Where a Conduit database kept its original media files: on the local
filesystem (the default), or in an object store named by
conduit_source_media_provider for a Conduit that backed its media with S3.
Attempts to read each original from a source storage provider before the
import gives up: one initial try plus one retry. The object store performs
its own internal retries under each attempt, so a transient provider blip
rarely reaches this outer limit.
Whether a Conduit media entry was blocked by a moderator. Conduit keeps the
file and refuses it only at read time (blocked_servername_mediaid);
tuwunel has no per-media blocklist, so importing a blocked original would
serve it again. The blocklist key is server_name 0xff media_id, the same
bytes as the servernamemediaid_metadata key, so the entry’s raw key probes
it directly. Only a clean miss imports; a hard read error aborts the import
(like an unreachable source) rather than silently re-serving blocked media.
The object-store key of a Conduit content-addressed media object, the same
shard segments as conduit_media_path joined by /. The source provider’s
base_path supplies any bucket prefix (Conduit’s media.path).
Reconstructs the on-disk path of a Conduit content-addressed media file from
the lowercase SHA-256 hex digest naming it, matching Conduit’s
split_media_path: media_dir joined with the digest’s shard segments.
Splits a lowercase SHA-256 hex digest into Conduit’s shard segments: depth
segments of length characters then the remainder, or the whole digest when
depth is zero (a flat layout). config::check bounds depth * length
below the digest length so the segments never overrun it.
Imports one servernamemediaid_metadata entry, returning whether an
original was imported (false = skipped). The skip/abort contract is
decided in read_conduit_original.
Injects room_id into one PDU value that lacks it, sourcing the room from
resolve. Returns whether the value was rewritten; false means it already
carried a room_id. A cheap HasRoomId probe short-circuits that common
case, so only the rewritten PDUs pay the full parse and re-serialize.
Whether a provider read failed because the object is absent (a 404 or a
dangling metadata row), which is skipped rather than retried. tuwunel’s
Error::is_not_found does not cover the object-store variant, so match it
directly.
Resolves the configured Conduit media source. A named provider must already
be defined under [storage_provider]; its absence is an operator error that
aborts the import rather than silently dropping every file.
Splits Conduit’s conflated highlight-count column. Conduit opens
roomuserid_lastnotificationread against the userroomid_highlightcount
tree (a copy-paste in its schema), so one column holds both stores:
highlight counts keyed user_id 0xff room_id and last-notification-read
tokens keyed room_id 0xff user_id. tuwunel keeps the two in separate
columns with those same byte layouts, so every room-keyed (last-read) row
moves verbatim into roomuserid_lastnotificationread, leaving the
user-keyed highlight rows in place. The orderings never collide: a user id
leads with @, a room id with !. Absent any room-keyed row the column is
not aliased, so this returns early and is safe to run on a native database.
Imports Conduit’s pending knocks. Conduit names the columns
roomuserid_knockcount / userroomid_knockstate; tuwunel renamed them to
*knocked* but kept the byte layout (room_id 0xff user_id -> u64 count;
user_id 0xff room_id -> JSON stripped state), so each row copies verbatim.
Imported once: tuwunel clears a knock on the user’s join or leave, so a
re-import would resurrect a knock the user has already resolved.
Imports the original media files of a Conduit database, re-uploading each
servernamemediaid_metadata entry through media.create. A malformed entry
or a missing source file is logged and skipped, but a source storage
provider that stays unreachable aborts the import: nothing is committed in a
way that needs cleanup, so the operator can fix the provider and restart to
resume from the beginning (re-importing an already-copied original is
idempotent).
Injects room_id into stored PDUs that lack it. Runs once on every database
(marker-gated by the caller); a native tuwunel DB always serializes the
field, so it no-ops there. Only a room v12 (hydra) create event imported
from Conduit omits it, deriving its room from the event’s own id per
MSC4291. Scans the pduid_pdu timeline (room from the key’s leading short
room id) and eventid_outlierpdu (room from the create event’s own id, the
outlier key).
The room of an eventid_outlierpdu entry that lacks room_id. Only a v12
create event omits it, and its room id derives from the create event’s own
id, which is this outlier’s key.
Splits a servernamemediaid_metadata value into its digest, filename, and
content type. The value is sha256(32) | filename | 0xff | content_type
with an optional trailing 0xff that Conduit’s media-auth migration appends
to flag unauthenticated access; that flag is ignored.
Reads one Conduit original, named by its content digest, from the configured
media source. A filesystem file that cannot be read is reported as None
(skipped, like a dangling metadata row). A source storage provider is
retried on a transient fault; a persistent one returns Err so the import
aborts instead of dropping reachable media.
Reads one original from the source storage provider. An absent object is
skipped (Ok(None)) like a dangling filesystem row; a transient fault is
retried up to PROVIDER_READ_ATTEMPTS times, and a persistent one aborts
the import with an Err.