+using Microsoft.IdentityModel.Tokens;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class GoogleOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    private readonly IHttpClientFactory _httpClientFactory = httpClientFactory;
+
+    public override string ProviderName => "google";
+    protected override string DiscoveryEndpoint => "https://accounts.google.com/.well-known/openid-configuration";
+    protected override string ConfigSectionName => "Google";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+        var discoveryDocument = GetDiscoveryDocumentAsync().GetAwaiter().GetResult();
+
+        if (discoveryDocument?.AuthorizationEndpoint == null)
+        {
+            throw new InvalidOperationException("Authorization endpoint not found in discovery document");
+        }
+
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "redirect_uri", config.RedirectUri },
+            { "response_type", "code" },
+            { "scope", "openid email profile" },
+            { "state", state }, // No '|codeVerifier' appended anymore
+            { "nonce", nonce }
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"{discoveryDocument.AuthorizationEndpoint}?{queryString}";
+    }
+
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        // No need to split or parse code verifier from state
+        var state = callbackData.State ?? "";
+        callbackData.State = state; // Keep the original state if needed
+
+        // Exchange the code for tokens
+        // Pass null or omit the parameter for codeVerifier as PKCE is removed
+        var tokenResponse = await ExchangeCodeForTokensAsync(callbackData.Code, null);
+        if (tokenResponse?.IdToken == null)
+        {
+            throw new InvalidOperationException("Failed to obtain ID token from Google");
+        }
+
+        // Validate the ID token
+        var userInfo = await ValidateTokenAsync(tokenResponse.IdToken);
+
+        // Set tokens on the user info
+        userInfo.AccessToken = tokenResponse.AccessToken;
+        userInfo.RefreshToken = tokenResponse.RefreshToken;
+
+        // Try to fetch additional profile data if userinfo endpoint is available
+        try
+        {
+            var discoveryDocument = await GetDiscoveryDocumentAsync();
+            if (discoveryDocument?.UserinfoEndpoint != null && !string.IsNullOrEmpty(tokenResponse.AccessToken))
+            {
+                var client = _httpClientFactory.CreateClient();
+                client.DefaultRequestHeaders.Authorization =
+                    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", tokenResponse.AccessToken);
+
+                var userInfoResponse =
+                    await client.GetFromJsonAsync<Dictionary<string, object>>(discoveryDocument.UserinfoEndpoint);
+
+                if (userInfoResponse != null)
+                {
+                    if (userInfoResponse.TryGetValue("picture", out var picture) && picture != null)
+                    {
+                        userInfo.ProfilePictureUrl = picture.ToString();
+                    }
+                }
+            }
+        }
+        catch
+        {
+            // Ignore errors when fetching additional profile data
+        }
+
+        return userInfo;
+    }
+
+    private async Task<OidcUserInfo> ValidateTokenAsync(string idToken)
+    {
+        var discoveryDocument = await GetDiscoveryDocumentAsync();
+        if (discoveryDocument?.JwksUri == null)
+        {
+            throw new InvalidOperationException("JWKS URI not found in discovery document");
+        }
+
+        var client = _httpClientFactory.CreateClient();
+        var jwksResponse = await client.GetFromJsonAsync<JsonWebKeySet>(discoveryDocument.JwksUri);
+        if (jwksResponse == null)
+        {
+            throw new InvalidOperationException("Failed to retrieve JWKS from Google");
+        }
+
+        var handler = new JwtSecurityTokenHandler();
+        var jwtToken = handler.ReadJwtToken(idToken);
+        var kid = jwtToken.Header.Kid;
+        var signingKey = jwksResponse.Keys.FirstOrDefault(k => k.Kid == kid);
+        if (signingKey == null)
+        {
+            throw new SecurityTokenValidationException("Unable to find matching key in Google's JWKS");
+        }
+
+        var validationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = "https://accounts.google.com",
+            ValidateAudience = true,
+            ValidAudience = GetProviderConfig().ClientId,
+            ValidateLifetime = true,
+            IssuerSigningKey = signingKey
+        };
+
+        return ValidateAndExtractIdToken(idToken, validationParameters);
+    }
+}

DysonNetwork.Pass/Auth/OpenId/MicrosoftOidcService.cs

@@ -0,0 +1,123 @@
+using System.Text.Json;
+using DysonNetwork.Shared.Cache;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+public class MicrosoftOidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+    : OidcService(configuration, httpClientFactory, db, auth, cache)
+{
+    public override string ProviderName => "Microsoft";
+
+    protected override string DiscoveryEndpoint => Configuration[$"Oidc:{ConfigSectionName}:DiscoveryEndpoint"] ??
+                                                   throw new InvalidOperationException(
+                                                       "Microsoft OIDC discovery endpoint is not configured.");
+
+    protected override string ConfigSectionName => "Microsoft";
+
+    public override string GetAuthorizationUrl(string state, string nonce)
+    {
+        var config = GetProviderConfig();
+        var discoveryDocument = GetDiscoveryDocumentAsync().GetAwaiter().GetResult();
+        if (discoveryDocument?.AuthorizationEndpoint == null)
+            throw new InvalidOperationException("Authorization endpoint not found in discovery document.");
+
+        var queryParams = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "response_type", "code" },
+            { "redirect_uri", config.RedirectUri },
+            { "response_mode", "query" },
+            { "scope", "openid profile email" },
+            { "state", state },
+            { "nonce", nonce },
+        };
+
+        var queryString = string.Join("&", queryParams.Select(p => $"{p.Key}={Uri.EscapeDataString(p.Value)}"));
+        return $"{discoveryDocument.AuthorizationEndpoint}?{queryString}";
+    }
+
+    public override async Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData)
+    {
+        var tokenResponse = await ExchangeCodeForTokensAsync(callbackData.Code);
+        if (tokenResponse?.AccessToken == null)
+        {
+            throw new InvalidOperationException("Failed to obtain access token from Microsoft");
+        }
+
+        var userInfo = await GetUserInfoAsync(tokenResponse.AccessToken);
+
+        userInfo.AccessToken = tokenResponse.AccessToken;
+        userInfo.RefreshToken = tokenResponse.RefreshToken;
+
+        return userInfo;
+    }
+
+    protected override async Task<OidcTokenResponse?> ExchangeCodeForTokensAsync(string code,
+        string? codeVerifier = null)
+    {
+        var config = GetProviderConfig();
+        var discoveryDocument = await GetDiscoveryDocumentAsync();
+        if (discoveryDocument?.TokenEndpoint == null)
+        {
+            throw new InvalidOperationException("Token endpoint not found in discovery document.");
+        }
+
+        var client = HttpClientFactory.CreateClient();
+
+        var tokenRequest = new HttpRequestMessage(HttpMethod.Post, discoveryDocument.TokenEndpoint)
+        {
+            Content = new FormUrlEncodedContent(new Dictionary<string, string>
+            {
+                { "client_id", config.ClientId },
+                { "scope", "openid profile email" },
+                { "code", code },
+                { "redirect_uri", config.RedirectUri },
+                { "grant_type", "authorization_code" },
+                { "client_secret", config.ClientSecret },
+            })
+        };
+
+        var response = await client.SendAsync(tokenRequest);
+        response.EnsureSuccessStatusCode();
+
+        return await response.Content.ReadFromJsonAsync<OidcTokenResponse>();
+    }
+
+    private async Task<OidcUserInfo> GetUserInfoAsync(string accessToken)
+    {
+        var discoveryDocument = await GetDiscoveryDocumentAsync();
+        if (discoveryDocument?.UserinfoEndpoint == null)
+            throw new InvalidOperationException("Userinfo endpoint not found in discovery document.");
+
+        var client = HttpClientFactory.CreateClient();
+        var request = new HttpRequestMessage(HttpMethod.Get, discoveryDocument.UserinfoEndpoint);
+        request.Headers.Add("Authorization", $"Bearer {accessToken}");
+
+        var response = await client.SendAsync(request);
+        response.EnsureSuccessStatusCode();
+
+        var json = await response.Content.ReadAsStringAsync();
+        var microsoftUser = JsonDocument.Parse(json).RootElement;
+
+        return new OidcUserInfo
+        {
+            UserId = microsoftUser.GetProperty("sub").GetString() ?? "",
+            Email = microsoftUser.TryGetProperty("email", out var emailElement) ? emailElement.GetString() : null,
+            DisplayName =
+                microsoftUser.TryGetProperty("name", out var nameElement) ? nameElement.GetString() ?? "" : "",
+            PreferredUsername = microsoftUser.TryGetProperty("preferred_username", out var preferredUsernameElement)
+                ? preferredUsernameElement.GetString() ?? ""
+                : "",
+            ProfilePictureUrl = microsoftUser.TryGetProperty("picture", out var pictureElement)
+                ? pictureElement.GetString() ?? ""
+                : "",
+            Provider = ProviderName
+        };
+    }
+}

DysonNetwork.Pass/Auth/OpenId/OidcController.cs

@@ -0,0 +1,194 @@
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.Cache;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Tokens;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+[ApiController]
+[Route("/api/auth/login")]
+public class OidcController(
+    IServiceProvider serviceProvider,
+    AppDatabase db,
+    AccountService accounts,
+    ICacheService cache
+)
+    : ControllerBase
+{
+    private const string StateCachePrefix = "oidc-state:";
+    private static readonly TimeSpan StateExpiration = TimeSpan.FromMinutes(15);
+
+    [HttpGet("{provider}")]
+    public async Task<ActionResult> OidcLogin(
+        [FromRoute] string provider,
+        [FromQuery] string? returnUrl = "/",
+        [FromHeader(Name = "X-Device-Id")] string? deviceId = null
+    )
+    {
+        try
+        {
+            var oidcService = GetOidcService(provider);
+
+            // If the user is already authenticated, treat as an account connection request
+            if (HttpContext.Items["CurrentUser"] is Account.Account currentUser)
+            {
+                var state = Guid.NewGuid().ToString();
+                var nonce = Guid.NewGuid().ToString();
+
+                // Create and store connection state
+                var oidcState = OidcState.ForConnection(currentUser.Id, provider, nonce, deviceId);
+                await cache.SetAsync($"{StateCachePrefix}{state}", oidcState, StateExpiration);
+
+                // The state parameter sent to the provider is the GUID key for the cache.
+                var authUrl = oidcService.GetAuthorizationUrl(state, nonce);
+                return Redirect(authUrl);
+            }
+            else // Otherwise, proceed with the login / registration flow
+            {
+                var nonce = Guid.NewGuid().ToString();
+                var state = Guid.NewGuid().ToString();
+
+                // Create login state with return URL and device ID
+                var oidcState = OidcState.ForLogin(returnUrl ?? "/", deviceId);
+                await cache.SetAsync($"{StateCachePrefix}{state}", oidcState, StateExpiration);
+                var authUrl = oidcService.GetAuthorizationUrl(state, nonce);
+                return Redirect(authUrl);
+            }
+        }
+        catch (Exception ex)
+        {
+            return BadRequest($"Error initiating OpenID Connect flow: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// Mobile Apple Sign In endpoint
+    /// Handles Apple authentication directly from mobile apps
+    /// </summary>
+    [HttpPost("apple/mobile")]
+    public async Task<ActionResult<AuthChallenge>> AppleMobileLogin(
+        [FromBody] AppleMobileSignInRequest request)
+    {
+        try
+        {
+            // Get Apple OIDC service
+            if (GetOidcService("apple") is not AppleOidcService appleService)
+                return StatusCode(503, "Apple OIDC service not available");
+
+            // Prepare callback data for processing
+            var callbackData = new OidcCallbackData
+            {
+                IdToken = request.IdentityToken,
+                Code = request.AuthorizationCode,
+            };
+
+            // Process the authentication
+            var userInfo = await appleService.ProcessCallbackAsync(callbackData);
+
+            // Find or create user account using existing logic
+            var account = await FindOrCreateAccount(userInfo, "apple");
+
+            // Create session using the OIDC service
+            var challenge = await appleService.CreateChallengeForUserAsync(
+                userInfo,
+                account,
+                HttpContext,
+                request.DeviceId
+            );
+
+            return Ok(challenge);
+        }
+        catch (SecurityTokenValidationException ex)
+        {
+            return Unauthorized($"Invalid identity token: {ex.Message}");
+        }
+        catch (Exception ex)
+        {
+            // Log the error
+            return StatusCode(500, $"Authentication failed: {ex.Message}");
+        }
+    }
+
+    private OidcService GetOidcService(string provider)
+    {
+        return provider.ToLower() switch
+        {
+            "apple" => serviceProvider.GetRequiredService<AppleOidcService>(),
+            "google" => serviceProvider.GetRequiredService<GoogleOidcService>(),
+            "microsoft" => serviceProvider.GetRequiredService<MicrosoftOidcService>(),
+            "discord" => serviceProvider.GetRequiredService<DiscordOidcService>(),
+            "github" => serviceProvider.GetRequiredService<GitHubOidcService>(),
+            "afdian" => serviceProvider.GetRequiredService<AfdianOidcService>(),
+            _ => throw new ArgumentException($"Unsupported provider: {provider}")
+        };
+    }
+
+    private async Task<Account.Account> FindOrCreateAccount(OidcUserInfo userInfo, string provider)
+    {
+        if (string.IsNullOrEmpty(userInfo.Email))
+            throw new ArgumentException("Email is required for account creation");
+
+        // Check if an account exists by email
+        var existingAccount = await accounts.LookupAccount(userInfo.Email);
+        if (existingAccount != null)
+        {
+            // Check if this provider connection already exists
+            var existingConnection = await db.AccountConnections
+                .FirstOrDefaultAsync(c => c.AccountId == existingAccount.Id &&
+                                          c.Provider == provider &&
+                                          c.ProvidedIdentifier == userInfo.UserId);
+
+            // If no connection exists, create one
+            if (existingConnection != null)
+            {
+                await db.AccountConnections
+                    .Where(c => c.AccountId == existingAccount.Id &&
+                                c.Provider == provider &&
+                                c.ProvidedIdentifier == userInfo.UserId)
+                    .ExecuteUpdateAsync(s => s
+                        .SetProperty(c => c.LastUsedAt, SystemClock.Instance.GetCurrentInstant())
+                        .SetProperty(c => c.Meta, userInfo.ToMetadata()));
+
+                return existingAccount;
+            }
+
+            var connection = new AccountConnection
+            {
+                AccountId = existingAccount.Id,
+                Provider = provider,
+                ProvidedIdentifier = userInfo.UserId!,
+                AccessToken = userInfo.AccessToken,
+                RefreshToken = userInfo.RefreshToken,
+                LastUsedAt = SystemClock.Instance.GetCurrentInstant(),
+                Meta = userInfo.ToMetadata()
+            };
+
+            await db.AccountConnections.AddAsync(connection);
+            await db.SaveChangesAsync();
+
+            return existingAccount;
+        }
+
+        // Create new account using the AccountService
+        var newAccount = await accounts.CreateAccount(userInfo);
+
+        // Create the provider connection
+        var newConnection = new AccountConnection
+        {
+            AccountId = newAccount.Id,
+            Provider = provider,
+            ProvidedIdentifier = userInfo.UserId!,
+            AccessToken = userInfo.AccessToken,
+            RefreshToken = userInfo.RefreshToken,
+            LastUsedAt = SystemClock.Instance.GetCurrentInstant(),
+            Meta = userInfo.ToMetadata()
+        };
+
+        db.AccountConnections.Add(newConnection);
+        await db.SaveChangesAsync();
+
+        return newAccount;
+    }
+}

DysonNetwork.Pass/Auth/OpenId/OidcService.cs

@@ -0,0 +1,294 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Text.Json.Serialization;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Tokens;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+/// <summary>
+/// Base service for OpenID Connect authentication providers
+/// </summary>
+public abstract class OidcService(
+    IConfiguration configuration,
+    IHttpClientFactory httpClientFactory,
+    AppDatabase db,
+    AuthService auth,
+    ICacheService cache
+)
+{
+    protected readonly IConfiguration Configuration = configuration;
+    protected readonly IHttpClientFactory HttpClientFactory = httpClientFactory;
+    protected readonly AppDatabase Db = db;
+
+    /// <summary>
+    /// Gets the unique identifier for this provider
+    /// </summary>
+    public abstract string ProviderName { get; }
+
+    /// <summary>
+    /// Gets the OIDC discovery document endpoint
+    /// </summary>
+    protected abstract string DiscoveryEndpoint { get; }
+
+    /// <summary>
+    /// Gets configuration section name for this provider
+    /// </summary>
+    protected abstract string ConfigSectionName { get; }
+
+    /// <summary>
+    /// Gets the authorization URL for initiating the authentication flow
+    /// </summary>
+    public abstract string GetAuthorizationUrl(string state, string nonce);
+
+    /// <summary>
+    /// Process the callback from the OIDC provider
+    /// </summary>
+    public abstract Task<OidcUserInfo> ProcessCallbackAsync(OidcCallbackData callbackData);
+
+    /// <summary>
+    /// Gets the provider configuration
+    /// </summary>
+    protected ProviderConfiguration GetProviderConfig()
+    {
+        return new ProviderConfiguration
+        {
+            ClientId = Configuration[$"Oidc:{ConfigSectionName}:ClientId"] ?? "",
+            ClientSecret = Configuration[$"Oidc:{ConfigSectionName}:ClientSecret"] ?? "",
+            RedirectUri = Configuration["BaseUrl"] + "/auth/callback/" + ProviderName.ToLower()
+        };
+    }
+
+    /// <summary>
+    /// Retrieves the OpenID Connect discovery document
+    /// </summary>
+    protected virtual async Task<OidcDiscoveryDocument?> GetDiscoveryDocumentAsync()
+    {
+        // Construct a cache key unique to the current provider:
+        var cacheKey = $"oidc-discovery:{ProviderName}";
+
+        // Try getting the discovery document from cache first:
+        var (found, cachedDoc) = await cache.GetAsyncWithStatus<OidcDiscoveryDocument>(cacheKey);
+        if (found && cachedDoc != null)
+        {
+            return cachedDoc;
+        }
+
+        // If it's not cached, fetch from the actual discovery endpoint:
+        var client = HttpClientFactory.CreateClient();
+        var response = await client.GetAsync(DiscoveryEndpoint);
+        response.EnsureSuccessStatusCode();
+        var doc = await response.Content.ReadFromJsonAsync<OidcDiscoveryDocument>();
+
+        // Store the discovery document in the cache for a while (e.g., 15 minutes):
+        if (doc is not null)
+            await cache.SetAsync(cacheKey, doc, TimeSpan.FromMinutes(15));
+
+        return doc;
+
+    }
+
+    /// <summary>
+    /// Exchange the authorization code for tokens
+    /// </summary>
+    protected virtual async Task<OidcTokenResponse?> ExchangeCodeForTokensAsync(string code,
+        string? codeVerifier = null)
+    {
+        var config = GetProviderConfig();
+        var discoveryDocument = await GetDiscoveryDocumentAsync();
+
+        if (discoveryDocument?.TokenEndpoint == null)
+        {
+            throw new InvalidOperationException("Token endpoint not found in discovery document");
+        }
+
+        var client = HttpClientFactory.CreateClient();
+        var content = new FormUrlEncodedContent(BuildTokenRequestParameters(code, config, codeVerifier));
+
+        var response = await client.PostAsync(discoveryDocument.TokenEndpoint, content);
+        response.EnsureSuccessStatusCode();
+
+        return await response.Content.ReadFromJsonAsync<OidcTokenResponse>();
+    }
+
+    /// <summary>
+    /// Build the token request parameters
+    /// </summary>
+    protected virtual Dictionary<string, string> BuildTokenRequestParameters(string code, ProviderConfiguration config,
+        string? codeVerifier)
+    {
+        var parameters = new Dictionary<string, string>
+        {
+            { "client_id", config.ClientId },
+            { "code", code },
+            { "grant_type", "authorization_code" },
+            { "redirect_uri", config.RedirectUri }
+        };
+
+        if (!string.IsNullOrEmpty(config.ClientSecret))
+        {
+            parameters.Add("client_secret", config.ClientSecret);
+        }
+
+        if (!string.IsNullOrEmpty(codeVerifier))
+        {
+            parameters.Add("code_verifier", codeVerifier);
+        }
+
+        return parameters;
+    }
+
+    /// <summary>
+    /// Validates and extracts information from an ID token
+    /// </summary>
+    protected virtual OidcUserInfo ValidateAndExtractIdToken(string idToken,
+        TokenValidationParameters validationParameters)
+    {
+        var handler = new JwtSecurityTokenHandler();
+        handler.ValidateToken(idToken, validationParameters, out _);
+
+        var jwtToken = handler.ReadJwtToken(idToken);
+
+        // Extract standard claims
+        var userId = jwtToken.Claims.FirstOrDefault(c => c.Type == "sub")?.Value;
+        var email = jwtToken.Claims.FirstOrDefault(c => c.Type == "email")?.Value;
+        var emailVerified = jwtToken.Claims.FirstOrDefault(c => c.Type == "email_verified")?.Value == "true";
+        var name = jwtToken.Claims.FirstOrDefault(c => c.Type == "name")?.Value;
+        var givenName = jwtToken.Claims.FirstOrDefault(c => c.Type == "given_name")?.Value;
+        var familyName = jwtToken.Claims.FirstOrDefault(c => c.Type == "family_name")?.Value;
+        var preferredUsername = jwtToken.Claims.FirstOrDefault(c => c.Type == "preferred_username")?.Value;
+        var picture = jwtToken.Claims.FirstOrDefault(c => c.Type == "picture")?.Value;
+
+        // Determine preferred username - try different options
+        var username = preferredUsername;
+        if (string.IsNullOrEmpty(username))
+        {
+            // Fall back to email local part if no preferred username
+            username = !string.IsNullOrEmpty(email) ? email.Split('@')[0] : null;
+        }
+
+        return new OidcUserInfo
+        {
+            UserId = userId,
+            Email = email,
+            EmailVerified = emailVerified,
+            FirstName = givenName ?? "",
+            LastName = familyName ?? "",
+            DisplayName = name ?? $"{givenName} {familyName}".Trim(),
+            PreferredUsername = username ?? "",
+            ProfilePictureUrl = picture,
+            Provider = ProviderName
+        };
+    }
+
+    /// <summary>
+    /// Creates a challenge and session for an authenticated user
+    /// Also creates or updates the account connection
+    /// </summary>
+    public async Task<AuthChallenge> CreateChallengeForUserAsync(
+        OidcUserInfo userInfo,
+        Account.Account account,
+        HttpContext request,
+        string deviceId
+    )
+    {
+        // Create or update the account connection
+        var connection = await Db.AccountConnections
+            .FirstOrDefaultAsync(c => c.Provider == ProviderName &&
+                                      c.ProvidedIdentifier == userInfo.UserId &&
+                                      c.AccountId == account.Id
+            );
+
+        if (connection is null)
+        {
+            connection = new AccountConnection
+            {
+                Provider = ProviderName,
+                ProvidedIdentifier = userInfo.UserId ?? "",
+                AccessToken = userInfo.AccessToken,
+                RefreshToken = userInfo.RefreshToken,
+                LastUsedAt = SystemClock.Instance.GetCurrentInstant(),
+                AccountId = account.Id
+            };
+            await Db.AccountConnections.AddAsync(connection);
+        }
+
+        // Create a challenge that's already completed
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var challenge = new AuthChallenge
+        {
+            ExpiredAt = now.Plus(Duration.FromHours(1)),
+            StepTotal = await auth.DetectChallengeRisk(request.Request, account),
+            Type = ChallengeType.Oidc,
+            Platform = ChallengePlatform.Unidentified,
+            Audiences = [ProviderName],
+            Scopes = ["*"],
+            AccountId = account.Id,
+            DeviceId = deviceId,
+            IpAddress = request.Connection.RemoteIpAddress?.ToString() ?? null,
+            UserAgent = request.Request.Headers.UserAgent,
+        };
+        challenge.StepRemain--;
+        if (challenge.StepRemain < 0) challenge.StepRemain = 0;
+
+        await Db.AuthChallenges.AddAsync(challenge);
+        await Db.SaveChangesAsync();
+
+        return challenge;
+    }
+}
+
+/// <summary>
+/// Provider configuration from app settings
+/// </summary>
+public class ProviderConfiguration
+{
+    public string ClientId { get; set; } = "";
+    public string ClientSecret { get; set; } = "";
+    public string RedirectUri { get; set; } = "";
+}
+
+/// <summary>
+/// OIDC Discovery Document
+/// </summary>
+public class OidcDiscoveryDocument
+{
+    [JsonPropertyName("authorization_endpoint")]
+    public string? AuthorizationEndpoint { get; set; }
+
+    [JsonPropertyName("token_endpoint")] public string? TokenEndpoint { get; set; }
+
+    [JsonPropertyName("userinfo_endpoint")]
+    public string? UserinfoEndpoint { get; set; }
+
+    [JsonPropertyName("jwks_uri")] public string? JwksUri { get; set; }
+}
+
+/// <summary>
+/// Response from the token endpoint
+/// </summary>
+public class OidcTokenResponse
+{
+    [JsonPropertyName("access_token")] public string? AccessToken { get; set; }
+
+    [JsonPropertyName("token_type")] public string? TokenType { get; set; }
+
+    [JsonPropertyName("expires_in")] public int ExpiresIn { get; set; }
+
+    [JsonPropertyName("refresh_token")] public string? RefreshToken { get; set; }
+
+    [JsonPropertyName("id_token")] public string? IdToken { get; set; }
+}
+
+/// <summary>
+/// Data received in the callback from an OIDC provider
+/// </summary>
+public class OidcCallbackData
+{
+    public string Code { get; set; } = "";
+    public string IdToken { get; set; } = "";
+    public string? State { get; set; }
+    public string? RawData { get; set; }
+}

DysonNetwork.Pass/Auth/OpenId/OidcState.cs

@@ -0,0 +1,189 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+/// <summary>
+/// Represents the state parameter used in OpenID Connect flows.
+/// Handles serialization and deserialization of the state parameter.
+/// </summary>
+public class OidcState
+{
+    /// <summary>
+    /// The type of OIDC flow (login or connect).
+    /// </summary>
+    public OidcFlowType FlowType { get; set; }
+
+    /// <summary>
+    /// The account ID (for connect flow).
+    /// </summary>
+    public Guid? AccountId { get; set; }
+
+
+    /// <summary>
+    /// The OIDC provider name.
+    /// </summary>
+    public string? Provider { get; set; }
+
+
+    /// <summary>
+    /// The nonce for CSRF protection.
+    /// </summary>
+    public string? Nonce { get; set; }
+
+
+    /// <summary>
+    /// The device ID for the authentication request.
+    /// </summary>
+    public string? DeviceId { get; set; }
+
+
+    /// <summary>
+    /// The return URL after authentication (for login flow).
+    /// </summary>
+    public string? ReturnUrl { get; set; }
+
+
+    /// <summary>
+    /// Creates a new OidcState for a connection flow.
+    /// </summary>
+    public static OidcState ForConnection(Guid accountId, string provider, string nonce, string? deviceId = null)
+    {
+        return new OidcState
+        {
+            FlowType = OidcFlowType.Connect,
+            AccountId = accountId,
+            Provider = provider,
+            Nonce = nonce,
+            DeviceId = deviceId
+        };
+    }
+
+    /// <summary>
+    /// Creates a new OidcState for a login flow.
+    /// </summary>
+    public static OidcState ForLogin(string returnUrl = "/", string? deviceId = null)
+    {
+        return new OidcState
+        {
+            FlowType = OidcFlowType.Login,
+            ReturnUrl = returnUrl,
+            DeviceId = deviceId
+        };
+    }
+
+    /// <summary>
+    /// The version of the state format.
+    /// </summary>
+    public int Version { get; set; } = 1;
+
+    /// <summary>
+    /// Serializes the state to a JSON string for use in OIDC flows.
+    /// </summary>
+    public string Serialize()
+    {
+        return JsonSerializer.Serialize(this, new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+            DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+        });
+    }
+
+    /// <summary>
+    /// Attempts to parse a state string into an OidcState object.
+    /// </summary>
+    public static bool TryParse(string? stateString, out OidcState? state)
+    {
+        state = null;
+
+        if (string.IsNullOrEmpty(stateString))
+            return false;
+
+        try
+        {
+            // First try to parse as JSON
+            try
+            {
+                state = JsonSerializer.Deserialize<OidcState>(stateString);
+                return state != null;
+            }
+            catch (JsonException)
+            {
+                // Not a JSON string, try legacy format for backward compatibility
+                return TryParseLegacyFormat(stateString, out state);
+            }
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    private static bool TryParseLegacyFormat(string stateString, out OidcState? state)
+    {
+        state = null;
+        var parts = stateString.Split('|');
+
+        // Check for connection flow format: {accountId}|{provider}|{nonce}|{deviceId}|connect
+        if (parts.Length >= 5 &&
+            Guid.TryParse(parts[0], out var accountId) &&
+            string.Equals(parts[^1], "connect", StringComparison.OrdinalIgnoreCase))
+        {
+            state = new OidcState
+            {
+                FlowType = OidcFlowType.Connect,
+                AccountId = accountId,
+                Provider = parts[1],
+                Nonce = parts[2],
+                DeviceId = parts.Length >= 4 && !string.IsNullOrEmpty(parts[3]) ? parts[3] : null
+            };
+            return true;
+        }
+
+        // Check for login flow format: {returnUrl}|{deviceId}|login
+        if (parts.Length >= 2 &&
+            parts.Length <= 3 &&
+            (parts.Length < 3 || string.Equals(parts[^1], "login", StringComparison.OrdinalIgnoreCase)))
+        {
+            state = new OidcState
+            {
+                FlowType = OidcFlowType.Login,
+                ReturnUrl = parts[0],
+                DeviceId = parts.Length >= 2 && !string.IsNullOrEmpty(parts[1]) ? parts[1] : null
+            };
+            return true;
+        }
+
+        // Legacy format support (for backward compatibility)
+        if (parts.Length == 1)
+        {
+            state = new OidcState
+            {
+                FlowType = OidcFlowType.Login,
+                ReturnUrl = parts[0],
+                DeviceId = null
+            };
+            return true;
+        }
+
+
+        return false;
+    }
+}
+
+/// <summary>
+/// Represents the type of OIDC flow.
+/// </summary>
+public enum OidcFlowType
+{
+    /// <summary>
+    /// Login or registration flow.
+    /// </summary>
+    Login,
+
+
+    /// <summary>
+    /// Account connection flow.
+    /// </summary>
+    Connect
+}

DysonNetwork.Pass/Auth/OpenId/OidcUserInfo.cs

@@ -0,0 +1,49 @@
+namespace DysonNetwork.Pass.Auth.OpenId;
+
+/// <summary>
+/// Represents the user information from an OIDC provider
+/// </summary>
+public class OidcUserInfo
+{
+    public string? UserId { get; set; }
+    public string? Email { get; set; }
+    public bool EmailVerified { get; set; }
+    public string FirstName { get; set; } = "";
+    public string LastName { get; set; } = "";
+    public string DisplayName { get; set; } = "";
+    public string PreferredUsername { get; set; } = "";
+    public string? ProfilePictureUrl { get; set; }
+    public string Provider { get; set; } = "";
+    public string? RefreshToken { get; set; }
+    public string? AccessToken { get; set; }
+
+    public Dictionary<string, object> ToMetadata()
+    {
+        var metadata = new Dictionary<string, object>();
+
+        if (!string.IsNullOrWhiteSpace(UserId))
+            metadata["user_id"] = UserId;
+
+        if (!string.IsNullOrWhiteSpace(Email))
+            metadata["email"] = Email;
+
+        metadata["email_verified"] = EmailVerified;
+
+        if (!string.IsNullOrWhiteSpace(FirstName))
+            metadata["first_name"] = FirstName;
+
+        if (!string.IsNullOrWhiteSpace(LastName))
+            metadata["last_name"] = LastName;
+
+        if (!string.IsNullOrWhiteSpace(DisplayName))
+            metadata["display_name"] = DisplayName;
+
+        if (!string.IsNullOrWhiteSpace(PreferredUsername))
+            metadata["preferred_username"] = PreferredUsername;
+
+        if (!string.IsNullOrWhiteSpace(ProfilePictureUrl))
+            metadata["profile_picture_url"] = ProfilePictureUrl;
+
+        return metadata;
+    }
+}

DysonNetwork.Pass/Auth/Session.cs

@@ -0,0 +1,103 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Pass;
+using DysonNetwork.Pass.Developer;
+using DysonNetwork.Shared.Data;
+using NodaTime;
+using NodaTime.Serialization.Protobuf;
+using Point = NetTopologySuite.Geometries.Point;
+
+namespace DysonNetwork.Pass.Auth;
+
+public class AuthSession : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string? Label { get; set; }
+    public Instant? LastGrantedAt { get; set; }
+    public Instant? ExpiredAt { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account.Account Account { get; set; } = null!;
+    public Guid ChallengeId { get; set; }
+    public AuthChallenge Challenge { get; set; } = null!;
+    public Guid? AppId { get; set; }
+    public CustomApp? App { get; set; }
+
+    public Shared.Proto.AuthSession ToProtoValue() => new()
+    {
+        Id = Id.ToString(),
+        Label = Label,
+        LastGrantedAt = LastGrantedAt?.ToTimestamp(),
+        ExpiredAt = ExpiredAt?.ToTimestamp(),
+        AccountId = AccountId.ToString(),
+        ChallengeId = ChallengeId.ToString(),
+        Challenge = Challenge.ToProtoValue(),
+        AppId = AppId?.ToString()
+    };
+}
+
+public enum ChallengeType
+{
+    Login,
+    OAuth, // Trying to authorize other platforms
+    Oidc // Trying to connect other platforms
+}
+
+public enum ChallengePlatform
+{
+    Unidentified,
+    Web,
+    Ios,
+    Android,
+    MacOs,
+    Windows,
+    Linux
+}
+
+public class AuthChallenge : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public Instant? ExpiredAt { get; set; }
+    public int StepRemain { get; set; }
+    public int StepTotal { get; set; }
+    public int FailedAttempts { get; set; }
+    public ChallengePlatform Platform { get; set; } = ChallengePlatform.Unidentified;
+    public ChallengeType Type { get; set; } = ChallengeType.Login;
+    [Column(TypeName = "jsonb")] public List<Guid> BlacklistFactors { get; set; } = new();
+    [Column(TypeName = "jsonb")] public List<string> Audiences { get; set; } = new();
+    [Column(TypeName = "jsonb")] public List<string> Scopes { get; set; } = new();
+    [MaxLength(128)] public string? IpAddress { get; set; }
+    [MaxLength(512)] public string? UserAgent { get; set; }
+    [MaxLength(256)] public string? DeviceId { get; set; }
+    [MaxLength(1024)] public string? Nonce { get; set; }
+    public Point? Location { get; set; }
+
+    public Guid AccountId { get; set; }
+    [JsonIgnore] public Account.Account Account { get; set; } = null!;
+
+    public AuthChallenge Normalize()
+    {
+        if (StepRemain == 0 && BlacklistFactors.Count == 0) StepRemain = StepTotal;
+        return this;
+    }
+
+    public Shared.Proto.AuthChallenge ToProtoValue() => new()
+    {
+        Id = Id.ToString(),
+        ExpiredAt = ExpiredAt?.ToTimestamp(),
+        StepRemain = StepRemain,
+        StepTotal = StepTotal,
+        FailedAttempts = FailedAttempts,
+        Platform = (Shared.Proto.ChallengePlatform)Platform,
+        Type = (Shared.Proto.ChallengeType)Type,
+        BlacklistFactors = { BlacklistFactors.Select(x => x.ToString()) },
+        Audiences = { Audiences },
+        Scopes = { Scopes },
+        IpAddress = IpAddress,
+        UserAgent = UserAgent,
+        DeviceId = DeviceId,
+        Nonce = Nonce,
+        AccountId = AccountId.ToString()
+    };
+}

DysonNetwork.Pass/Developer/CustomApp.cs

@@ -0,0 +1,68 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json.Serialization;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.Data;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Developer;
+
+public enum CustomAppStatus
+{
+    Developing,
+    Staging,
+    Production,
+    Suspended
+}
+
+public class CustomApp : ModelBase, IIdentifiedResource
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Slug { get; set; } = null!;
+    [MaxLength(1024)] public string Name { get; set; } = null!;
+    [MaxLength(4096)] public string? Description { get; set; }
+    public CustomAppStatus Status { get; set; } = CustomAppStatus.Developing;
+
+    [Column(TypeName = "jsonb")] public CloudFileReferenceObject? Picture { get; set; }
+    [Column(TypeName = "jsonb")] public CloudFileReferenceObject? Background { get; set; }
+
+    [Column(TypeName = "jsonb")] public VerificationMark? Verification { get; set; }
+    [Column(TypeName = "jsonb")] public CustomAppOauthConfig? OauthConfig { get; set; }
+    [Column(TypeName = "jsonb")] public CustomAppLinks? Links { get; set; }
+
+    [JsonIgnore] public ICollection<CustomAppSecret> Secrets { get; set; } = new List<CustomAppSecret>();
+
+    // TODO: Publisher
+
+    [NotMapped] public string ResourceIdentifier => "custom-app/" + Id;
+}
+
+public class CustomAppLinks
+{
+    [MaxLength(8192)] public string? HomePage { get; set; }
+    [MaxLength(8192)] public string? PrivacyPolicy { get; set; }
+    [MaxLength(8192)] public string? TermsOfService { get; set; }
+}
+
+public class CustomAppOauthConfig
+{
+    [MaxLength(1024)] public string? ClientUri { get; set; }
+    [MaxLength(4096)] public string[] RedirectUris { get; set; } = [];
+    [MaxLength(4096)] public string[]? PostLogoutRedirectUris { get; set; }
+    [MaxLength(256)] public string[]? AllowedScopes { get; set; } = ["openid", "profile", "email"];
+    [MaxLength(256)] public string[] AllowedGrantTypes { get; set; } = ["authorization_code", "refresh_token"];
+    public bool RequirePkce { get; set; } = true;
+    public bool AllowOfflineAccess { get; set; } = false;
+}
+
+public class CustomAppSecret : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Secret { get; set; } = null!;
+    [MaxLength(4096)] public string? Description { get; set; } = null!;
+    public Instant? ExpiredAt { get; set; }
+    public bool IsOidc { get; set; } = false; // Indicates if this secret is for OIDC/OAuth
+
+    public Guid AppId { get; set; }
+    public CustomApp App { get; set; } = null!;
+}

DysonNetwork.Pass/Dockerfile

@@ -0,0 +1,23 @@
+FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
+USER $APP_UID
+WORKDIR /app
+EXPOSE 8080
+EXPOSE 8081
+
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+ARG BUILD_CONFIGURATION=Release
+WORKDIR /src
+COPY ["DysonNetwork.Pass/DysonNetwork.Pass.csproj", "DysonNetwork.Pass/"]
+RUN dotnet restore "DysonNetwork.Pass/DysonNetwork.Pass.csproj"
+COPY . .
+WORKDIR "/src/DysonNetwork.Pass"
+RUN dotnet build "./DysonNetwork.Pass.csproj" -c $BUILD_CONFIGURATION -o /app/build
+
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "./DysonNetwork.Pass.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
+
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "DysonNetwork.Pass.dll"]

DysonNetwork.Pass/DysonNetwork.Pass.csproj

@@ -0,0 +1,119 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+    <PropertyGroup>
+        <TargetFramework>net9.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Grpc.AspNetCore.Server" Version="2.71.0" />
+        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.7" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.7">
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+          <PrivateAssets>all</PrivateAssets>
+        </PackageReference>
+        <PackageReference Include="NodaTime" Version="3.2.2" />
+        <PackageReference Include="NodaTime.Serialization.JsonNet" Version="3.2.0" />
+        <PackageReference Include="NodaTime.Serialization.Protobuf" Version="2.0.2" />
+        <PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.0" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.Design" Version="1.1.0" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.NetTopologySuite" Version="9.0.4" />
+        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.NodaTime" Version="9.0.4" />
+        <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.12.0" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.12.0" />
+        <PackageReference Include="Otp.NET" Version="1.4.0" />
+        <PackageReference Include="prometheus-net.AspNetCore" Version="8.2.1" />
+        <PackageReference Include="prometheus-net.AspNetCore.HealthChecks" Version="8.2.1" />
+        <PackageReference Include="prometheus-net.DotNetRuntime" Version="4.4.1" />
+        <PackageReference Include="prometheus-net.EntityFramework" Version="0.9.5" />
+        <PackageReference Include="prometheus-net.SystemMetrics" Version="3.1.0" />
+        <PackageReference Include="Quartz" Version="3.14.0" />
+        <PackageReference Include="Quartz.AspNetCore" Version="3.14.0" />
+        <PackageReference Include="Quartz.Extensions.Hosting" Version="3.14.0" />
+        <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
+        <PackageReference Include="EFCore.BulkExtensions" Version="9.0.1" />
+        <PackageReference Include="EFCore.BulkExtensions.PostgreSql" Version="9.0.1" />
+        <PackageReference Include="EFCore.NamingConventions" Version="9.0.0" />
+        <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.3" />
+        <PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="9.0.3" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\DysonNetwork.Shared\DysonNetwork.Shared.csproj" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <Compile Update="Resources\Localization\NotificationResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>NotificationResource.resx</DependentUpon>
+      </Compile>
+      <Compile Update="Resources\Localization\SharedResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>SharedResource.resx</DependentUpon>
+      </Compile>
+      <Compile Update="Resources\Localization\NotificationResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>NotificationResource.resx</DependentUpon>
+      </Compile>
+      <Compile Update="Resources\Localization\SharedResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>SharedResource.resx</DependentUpon>
+      </Compile>
+      <Compile Update="Resources\Localization\AccountEventResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>AccountEventResource.resx</DependentUpon>
+      </Compile>
+      <Compile Update="Resources\Localization\AccountEventResource.Designer.cs">
+        <DesignTime>True</DesignTime>
+        <AutoGen>True</AutoGen>
+        <DependentUpon>AccountEventResource.resx</DependentUpon>
+      </Compile>
+    </ItemGroup>
+
+    <ItemGroup>
+      <EmbeddedResource Update="Resources\Localization\EmailResource.resx">
+        <Generator>ResXFileCodeGenerator</Generator>
+        <LastGenOutput>Email.LandingResource.Designer.cs</LastGenOutput>
+      </EmbeddedResource>
+      <EmbeddedResource Update="Resources\Localization\NotificationResource.resx">
+        <Generator>ResXFileCodeGenerator</Generator>
+        <LastGenOutput>NotificationResource.Designer.cs</LastGenOutput>
+      </EmbeddedResource>
+      <EmbeddedResource Update="Resources\Localization\SharedResource.resx">
+        <Generator>ResXFileCodeGenerator</Generator>
+        <LastGenOutput>SharedResource.Designer.cs</LastGenOutput>
+      </EmbeddedResource>
+      <EmbeddedResource Update="Resources\Localization\AccountEventResource.resx">
+        <Generator>ResXFileCodeGenerator</Generator>
+        <LastGenOutput>AccountEventResource.Designer.cs</LastGenOutput>
+      </EmbeddedResource>
+    </ItemGroup>
+
+    <ItemGroup>
+      <AdditionalFiles Include="Pages\Emails\AccountDeletionEmail.razor" />
+      <AdditionalFiles Include="Pages\Emails\ContactVerificationEmail.razor" />
+      <AdditionalFiles Include="Pages\Emails\EmailLayout.razor" />
+      <AdditionalFiles Include="Pages\Emails\LandingEmail.razor" />
+      <AdditionalFiles Include="Pages\Emails\PasswordResetEmail.razor" />
+      <AdditionalFiles Include="Pages\Emails\VerificationEmail.razor" />
+      <AdditionalFiles Include="Resources\Localization\AccountEventResource.resx" />
+      <AdditionalFiles Include="Resources\Localization\AccountEventResource.zh-hans.resx" />
+      <AdditionalFiles Include="Resources\Localization\EmailResource.resx" />
+      <AdditionalFiles Include="Resources\Localization\EmailResource.zh-hans.resx" />
+      <AdditionalFiles Include="Resources\Localization\NotificationResource.resx" />
+      <AdditionalFiles Include="Resources\Localization\NotificationResource.zh-hans.resx" />
+      <AdditionalFiles Include="Resources\Localization\SharedResource.resx" />
+      <AdditionalFiles Include="Resources\Localization\SharedResource.zh-hans.resx" />
+    </ItemGroup>
+
+</Project>

DysonNetwork.Pass/Email/EmailModels.cs

@@ -0,0 +1,31 @@
+namespace DysonNetwork.Pass.Email;
+
+public class LandingEmailModel
+{
+    public required string Name { get; set; }
+    public required string Link { get; set; }  
+}
+
+public class AccountDeletionEmailModel
+{
+    public required string Name { get; set; }
+    public required string Link { get; set; }
+}
+
+public class PasswordResetEmailModel
+{
+    public required string Name { get; set; }
+    public required string Link { get; set; } 
+}
+
+public class VerificationEmailModel
+{
+    public required string Name { get; set; }
+    public required string Code { get; set; }
+}
+
+public class ContactVerificationEmailModel
+{
+    public required string Name { get; set; }
+    public required string Link { get; set; }
+}

DysonNetwork.Pass/Email/EmailService.cs

@@ -0,0 +1,52 @@
+using dotnet_etcd;
+using dotnet_etcd.interfaces;
+using DysonNetwork.Shared.Proto;
+using Microsoft.AspNetCore.Components;
+
+namespace DysonNetwork.Pass.Email;
+
+public class EmailService(
+    PusherService.PusherServiceClient pusher,
+    RazorViewRenderer viewRenderer,
+    ILogger<EmailService> logger
+)
+{
+    public async Task SendEmailAsync(
+        string? recipientName,
+        string recipientEmail,
+        string subject,
+        string htmlBody
+    )
+    {
+        subject = $"[Solarpass] {subject}";
+
+        await pusher.SendEmailAsync(
+            new SendEmailRequest()
+            {
+                Email = new EmailMessage()
+                {
+                    ToName = recipientName,
+                    ToAddress = recipientEmail,
+                    Subject = subject,
+                    Body = htmlBody
+                }
+            }
+        );
+    }
+
+    public async Task SendTemplatedEmailAsync<TComponent, TModel>(string? recipientName, string recipientEmail,
+        string subject, TModel model)
+        where TComponent : IComponent
+    {
+        try
+        {
+            var htmlBody = await viewRenderer.RenderComponentToStringAsync<TComponent, TModel>(model);
+            await SendEmailAsync(recipientName, recipientEmail, subject, htmlBody);
+        }
+        catch (Exception err)
+        {
+            logger.LogError(err, "Failed to render email template...");
+            throw;
+        }
+    }
+}

DysonNetwork.Pass/Email/RazorViewRenderer.cs

@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Components;
+using Microsoft.AspNetCore.Components.Web;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Microsoft.AspNetCore.Mvc.ModelBinding;
+using Microsoft.AspNetCore.Mvc.Razor;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Mvc.ViewEngines;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using RouteData = Microsoft.AspNetCore.Routing.RouteData;
+
+namespace DysonNetwork.Pass.Email;
+
+public class RazorViewRenderer(
+    IServiceProvider serviceProvider,
+    ILoggerFactory loggerFactory,
+    ILogger<RazorViewRenderer> logger
+)
+{
+    public async Task<string> RenderComponentToStringAsync<TComponent, TModel>(TModel? model) 
+        where TComponent : IComponent
+    {
+        await using var htmlRenderer = new HtmlRenderer(serviceProvider, loggerFactory);
+
+        return await htmlRenderer.Dispatcher.InvokeAsync(async () =>
+        {
+            try 
+            {
+                var dictionary = model?.GetType().GetProperties()
+                    .ToDictionary(
+                        prop => prop.Name,
+                        prop => prop.GetValue(model, null)
+                    ) ?? new Dictionary<string, object?>();
+                var parameterView = ParameterView.FromDictionary(dictionary);
+                var output = await htmlRenderer.RenderComponentAsync<TComponent>(parameterView);
+                return output.ToHtmlString();
+            }
+            catch (Exception ex)
+            {
+                logger.LogError(ex, "Error rendering component {ComponentName}", typeof(TComponent).Name);
+                throw;
+            }
+        });
+    }
+}

DysonNetwork.Pass/Handlers/ActionLogFlushHandler.cs

@@ -0,0 +1,25 @@
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Shared.Cache;
+using EFCore.BulkExtensions;
+using Quartz;
+
+namespace DysonNetwork.Pass.Handlers;
+
+public class ActionLogFlushHandler(IServiceProvider serviceProvider) : IFlushHandler<ActionLog>
+{
+    public async Task FlushAsync(IReadOnlyList<ActionLog> items)
+    {
+        using var scope = serviceProvider.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<AppDatabase>();
+
+        await db.BulkInsertAsync(items, config => config.ConflictOption = ConflictOption.Ignore);
+    }
+}
+
+public class ActionLogFlushJob(FlushBufferService fbs, ActionLogFlushHandler hdl) : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {
+        await fbs.FlushAsync(hdl);
+    }
+}

DysonNetwork.Pass/Handlers/LastActiveFlushHandler.cs

@@ -0,0 +1,61 @@
+using DysonNetwork.Shared.Cache;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using Quartz;
+
+namespace DysonNetwork.Pass.Handlers;
+
+public class LastActiveInfo
+{
+    public Auth.AuthSession Session { get; set; } = null!;
+    public Account.Account Account { get; set; } = null!;
+    public Instant SeenAt { get; set; }
+}
+
+public class LastActiveFlushHandler(IServiceProvider serviceProvider) : IFlushHandler<LastActiveInfo>
+{
+    public async Task FlushAsync(IReadOnlyList<LastActiveInfo> items)
+    {
+        using var scope = serviceProvider.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<AppDatabase>();
+
+        // Remove duplicates by grouping on (sessionId, accountId), taking the most recent SeenAt
+        var distinctItems = items
+            .GroupBy(x => (SessionId: x.Session.Id, AccountId: x.Account.Id))
+            .Select(g => g.OrderByDescending(x => x.SeenAt).First())
+            .ToList();
+
+        // Build dictionaries so we can match session/account IDs to their new "last seen" timestamps
+        var sessionIdMap = distinctItems
+            .GroupBy(x => x.Session.Id)
+            .ToDictionary(g => g.Key, g => g.Last().SeenAt);
+
+        var accountIdMap = distinctItems
+            .GroupBy(x => x.Account.Id)
+            .ToDictionary(g => g.Key, g => g.Last().SeenAt);
+
+        // Update sessions using native EF Core ExecuteUpdateAsync
+        foreach (var kvp in sessionIdMap)
+        {
+            await db.AuthSessions
+                .Where(s => s.Id == kvp.Key)
+                .ExecuteUpdateAsync(s => s.SetProperty(x => x.LastGrantedAt, kvp.Value));
+        }
+
+        // Update account profiles using native EF Core ExecuteUpdateAsync
+        foreach (var kvp in accountIdMap)
+        {
+            await db.AccountProfiles
+                .Where(a => a.AccountId == kvp.Key)
+                .ExecuteUpdateAsync(a => a.SetProperty(x => x.LastSeenAt, kvp.Value));
+        }
+    }
+}
+
+public class LastActiveFlushJob(FlushBufferService fbs, ActionLogFlushHandler hdl) : IJob
+{
+    public async Task Execute(IJobExecutionContext context)
+    {
+        await fbs.FlushAsync(hdl);
+    }
+}

DysonNetwork.Pass/Localization/AccountEventResource.cs

@@ -0,0 +1,6 @@
+namespace DysonNetwork.Pass.Localization;
+
+public class AccountEventResource
+{
+    
+}

DysonNetwork.Pass/Localization/EmailResource.cs

@@ -0,0 +1,5 @@
+namespace DysonNetwork.Pass.Localization;
+
+public class EmailResource
+{
+}

DysonNetwork.Pass/Localization/NotificationResource.cs

@@ -0,0 +1,6 @@
+namespace DysonNetwork.Pass.Localization;
+
+public class NotificationResource
+{
+    
+}

DysonNetwork.Pass/Localization/SharedResource.cs

@@ -0,0 +1,6 @@
+namespace DysonNetwork.Pass.Localization;
+
+public class SharedResource
+{
+    
+}

DysonNetwork.Pass/Migrations/20250713121237_InitialMigration.cs

@@ -0,0 +1,998 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Pass.Developer;
+using DysonNetwork.Pass.Wallet;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore.Migrations;
+using NetTopologySuite.Geometries;
+using NodaTime;
+
+#nullable disable
+
+namespace DysonNetwork.Pass.Migrations
+{
+    /// <inheritdoc />
+    public partial class InitialMigration : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterDatabase()
+                .Annotation("Npgsql:PostgresExtension:postgis", ",,");
+
+            migrationBuilder.CreateTable(
+                name: "accounts",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
+                    nick = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: false),
+                    language = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: false),
+                    activated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    is_superuser = table.Column<bool>(type: "boolean", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_accounts", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "custom_apps",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    slug = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    name = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    description = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    status = table.Column<int>(type: "integer", nullable: false),
+                    picture = table.Column<CloudFileReferenceObject>(type: "jsonb", nullable: true),
+                    background = table.Column<CloudFileReferenceObject>(type: "jsonb", nullable: true),
+                    verification = table.Column<VerificationMark>(type: "jsonb", nullable: true),
+                    oauth_config = table.Column<CustomAppOauthConfig>(type: "jsonb", nullable: true),
+                    links = table.Column<CustomAppLinks>(type: "jsonb", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_custom_apps", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "permission_groups",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    key = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_permission_groups", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "wallet_coupons",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    identifier = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    code = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    affected_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    discount_amount = table.Column<decimal>(type: "numeric", nullable: true),
+                    discount_rate = table.Column<double>(type: "double precision", nullable: true),
+                    max_usage = table.Column<int>(type: "integer", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_wallet_coupons", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "abuse_reports",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    resource_identifier = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    reason = table.Column<string>(type: "character varying(8192)", maxLength: 8192, nullable: false),
+                    resolved_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    resolution = table.Column<string>(type: "character varying(8192)", maxLength: 8192, nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_abuse_reports", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_abuse_reports_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_auth_factors",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    secret = table.Column<string>(type: "character varying(8196)", maxLength: 8196, nullable: true),
+                    config = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    trustworthy = table.Column<int>(type: "integer", nullable: false),
+                    enabled_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_auth_factors", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_auth_factors_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_check_in_results",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    level = table.Column<int>(type: "integer", nullable: false),
+                    reward_points = table.Column<decimal>(type: "numeric", nullable: true),
+                    reward_experience = table.Column<int>(type: "integer", nullable: true),
+                    tips = table.Column<ICollection<FortuneTip>>(type: "jsonb", nullable: false),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_check_in_results", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_check_in_results_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_connections",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    provider = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    provided_identifier = table.Column<string>(type: "character varying(8192)", maxLength: 8192, nullable: false),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    access_token = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    refresh_token = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    last_used_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_connections", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_connections_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_contacts",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    verified_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    is_primary = table.Column<bool>(type: "boolean", nullable: false),
+                    content = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_contacts", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_contacts_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_profiles",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    first_name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    middle_name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    last_name = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    bio = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    gender = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    pronouns = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    time_zone = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    location = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    birthday = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    last_seen_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    verification = table.Column<VerificationMark>(type: "jsonb", nullable: true),
+                    active_badge = table.Column<BadgeReferenceObject>(type: "jsonb", nullable: true),
+                    experience = table.Column<int>(type: "integer", nullable: false),
+                    picture_id = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: true),
+                    background_id = table.Column<string>(type: "character varying(32)", maxLength: 32, nullable: true),
+                    picture = table.Column<CloudFileReferenceObject>(type: "jsonb", nullable: true),
+                    background = table.Column<CloudFileReferenceObject>(type: "jsonb", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_profiles", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_profiles_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_relationships",
+                columns: table => new
+                {
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    related_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    status = table.Column<short>(type: "smallint", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_relationships", x => new { x.account_id, x.related_id });
+                    table.ForeignKey(
+                        name: "fk_account_relationships_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "fk_account_relationships_accounts_related_id",
+                        column: x => x.related_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "account_statuses",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    attitude = table.Column<int>(type: "integer", nullable: false),
+                    is_invisible = table.Column<bool>(type: "boolean", nullable: false),
+                    is_not_disturb = table.Column<bool>(type: "boolean", nullable: false),
+                    label = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    cleared_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_account_statuses", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_account_statuses_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "action_logs",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    action = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: false),
+                    user_agent = table.Column<string>(type: "character varying(512)", maxLength: 512, nullable: true),
+                    ip_address = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: true),
+                    location = table.Column<Point>(type: "geometry", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    session_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_action_logs", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_action_logs_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "auth_challenges",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    step_remain = table.Column<int>(type: "integer", nullable: false),
+                    step_total = table.Column<int>(type: "integer", nullable: false),
+                    failed_attempts = table.Column<int>(type: "integer", nullable: false),
+                    platform = table.Column<int>(type: "integer", nullable: false),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    blacklist_factors = table.Column<List<Guid>>(type: "jsonb", nullable: false),
+                    audiences = table.Column<List<string>>(type: "jsonb", nullable: false),
+                    scopes = table.Column<List<string>>(type: "jsonb", nullable: false),
+                    ip_address = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: true),
+                    user_agent = table.Column<string>(type: "character varying(512)", maxLength: 512, nullable: true),
+                    device_id = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
+                    nonce = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    location = table.Column<Point>(type: "geometry", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_auth_challenges", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_auth_challenges_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "badges",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    type = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    label = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    caption = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: false),
+                    activated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_badges", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_badges_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "magic_spells",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    spell = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    expires_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    affected_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: false),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_magic_spells", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_magic_spells_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateTable(
+                name: "notification_push_subscriptions",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    device_id = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    device_token = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    provider = table.Column<int>(type: "integer", nullable: false),
+                    last_used_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_notification_push_subscriptions", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_notification_push_subscriptions_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "notifications",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    topic = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    title = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    subtitle = table.Column<string>(type: "character varying(2048)", maxLength: 2048, nullable: true),
+                    content = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    priority = table.Column<int>(type: "integer", nullable: false),
+                    viewed_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_notifications", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_notifications_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "wallets",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_wallets", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_wallets_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "custom_app_secrets",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    secret = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    description = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    is_oidc = table.Column<bool>(type: "boolean", nullable: false),
+                    app_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_custom_app_secrets", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_custom_app_secrets_custom_apps_app_id",
+                        column: x => x.app_id,
+                        principalTable: "custom_apps",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "permission_group_members",
+                columns: table => new
+                {
+                    group_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    actor = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    affected_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_permission_group_members", x => new { x.group_id, x.actor });
+                    table.ForeignKey(
+                        name: "fk_permission_group_members_permission_groups_group_id",
+                        column: x => x.group_id,
+                        principalTable: "permission_groups",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "permission_nodes",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    actor = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    area = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    key = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: false),
+                    value = table.Column<JsonDocument>(type: "jsonb", nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    affected_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    group_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_permission_nodes", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_permission_nodes_permission_groups_group_id",
+                        column: x => x.group_id,
+                        principalTable: "permission_groups",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateTable(
+                name: "wallet_subscriptions",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    begun_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    ended_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    identifier = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    is_active = table.Column<bool>(type: "boolean", nullable: false),
+                    is_free_trial = table.Column<bool>(type: "boolean", nullable: false),
+                    status = table.Column<int>(type: "integer", nullable: false),
+                    payment_method = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: false),
+                    payment_details = table.Column<PaymentDetails>(type: "jsonb", nullable: false),
+                    base_price = table.Column<decimal>(type: "numeric", nullable: false),
+                    coupon_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    renewal_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_wallet_subscriptions", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_wallet_subscriptions_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "fk_wallet_subscriptions_wallet_coupons_coupon_id",
+                        column: x => x.coupon_id,
+                        principalTable: "wallet_coupons",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateTable(
+                name: "auth_sessions",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    label = table.Column<string>(type: "character varying(1024)", maxLength: 1024, nullable: true),
+                    last_granted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true),
+                    account_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    challenge_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    app_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_auth_sessions", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_auth_sessions_accounts_account_id",
+                        column: x => x.account_id,
+                        principalTable: "accounts",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "fk_auth_sessions_auth_challenges_challenge_id",
+                        column: x => x.challenge_id,
+                        principalTable: "auth_challenges",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "fk_auth_sessions_custom_apps_app_id",
+                        column: x => x.app_id,
+                        principalTable: "custom_apps",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateTable(
+                name: "payment_transactions",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    currency = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: false),
+                    amount = table.Column<decimal>(type: "numeric", nullable: false),
+                    remarks = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    type = table.Column<int>(type: "integer", nullable: false),
+                    payer_wallet_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    payee_wallet_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_payment_transactions", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_payment_transactions_wallets_payee_wallet_id",
+                        column: x => x.payee_wallet_id,
+                        principalTable: "wallets",
+                        principalColumn: "id");
+                    table.ForeignKey(
+                        name: "fk_payment_transactions_wallets_payer_wallet_id",
+                        column: x => x.payer_wallet_id,
+                        principalTable: "wallets",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateTable(
+                name: "wallet_pockets",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    currency = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: false),
+                    amount = table.Column<decimal>(type: "numeric", nullable: false),
+                    wallet_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_wallet_pockets", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_wallet_pockets_wallets_wallet_id",
+                        column: x => x.wallet_id,
+                        principalTable: "wallets",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "payment_orders",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    status = table.Column<int>(type: "integer", nullable: false),
+                    currency = table.Column<string>(type: "character varying(128)", maxLength: 128, nullable: false),
+                    remarks = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    app_identifier = table.Column<string>(type: "character varying(4096)", maxLength: 4096, nullable: true),
+                    meta = table.Column<Dictionary<string, object>>(type: "jsonb", nullable: true),
+                    amount = table.Column<decimal>(type: "numeric", nullable: false),
+                    expired_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    payee_wallet_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    transaction_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    created_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    updated_at = table.Column<Instant>(type: "timestamp with time zone", nullable: false),
+                    deleted_at = table.Column<Instant>(type: "timestamp with time zone", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_payment_orders", x => x.id);
+                    table.ForeignKey(
+                        name: "fk_payment_orders_payment_transactions_transaction_id",
+                        column: x => x.transaction_id,
+                        principalTable: "payment_transactions",
+                        principalColumn: "id");
+                    table.ForeignKey(
+                        name: "fk_payment_orders_wallets_payee_wallet_id",
+                        column: x => x.payee_wallet_id,
+                        principalTable: "wallets",
+                        principalColumn: "id");
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_abuse_reports_account_id",
+                table: "abuse_reports",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_auth_factors_account_id",
+                table: "account_auth_factors",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_check_in_results_account_id",
+                table: "account_check_in_results",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_connections_account_id",
+                table: "account_connections",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_contacts_account_id",
+                table: "account_contacts",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_profiles_account_id",
+                table: "account_profiles",
+                column: "account_id",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_relationships_related_id",
+                table: "account_relationships",
+                column: "related_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_account_statuses_account_id",
+                table: "account_statuses",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_accounts_name",
+                table: "accounts",
+                column: "name",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "ix_action_logs_account_id",
+                table: "action_logs",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_auth_challenges_account_id",
+                table: "auth_challenges",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_auth_sessions_account_id",
+                table: "auth_sessions",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_auth_sessions_app_id",
+                table: "auth_sessions",
+                column: "app_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_auth_sessions_challenge_id",
+                table: "auth_sessions",
+                column: "challenge_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_badges_account_id",
+                table: "badges",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_custom_app_secrets_app_id",
+                table: "custom_app_secrets",
+                column: "app_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_magic_spells_account_id",
+                table: "magic_spells",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_magic_spells_spell",
+                table: "magic_spells",
+                column: "spell",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "ix_notification_push_subscriptions_account_id",
+                table: "notification_push_subscriptions",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_notification_push_subscriptions_device_token_device_id_acco",
+                table: "notification_push_subscriptions",
+                columns: new[] { "device_token", "device_id", "account_id" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "ix_notifications_account_id",
+                table: "notifications",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_payment_orders_payee_wallet_id",
+                table: "payment_orders",
+                column: "payee_wallet_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_payment_orders_transaction_id",
+                table: "payment_orders",
+                column: "transaction_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_payment_transactions_payee_wallet_id",
+                table: "payment_transactions",
+                column: "payee_wallet_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_payment_transactions_payer_wallet_id",
+                table: "payment_transactions",
+                column: "payer_wallet_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_permission_nodes_group_id",
+                table: "permission_nodes",
+                column: "group_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_permission_nodes_key_area_actor",
+                table: "permission_nodes",
+                columns: new[] { "key", "area", "actor" });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_wallet_pockets_wallet_id",
+                table: "wallet_pockets",
+                column: "wallet_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_wallet_subscriptions_account_id",
+                table: "wallet_subscriptions",
+                column: "account_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_wallet_subscriptions_coupon_id",
+                table: "wallet_subscriptions",
+                column: "coupon_id");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_wallet_subscriptions_identifier",
+                table: "wallet_subscriptions",
+                column: "identifier");
+
+            migrationBuilder.CreateIndex(
+                name: "ix_wallets_account_id",
+                table: "wallets",
+                column: "account_id");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "abuse_reports");
+
+            migrationBuilder.DropTable(
+                name: "account_auth_factors");
+
+            migrationBuilder.DropTable(
+                name: "account_check_in_results");
+
+            migrationBuilder.DropTable(
+                name: "account_connections");
+
+            migrationBuilder.DropTable(
+                name: "account_contacts");
+
+            migrationBuilder.DropTable(
+                name: "account_profiles");
+
+            migrationBuilder.DropTable(
+                name: "account_relationships");
+
+            migrationBuilder.DropTable(
+                name: "account_statuses");
+
+            migrationBuilder.DropTable(
+                name: "action_logs");
+
+            migrationBuilder.DropTable(
+                name: "auth_sessions");
+
+            migrationBuilder.DropTable(
+                name: "badges");
+
+            migrationBuilder.DropTable(
+                name: "custom_app_secrets");
+
+            migrationBuilder.DropTable(
+                name: "magic_spells");
+
+            migrationBuilder.DropTable(
+                name: "notification_push_subscriptions");
+
+            migrationBuilder.DropTable(
+                name: "notifications");
+
+            migrationBuilder.DropTable(
+                name: "payment_orders");
+
+            migrationBuilder.DropTable(
+                name: "permission_group_members");
+
+            migrationBuilder.DropTable(
+                name: "permission_nodes");
+
+            migrationBuilder.DropTable(
+                name: "wallet_pockets");
+
+            migrationBuilder.DropTable(
+                name: "wallet_subscriptions");
+
+            migrationBuilder.DropTable(
+                name: "auth_challenges");
+
+            migrationBuilder.DropTable(
+                name: "custom_apps");
+
+            migrationBuilder.DropTable(
+                name: "payment_transactions");
+
+            migrationBuilder.DropTable(
+                name: "permission_groups");
+
+            migrationBuilder.DropTable(
+                name: "wallet_coupons");
+
+            migrationBuilder.DropTable(
+                name: "wallets");
+
+            migrationBuilder.DropTable(
+                name: "accounts");
+        }
+    }
+}

DysonNetwork.Pass/Pages/Emails/AccountDeletionEmail.razor

@@ -0,0 +1,42 @@
+@using DysonNetwork.Pass.Localization
+@using Microsoft.Extensions.Localization
+
+<EmailLayout>
+    <tr>
+        <td class="wrapper">
+            <p class="font-bold">@(Localizer["AccountDeletionHeader"])</p>
+            <p>@(Localizer["AccountDeletionPara1"]) @@@Name,</p>
+            <p>@(Localizer["AccountDeletionPara2"])</p>
+            <p>@(Localizer["AccountDeletionPara3"])</p>
+
+            <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="btn btn-primary">
+                <tbody>
+                <tr>
+                    <td align="left">
+                        <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <a href="@Link" target="_blank">
+                                        @(Localizer["AccountDeletionButton"])
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                </tr>
+                </tbody>
+            </table>
+
+            <p>@(Localizer["AccountDeletionPara4"])</p>
+        </td>
+    </tr>
+</EmailLayout>
+
+@code {
+    [Parameter] public required string Name { get; set; }
+    [Parameter] public required string Link { get; set; }
+
+    [Inject] IStringLocalizer<EmailResource> Localizer { get; set; } = null!;
+}

DysonNetwork.Pass/Pages/Emails/ContactVerificationEmail.razor

@@ -0,0 +1,43 @@
+@using DysonNetwork.Pass.Localization
+@using Microsoft.Extensions.Localization
+@using EmailResource = DysonNetwork.Pass.Localization.EmailResource
+
+<EmailLayout>
+    <tr>
+        <td class="wrapper">
+            <p class="font-bold">@(Localizer["ContactVerificationHeader"])</p>
+            <p>@(Localizer["ContactVerificationPara1"]) @Name,</p>
+            <p>@(Localizer["ContactVerificationPara2"])</p>
+
+            <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="btn btn-primary">
+                <tbody>
+                <tr>
+                    <td align="left">
+                        <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <a href="@Link" target="_blank">
+                                        @(Localizer["ContactVerificationButton"])
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                </tr>
+                </tbody>
+            </table>
+
+            <p>@(Localizer["ContactVerificationPara3"])</p>
+            <p>@(Localizer["ContactVerificationPara4"])</p>
+        </td>
+    </tr>
+</EmailLayout>
+
+@code {
+    [Parameter] public required string Name { get; set; }
+    [Parameter] public required string Link { get; set; }
+
+    [Inject] IStringLocalizer<EmailResource> Localizer { get; set; } = null!;
+}

DysonNetwork.Pass/Pages/Emails/EmailLayout.razor

@@ -0,0 +1,337 @@
+@inherits LayoutComponentBase
+
+<!doctype html>
+<html lang="en">
+<head>
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <style media="all" type="text/css">
+        body {
+            font-family: Helvetica, sans-serif;
+            -webkit-font-smoothing: antialiased;
+            font-size: 16px;
+            line-height: 1.3;
+            -ms-text-size-adjust: 100%;
+            -webkit-text-size-adjust: 100%;
+        }
+
+        table {
+            border-collapse: separate;
+            mso-table-lspace: 0pt;
+            mso-table-rspace: 0pt;
+            width: 100%;
+        }
+
+        table td {
+            font-family: Helvetica, sans-serif;
+            font-size: 16px;
+            vertical-align: top;
+        }
+
+        body {
+            background-color: #f4f5f6;
+            margin: 0;
+            padding: 0;
+        }
+
+        .body {
+            background-color: #f4f5f6;
+            width: 100%;
+        }
+
+        .container {
+            margin: 0 auto !important;
+            max-width: 600px;
+            padding: 0;
+            padding-top: 24px;
+            width: 600px;
+        }
+
+        .content {
+            box-sizing: border-box;
+            display: block;
+            margin: 0 auto;
+            max-width: 600px;
+            padding: 0;
+        }
+
+        .main {
+            background: #ffffff;
+            border: 1px solid #eaebed;
+            border-radius: 16px;
+            width: 100%;
+        }
+
+        .wrapper {
+            box-sizing: border-box;
+            padding: 24px;
+        }
+
+        .footer {
+            clear: both;
+            padding-top: 24px;
+            text-align: center;
+            width: 100%;
+        }
+
+        .footer td,
+        .footer p,
+        .footer span,
+        .footer a {
+            color: #9a9ea6;
+            font-size: 16px;
+            text-align: center;
+        }
+
+        p {
+            font-family: Helvetica, sans-serif;
+            font-size: 16px;
+            font-weight: normal;
+            margin: 0;
+            margin-bottom: 16px;
+        }
+
+        a {
+            color: #0867ec;
+            text-decoration: underline;
+        }
+
+        .btn {
+            box-sizing: border-box;
+            min-width: 100% !important;
+            width: 100%;
+        }
+
+        .btn > tbody > tr > td {
+            padding-bottom: 16px;
+        }
+
+        .btn table {
+            width: auto;
+        }
+
+        .btn table td {
+            background-color: #ffffff;
+            border-radius: 4px;
+            text-align: center;
+        }
+
+        .btn a {
+            background-color: #ffffff;
+            border: solid 2px #0867ec;
+            border-radius: 4px;
+            box-sizing: border-box;
+            color: #0867ec;
+            cursor: pointer;
+            display: inline-block;
+            font-size: 16px;
+            font-weight: bold;
+            margin: 0;
+            padding: 12px 24px;
+            text-decoration: none;
+            text-transform: capitalize;
+        }
+
+        .btn-primary table td {
+            background-color: #0867ec;
+        }
+
+        .btn-primary a {
+            background-color: #0867ec;
+            border-color: #0867ec;
+            color: #ffffff;
+        }
+        
+        .font-bold {
+            font-weight: bold;
+        }
+        
+        .verification-code
+        {
+            font-family: "Courier New", Courier, monospace;
+            font-size: 24px;
+            letter-spacing: 0.5em;
+        }
+
+        @@media all {
+            .btn-primary table td:hover {
+                background-color: #ec0867 !important;
+            }
+
+            .btn-primary a:hover {
+                background-color: #ec0867 !important;
+                border-color: #ec0867 !important;
+            }
+        }
+
+        .last {
+            margin-bottom: 0;
+        }
+
+        .first {
+            margin-top: 0;
+        }
+
+        .align-center {
+            text-align: center;
+        }
+
+        .align-right {
+            text-align: right;
+        }
+
+        .align-left {
+            text-align: left;
+        }
+
+        .text-link {
+            color: #0867ec !important;
+            text-decoration: underline !important;
+        }
+
+        .clear {
+            clear: both;
+        }
+
+        .mt0 {
+            margin-top: 0;
+        }
+
+        .mb0 {
+            margin-bottom: 0;
+        }
+
+        .preheader {
+            color: transparent;
+            display: none;
+            height: 0;
+            max-height: 0;
+            max-width: 0;
+            opacity: 0;
+            overflow: hidden;
+            mso-hide: all;
+            visibility: hidden;
+            width: 0;
+        }
+
+        .powered-by a {
+            text-decoration: none;
+        }
+
+        @@media only screen and (max-width: 640px) {
+            .main p,
+            .main td,
+            .main span {
+                font-size: 16px !important;
+            }
+
+            .wrapper {
+                padding: 8px !important;
+            }
+
+            .content {
+                padding: 0 !important;
+            }
+
+            .container {
+                padding: 0 !important;
+                padding-top: 8px !important;
+                width: 100% !important;
+            }
+
+            .main {
+                border-left-width: 0 !important;
+                border-radius: 0 !important;
+                border-right-width: 0 !important;
+            }
+
+            .btn table {
+                max-width: 100% !important;
+                width: 100% !important;
+            }
+
+            .btn a {
+                font-size: 16px !important;
+                max-width: 100% !important;
+                width: 100% !important;
+            }
+        }
+
+        @@media all {
+            .ExternalClass {
+                width: 100%;
+            }
+
+            .ExternalClass,
+            .ExternalClass p,
+            .ExternalClass span,
+            .ExternalClass font,
+            .ExternalClass td,
+            .ExternalClass div {
+                line-height: 100%;
+            }
+
+            .apple-link a {
+                color: inherit !important;
+                font-family: inherit !important;
+                font-size: inherit !important;
+                font-weight: inherit !important;
+                line-height: inherit !important;
+                text-decoration: none !important;
+            }
+
+            #MessageViewBody a {
+                color: inherit;
+                text-decoration: none;
+                font-size: inherit;
+                font-family: inherit;
+                font-weight: inherit;
+                line-height: inherit;
+            }
+        }
+    </style>
+</head>
+<body>
+<table role="presentation" border="0" cellpadding="0" cellspacing="0" class="body">
+    <tr>
+        <td>&nbsp;</td>
+        <td class="container">
+            <div class="content">
+
+                <!-- START CENTERED WHITE CONTAINER -->
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="main">
+                    <!-- START MAIN CONTENT AREA -->
+                    @ChildContent
+                    <!-- END MAIN CONTENT AREA -->
+                </table>
+
+                <!-- START FOOTER -->
+                <div class="footer">
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+                        <tr>
+                            <td class="content-block">
+                                <span class="apple-link">Solar Network</span>
+                                <br> Solsynth LLC © @(DateTime.Now.Year)
+                            </td>
+                        </tr>
+                        <tr>
+                            <td class="content-block powered-by">
+                                Powered by <a href="https://github.com/solsynth/dysonnetwork">Dyson Network</a>
+                            </td>
+                        </tr>
+                    </table>
+                </div>
+
+                <!-- END FOOTER -->
+
+                <!-- END CENTERED WHITE CONTAINER --></div>
+        </td>
+        <td>&nbsp;</td>
+    </tr>
+</table>
+</body>
+</html>
+
+@code {
+    [Parameter] public RenderFragment? ChildContent { get; set; }
+}

DysonNetwork.Pass/Pages/Emails/LandingEmail.razor

@@ -0,0 +1,43 @@
+@using DysonNetwork.Pass.Localization
+@using Microsoft.Extensions.Localization
+@using EmailResource = DysonNetwork.Pass.Localization.EmailResource
+
+<EmailLayout>
+    <tr>
+        <td class="wrapper">
+            <p class="font-bold">@(Localizer["LandingHeader1"])</p>
+            <p>@(Localizer["LandingPara1"]) @@@Name,</p>
+            <p>@(Localizer["LandingPara2"])</p>
+            <p>@(Localizer["LandingPara3"])</p>
+
+            <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="btn btn-primary">
+                <tbody>
+                <tr>
+                    <td align="left">
+                        <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <a href="@Link" target="_blank">
+                                        @(Localizer["LandingButton1"])
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                </tr>
+                </tbody>
+            </table>
+
+            <p>@(Localizer["LandingPara4"])</p>
+        </td>
+    </tr>
+</EmailLayout>
+
+@code {
+    [Parameter] public required string Name { get; set; }
+    [Parameter] public required string Link { get; set; }
+
+    [Inject] IStringLocalizer<EmailResource> Localizer { get; set; } = null!;
+}

DysonNetwork.Pass/Pages/Emails/PasswordResetEmail.razor

@@ -0,0 +1,44 @@
+@using DysonNetwork.Pass.Localization
+@using Microsoft.Extensions.Localization
+@using EmailResource = DysonNetwork.Pass.Localization.EmailResource
+
+<EmailLayout>
+    <tr>
+        <td class="wrapper">
+            <p class="font-bold">@(Localizer["PasswordResetHeader"])</p>
+            <p>@(Localizer["PasswordResetPara1"]) @@@Name,</p>
+            <p>@(Localizer["PasswordResetPara2"])</p>
+            <p>@(Localizer["PasswordResetPara3"])</p>
+
+            <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="btn btn-primary">
+                <tbody>
+                <tr>
+                    <td align="left">
+                        <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <a href="@Link" target="_blank">
+                                        @(Localizer["PasswordResetButton"])
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                </tr>
+                </tbody>
+            </table>
+
+            <p>@(Localizer["PasswordResetPara4"])</p>
+        </td>
+    </tr>
+</EmailLayout>
+
+@code {
+    [Parameter] public required string Name { get; set; }
+    [Parameter] public required string Link { get; set; }
+
+    [Inject] IStringLocalizer<EmailResource> Localizer { get; set; } = null!;
+    [Inject] IStringLocalizer<SharedResource> LocalizerShared { get; set; } = null!;
+}

DysonNetwork.Pass/Pages/Emails/VerificationEmail.razor

@@ -0,0 +1,27 @@
+@using DysonNetwork.Pass.Localization
+@using Microsoft.Extensions.Localization
+@using EmailResource = DysonNetwork.Pass.Localization.EmailResource
+
+<EmailLayout>
+    <tr>
+        <td class="wrapper">
+            <p class="font-bold">@(Localizer["VerificationHeader1"])</p>
+            <p>@(Localizer["VerificationPara1"]) @@@Name,</p>
+            <p>@(Localizer["VerificationPara2"])</p>
+            <p>@(Localizer["VerificationPara3"])</p>
+
+            <p class="verification-code">@Code</p>
+
+            <p>@(Localizer["VerificationPara4"])</p>
+            <p>@(Localizer["VerificationPara5"])</p>
+        </td>
+    </tr>
+</EmailLayout>
+
+@code {
+    [Parameter] public required string Name { get; set; }
+    [Parameter] public required string Code { get; set; }
+
+    [Inject] IStringLocalizer<EmailResource> Localizer { get; set; } = null!;
+    [Inject] IStringLocalizer<SharedResource> LocalizerShared { get; set; } = null!;
+}

DysonNetwork.Pass/Permission/Permission.cs

@@ -0,0 +1,60 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DysonNetwork.Shared.Data;
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+
+namespace DysonNetwork.Pass.Permission;
+
+/// The permission node model provides the infrastructure of permission control in Dyson Network.
+/// It based on the ABAC permission model.
+/// 
+/// The value can be any type, boolean and number for most cases and stored in jsonb.
+/// 
+/// The area represents the region this permission affects. For example, the pub:<publisherId>
+/// indicates it's a permission node for the publishers managing.
+///
+/// And the actor shows who owns the permission, in most cases, the user:<userId>
+/// and when the permission node has a GroupId, the actor will be set to the group, but it won't work on checking
+/// expect the member of that permission group inherent the permission from the group.
+[Index(nameof(Key), nameof(Area), nameof(Actor))]
+public class PermissionNode : ModelBase, IDisposable
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Actor { get; set; } = null!;
+    [MaxLength(1024)] public string Area { get; set; } = null!;
+    [MaxLength(1024)] public string Key { get; set; } = null!;
+    [Column(TypeName = "jsonb")] public JsonDocument Value { get; set; } = null!;
+    public Instant? ExpiredAt { get; set; } = null;
+    public Instant? AffectedAt { get; set; } = null;
+
+    public Guid? GroupId { get; set; } = null;
+    [JsonIgnore] public PermissionGroup? Group { get; set; } = null;
+
+    public void Dispose()
+    {
+        Value.Dispose();
+        GC.SuppressFinalize(this);
+    }
+}
+
+public class PermissionGroup : ModelBase
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    [MaxLength(1024)] public string Key { get; set; } = null!;
+
+    public ICollection<PermissionNode> Nodes { get; set; } = new List<PermissionNode>();
+    [JsonIgnore] public ICollection<PermissionGroupMember> Members { get; set; } = new List<PermissionGroupMember>();
+}
+
+public class PermissionGroupMember : ModelBase
+{
+    public Guid GroupId { get; set; }
+    public PermissionGroup Group { get; set; } = null!;
+    [MaxLength(1024)] public string Actor { get; set; } = null!;
+
+    public Instant? ExpiredAt { get; set; }
+    public Instant? AffectedAt { get; set; }
+}

DysonNetwork.Pass/Permission/PermissionMiddleware.cs

@@ -0,0 +1,51 @@
+namespace DysonNetwork.Pass.Permission;
+
+using System;
+
+[AttributeUsage(AttributeTargets.Method)]
+public class RequiredPermissionAttribute(string area, string key) : Attribute
+{
+    public string Area { get; set; } = area;
+    public string Key { get; } = key;
+}
+
+public class PermissionMiddleware(RequestDelegate next)
+{
+    public async Task InvokeAsync(HttpContext httpContext, PermissionService pm)
+    {
+        var endpoint = httpContext.GetEndpoint();
+
+        var attr = endpoint?.Metadata
+            .OfType<RequiredPermissionAttribute>()
+            .FirstOrDefault();
+
+        if (attr != null)
+        {
+            if (httpContext.Items["CurrentUser"] is not Account.Account currentUser)
+            {
+                httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
+                await httpContext.Response.WriteAsync("Unauthorized");
+                return;
+            }
+
+            if (currentUser.IsSuperuser)
+            {
+                // Bypass the permission check for performance
+                await next(httpContext);
+                return;
+            }
+
+            var actor = $"user:{currentUser.Id}";
+            var permNode = await pm.GetPermissionAsync<bool>(actor, attr.Area, attr.Key);
+
+            if (!permNode)
+            {
+                httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
+                await httpContext.Response.WriteAsync($"Permission {attr.Area}/{attr.Key} = {true} was required.");
+                return;
+            }
+        }
+
+        await next(httpContext);
+    } 
+}

DysonNetwork.Pass/Permission/PermissionService.cs

@@ -0,0 +1,198 @@
+using Microsoft.EntityFrameworkCore;
+using NodaTime;
+using System.Text.Json;
+using DysonNetwork.Pass;
+using DysonNetwork.Shared.Cache;
+
+namespace DysonNetwork.Pass.Permission;
+
+public class PermissionService(
+    AppDatabase db,
+    ICacheService cache
+)
+{
+    private static readonly TimeSpan CacheExpiration = TimeSpan.FromMinutes(1);
+
+    private const string PermCacheKeyPrefix = "perm:";
+    private const string PermGroupCacheKeyPrefix = "perm-cg:";
+    private const string PermissionGroupPrefix = "perm-g:";
+
+    private static string _GetPermissionCacheKey(string actor, string area, string key) =>
+        PermCacheKeyPrefix + actor + ":" + area + ":" + key;
+
+    private static string _GetGroupsCacheKey(string actor) =>
+        PermGroupCacheKeyPrefix + actor;
+
+    private static string _GetPermissionGroupKey(string actor) =>
+        PermissionGroupPrefix + actor;
+
+    public async Task<bool> HasPermissionAsync(string actor, string area, string key)
+    {
+        var value = await GetPermissionAsync<bool>(actor, area, key);
+        return value;
+    }
+
+    public async Task<T?> GetPermissionAsync<T>(string actor, string area, string key)
+    {
+        var cacheKey = _GetPermissionCacheKey(actor, area, key);
+
+        var (hit, cachedValue) = await cache.GetAsyncWithStatus<T>(cacheKey);
+        if (hit)
+            return cachedValue;
+
+        var now = SystemClock.Instance.GetCurrentInstant();
+        var groupsKey = _GetGroupsCacheKey(actor);
+
+        var groupsId = await cache.GetAsync<List<Guid>>(groupsKey);
+        if (groupsId == null)
+        {
+            groupsId = await db.PermissionGroupMembers
+                .Where(n => n.Actor == actor)
+                .Where(n => n.ExpiredAt == null || n.ExpiredAt > now)
+                .Where(n => n.AffectedAt == null || n.AffectedAt <= now)
+                .Select(e => e.GroupId)
+                .ToListAsync();
+
+            await cache.SetWithGroupsAsync(groupsKey, groupsId,
+                [_GetPermissionGroupKey(actor)],
+                CacheExpiration);
+        }
+
+        var permission = await db.PermissionNodes
+            .Where(n => (n.GroupId == null && n.Actor == actor) ||
+                        (n.GroupId != null && groupsId.Contains(n.GroupId.Value)))
+            .Where(n => n.Key == key && n.Area == area)
+            .Where(n => n.ExpiredAt == null || n.ExpiredAt > now)
+            .Where(n => n.AffectedAt == null || n.AffectedAt <= now)
+            .FirstOrDefaultAsync();
+
+        var result = permission is not null ? _DeserializePermissionValue<T>(permission.Value) : default;
+
+        await cache.SetWithGroupsAsync(cacheKey, result,
+            [_GetPermissionGroupKey(actor)],
+            CacheExpiration);
+
+        return result;
+    }
+
+    public async Task<PermissionNode> AddPermissionNode<T>(
+        string actor,
+        string area,
+        string key,
+        T value,
+        Instant? expiredAt = null,
+        Instant? affectedAt = null
+    )
+    {
+        if (value is null) throw new ArgumentNullException(nameof(value));
+
+        var node = new PermissionNode
+        {
+            Actor = actor,
+            Key = key,
+            Area = area,
+            Value = _SerializePermissionValue(value),
+            ExpiredAt = expiredAt,
+            AffectedAt = affectedAt
+        };
+
+        db.PermissionNodes.Add(node);
+        await db.SaveChangesAsync();
+
+        // Invalidate related caches
+        await InvalidatePermissionCacheAsync(actor, area, key);
+
+        return node;
+    }
+
+    public async Task<PermissionNode> AddPermissionNodeToGroup<T>(
+        PermissionGroup group,
+        string actor,
+        string area,
+        string key,
+        T value,
+        Instant? expiredAt = null,
+        Instant? affectedAt = null
+    )
+    {
+        if (value is null) throw new ArgumentNullException(nameof(value));
+
+        var node = new PermissionNode
+        {
+            Actor = actor,
+            Key = key,
+            Area = area,
+            Value = _SerializePermissionValue(value),
+            ExpiredAt = expiredAt,
+            AffectedAt = affectedAt,
+            Group = group,
+            GroupId = group.Id
+        };
+
+        db.PermissionNodes.Add(node);
+        await db.SaveChangesAsync();
+
+        // Invalidate related caches
+        await InvalidatePermissionCacheAsync(actor, area, key);
+        await cache.RemoveAsync(_GetGroupsCacheKey(actor));
+        await cache.RemoveGroupAsync(_GetPermissionGroupKey(actor));
+
+        return node;
+    }
+
+    public async Task RemovePermissionNode(string actor, string area, string key)
+    {
+        var node = await db.PermissionNodes
+            .Where(n => n.Actor == actor && n.Area == area && n.Key == key)
+            .FirstOrDefaultAsync();
+        if (node is not null) db.PermissionNodes.Remove(node);
+        await db.SaveChangesAsync();
+
+        // Invalidate cache
+        await InvalidatePermissionCacheAsync(actor, area, key);
+    }
+
+    public async Task RemovePermissionNodeFromGroup<T>(PermissionGroup group, string actor, string area, string key)
+    {
+        var node = await db.PermissionNodes
+            .Where(n => n.GroupId == group.Id)
+            .Where(n => n.Actor == actor && n.Area == area && n.Key == key)
+            .FirstOrDefaultAsync();
+        if (node is null) return;
+        db.PermissionNodes.Remove(node);
+        await db.SaveChangesAsync();
+
+        // Invalidate caches
+        await InvalidatePermissionCacheAsync(actor, area, key);
+        await cache.RemoveAsync(_GetGroupsCacheKey(actor));
+        await cache.RemoveGroupAsync(_GetPermissionGroupKey(actor));
+    }
+
+    private async Task InvalidatePermissionCacheAsync(string actor, string area, string key)
+    {
+        var cacheKey = _GetPermissionCacheKey(actor, area, key);
+        await cache.RemoveAsync(cacheKey);
+    }
+
+    private static T? _DeserializePermissionValue<T>(JsonDocument json)
+    {
+        return JsonSerializer.Deserialize<T>(json.RootElement.GetRawText());
+    }
+
+    private static JsonDocument _SerializePermissionValue<T>(T obj)
+    {
+        var str = JsonSerializer.Serialize(obj);
+        return JsonDocument.Parse(str);
+    }
+
+    public static PermissionNode NewPermissionNode<T>(string actor, string area, string key, T value)
+    {
+        return new PermissionNode
+        {
+            Actor = actor,
+            Area = area,
+            Key = key,
+            Value = _SerializePermissionValue(value),
+        };
+    }
+}

DysonNetwork.Pass/Permission/PermissionServiceGrpc.cs

@@ -0,0 +1,96 @@
+using Grpc.Core;
+using Microsoft.EntityFrameworkCore;
+using DysonNetwork.Shared.Proto;
+using Google.Protobuf.WellKnownTypes;
+using System.Text.Json;
+using NodaTime.Serialization.Protobuf;
+
+namespace DysonNetwork.Pass.Permission;
+
+public class PermissionServiceGrpc(
+    PermissionService permissionService,
+    AppDatabase db
+) : DysonNetwork.Shared.Proto.PermissionService.PermissionServiceBase
+{
+    public override async Task<HasPermissionResponse> HasPermission(HasPermissionRequest request, ServerCallContext context)
+    {
+        var hasPermission = await permissionService.HasPermissionAsync(request.Actor, request.Area, request.Key);
+        return new HasPermissionResponse { HasPermission = hasPermission };
+    }
+
+    public override async Task<GetPermissionResponse> GetPermission(GetPermissionRequest request, ServerCallContext context)
+    {
+        var permissionValue = await permissionService.GetPermissionAsync<JsonDocument>(request.Actor, request.Area, request.Key);
+        return new GetPermissionResponse { Value = permissionValue != null ? Value.Parser.ParseJson(permissionValue.RootElement.GetRawText()) : null };
+    }
+
+    public override async Task<AddPermissionNodeResponse> AddPermissionNode(AddPermissionNodeRequest request, ServerCallContext context)
+    {
+        var node = await permissionService.AddPermissionNode(
+            request.Actor,
+            request.Area,
+            request.Key,
+            JsonDocument.Parse(request.Value.ToString()), // Convert Value to JsonDocument
+            request.ExpiredAt?.ToInstant(),
+            request.AffectedAt?.ToInstant()
+        );
+        return new AddPermissionNodeResponse { Node = node.ToProtoValue() };
+    }
+
+    public override async Task<AddPermissionNodeToGroupResponse> AddPermissionNodeToGroup(AddPermissionNodeToGroupRequest request, ServerCallContext context)
+    {
+        var group = await db.PermissionGroups.FirstOrDefaultAsync(g => g.Id == Guid.Parse(request.Group.Id));
+        if (group == null)
+        {
+            throw new RpcException(new Status(StatusCode.NotFound, "Permission group not found."));
+        }
+
+        var node = await permissionService.AddPermissionNodeToGroup(
+            group,
+            request.Actor,
+            request.Area,
+            request.Key,
+            JsonDocument.Parse(request.Value.ToString()), // Convert Value to JsonDocument
+            request.ExpiredAt?.ToInstant(),
+            request.AffectedAt?.ToInstant()
+        );
+        return new AddPermissionNodeToGroupResponse { Node = node.ToProtoValue() };
+    }
+
+    public override async Task<RemovePermissionNodeResponse> RemovePermissionNode(RemovePermissionNodeRequest request, ServerCallContext context)
+    {
+        await permissionService.RemovePermissionNode(request.Actor, request.Area, request.Key);
+        return new RemovePermissionNodeResponse { Success = true };
+    }
+
+    public override async Task<RemovePermissionNodeFromGroupResponse> RemovePermissionNodeFromGroup(RemovePermissionNodeFromGroupRequest request, ServerCallContext context)
+    {
+        var group = await db.PermissionGroups.FirstOrDefaultAsync(g => g.Id == Guid.Parse(request.Group.Id));
+        if (group == null)
+        {
+            throw new RpcException(new Status(StatusCode.NotFound, "Permission group not found."));
+        }
+
+        await permissionService.RemovePermissionNodeFromGroup<JsonDocument>(group, request.Actor, request.Area, request.Key);
+        return new RemovePermissionNodeFromGroupResponse { Success = true };
+    }
+}
+
+public static class PermissionExtensions
+{
+    public static DysonNetwork.Shared.Proto.PermissionNode ToProtoValue(this PermissionNode node)
+    {
+        return new DysonNetwork.Shared.Proto.PermissionNode
+        {
+            Id = node.Id.ToString(),
+            Actor = node.Actor,
+            Area = node.Area,
+            Key = node.Key,
+            Value = Value.Parser.ParseJson(node.Value.RootElement.GetRawText()),
+            ExpiredAt = node.ExpiredAt?.ToTimestamp(),
+            AffectedAt = node.AffectedAt?.ToTimestamp(),
+            GroupId = node.GroupId?.ToString() ?? string.Empty
+        };
+    }
+}
+

DysonNetwork.Pass/Program.cs

@@ -0,0 +1,47 @@
+using DysonNetwork.Pass;
+using DysonNetwork.Pass.Account;
+using DysonNetwork.Pass.Startup;
+using DysonNetwork.Shared.Http;
+using DysonNetwork.Shared.Registry;
+using Microsoft.EntityFrameworkCore;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Configure Kestrel and server options
+builder.ConfigureAppKestrel();
+
+// Add metrics and telemetry
+builder.Services.AddAppMetrics();
+
+// Add application services
+builder.Services.AddRegistryService(builder.Configuration);
+builder.Services.AddAppServices(builder.Configuration);
+builder.Services.AddAppRateLimiting();
+builder.Services.AddAppAuthentication();
+builder.Services.AddAppSwagger();
+
+// Add flush handlers and websocket handlers
+builder.Services.AddAppFlushHandlers();
+
+// Add business services
+builder.Services.AddAppBusinessServices(builder.Configuration);
+
+// Add scheduled jobs
+builder.Services.AddAppScheduledJobs();
+
+var app = builder.Build();
+
+// Run database migrations
+using (var scope = app.Services.CreateScope())
+{
+    var db = scope.ServiceProvider.GetRequiredService<AppDatabase>();
+    await db.Database.MigrateAsync();
+}
+
+// Configure application middleware pipeline
+app.ConfigureAppMiddleware(builder.Configuration);
+
+// Configure gRPC
+app.ConfigureGrpcServices();
+
+app.Run();

DysonNetwork.Pass/Properties/launchSettings.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "http://localhost:5216",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "https://localhost:7058;http://localhost:5216",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

DysonNetwork.Pass/Resources/Localization/AccountEventResource.Designer.cs

@@ -0,0 +1,222 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     This code was generated by a tool.
+//
+//     Changes to this file may cause incorrect behavior and will be lost if
+//     the code is regenerated.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+namespace DysonNetwork.Pass.Resources {
+    using System;
+    
+    
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+    [System.Diagnostics.DebuggerNonUserCodeAttribute()]
+    [System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+    internal class AccountEventResource {
+        
+        private static System.Resources.ResourceManager resourceMan;
+        
+        private static System.Globalization.CultureInfo resourceCulture;
+        
+        [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
+        internal AccountEventResource() {
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Resources.ResourceManager ResourceManager {
+            get {
+                if (object.Equals(null, resourceMan)) {
+                    System.Resources.ResourceManager temp = new System.Resources.ResourceManager("DysonNetwork.Pass.Resources.AccountEventResource", typeof(AccountEventResource).Assembly);
+                    resourceMan = temp;
+                }
+                return resourceMan;
+            }
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Globalization.CultureInfo Culture {
+            get {
+                return resourceCulture;
+            }
+            set {
+                resourceCulture = value;
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_1 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_1", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_1 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_1", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_1 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_1", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_1 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_1", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_2 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_2", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_2 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_2", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_2 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_2", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_2 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_2", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_3 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_3", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_3 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_3", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_3 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_3", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_3 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_3", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_4 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_4", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_4 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_4", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_4 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_4", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_4 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_4", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_5 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_5", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_5 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_5", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_5 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_5", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_5 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_5", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_6 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_6", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_6 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_6", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_6 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_6", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_6 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_6", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveTitle_7 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveTitle_7", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipPositiveContent_7 {
+            get {
+                return ResourceManager.GetString("FortuneTipPositiveContent_7", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_7 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_7", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeContent_7 {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeContent_7", resourceCulture);
+            }
+        }
+        
+        internal static string FortuneTipNegativeTitle_1_ {
+            get {
+                return ResourceManager.GetString("FortuneTipNegativeTitle_1 ", resourceCulture);
+            }
+        }
+    }
+}

DysonNetwork.Pass/Resources/Localization/AccountEventResource.resx

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<root>
+    <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+        <xsd:element name="root" msdata:IsDataSet="true">
+
+        </xsd:element>
+    </xsd:schema>
+    <resheader name="resmimetype">
+        <value>text/microsoft-resx</value>
+    </resheader>
+    <resheader name="version">
+        <value>1.3</value>
+    </resheader>
+    <resheader name="reader">
+        <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral,
+            PublicKeyToken=b77a5c561934e089
+        </value>
+    </resheader>
+    <resheader name="writer">
+        <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral,
+            PublicKeyToken=b77a5c561934e089
+        </value>
+    </resheader>
+    <data name="FortuneTipPositiveTitle_1" xml:space="preserve">
+    <value>Gacha</value>
+  </data>
+    <data name="FortuneTipPositiveContent_1" xml:space="preserve">
+    <value>Golden every pull</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_1" xml:space="preserve">
+    <value>Gacha</value>
+  </data>
+    <data name="FortuneTipNegativeContent_1" xml:space="preserve">
+    <value>Won't pull the card you like</value>
+  </data>
+    <data name="FortuneTipPositiveTitle_2" xml:space="preserve">
+    <value>Gaming</value>
+  </data>
+    <data name="FortuneTipPositiveContent_2" xml:space="preserve">
+    <value>Rank up like a hot knife through butter</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_2" xml:space="preserve">
+    <value>Gaming</value>
+  </data>
+    <data name="FortuneTipNegativeContent_2" xml:space="preserve">
+    <value>Dropping ranks like a landslide</value>
+  </data>
+    <data name="FortuneTipPositiveTitle_3" xml:space="preserve">
+    <value>Lottery</value>
+  </data>
+    <data name="FortuneTipPositiveContent_3" xml:space="preserve">
+    <value>Blessed with luck</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_3" xml:space="preserve">
+    <value>Lottery</value>
+  </data>
+    <data name="FortuneTipNegativeContent_3" xml:space="preserve">
+    <value>Ten pulls, all silence</value>
+  </data>
+    <data name="FortuneTipPositiveTitle_4" xml:space="preserve">
+    <value>Speech</value>
+  </data>
+    <data name="FortuneTipPositiveContent_4" xml:space="preserve">
+    <value>Words flow like gems</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_4" xml:space="preserve">
+    <value>Speech</value>
+  </data>
+    <data name="FortuneTipNegativeContent_4" xml:space="preserve">
+        <value>Be careful what you're saying</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_5" xml:space="preserve">
+    <value>Drawing</value>
+  </data>
+    <data name="FortuneTipPositiveContent_5" xml:space="preserve">
+    <value>Inspiration gushes like a spring</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_5" xml:space="preserve">
+    <value>Drawing</value>
+  </data>
+    <data name="FortuneTipNegativeContent_5" xml:space="preserve">
+    <value>Every stroke weighs a thousand pounds</value>
+  </data>
+    <data name="FortuneTipPositiveTitle_6" xml:space="preserve">
+    <value>Coding</value>
+  </data>
+    <data name="FortuneTipPositiveContent_6" xml:space="preserve">
+    <value>0 error(s), 0 warning(s)</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_6" xml:space="preserve">
+    <value>Coding</value>
+  </data>
+    <data name="FortuneTipNegativeContent_6" xml:space="preserve">
+    <value>114 error(s), 514 warning(s)</value>
+  </data>
+    <data name="FortuneTipPositiveTitle_7" xml:space="preserve">
+    <value>Shopping</value>
+  </data>
+    <data name="FortuneTipPositiveContent_7" xml:space="preserve">
+    <value>Exchange rate at its lowest</value>
+  </data>
+    <data name="FortuneTipNegativeTitle_7" xml:space="preserve">
+    <value>Unboxing</value>
+  </data>
+    <data name="FortuneTipNegativeContent_7" xml:space="preserve">
+    <value>225% tariff</value>
+  </data>
+  <data name="FortuneTipNegativeTitle_1 " xml:space="preserve">
+    <value>Gacha</value>
+  </data>
+</root>

DysonNetwork.Pass/Resources/Localization/AccountEventResource.zh-hans.resx

@@ -0,0 +1,98 @@
+<root>
+    <resheader name="resmimetype">
+        <value>text/microsoft-resx</value>
+    </resheader>
+    <resheader name="version">
+        <value>1.3</value>
+    </resheader>
+    <resheader name="reader">
+        <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <resheader name="writer">
+        <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <data name="FortuneTipPositiveTitle_1" xml:space="preserve">
+        <value>抽卡</value>
+    </data>
+    <data name="FortuneTipPositiveContent_1" xml:space="preserve">
+        <value>次次出金</value>
+    </data>
+    <data name="FortuneTipNegativeContent_1" xml:space="preserve">
+        <value>吃大保底</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_2" xml:space="preserve">
+        <value>游戏</value>
+    </data>
+    <data name="FortuneTipPositiveContent_2" xml:space="preserve">
+        <value>升段如破竹</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_2" xml:space="preserve">
+        <value>游戏</value>
+    </data>
+    <data name="FortuneTipNegativeContent_2" xml:space="preserve">
+        <value>掉分如山崩</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_3" xml:space="preserve">
+        <value>抽奖</value>
+    </data>
+    <data name="FortuneTipPositiveContent_3" xml:space="preserve">
+        <value>欧气加身</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_3" xml:space="preserve">
+        <value>抽奖</value>
+    </data>
+    <data name="FortuneTipNegativeContent_3" xml:space="preserve">
+        <value>十连皆寂</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_4" xml:space="preserve">
+        <value>演讲</value>
+    </data>
+    <data name="FortuneTipPositiveContent_4" xml:space="preserve">
+        <value>妙语连珠</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_4" xml:space="preserve">
+        <value>演讲</value>
+    </data>
+    <data name="FortuneTipNegativeContent_4" xml:space="preserve">
+        <value>谨言慎行</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_5" xml:space="preserve">
+        <value>绘图</value>
+    </data>
+    <data name="FortuneTipPositiveContent_5" xml:space="preserve">
+        <value>灵感如泉涌</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_5" xml:space="preserve">
+        <value>绘图</value>
+    </data>
+    <data name="FortuneTipNegativeContent_5" xml:space="preserve">
+        <value>下笔如千斤</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_6" xml:space="preserve">
+        <value>编程</value>
+    </data>
+    <data name="FortuneTipPositiveContent_6" xml:space="preserve">
+        <value>0 error(s), 0 warning(s)</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_6" xml:space="preserve">
+        <value>编程</value>
+    </data>
+    <data name="FortuneTipNegativeContent_6" xml:space="preserve">
+        <value>114 error(s), 514 warning(s)</value>
+    </data>
+    <data name="FortuneTipPositiveTitle_7" xml:space="preserve">
+        <value>购物</value>
+    </data>
+    <data name="FortuneTipPositiveContent_7" xml:space="preserve">
+        <value>汇率低谷</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_7" xml:space="preserve">
+        <value>开箱</value>
+    </data>
+    <data name="FortuneTipNegativeContent_7" xml:space="preserve">
+        <value>225% 关税</value>
+    </data>
+    <data name="FortuneTipNegativeTitle_1" xml:space="preserve">
+        <value>抽卡</value>
+    </data>
+</root>

DysonNetwork.Pass/Resources/Localization/EmailResource.Designer.cs

@@ -0,0 +1,90 @@
+//------------------------------------------------------------------------------
+// <auto-generated>
+//     This code was generated by a tool.
+//
+//     Changes to this file may cause incorrect behavior and will be lost if
+//     the code is regenerated.
+// </auto-generated>
+//------------------------------------------------------------------------------
+
+namespace DysonNetwork.Pass.Resources.Pages.Emails {
+    using System;
+    
+    
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
+    [System.Diagnostics.DebuggerNonUserCodeAttribute()]
+    [System.Runtime.CompilerServices.CompilerGeneratedAttribute()]
+    internal class EmailResource {
+        
+        private static System.Resources.ResourceManager resourceMan;
+        
+        private static System.Globalization.CultureInfo resourceCulture;
+        
+        [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")]
+        internal EmailResource() {
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Resources.ResourceManager ResourceManager {
+            get {
+                if (object.Equals(null, resourceMan)) {
+                    System.Resources.ResourceManager temp = new System.Resources.ResourceManager("DysonNetwork.Pass.Resources.Localization.EmailResource", typeof(EmailResource).Assembly);
+                    resourceMan = temp;
+                }
+                return resourceMan;
+            }
+        }
+        
+        [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Advanced)]
+        internal static System.Globalization.CultureInfo Culture {
+            get {
+                return resourceCulture;
+            }
+            set {
+                resourceCulture = value;
+            }
+        }
+        
+        internal static string LandingHeader1 {
+            get {
+                return ResourceManager.GetString("LandingHeader1", resourceCulture);
+            }
+        }
+        
+        internal static string LandingPara1 {
+            get {
+                return ResourceManager.GetString("LandingPara1", resourceCulture);
+            }
+        }
+        
+        internal static string LandingPara2 {
+            get {
+                return ResourceManager.GetString("LandingPara2", resourceCulture);
+            }
+        }
+        
+        internal static string LandingPara3 {
+            get {
+                return ResourceManager.GetString("LandingPara3", resourceCulture);
+            }
+        }
+        
+        internal static string LandingButton1 {
+            get {
+                return ResourceManager.GetString("LandingButton1", resourceCulture);
+            }
+        }
+        
+        internal static string LandingPara4 {
+            get {
+                return ResourceManager.GetString("LandingPara4", resourceCulture);
+            }
+        }
+        
+        internal static string EmailLandingTitle {
+            get {
+                return ResourceManager.GetString("EmailLandingTitle", resourceCulture);
+            }
+        }
+    }
+}

DysonNetwork.Pass/Resources/Localization/EmailResource.resx

@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<root>
+    <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+        <xsd:element name="root" msdata:IsDataSet="true">
+            
+        </xsd:element>
+    </xsd:schema>
+    <resheader name="resmimetype">
+        <value>text/microsoft-resx</value>
+    </resheader>
+    <resheader name="version">
+        <value>1.3</value>
+    </resheader>
+    <resheader name="reader">
+        <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <resheader name="writer">
+        <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <data name="LandingHeader1" xml:space="preserve">
+        <value>Welcome to the Solar Network!</value>
+    </data>
+    <data name="LandingPara1" xml:space="preserve">
+        <value>Dear, </value>
+    </data>
+    <data name="LandingPara2" xml:space="preserve">
+        <value>Thank you for creating an account on the Solar Network. We're excited to have you join our community!</value>
+    </data>
+    <data name="LandingPara3" xml:space="preserve">
+        <value>To access all features and ensure the security of your account, please confirm your registration by clicking the button below:</value>
+    </data>
+    <data name="LandingButton1" xml:space="preserve">
+        <value>Confirm Registration</value>
+    </data>
+    <data name="LandingPara4" xml:space="preserve">
+        <value>If you didn't create this account, please ignore this email.</value>
+    </data>
+    <data name="EmailLandingTitle" xml:space="preserve">
+        <value>Confirm your registration</value>
+    </data>
+    <data name="AccountDeletionHeader" xml:space="preserve">
+        <value>Account Deletion Confirmation</value>
+    </data>
+    <data name="AccountDeletionPara1" xml:space="preserve">
+        <value>Dear, </value>
+    </data>
+    <data name="AccountDeletionPara2" xml:space="preserve">
+        <value>We've received a request to delete your Solar Network account. We're sorry to see you go.</value>
+    </data>
+    <data name="AccountDeletionPara3" xml:space="preserve">
+        <value>To confirm your account deletion, please click the button below. Please note that this action is permanent and cannot be undone.</value>
+    </data>
+    <data name="AccountDeletionButton" xml:space="preserve">
+        <value>Confirm Account Deletion</value>
+    </data>
+    <data name="AccountDeletionPara4" xml:space="preserve">
+        <value>If you did not request to delete your account, please ignore this email or contact our support team immediately.</value>
+    </data>
+    <data name="EmailAccountDeletionTitle" xml:space="preserve">
+        <value>Confirm your account deletion</value>
+    </data>
+    <data name="EmailPasswordResetTitle" xml:space="preserve">
+        <value>Reset your password</value>
+    </data>
+    <data name="PasswordResetButton" xml:space="preserve">
+        <value>Reset Password</value>
+    </data>
+    <data name="PasswordResetHeader" xml:space="preserve">
+        <value>Password Reset Request</value>
+    </data>
+    <data name="PasswordResetPara1" xml:space="preserve">
+        <value>Dear,</value>
+    </data>
+    <data name="PasswordResetPara2" xml:space="preserve">
+        <value>We recieved a request to reset your Solar Network account password.</value>
+    </data>
+    <data name="PasswordResetPara3" xml:space="preserve">
+        <value>You can click the button below to continue reset your password.</value>
+    </data>
+    <data name="PasswordResetPara4" xml:space="preserve">
+        <value>If you didn't request this, you can ignore this email safety.</value>
+    </data>
+    <data name="VerificationHeader1" xml:space="preserve">
+        <value>Verify Your Email Address</value>
+    </data>
+    <data name="VerificationPara1" xml:space="preserve">
+        <value>Dear, </value>
+    </data>
+    <data name="VerificationPara2" xml:space="preserve">
+        <value>Thank you for creating an account on the Solar Network. We're excited to have you join our community!</value>
+    </data>
+    <data name="VerificationPara3" xml:space="preserve">
+        <value>To verify your email address and access all features of your account, please use the verification code below:</value>
+    </data>
+    <data name="VerificationPara4" xml:space="preserve">
+        <value>This code will expire in 30 minutes. Please enter it on the verification page to complete your registration.</value>
+    </data>
+    <data name="VerificationPara5" xml:space="preserve">
+        <value>If you didn't create this account, please ignore this email.</value>
+    </data>
+    <data name="EmailVerificationTitle" xml:space="preserve">
+        <value>Verify your email address</value>
+    </data>
+    <data name="ContactVerificationHeader" xml:space="preserve">
+        <value>Verify Your Contact Information</value>
+    </data>
+    <data name="ContactVerificationPara1" xml:space="preserve">
+        <value>Dear, </value>
+    </data>
+    <data name="ContactVerificationPara2" xml:space="preserve">
+        <value>Thank you for updating your contact information on the Solar Network. To ensure your account security, we need to verify this change.</value>
+    </data>
+    <data name="ContactVerificationPara3" xml:space="preserve">
+        <value>Please click the button below to verify your contact information:</value>
+    </data>
+    <data name="ContactVerificationButton" xml:space="preserve">
+        <value>Verify Contact Information</value>
+    </data>
+    <data name="ContactVerificationPara4" xml:space="preserve">
+        <value>If you didn't request this change, please contact our support team immediately.</value>
+    </data>
+    <data name="EmailContactVerificationTitle" xml:space="preserve">
+        <value>Verify your contact information</value>
+    </data>
+</root>

DysonNetwork.Pass/Resources/Localization/EmailResource.zh-hans.resx

@@ -0,0 +1,119 @@
+<root>
+    <resheader name="resmimetype">
+        <value>text/microsoft-resx</value>
+    </resheader>
+    <resheader name="version">
+        <value>1.3</value>
+    </resheader>
+    <resheader name="reader">
+        <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <resheader name="writer">
+        <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+    </resheader>
+    <data name="LandingHeader1" xml:space="preserve">
+        <value>欢迎来到 Solar Network！</value>
+    </data>
+    <data name="LandingPara1" xml:space="preserve">
+        <value>尊敬的 </value>
+    </data>
+    <data name="LandingButton1" xml:space="preserve">
+        <value>确认注册</value>
+    </data>
+    <data name="LandingPara2" xml:space="preserve">
+        <value>感谢你在 Solar Network 上注册帐号，我们很激动你即将加入我们的社区！</value>
+    </data>
+    <data name="LandingPara3" xml:space="preserve">
+        <value>点击下方按钮来确认你的注册以获得所有功能的权限。</value>
+    </data>
+    <data name="LandingPara4" xml:space="preserve">
+        <value>如果你并没有注册帐号，你可以忽略此邮件。</value>
+    </data>
+    <data name="EmailLandingTitle" xml:space="preserve">
+        <value>确认你的注册</value>
+    </data>
+    <data name="AccountDeletionHeader" xml:space="preserve">
+        <value>账户删除确认</value>
+    </data>
+    <data name="AccountDeletionPara1" xml:space="preserve">
+        <value>尊敬的 </value>
+    </data>
+    <data name="AccountDeletionPara2" xml:space="preserve">
+        <value>我们收到了删除您 Solar Network 账户的请求。我们很遗憾看到您的离开。</value>
+    </data>
+    <data name="AccountDeletionPara3" xml:space="preserve">
+        <value>请点击下方按钮确认删除您的账户。请注意，此操作是永久性的，无法撤销。</value>
+    </data>
+    <data name="AccountDeletionButton" xml:space="preserve">
+        <value>确认删除账户</value>
+    </data>
+    <data name="AccountDeletionPara4" xml:space="preserve">
+        <value>如果您并未请求删除账户，请忽略此邮件或立即联系我们的支持团队。</value>
+    </data>
+    <data name="EmailAccountDeletionTitle" xml:space="preserve">
+        <value>确认删除您的账户</value>
+    </data>
+    <data name="PasswordResetHeader" xml:space="preserve">
+        <value>密码重置请求</value>
+    </data>
+    <data name="PasswordResetPara1" xml:space="preserve">
+        <value>尊敬的 </value>
+    </data>
+    <data name="PasswordResetPara2" xml:space="preserve">
+        <value>我们收到了重置您 Solar Network 账户密码的请求。</value>
+    </data>
+    <data name="PasswordResetPara3" xml:space="preserve">
+        <value>请点击下方按钮重置您的密码。此链接将在24小时后失效。</value>
+    </data>
+    <data name="PasswordResetButton" xml:space="preserve">
+        <value>重置密码</value>
+    </data>
+    <data name="PasswordResetPara4" xml:space="preserve">
+        <value>如果您并未请求重置密码，你可以安全地忽略此邮件。</value>
+    </data>
+    <data name="EmailPasswordResetTitle" xml:space="preserve">
+        <value>重置您的密码</value>
+    </data>
+    <data name="VerificationHeader1" xml:space="preserve">
+        <value>验证您的电子邮箱</value>
+    </data>
+    <data name="VerificationPara1" xml:space="preserve">
+        <value>尊敬的 </value>
+    </data>
+    <data name="VerificationPara2" xml:space="preserve">
+        <value>感谢您在 Solar Network 上注册账号，我们很高兴您即将加入我们的社区！</value>
+    </data>
+    <data name="VerificationPara3" xml:space="preserve">
+        <value>请使用以下验证码来验证您的电子邮箱并获取账号的所有功能：</value>
+    </data>
+    <data name="VerificationPara4" xml:space="preserve">
+        <value>此验证码将在30分钟后失效。请在验证页面输入此验证码以完成注册。</value>
+    </data>
+    <data name="VerificationPara5" xml:space="preserve">
+        <value>如果您并未创建此账号，请忽略此邮件。</value>
+    </data>
+    <data name="EmailVerificationTitle" xml:space="preserve">
+        <value>验证您的电子邮箱</value>
+    </data>
+    <data name="ContactVerificationHeader" xml:space="preserve">
+        <value>验证您的联系信息</value>
+    </data>
+    <data name="ContactVerificationPara1" xml:space="preserve">
+        <value>尊敬的 </value>
+    </data>
+    <data name="ContactVerificationPara2" xml:space="preserve">
+        <value>感谢您更新 Solar Network 上的联系信息。为确保您的账户安全，我们需要验证此更改。</value>
+    </data>
+    <data name="ContactVerificationPara3" xml:space="preserve">
+        <value>请点击下方按钮验证您的联系信息：</value>
+    </data>
+    <data name="ContactVerificationButton" xml:space="preserve">
+        <value>验证联系信息</value>
+    </data>
+    <data name="ContactVerificationPara4" xml:space="preserve">
+        <value>如果您没有请求此更改，请立即联系我们的支持团队。</value>
+    </data>
+    <data name="EmailContactVerificationTitle" xml:space="preserve">
+        <value>验证您的联系信息</value>
+    </data>
+</root>