why2-chat 2.1.3

/*
This is part of WHY2
Copyright (C) 2022-2026 Václav Šmejkal

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
*/

//MODULES
pub mod connection;
pub mod handshake;

use std::
{
    path::Path,
    future::Future,
    net::{ IpAddr, SocketAddr },
    time::{ Instant, Duration },
    collections::{ HashSet, HashMap },
    sync::
    {
        Arc,
        LazyLock,
        Mutex as MutexSync,
    },
};

use tokio::
{
    fs,
    time,
    sync::{ Mutex, oneshot },
    net::tcp::OwnedWriteHalf,
    task::{ self, AbortHandle },
};

use rand::
{
    TryRng,
    rngs::SysRng,
};

use zeroize::Zeroizing;

use dashmap::DashMap;

use connection::
{
    AvailableFile,
    ConnectionType,
    Connection,
};

use crate::
{
    misc,
    options,
    role::Role,
    crypto::password,
    config::{ self, users },
    consts::
    {
        self,
        SharedKeys,
        Streams,
    },
    network::
    {
        self,
        voice::server as voice_server,
        file::server as file,
        codes::
        {
            PacketCode,
            OnlineUser,
            StoredMessage,
            UserFile,
            UserScreen,
        },
    },
};

//LISTS
pub static PENDING_TOKENS: LazyLock<DashMap<[u8; 32], (usize, ConnectionType, Instant)>> = LazyLock::new(|| DashMap::new());
pub static CONNECTIONS: LazyLock<DashMap<SocketAddr, Connection>> = LazyLock::new(|| DashMap::new());     //LIST FOR EACH CLIENT CONNECTION
pub static AVAILABLE_FILES: LazyLock<DashMap<String, Vec<AvailableFile>>> = LazyLock::new(|| DashMap::new()); //LIST FOR UPLOADED FILES

//PRIVATE
async fn send_bans(write_stream: &Arc<Mutex<OwnedWriteHalf>>, keys: &SharedKeys) //SEND THE WHOLE BAN LIST
{
    network::send(&mut *write_stream.lock().await, PacketCode::ServerBans
    {
        users: Some(config::bans::users()),
        ips: Some(config::bans::ips()),
    }, Some(keys)).await;
}

async fn send_history(write_stream: &Arc<Mutex<OwnedWriteHalf>>, keys: &SharedKeys) //SEND THE STORED LOBBY MESSAGES
{
    if !config::read_config::<bool>("persistent_messages") { return; }

    let stored = config::messages::all();
    if stored.is_empty() { return; }

    //THE REPLAY IS ONE PACKET, SO IT IS THE NEWEST PART OF THE HISTORY THAT FITS IN ONE: A PACKET OVER THE
    //CLIENT'S CEILING IS NOT TRIMMED THERE, IT IS REFUSED AND THE SOCKET DROPPED. THE PICTURES ARE NOT IN
    //IT - AN IMAGE IS ITS HASH HERE, AND THE CLIENT ASKS FOR THE ONES IT WANTS TO SEE (PacketCode::ImageData)
    let mut messages: Vec<StoredMessage> = Vec::new();
    let mut budget = consts::MAX_HISTORY_SIZE;

    for message in stored.into_iter().rev()
    {
        let size = message.username.len() + message.text.len();
        if size > budget { break; }

        budget -= size;

        messages.push(message);
    }

    if messages.is_empty() { return; }

    messages.reverse(); //OLDEST FIRST AGAIN - THE BUDGET IS SPENT FROM THE NEWEST END, THE PANE READS FROM THE OTHER

    log::debug!("Replaying history ({} messages)", messages.len());

    network::send(&mut *write_stream.lock().await, PacketCode::History { messages }, Some(keys)).await;
}

async fn remove_connections(addr: &IpAddr, grace: bool, info: Option<&str>) //REMOVE CONNECTIONS BY IP
{
    let addrs: Vec<SocketAddr> = CONNECTIONS.iter()
        .filter(|conn| conn.key().ip() == *addr)
        .map(|conn| *conn.key()).collect();

    for addr in addrs
    {
        remove_connection(&addr, grace, info).await;
    }
}

//PUBLIC
//THE ADDRESS EVERY LINE ABOUT A CLIENT IS KEYED BY. AN AUXILIARY SOCKET (AN UPLOAD, A DOWNLOAD, A SHARE, A
//VIEWER, A VOICE SESSION) IS A CONNECTION OF ITS OWN ON AN EPHEMERAL PORT THAT NOTHING ELSE IN THE LOG EVER
//NAMES, SO IT IS LOGGED AS THE MAIN CONNECTION THAT ASKED FOR IT AND THE TWO CAN BE READ TOGETHER.
//NEVER CALL THIS WHILE HOLDING A CONNECTIONS GUARD - IT WALKS THE SAME MAP
pub fn log_addr(id: &usize) -> String
{
    CONNECTIONS.iter().find(|conn| conn.id() == Some(id))
        .map(|conn| conn.peer_addr().to_string())
        .unwrap_or_else(|| String::from("<gone>"))
}

pub fn spawn_with_abort<F, Fut>(f: F) -> AbortHandle //SPAWN TASK WHICH KNOWS ITS OWN AbortHandle
where
    F: FnOnce(AbortHandle) -> Fut + Send + 'static,
    Fut: Future<Output = ()> + Send + 'static,
{
    //CHANNEL FOR HANDING THE HANDLE OVER TO THE TASK
    let (tx, rx) = oneshot::channel::<AbortHandle>();

    let handle = tokio::spawn(async move
    {
        //WAIT FOR OWN HANDLE (PREVENTS RACE WITH REGISTRATION)
        let task = match rx.await
        {
            Ok(t) => t,
            Err(_) => return
        };

        f(task).await;
    });

    let task = handle.abort_handle();
    tx.send(task.clone()).ok();

    task
}

pub fn send_to_all(code: PacketCode, filter_channel: bool, channel: Option<&str>) //SEND PACKET TO ALL CLIENTS
{
    //COLLECT EACH CLIENT IN SAME CHANNEL
    let entries: Vec<Connection> = CONNECTIONS.iter().filter_map(|entry|
    {
        match entry.value()
        {
            Connection::Authenticated { channel: c, .. } if !filter_channel || c.as_deref() == channel =>
            {
                //FOUND, COLLECT
                Some(entry.value().clone())
            },
            _ => None,
        }
    }).collect();

    for ref entry in entries
    {
        let write_stream = entry.write_stream().clone();
        let code = code.clone();
        let keys = entry.keys().cloned();

        tokio::spawn(async move
        {
            network::send(&mut *write_stream.lock().await, code, keys.as_ref()).await;
        });
    }
}

pub async fn remove_connection(peer_addr: &SocketAddr, grace: bool, info: Option<&str>) //REMOVE CONNECTION BY PEER ADDRESS
{
    //REMOVE CONNECTION
    let mut connection = match CONNECTIONS.remove(peer_addr)
    {
        Some((_, conn)) => conn,
        None => return
    };

    //SEND DISCONNECT CODE IF GRACEFUL
    if grace
    {
        network::send(&mut *connection.write_stream().lock().await, PacketCode::Disconnect, connection.keys()).await;
    }

    //CLOSE ALL FILE STREAMS
    if let Some(streams) = connection.file_streams()
    {
        //COLLECT UIDS
        let uids: Vec<u64> = streams.lock().unwrap().keys().copied().collect();

        for uid in uids
        {
            connection.remove_file_stream(uid);
        }
    }

    //CLOSE SCREEN UPLOAD STREAM
    if let Some(id) = connection.remove_screen_stream()
    {
        //DEATTACH ALL ATTACHED CLIENTS
        deattach(id, connection.username().unwrap()).await;
    }

    //AUTHENTICATED ACTIONS
    if connection.is_authenticated()
    {
        //TELL THE SHARER WE STOPPED WATCHING
        if let Some(target_id) = connection.attached_screen().as_ref().map(|a| a.target_id)
        {
            notify(target_id, PacketCode::Deattached
            {
                username: connection.username().unwrap().to_owned(),
            }).await;
        }

        //DISCONNECT FROM VOICE CHAT
        if options::voice_chat_enabled()
        {
            voice_server::remove_connection(connection.id().unwrap());
        }

        //REMOVE UPLOADS
        let username = connection.username().unwrap();
        let _ = fs::remove_dir_all(misc::get_upload_dir(username)).await; //REMOVE FILES
        file::ACTIVE_FILESHARES.retain(|_, u| u.client_id != *connection.id().unwrap());
        AVAILABLE_FILES.remove(username); //REMOVE AVAILABLE FILES

        //SEND LEAVE MESSAGE
        send_to_all(PacketCode::Leave
        {
            username: connection.username().unwrap().to_string(),
            id: *connection.id().unwrap(),
        }, false, None);
    }

    log::info!
    (
        "Close connection{}: {peer_addr} ({}, {} left)",

        if let Some(info) = info
        {
            format!(" ({info})")
        } else { String::new() },

        if connection.is_authenticated() { "authenticated" } else { "unauthenticated" },
        CONNECTIONS.len(),
    );

    //SHUT DOWN THE HANDLER TASK (MUST BE LAST - THIS MAY BE THE CALLING TASK ITSELF)
    connection.task().abort();
}

fn user_connected(username: &str) -> bool //CHECK IF CLIENT WITH username IS CONNECTED
{
    CONNECTIONS.iter().any(|conn|
    {
        conn.username().map_or(false, |u| u == &username.to_string())
    })
}

fn get_latest_id() -> usize
{
    //GET HashSet OF IDS
    let ids: HashSet<usize> = CONNECTIONS.iter().filter_map(|conn|
    {
        if let Some(id) = conn.id()
        {
            Some(*id)
        } else
        {
            None
        }
    }).collect();

    //GET SMALLEST UNUSED ID
    for i in 0..
    {
        if !ids.contains(&i) //ID FOUND, RETURN
        {
            return i;
        }
    }

    unreachable!("what the fuck");
}

fn update_client_keys(peer_addr: &SocketAddr, keys: &SharedKeys) //ADD KEY TO NonAuthenticated CLIENT AFTER KEY EXCHANGE
{
    //UPDATE CONNECTION
    CONNECTIONS.alter(peer_addr, |_, old_connection|
    {
        match old_connection
        {
            Connection::NonAuthenticated { write_stream, task, seq, peer_addr, connect, obfuscation_key, .. } =>
            {
                Connection::NonAuthenticated
                {
                    write_stream,
                    task,
                    peer_addr,
                    username: None,
                    keys: Some(keys.to_owned()),
                    obfuscation_key,
                    last_activity: Instant::now(),
                    seq,
                    connect,
                }
            },

            Connection::Authenticated { write_stream, task, file_streams, screen_stream, username, role,
                id, attached_screen, last_activity, last_image, channel, seq, server_seq, peer_addr, alive, muted,
                credit, refill, throttles, .. } =>
            {
                Connection::Authenticated
                {
                    write_stream,
                    task,
                    file_streams,
                    screen_stream,
                    peer_addr,
                    username,
                    role,
                    id,
                    keys: keys.to_owned(),
                    attached_screen,
                    last_activity,
                    last_key_exchange: Instant::now(),
                    last_image,
                    spam_violations: 0,
                    credit,
                    refill,
                    throttles,
                    channel,
                    seq,
                    server_seq,
                    alive,
                    muted,
                }
            }
        }
    });
}

fn authenticate_client(peer_addr: &SocketAddr, username: &str, role: Role, id: usize) //MOVE CONNECTION FROM NonAuthenticated TO Authenticated
{
    //UPDATE CONNECTION
    CONNECTIONS.alter(&peer_addr, |_, old_connection|
    {
        Connection::Authenticated
        {
            write_stream: old_connection.write_stream().clone(),
            task: old_connection.task().clone(),
            file_streams: Arc::new(MutexSync::new(HashMap::new())),
            screen_stream: None,
            peer_addr: *old_connection.peer_addr(),
            username: username.to_string(),
            role,
            id,
            keys: old_connection.keys().unwrap().to_owned(),
            attached_screen: None,
            last_activity: Instant::now() - Duration::from_millis(config::read_config("min_message_delay")),
            last_key_exchange: old_connection.last_key_exchange().copied().unwrap_or_else(Instant::now),
            last_image: Instant::now() - consts::IMAGE_REQUEST_DELAY,
            spam_violations: 0,
            credit: config::read_config::<f32>("max_packet_burst"),
            refill: Instant::now(),
            throttles: 0,
            channel: None,
            seq: *old_connection.seq(),
            server_seq: 0,
            alive: true,
            muted: false,
        }
    });

    //CREATE AVAILABLE FILES ENTRY
    AVAILABLE_FILES.insert(username.to_string(), Vec::new());

    log::info!("Authenticate connection: {peer_addr} (id {id}, role {role})");
}

fn update_client_channel(peer_addr: &SocketAddr, channel: &Option<String>) //MOVE CLIENT TO CHANNEL
{
    let mut old_channel = None; //PREVIOUS CHANNEL

    //UPDATE CONNECTION
    CONNECTIONS.alter(&peer_addr, |_, old_connection|
    {
        //GET PREVIOUS CHANNEL
        old_channel = old_connection.channel().clone();

        Connection::Authenticated
        {
            write_stream: old_connection.write_stream().clone(),
            task: old_connection.task().clone(),
            file_streams: old_connection.file_streams().unwrap().clone(),
            screen_stream: old_connection.screen_stream().clone(),
            peer_addr: *old_connection.peer_addr(),
            username: old_connection.username().unwrap().clone(),
            role: *old_connection.role().unwrap(),
            id: *old_connection.id().unwrap(),
            keys: old_connection.keys().unwrap().to_owned(),
            attached_screen: old_connection.attached_screen().clone(),
            last_activity: Instant::now(),
            last_key_exchange: *old_connection.last_key_exchange().unwrap(),
            last_image: *old_connection.last_image().unwrap(),
            spam_violations: *old_connection.spam_violations().unwrap(),
            credit: *old_connection.credit().unwrap(),
            refill: *old_connection.refill().unwrap(),
            throttles: *old_connection.throttles().unwrap(),
            channel: channel.clone(),
            seq: *old_connection.seq(),
            server_seq: *old_connection.server_seq().unwrap(),
            alive: true,
            muted: *old_connection.muted(),
        }
    });

    //RETURN IF CLIENT SWITCHED TO SAME CHANNEL
    if old_channel == *channel { return; }

    log::info!("Channel switch: {peer_addr} ({} -> {})",
        if old_channel.is_some() { "channel" } else { "lobby" },
        if channel.is_some() { "channel" } else { "lobby" });

    //CHECK IF CHANNEL WAS ABANDONED
    if let Some(old_channel) = old_channel
    {
        if !CONNECTIONS.iter().any(|c| c.channel().as_ref() == Some(&old_channel))
        {
            //NO CLIENT IS IN OLD CHANNEL
            log::info!("Channel destroyed (last client left): {peer_addr}");

            send_to_all(PacketCode::ChannelDestroyed
            {
                name: old_channel,
            }, false, None);
        }
    }

    //CHECK IF CHANNEL WAS CREATED
    if let Some(channel) = channel
    {
        if CONNECTIONS.iter().filter(|c| c.channel().as_ref() == Some(channel)).count() == 1
        {
            //CLIENT IS FIRST IN CHANNEL
            log::info!("Channel created: {peer_addr}");

            send_to_all(PacketCode::ChannelCreated
            {
                name: channel.clone(),
            }, false, None);
        }
    }
}

async fn send_voice_clients(stream: &mut OwnedWriteHalf, keys: &SharedKeys, id: usize)
{
    //FIND CHANNEL
    let sender_channel = match CONNECTIONS.iter().find(|e| e.value().id() == Some(&id))
    {
        Some(entry) => entry.value().channel().clone(),
        None => return,
    };

    let mut clients: Vec<(usize, String)> = Vec::new();

    //COLLECT VOICE CLIENTS
    for entry in CONNECTIONS.iter()
    {
        let conn = entry.value();

        let uid = match conn.id()
        {
            Some(i) => *i,
            None => continue
        };

        //FILTERS
        if uid == id { continue; } // IGNORE SELF
        if conn.channel() != &sender_channel { continue; } //IGNORE ANOTHER CHANNELS

        //CHECK IF IS IN VOICE
        if voice_server::CONNECTIONS.contains_key(&uid)
        {
            //ADD USERNAMES
            if let Some(username) = conn.username()
            {
                 clients.push((uid, username.clone()));
            }
        }
    }

    //SEND
    network::send(stream, PacketCode::VoiceClients { clients }, Some(keys)).await;
}

fn open_connection(id: usize, conn_type: ConnectionType) -> [u8; 32] //ADD NEW TOKEN
{
    //GENERATE RANDOM TOKEN
    let mut token = [0u8; 32];
    SysRng.try_fill_bytes(&mut token).unwrap();

    //OPEN NEW CONNECTION
    PENDING_TOKENS.insert(token, (id, conn_type, Instant::now()));

    token
}

//PUBLIC
pub async fn notify(id: usize, code: PacketCode) //SEND PACKET TO THE CLIENT WITH id (NOTHING HAPPENS IF IT IS GONE)
{
    //COLLECT INTO LOCALS FIRST - THE GUARD MUST NOT LIVE ACROSS THE await
    let target = CONNECTIONS.iter().find(|conn| conn.id() == Some(&id))
        .map(|conn| (conn.write_stream().clone(), conn.keys().cloned()));

    if let Some((write_stream, keys)) = target
    {
        network::send(&mut *write_stream.lock().await, code, keys.as_ref()).await;
    }
}

pub async fn deattach(sharer_id: usize, sharer_uname: &String) //DEATTACH ALL ATTACHED CLIENTS
{
    let mut to_notify = Vec::new();

    for mut conn in CONNECTIONS.iter_mut()
        .filter(|conn| conn.attached_screen().as_ref().is_some_and(|a| a.target_id == sharer_id))
    {
        conn.deattach_screen();
        to_notify.push((conn.write_stream().clone(), conn.keys().cloned()));
    }

    for (stream_mutex, keys) in to_notify
    {
        network::send(&mut *stream_mutex.lock().await,
            PacketCode::Deattach { username: Some(sharer_uname.to_owned()) }, keys.as_ref()).await;
    }
}

pub async fn listen_client //CLIENT -> SERVER COMMUNICATION
(
    streams: &mut Streams<'_>,
    peer_addr: SocketAddr,
    obfuscation_key: [u8; 32],
    task: AbortHandle,
)
{
    log::info!("New connection: {peer_addr}");

    //PUSH NEW CONNECTION
    CONNECTIONS.insert(peer_addr, Connection::NonAuthenticated
    {
        write_stream: streams.1.clone(),
        task,
        peer_addr: peer_addr,
        username: None,
        keys: None,
        obfuscation_key,
        last_activity: Instant::now(),
        seq: 0,
        connect: Instant::now(),
    });

    //GET ENCRYPTION & MAC KEYS
    let mut keys = (Zeroizing::new(vec![]), Zeroizing::new(vec![]));
    handshake::key_exchange(streams, &peer_addr, &obfuscation_key, &mut keys, None).await;

    //CHECK FOR VALID KEYS
    if keys.0.is_empty() || keys.1.is_empty()
    {
        log::warn!("Key exchange failed: {peer_addr}");
        return remove_connection(&peer_addr, false, None).await
    }

    log::debug!("Key exchange done: {peer_addr}");

    //ASK CLIENT FOR THEIR PACKAGE VERSION
    if config::read_config("check_client_version")
    {
        let version = handshake::ask_version(streams, &keys).await;
        if version.is_none() || version != Some(misc::get_version().to_string())
        {
            log::warn!("Version mismatch: {peer_addr} (client {}, server {})",
                version.as_deref().unwrap_or("none"), misc::get_version());

            return remove_connection(&peer_addr, true, Some("version")).await;
        }
    }

    //SEND PACKET WITH REQUIRED SERVER INFO
    handshake::send_welcome_packet(&mut *streams.1.lock().await, &keys).await;

    //GET USERNAME FROM USER
    let mut username: Option<String> = None; //USER ENTERED USERNAME

    //USERNAME CONFIGS
    let max_tries = config::read_config::<usize>("max_auth_tries"); //MAX n
    let min_len = config::read_config::<usize>("min_username_length");
    let max_len = config::read_config::<usize>("max_username_length");

    //TELL USER IF REGISTRATIONS ARE DISABLED
    let disabled_registration = !config::read_config::<bool>("allow_register");
    if disabled_registration
    {
        network::send(&mut *streams.1.lock().await, PacketCode::RegisterDisabled, Some(&keys)).await;
    }

    //ASK n TIMES
    for attempt in 0..max_tries
    {
        log::debug!("Asking for username: {peer_addr} (try {}/{max_tries})", attempt + 1);

        //SEND PICK_USERNAME CODE
        network::send(&mut *streams.1.lock().await, PacketCode::Username { username: None }, Some(&keys)).await;

        match network::receive(streams, Some(&keys), None).await
        {
            //USERNAME CONDITIONS MET, BREAK LOOP
            Some(PacketCode::Username { username: uname }) =>
            {
                if let Some(uname) = uname
                {
                    if uname.len() >= min_len && uname.len() <= max_len &&
                        uname.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-') &&
                        !user_connected(&uname) && uname != options::get_server_username()
                    {
                        username = Some(uname);
                        break;
                    }

                    log::debug!("Username refused: {peer_addr}");
                }
            },

            _ => return remove_connection(&peer_addr, false, Some("username")).await,
        }
    }

    //NO USERNAME RECEIVED, DISCONNECT CLIENT
    if username.is_none()
    {
        return remove_connection(&peer_addr, true, Some("username")).await;
    }

    let username = username.unwrap();

    //UPDATE USERNAME IN NonAuthenticated
    if let Some(mut conn) = CONNECTIONS.get_mut(&peer_addr)
    {
        if !conn.is_authenticated()
        {
            //UPDATE
            *conn.username_mut() = Some(username.clone());
        }
    }

    let user_exists = config::users::contains(&username);

    //ASK FOR PASSWORD
    if !user_exists && !disabled_registration //REGISTRATION (OR "FAKE" LOGIN ON DISABLED REGISTER)
    {
        let max_tries = config::read_config::<usize>("max_auth_tries"); //MAX n
        let mut password: Option<Zeroizing<String>> = None;

        //KEEP ASKING FOR PASSWORD n TIMES
        for _ in 0..max_tries
        {
            //SEND REGISTER CODE
            network::send(&mut *streams.1.lock().await, PacketCode::PasswordR { password: None }, Some(&keys)).await;

            //WAIT FOR ANSWER
            match network::receive(streams, Some(&keys), None).await
            {
                Some(PacketCode::PasswordR { password: pass }) =>
                {
                    if let Some(pass) = pass
                    {
                        let pass = Zeroizing::new(pass);
                        //CHECK LENGTH
                        if pass.len() >= config::read_config("min_password_length")
                        {
                            password = Some(pass);
                            break;
                        }
                    }
                },

                _ => return remove_connection(&peer_addr, false, Some("register")).await
            };
        }

        if password.is_none()
        {
            return remove_connection(&peer_addr, true, Some("register")).await;
        }

        log::info!("Registering new user: {peer_addr}");

        //HASH PASSWORD (ARGON2 IS CPU HEAVY, KEEP IT OFF THE RUNTIME)
        let hash = task::spawn_blocking(move || password::hash_password(password.as_ref().unwrap().as_str()))
            .await.expect("Hashing password failed");

        //SAVE PASSWORD
        if config::users::add(&username, &hash)
        {
            //FIRST USER, NOTIFY ABOUT OWNER ROLE
            log::info!("First user registered, granting {}: {peer_addr}", Role::Owner);

            network::send(&mut *streams.1.lock().await, PacketCode::FirstUser, Some(&keys)).await;
        }
    } else //LOGIN
    {
        //SEND LOGIN CODE
        network::send(&mut *streams.1.lock().await, PacketCode::PasswordL { password: None }, Some(&keys)).await;

        //WAIT FOR ANSWER
        let password = loop
        {
            match network::receive(streams, Some(&keys), None).await
            {
                Some(PacketCode::PasswordL { password: Some(password) }) => break Zeroizing::new(password),

                _ => return remove_connection(&peer_addr, false, Some("login")).await,
            }
        };

        //VERIFY PASSWORD (ARGON2 IS CPU HEAVY, KEEP IT OFF THE RUNTIME)
        let valid = if password.is_empty() || config::bans::banned(&username)
        {
            false
        } else if let Some(hashed) = config::users::password(&username)
        {
            task::spawn_blocking(move || password::compare_password_hash(&hashed, &password))
                .await.expect("Comparing password failed")
        } else //UNKNOWN USER (OR FAKE LOGIN)
        {
            false
        };

        //INVALID PASSWORD (OR FAKE LOGIN), DISCONNECT CLIENT
        if !valid
        {
            log::warn!("Login refused: {peer_addr}");
            return remove_connection(&peer_addr, true, Some("login")).await;
        }

        log::debug!("Login accepted: {peer_addr}");
    }

    let id = get_latest_id(); //GENERATE ID FOR CLIENT
    let role = config::users::role(&username).unwrap(); //WHAT THIS CLIENT IS ALLOWED TO ASK FOR

    let mut channel: Option<String> = None; //CURRENT CLIENT CHANNEL

    //AUTHENTICATE CLIENT
    authenticate_client(&peer_addr, &username, role, id);

    //SEND WHAT WAS SAID IN THE LOBBY BEFORE THIS CLIENT ARRIVED
    send_history(&streams.1, &keys).await;

    //TELL CLIENT TO START CHATTING
    network::send(&mut *streams.1.lock().await, PacketCode::Accept { id, role }, Some(&keys)).await;

    //SEND JOIN MESSAGE
    send_to_all(PacketCode::Join { username: username.clone() }, false, None);

    //TELL THE CLIENT WHO IS ALREADY IN VOICE - THE ROSTER IS SHOWN WHETHER OR NOT THEY JOIN IT
    if options::voice_chat_enabled()
    {
        send_voice_clients(&mut *streams.1.lock().await, &keys, id).await;
    }

    //LOOP READING
    loop
    {
        //READ
        let read = match network::receive(streams, Some(&keys), None).await
        {
            Some(r) => r,
            None => return
        };

        //REKEY EVERY 10 MINUTES
        if Instant::now().duration_since(*CONNECTIONS.get(&peer_addr).unwrap().last_key_exchange().unwrap()) >=
            Duration::from_secs(consts::REKEY_INTERVAL) &&
            !file::ACTIVE_FILESHARES.iter().any(|entry| entry.client_id == id) //DO NOT REKEY ON FILE UPLOAD
        {
            //INFORM CLIENT ABOUT REKEYING
            log::debug!("Rekeying: {peer_addr}");

            let current_keys = keys.clone();
            handshake::key_exchange(streams, &peer_addr, &obfuscation_key, &mut keys, Some(&current_keys)).await; //INIT REKEY
        }

        //THE ROLE IS RE-READ RATHER THAN LATCHED AT LOGIN: /server role APPLIES TO THE SESSION IT LANDS
        //ON, SO A DEMOTION HAS TO REACH THESE CHECKS BEFORE THE NEXT PRIVILEGED PACKET DOES
        let role = CONNECTIONS.get(&peer_addr).and_then(|entry| entry.role().copied()).unwrap_or(role);

        //WHAT ARRIVED, NEVER WHAT WAS IN IT: A CONTROL CODE IS THE SERVER'S OWN VOCABULARY, WHILE THE TEXT,
        //THE FILENAMES AND THE CHANNEL NAMES BESIDE IT ARE WHAT THE USERS TYPED AND ARE NOT LOGGED ANYWHERE
        log::debug!("Packet {}: {peer_addr}", read.name());

        //CLIENT CODES
        match read
        {
            //MESSAGE
            PacketCode::Message { text, colors, .. } =>
            {
                //SILENCE MUTED USERS
                if *CONNECTIONS.get(&peer_addr).unwrap().muted()
                {
                    log::debug!("Message dropped (muted): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::Muted, Some(&keys)).await;
                    continue;
                }

                let text = text.trim().to_owned();

                log::info!("Message ({} chars) in {}: {peer_addr}", text.chars().count(),
                    if channel.is_some() { "channel" } else { "lobby" });

                //KEEP IT - ONLY THE LOBBY HAS A HISTORY, A CHANNEL IS AS TEMPORARY AS THE CLIENTS IN IT
                if channel.is_none() && config::read_config::<bool>("persistent_messages")
                {
                    config::messages::store(&username, &text, &colors);
                }

                //SEND MESSAGE TO ALL USERS
                send_to_all(PacketCode::Message
                {
                    text,
                    username: Some(username.clone()),
                    id: Some(id),
                    colors,
                }, true, channel.as_deref());
            }

            //CLIENT QUITS
            PacketCode::Disconnect =>
            {
                //DISCONNECT CLIENT
                return remove_connection(&peer_addr, true, None).await;
            },

            //VOICE CALL
            PacketCode::Voice { .. } =>
            {
                //CHECK DISABLED FEATURE
                if !options::voice_chat_enabled()
                {
                    log::warn!("Voice refused (disabled): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidFeature, Some(&keys)).await;
                } else if !voice_server::CONNECTIONS.contains_key(&id) //IS NOT USING VOICE
                {
                    log::info!("Voice slot opened: {peer_addr}");

                    //OPEN THE VOICE SLOT AND ACKNOWLEDGE WITH THE TOKEN THAT CLAIMS IT OVER UDP
                    let token = voice_server::open_connection(id, username.clone());
                    network::send(&mut *streams.1.lock().await, PacketCode::Voice { token: Some(token) }, Some(&keys)).await;

                    //SEND CODE TO CHANNEL
                    send_to_all(PacketCode::VoiceJoin { username: username.clone(), id }, true, channel.as_deref());

                    //SEND CONNECTED CLIENTS
                    send_voice_clients(&mut *streams.1.lock().await, &keys, id).await;
                } else //IS USING VOICE
                {
                    log::info!("Voice leave: {peer_addr}");

                    //ACKNOWLEDGE THE LEAVE
                    network::send(&mut *streams.1.lock().await, PacketCode::Voice { token: None }, Some(&keys)).await;

                    //SEND CODE TO LAST CHANNEL
                    send_to_all(PacketCode::VoiceLeave { id }, true, channel.as_deref());

                    //REMOVE FROM VOICE
                    voice_server::remove_connection(&id);
                }
            },

            //SWITCH CHANNEL
            PacketCode::Channel { channel: tchannel } =>
            {
                //CHECK PARAMETER VALIDITY
                if tchannel.iter().all(|s| !s.is_empty() && s.len() <= config::read_config("max_channel_length") && s.chars().all(|c| c.is_ascii_alphanumeric() && c != ' '))
                {
                    //SEND VoiceLeave CODE TO OLD CHANNEL (ONLY IF THERE WAS ANYTHING TO LEAVE)
                    if options::voice_chat_enabled() && voice_server::CONNECTIONS.contains_key(&id)
                    {
                        send_to_all(PacketCode::VoiceLeave { id }, true, channel.as_deref());
                    }

                    //UPDATE CHANNEL
                    update_client_channel(&peer_addr, &tchannel);
                    channel = tchannel.clone();
                    network::send(&mut *streams.1.lock().await, PacketCode::Channel { channel: tchannel }, Some(&keys)).await;

                    //SEND CODE TO CHANNEL
                    if options::voice_chat_enabled() && voice_server::CONNECTIONS.contains_key(&id)
                    {
                        send_to_all(PacketCode::VoiceJoin { username: username.clone(), id }, true, channel.as_deref());
                    }

                    //SEND CONNECTED CLIENTS
                    send_voice_clients(&mut *streams.1.lock().await, &keys, id).await;
                } else //INVALID CHANNEL
                {
                    log::warn!("Channel refused (invalid name): {peer_addr}");

                    //SEND InvalidUsage CODE
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //CLIENT REQUESTED LIST OF ONLINE USERS
            PacketCode::List { .. } =>
            {
                let mut users = Vec::new();

                //ITERATE OVER CONNECTIONS, CREATE JSON OF USERS
                for connection_enum in CONNECTIONS.iter()
                {
                    if let Connection::Authenticated { username: uname, id: user_id, channel, .. } = connection_enum.value()
                    {
                        users.push(OnlineUser
                        {
                            username: uname.clone(),
                            id: *user_id,
                            channel: channel.clone(),
                        });
                    }
                }

                log::debug!("Sending online list ({} users): {peer_addr}", users.len());

                //SEND LIST BACK TO CLIENT
                network::send(&mut *streams.1.lock().await, PacketCode::List { users: Some(users) }, Some(&keys)).await;
            },

            //NEW FILE UPLOAD
            PacketCode::Upload { hash, .. } | PacketCode::Image { hash, .. } =>
            {
                //SILENCE MUTED USERS
                if *CONNECTIONS.get(&peer_addr).unwrap().muted()
                {
                    network::send(&mut *streams.1.lock().await, PacketCode::Muted, Some(&keys)).await;
                    continue;
                }

                let image = matches!(read, PacketCode::Image { .. });

                //AN IMAGE'S LINE NAMES THE SENDER LIKE A MESSAGE DOES, SO IT CARRIES THEIR COLOR
                let username_color = match &read
                {
                    PacketCode::Image { username_color, .. } => *username_color,
                    _ => None,
                };

                //CHECK IF IMAGE WAS ALREADY UPLOADED
                if image && config::messages::has_image(&hash)
                {
                    let filename = match &read
                    {
                        PacketCode::Image { filename, .. } => Path::new(filename)
                            .file_name()
                            .and_then(|f| f.to_str())
                            .unwrap_or("unnamed_file")
                            .to_string(),

                        _ => String::from("unnamed_file"),
                    };

                    //KEEP IT, ON THE SAME TERMS AS AN UPLOAD OF IT WOULD HAVE BEEN
                    if channel.is_none() && config::read_config::<bool>("persistent_messages")
                    {
                        config::messages::store_image(&username, &filename, &hash, username_color);
                    }

                    send_to_all(PacketCode::ImageDisplay
                    {
                        username: username.clone(),
                        filename: filename.clone(),
                        hash,
                        data: None,
                        username_color,
                    }, true, channel.as_deref());

                    //TELL THE UPLOADER THERE IS NOTHING TO SEND
                    network::send(&mut *streams.1.lock().await, PacketCode::Image
                    {
                        hash,
                        filename,
                        token: None,
                        uid: None,
                        username_color,
                    }, Some(&keys)).await;

                    log::info!("Image already stored, upload skipped: {peer_addr}");
                    continue;
                }

                //PREVENT TOKEN SPAM
                let active_count = file::ACTIVE_FILESHARES.iter().filter(|u| u.client_id == id).count();
                if active_count >= config::read_config::<usize>("max_client_parallel_uploads")
                {
                    log::warn!("Upload refused ({active_count} already running): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::UploadLimit, Some(&keys)).await;
                    continue;
                }

                //GENERATE RANDOM UID
                let uid = rand::random::<u64>();
                let token = open_connection(id, if image
                {
                    ConnectionType::Image { uid, username_color }
                } else
                {
                    ConnectionType::FileUpload { uid }
                });

                //LOG FILE UPLOAD
                log::info!("Upload request ({}): {peer_addr}", if image { "image" } else { "file" });

                let packet = if image
                {
                    PacketCode::Image
                    {
                        hash,
                        filename: String::new(), //THE UPLOAD'S OWN METADATA CARRIES IT FROM HERE
                        token: Some(token),
                        uid: Some(uid),
                        username_color,
                    }
                } else
                {
                    PacketCode::Upload
                    {
                        hash,
                        token: Some(token),
                        uid: Some(uid),
                    }
                };

                //SEND APPROVAL TO CLIENT
                network::send(&mut *streams.1.lock().await, packet, Some(&keys)).await;
            },

            //DOWNLOAD
            PacketCode::Download { id: owner_id, file_id, .. } =>
            {
                //FIND USERNAME BY ID
                let username = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == owner_id.as_ref())
                    .and_then(|entry| entry.value().username().cloned());

                //GET USER UPLOADS
                if let Some(username) = username &&
                    let Some(file_id) = file_id &&
                    let Some(file) = AVAILABLE_FILES.get(&username).and_then(|f| f.value().get(file_id).cloned())
                {
                    //GENERATE RANDOM SHARE UID
                    let uid = rand::random::<u64>();

                    let file_size = file.size;

                    //OPEN NEW CONNECTION
                    let token = open_connection(id, ConnectionType::FileDownload { uid, file });

                    network::send(&mut *streams.1.lock().await, PacketCode::Download
                    {
                        token: Some(token),
                        file_id: None,
                        id: None,
                    }, Some(&keys)).await;

                    //LOG START
                    log::info!("Download request ({} bytes): {peer_addr}", file_size);
                } else
                {
                    log::warn!("Download refused (unknown file): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //SCREEN SHARE
            PacketCode::Screen { .. } =>
            {
                //CHECK FOR DISABLING SCREEN SHARE
                if let Some((Some(removed_id), Some(username))) = CONNECTIONS.get_mut(&peer_addr)
                    .and_then(|mut conn| Some((conn.remove_screen_stream(), conn.username().cloned())))
                {
                    //DEATTACH ALL CLIENTS
                    deattach(removed_id, &username).await;

                    log::info!("Screen share stopped: {peer_addr}");

                    //SEND SCREEN DISABLE NOTIFICATION
                    network::send(&mut *streams.1.lock().await, PacketCode::Screen { token: None }, Some(&keys)).await;

                    //NOTIFY USERS ABOUT SCREEN
                    send_to_all(PacketCode::ScreenshareEnd { username: username.clone() }, false, None);

                    continue;
                }

                //CHECK FOR ENABLED SCREENSHARE
                if config::read_config("enable_screenshare")
                {
                    //SEND SCREEN ACCEPT
                    network::send(&mut *streams.1.lock().await, PacketCode::Screen
                    {
                        token: Some(open_connection(id, ConnectionType::Screen))
                    }, Some(&keys)).await;

                    //NOTIFY USERS ABOUT SCREEN
                    send_to_all(PacketCode::Screenshare { username: username.clone() }, false, None);

                    //LOG START
                    log::info!("Screen share: {peer_addr}");
                } else
                {
                    log::warn!("Screen share refused (disabled): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidFeature, Some(&keys)).await;
                }
            },

            //SCREENSHARE ATTACH
            PacketCode::Attach { id: sharer_id, .. } =>
            {
                //FIND SHARER ADDRESS BY ID
                let sharer_info = sharer_id.and_then(|sid|
                {
                    CONNECTIONS.iter().find(|entry| entry.value().id() == Some(&sid) && entry.screen_stream().is_some())
                        .and_then(|conn| conn.username().map(|u| (sid, u.to_owned())))
                });

                if let Some((sharer_id, sharer_username)) = sharer_info &&
                    CONNECTIONS.get(&peer_addr).is_some_and(|c| c.attached_screen().as_ref()
                        .is_none_or(|s| s.target_id != sharer_id)) //PROHIBIT ATTACHING THE SAME SCREEN TWICE
                { //VALID SHARER FOUND
                    //OPEN NEW CONNECTION
                    let token = open_connection(id, ConnectionType::Attach
                    {
                        id: sharer_id,
                    });

                    //SEND ACCEPT
                    network::send(&mut *streams.1.lock().await, PacketCode::Attach
                    {
                        id: None,
                        username: Some(sharer_username.to_owned()),
                        token: Some(token),
                    }, Some(&keys)).await;

                    //TELL THE SHARER WHO IS WATCHING
                    notify(sharer_id, PacketCode::Attached
                    {
                        username: username.clone(),
                    }).await;

                    //LOG START
                    log::info!("Screen attach: {peer_addr} watching {}", log_addr(&sharer_id));
                } else
                {
                    log::warn!("Screen attach refused (no such share): {peer_addr}");

                    //INVALID ARGS
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //SCREENSHARE DEATTACH
            PacketCode::Deattach { .. } =>
            {
                //DEATTACH
                if let Some(sharer_id) = if let Some(mut conn) = CONNECTIONS.get_mut(&peer_addr)
                {
                    if let Some(target_id) = conn.attached_screen().as_ref().map(|a| a.target_id)
                    {
                        conn.deattach_screen();
                        Some(target_id)
                    } else { None }
                } else { None }
                {
                    //FIND SHARER USERNAME
                    let sharer_uname = CONNECTIONS.iter()
                        .find(|c| c.value().id() == Some(&sharer_id))
                        .and_then(|c| c.value().username().cloned());

                    //SEND ACCEPT
                    network::send(&mut *streams.1.lock().await, PacketCode::Deattach { username: sharer_uname }, Some(&keys)).await;

                    //TELL THE SHARER WHO STOPPED WATCHING
                    notify(sharer_id, PacketCode::Deattached
                    {
                        username: username.clone(),
                    }).await;
                } else
                {
                    log::warn!("Deattach refused (not attached): {peer_addr}");

                    //NOT ATTACHED
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //LIST FILES
            PacketCode::Files { .. } =>
            {
                //GET ALL UPLOADS
                let mut users = Vec::new();
                for entry in AVAILABLE_FILES.iter()
                {
                    //GET VALUES
                    let username = entry.key();
                    let uploads = entry.value();

                    if !uploads.is_empty() //DO NOT ADD USERS WITH NO UPLOADS
                    {
                        //GET ID TO THE USERNAME
                        let id = CONNECTIONS.iter()
                            .find(|c| c.username() == Some(&username))
                            .and_then(|c| c.id().copied()).unwrap();

                        //GET USER'S UPLOADS
                        let upload: Vec<(String, usize)> = uploads.iter().enumerate()
                            .map(|(idx, u)| (u.filename.clone(), idx)).collect();

                        //ADD TO LIST
                        users.push(UserFile
                        {
                            username: username.to_string(),
                            id,
                            upload,
                        });
                    }
                }

                log::debug!("Sending file list ({} users): {peer_addr}", users.len());

                //SEND LIST BACK TO CLIENT
                network::send(&mut *streams.1.lock().await, PacketCode::Files { users: Some(users) }, Some(&keys)).await;
            },

            //ONE OF THE HISTORY'S PICTURES, ASKED FOR BY A CLIENT THAT WAS SHOWN ITS CAPTION. THE HISTORY
            //IS THE GUARD: A HASH IT DOES NOT NAME IS NOT SERVED, SO NOTHING ELSE IN server_images/ IS REACHABLE
            PacketCode::ImageData { hash, .. } =>
            {
                //CHEAP TO ASK FOR, EXPENSIVE TO ANSWER - SO ONE CLIENT IS HELD TO ONE PER
                //IMAGE_REQUEST_DELAY, SERVED LATE RATHER THAN REFUSED (THE CLIENT NEVER RETRIES)
                let wait = CONNECTIONS.get(&peer_addr)
                    .and_then(|conn| conn.last_image().map(|last| consts::IMAGE_REQUEST_DELAY
                        .saturating_sub(last.elapsed())))
                    .unwrap_or_default(); //GUARD DROPPED HERE - NEVER HELD ACROSS THE SLEEP

                if !wait.is_zero()
                {
                    log::debug!("Image fetch held for {}ms: {peer_addr}", wait.as_millis());
                    time::sleep(wait).await;
                }

                if let Some(mut conn) = CONNECTIONS.get_mut(&peer_addr)
                    && let Some(last) = conn.last_image_mut() { *last = Instant::now(); }

                let image = match config::messages::has_image(&hash)
                {
                    true => file::read_image(&hash).await,
                    false => None,
                };

                match image.as_ref()
                {
                    Some(data) => log::info!("Image fetch served ({} bytes): {peer_addr}", data.len()),
                    None => log::warn!("Image fetch refused (not in history): {peer_addr}"),
                }

                network::send(&mut *streams.1.lock().await, PacketCode::ImageData { hash, data: image }, Some(&keys)).await;
            },

            //LIST SCREENSHARES
            PacketCode::Screens { .. } =>
            {
                let mut users = Vec::new();

                //ITERATE OVER CONNECTIONS, CREATE JSON OF USERS
                for connection_enum in CONNECTIONS.iter()
                {
                    if let Connection::Authenticated { username: uname, id: user_id, screen_stream, .. } = connection_enum.value()
                    {
                        if screen_stream.is_none() { continue; }

                        users.push(UserScreen
                        {
                            username: uname.clone(),
                            id: *user_id,
                        });
                    }
                }

                log::debug!("Sending screenshare list ({} users): {peer_addr}", users.len());

                //SEND LIST BACK TO CLIENT
                network::send(&mut *streams.1.lock().await, PacketCode::Screens { users: Some(users) }, Some(&keys)).await;
            },

            //PRIVATE MESSAGE
            PacketCode::PrivateMessage { text, id: recipient_id, .. } =>
            {
                //SILENCE MUTED USERS
                if *CONNECTIONS.get(&peer_addr).unwrap().muted()
                {
                    network::send(&mut *streams.1.lock().await, PacketCode::Muted, Some(&keys)).await;
                    continue;
                }

                //FIND RECIPIENT BY ID
                let recipient_addr = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == Some(&recipient_id))
                    .map(|entry| *entry.key());

                if let Some(recipient_addr) = recipient_addr
                {
                    log::info!("Private message ({} chars): {peer_addr} -> {recipient_addr}", text.chars().count());

                    //SEND TO RECIPIENT (IF NOT SELF-MESSAGE)
                    if recipient_id != id
                    {
                        let recipient_data = if let Some(recipient) =
                            CONNECTIONS.get(&recipient_addr)
                        {
                            Some((recipient.write_stream().clone(), recipient.keys().cloned()))
                        } else
                        {
                            None
                        };

                        //SEND
                        if let Some((recipient_stream, recipient_keys)) = recipient_data
                        {
                            network::send(&mut *recipient_stream.lock().await, PacketCode::PrivateMessage
                            {
                                text: text.clone(),
                                username: Some(username.clone()),
                                id,
                            }, recipient_keys.as_ref()).await;
                        }
                    }

                    //SEND CONFIRMATION BACK TO SENDER
                    let recipient_uname = CONNECTIONS.get(&recipient_addr).and_then(|e| e.username().cloned()).unwrap();
                    network::send(&mut *streams.1.lock().await, PacketCode::PrivateMessageBack
                    {
                        text,
                        id: recipient_id,
                        username: recipient_uname,
                    }, Some(&keys)).await;
                } else
                {
                    log::warn!("Private message refused (no such recipient): {peer_addr}");

                    //INVALID PM FORMAT
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //MUTE USER
            PacketCode::ServerMute { id } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Moderator
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //FIND TARGET USER
                let muted = if let Some(mut conn) = CONNECTIONS.iter_mut()
                    .find(|entry| entry.value().id() == Some(&id)) && conn.role() < Some(&role)
                {
                    //TOGGLE MUTE
                    conn.toggle_mute();

                    Some((*conn.peer_addr(), *conn.muted()))
                } else { None }; //USER NOT FOUND

                match muted
                {
                    //THE GUARD IS DROPPED BEFORE THE SEND BELOW, AND BEFORE THIS LINE
                    Some((target, muted)) => log::info!("{} by {peer_addr}: {target}",
                        if muted { "Mute" } else { "Unmute" }),

                    None =>
                    {
                        log::warn!("Mute refused (no such user, or a peer): {peer_addr}");

                        network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    }
                }
            },

            //KICK USER
            PacketCode::ServerKick { id } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Moderator
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //FIND TARGET USER
                let target = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == Some(&id))
                    .map(|entry| (*entry.key(), entry.role().cloned()));

                if let Some((addr, Some(trole))) = target && trole < role
                {
                    log::info!("Kick by {peer_addr}: {addr}");

                    //KICK
                    remove_connection(&addr, true, Some("kick")).await;
                } else //USER NOT FOUND
                {
                    log::warn!("Kick refused (no such user, or a peer): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //BAN USER
            PacketCode::ServerBan { id: uid } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner || id == uid
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //FIND TARGET USER
                let target = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == Some(&uid))
                    .map(|entry| (*entry.key(), entry.username().cloned()));

                if let Some((addr, Some(username))) = target
                {
                    log::info!("Ban by {peer_addr}: {addr}");

                    config::bans::ban(&username);
                    remove_connection(&addr, true, Some("ban")).await;
                } else //USER NOT FOUND
                {
                    log::warn!("Ban refused (no such user): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //BAN USER'S IP
            PacketCode::ServerBanIp { id: uid } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner || id == uid
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //FIND TARGET USER
                let target = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == Some(&uid))
                    .map(|entry| *entry.key());

                if let Some(addr) = target
                {
                    log::info!("IP ban by {peer_addr}: {}", addr.ip());

                    config::bans::ban_ip(&addr.ip());
                    remove_connections(&addr.ip(), true, Some("ip ban")).await;
                } else //USER NOT FOUND
                {
                    log::warn!("IP ban refused (no such user): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //BAN LIST
            PacketCode::ServerBans { .. } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                send_bans(&streams.1, &keys).await;
            },

            //LIFT A USERNAME BAN
            PacketCode::ServerPardon { id: ban } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                if config::bans::pardon(ban)
                {
                    log::info!("Pardon by {peer_addr}");

                    send_bans(&streams.1, &keys).await;
                } else
                {
                    log::warn!("Pardon refused (no such ban): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //LIFT AN IP BAN
            PacketCode::ServerPardonIp { id: ban } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                if config::bans::pardon_ip(ban)
                {
                    log::info!("IP pardon by {peer_addr}");

                    send_bans(&streams.1, &keys).await;
                } else
                {
                    log::warn!("IP pardon refused (no such ban): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                }
            },

            //SAY AS SERVER
            PacketCode::ServerSay { message } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                log::info!("Server announcement ({} chars) by {peer_addr}", message.chars().count());

                //SEND BACK TO ALL CLIENTS ACROSS ALL CHANNELS
                send_to_all(PacketCode::ServerSay { message }, false, None);
            },

            //SET A USER'S ROLE
            PacketCode::ServerRole { id: uid, role: new_role, .. } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner || id == uid || new_role > role
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //FIND TARGET USER
                let target = CONNECTIONS.iter()
                    .find(|entry| entry.value().id() == Some(&uid))
                    .map(|entry| (entry.username().cloned(), entry.role().copied()));

                //CHECK FOR VALID TARGET
                let Some((Some(target_username), Some(target_role))) = target else
                {
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                };

                //A PEER OR A SUPERIOR CANNOT BE AFFECTED
                if target_role >= role || target_role == new_role
                {
                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                log::info!("Role change by {peer_addr}: {} is now {new_role} (was {target_role})", log_addr(&uid));

                //STORE
                users::set_role(&target_username, new_role);

                //APPLY TO WHATEVER SESSIONS USER HAS OPENED
                let sessions: Vec<(usize, Arc<Mutex<OwnedWriteHalf>>, SharedKeys)> =
                {
                    let mut sessions = Vec::new();

                    for mut entry in CONNECTIONS.iter_mut()
                        .filter(|entry| entry.username() == Some(&target_username) && entry.role().is_some())
                    {
                        entry.set_role(new_role);

                        sessions.push((entry.id().copied().unwrap(), entry.write_stream().clone(), entry.keys().cloned().unwrap()));
                    }

                    sessions
                };

                //TELL THE TARGET
                for (sid, write_stream, target_keys) in sessions
                {
                    network::send(&mut *write_stream.lock().await, PacketCode::ServerRole
                    {
                        id: sid,
                        role: new_role,
                        username: None,
                    }, Some(&target_keys)).await;
                }

                //TELL THE ISSUER
                network::send(&mut *streams.1.lock().await, PacketCode::ServerRole
                {
                    id: uid,
                    role: new_role,
                    username: Some(target_username),
                }, Some(&keys)).await;
            },

            //SERVER CONFIGURATION
            PacketCode::ServerSettings { settings, save } =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                //A SAVE WITHOUT ROWS IS NOT A SAVE, AND A READ IGNORES WHATEVER IT WAS SENT WITH
                if save && let Some(settings) = &settings
                {
                    let accepted = config::settings::write(settings);

                    log::info!("Server settings saved by {peer_addr}: {accepted}/{} rows accepted", settings.len());
                } else if !save
                {
                    log::info!("Server settings read by {peer_addr}");
                }

                network::send(&mut *streams.1.lock().await, PacketCode::ServerSettings
                {
                    settings: Some(config::settings::all()),
                    save,
                }, Some(&keys)).await;
            },

            //SERVER RESTART
            PacketCode::ServerRestart =>
            {
                //VERIFY PERMISSIONS
                if role < Role::Owner
                {
                    log::warn!("Refused (permissions): {peer_addr}");

                    network::send(&mut *streams.1.lock().await, PacketCode::InvalidUsage, Some(&keys)).await;
                    continue;
                }

                log::info!("Restart requested by {peer_addr}");

                //IN A TASK OF ITS OWN, BECAUSE disconnect_all ABORTS THIS ONE
                tokio::spawn(async
                {
                    //EVERYONE IS SENT OFF FIRST, SO A CLIENT READS A DISCONNECT RATHER THAN A DEAD SOCKET
                    disconnect_all().await;

                    misc::restart();
                });
            },

            //KEEPALIVE
            PacketCode::KeepAlive =>
            {
                //SET TO ALIVE
                if let Some(mut conn) = CONNECTIONS.get_mut(&peer_addr)
                {
                    conn.set_alive(true);
                }
            },

            _ => {}
        }
    }
}

pub async fn disconnect_all() //DISCONNECT ALL CLIENTS
{
    //ITERATE OVER ALL ADDRESSES, REMOVE CONNECTIONS
    let addrs: Vec<SocketAddr> = CONNECTIONS.iter().map(|conn| *conn.peer_addr()).collect();

    log::info!("Disconnecting {} connections", addrs.len());
    for addr in &addrs
    {
        remove_connection(addr, true, None).await; //REMOVE GRACEFULLY
    }
}

pub async fn disconnect_inactive() //DISCONNECT ALL INACTIVE CLIENTS
{
    let now = Instant::now();

    //COLLECT ADDRESSES OF INACTIVE CONNECTIONS
    let inactive_addrs: Vec<SocketAddr> = CONNECTIONS.iter()
        .filter(|conn| conn.is_inactive(Some(now)))
        .map(|conn| *conn.peer_addr())
        .collect();

    if !inactive_addrs.is_empty() { log::debug!("Disconnecting {} inactive connections", inactive_addrs.len()); }

    //DISCONNECT INACTIVE CLIENTS
    for addr in &inactive_addrs
    {
        remove_connection(addr, true, Some("inactive")).await;
    }
}

pub async fn send_keepalive() //SEND KEEPALIVE PACKET TO ALL CLIENTS
{
    //COLLECT ALL CLIENT ADDRESSES
    let addresses: Vec<SocketAddr> = CONNECTIONS.iter()
        .filter(|entry| entry.is_authenticated())
        .map(|entry| *entry.key())
        .collect();

    let mut dead_clients = Vec::new();

    //PREPARE
    for addr in addresses
    {
        let mut stream = None;
        let mut keys = None;

        if let Some(mut conn) = CONNECTIONS.get_mut(&addr)
        {
            //COLLECT DEAD BODIES
            if !conn.is_alive()
            {
                dead_clients.push(addr);
                continue;
            }

            //COPY STREAM & KEYS
            stream = Some(conn.write_stream().clone());
            keys = conn.keys().cloned();

            //PRONOUNCE DEAD UNTIL ECHO
            conn.set_alive(false);
        }

        //SEND KEEPALIVES
        if let Some(stream) = stream
        {
            network::send(&mut *stream.lock().await, PacketCode::KeepAlive, keys.as_ref()).await;
        }
    }

    //DISCONENCT DEAD CONNECTIONS
    for dead in dead_clients
    {
        //HAIL SATAN, AVE CLIENT
        log::warn!("Missed keepalive: {dead}");

        remove_connection(&dead, false, Some("dead")).await;
    }
}