Separate Python and Rust into python/ and rust/ with per-stack Dockerfiles

rust/myfsio-engine/crates/myfsio-server/src/config.rs

@@ -0,0 +1,203 @@
+use std::net::SocketAddr;
+use std::path::PathBuf;
+
+#[derive(Debug, Clone)]
+pub struct ServerConfig {
+    pub bind_addr: SocketAddr,
+    pub storage_root: PathBuf,
+    pub region: String,
+    pub iam_config_path: PathBuf,
+    pub sigv4_timestamp_tolerance_secs: u64,
+    pub presigned_url_min_expiry: u64,
+    pub presigned_url_max_expiry: u64,
+    pub secret_key: Option<String>,
+    pub encryption_enabled: bool,
+    pub kms_enabled: bool,
+    pub gc_enabled: bool,
+    pub integrity_enabled: bool,
+    pub metrics_enabled: bool,
+    pub lifecycle_enabled: bool,
+    pub website_hosting_enabled: bool,
+    pub replication_connect_timeout_secs: u64,
+    pub replication_read_timeout_secs: u64,
+    pub replication_max_retries: u32,
+    pub replication_streaming_threshold_bytes: u64,
+    pub replication_max_failures_per_bucket: usize,
+    pub site_sync_enabled: bool,
+    pub site_sync_interval_secs: u64,
+    pub site_sync_batch_size: usize,
+    pub site_sync_connect_timeout_secs: u64,
+    pub site_sync_read_timeout_secs: u64,
+    pub site_sync_max_retries: u32,
+    pub site_sync_clock_skew_tolerance: f64,
+    pub ui_enabled: bool,
+    pub templates_dir: PathBuf,
+    pub static_dir: PathBuf,
+}
+
+impl ServerConfig {
+    pub fn from_env() -> Self {
+        let host = std::env::var("HOST").unwrap_or_else(|_| "127.0.0.1".to_string());
+        let port: u16 = std::env::var("PORT")
+            .unwrap_or_else(|_| "5000".to_string())
+            .parse()
+            .unwrap_or(5000);
+        let storage_root = std::env::var("STORAGE_ROOT")
+            .unwrap_or_else(|_| "./data".to_string());
+        let region = std::env::var("AWS_REGION")
+            .unwrap_or_else(|_| "us-east-1".to_string());
+
+        let storage_path = PathBuf::from(&storage_root);
+        let iam_config_path = std::env::var("IAM_CONFIG")
+            .map(PathBuf::from)
+            .unwrap_or_else(|_| {
+                storage_path.join(".myfsio.sys").join("config").join("iam.json")
+            });
+
+        let sigv4_timestamp_tolerance_secs: u64 = std::env::var("SIGV4_TIMESTAMP_TOLERANCE_SECONDS")
+            .unwrap_or_else(|_| "900".to_string())
+            .parse()
+            .unwrap_or(900);
+
+        let presigned_url_min_expiry: u64 = std::env::var("PRESIGNED_URL_MIN_EXPIRY_SECONDS")
+            .unwrap_or_else(|_| "1".to_string())
+            .parse()
+            .unwrap_or(1);
+
+        let presigned_url_max_expiry: u64 = std::env::var("PRESIGNED_URL_MAX_EXPIRY_SECONDS")
+            .unwrap_or_else(|_| "604800".to_string())
+            .parse()
+            .unwrap_or(604800);
+
+        let secret_key = {
+            let env_key = std::env::var("SECRET_KEY").ok();
+            match env_key {
+                Some(k) if !k.is_empty() && k != "dev-secret-key" => Some(k),
+                _ => {
+                    let secret_file = storage_path
+                        .join(".myfsio.sys")
+                        .join("config")
+                        .join(".secret");
+                    std::fs::read_to_string(&secret_file).ok().map(|s| s.trim().to_string())
+                }
+            }
+        };
+
+        let encryption_enabled = std::env::var("ENCRYPTION_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let kms_enabled = std::env::var("KMS_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let gc_enabled = std::env::var("GC_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let integrity_enabled = std::env::var("INTEGRITY_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let metrics_enabled = std::env::var("OPERATION_METRICS_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let lifecycle_enabled = std::env::var("LIFECYCLE_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let website_hosting_enabled = std::env::var("WEBSITE_HOSTING_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+
+        let replication_connect_timeout_secs = parse_u64_env("REPLICATION_CONNECT_TIMEOUT_SECONDS", 5);
+        let replication_read_timeout_secs = parse_u64_env("REPLICATION_READ_TIMEOUT_SECONDS", 30);
+        let replication_max_retries = parse_u64_env("REPLICATION_MAX_RETRIES", 2) as u32;
+        let replication_streaming_threshold_bytes =
+            parse_u64_env("REPLICATION_STREAMING_THRESHOLD_BYTES", 10_485_760);
+        let replication_max_failures_per_bucket =
+            parse_u64_env("REPLICATION_MAX_FAILURES_PER_BUCKET", 50) as usize;
+
+        let site_sync_enabled = std::env::var("SITE_SYNC_ENABLED")
+            .unwrap_or_else(|_| "false".to_string())
+            .to_lowercase() == "true";
+        let site_sync_interval_secs = parse_u64_env("SITE_SYNC_INTERVAL_SECONDS", 60);
+        let site_sync_batch_size = parse_u64_env("SITE_SYNC_BATCH_SIZE", 100) as usize;
+        let site_sync_connect_timeout_secs = parse_u64_env("SITE_SYNC_CONNECT_TIMEOUT_SECONDS", 10);
+        let site_sync_read_timeout_secs = parse_u64_env("SITE_SYNC_READ_TIMEOUT_SECONDS", 120);
+        let site_sync_max_retries = parse_u64_env("SITE_SYNC_MAX_RETRIES", 2) as u32;
+        let site_sync_clock_skew_tolerance: f64 = std::env::var("SITE_SYNC_CLOCK_SKEW_TOLERANCE_SECONDS")
+            .ok()
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(1.0);
+
+        let ui_enabled = std::env::var("UI_ENABLED")
+            .unwrap_or_else(|_| "true".to_string())
+            .to_lowercase() == "true";
+        let templates_dir = std::env::var("TEMPLATES_DIR")
+            .map(PathBuf::from)
+            .unwrap_or_else(|_| default_templates_dir());
+        let static_dir = std::env::var("STATIC_DIR")
+            .map(PathBuf::from)
+            .unwrap_or_else(|_| default_static_dir());
+
+        Self {
+            bind_addr: SocketAddr::new(host.parse().unwrap(), port),
+            storage_root: storage_path,
+            region,
+            iam_config_path,
+            sigv4_timestamp_tolerance_secs,
+            presigned_url_min_expiry,
+            presigned_url_max_expiry,
+            secret_key,
+            encryption_enabled,
+            kms_enabled,
+            gc_enabled,
+            integrity_enabled,
+            metrics_enabled,
+            lifecycle_enabled,
+            website_hosting_enabled,
+            replication_connect_timeout_secs,
+            replication_read_timeout_secs,
+            replication_max_retries,
+            replication_streaming_threshold_bytes,
+            replication_max_failures_per_bucket,
+            site_sync_enabled,
+            site_sync_interval_secs,
+            site_sync_batch_size,
+            site_sync_connect_timeout_secs,
+            site_sync_read_timeout_secs,
+            site_sync_max_retries,
+            site_sync_clock_skew_tolerance,
+            ui_enabled,
+            templates_dir,
+            static_dir,
+        }
+    }
+}
+
+fn default_templates_dir() -> PathBuf {
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    manifest_dir.join("templates")
+}
+
+fn default_static_dir() -> PathBuf {
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    for candidate in [
+        manifest_dir.join("static"),
+        manifest_dir.join("..").join("..").join("..").join("static"),
+    ] {
+        if candidate.exists() {
+            return candidate;
+        }
+    }
+    manifest_dir.join("static")
+}
+
+fn parse_u64_env(key: &str, default: u64) -> u64 {
+    std::env::var(key)
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(default)
+}

rust/myfsio-engine/crates/myfsio-server/src/handlers/admin.rs

@@ -0,0 +1,704 @@
+use axum::body::Body;
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use axum::Extension;
+use myfsio_common::types::Principal;
+use myfsio_storage::traits::StorageEngine;
+
+use crate::services::site_registry::{PeerSite, SiteInfo};
+use crate::services::website_domains::{is_valid_domain, normalize_domain};
+use crate::state::AppState;
+
+fn json_response(status: StatusCode, value: serde_json::Value) -> Response {
+    (
+        status,
+        [("content-type", "application/json")],
+        value.to_string(),
+    )
+        .into_response()
+}
+
+fn json_error(code: &str, message: &str, status: StatusCode) -> Response {
+    json_response(
+        status,
+        serde_json::json!({"error": {"code": code, "message": message}}),
+    )
+}
+
+fn require_admin(principal: &Principal) -> Option<Response> {
+    if !principal.is_admin {
+        return Some(json_error("AccessDenied", "Admin access required", StatusCode::FORBIDDEN));
+    }
+    None
+}
+
+async fn read_json_body(body: Body) -> Option<serde_json::Value> {
+    let bytes = http_body_util::BodyExt::collect(body).await.ok()?.to_bytes();
+    serde_json::from_slice(&bytes).ok()
+}
+
+fn validate_site_id(site_id: &str) -> Option<String> {
+    if site_id.is_empty() || site_id.len() > 63 {
+        return Some("site_id must be 1-63 characters".to_string());
+    }
+    let first = site_id.chars().next().unwrap();
+    if !first.is_ascii_alphanumeric() {
+        return Some("site_id must start with alphanumeric".to_string());
+    }
+    if !site_id.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
+        return Some("site_id must contain only alphanumeric, hyphens, underscores".to_string());
+    }
+    None
+}
+
+fn validate_endpoint(endpoint: &str) -> Option<String> {
+    if !endpoint.starts_with("http://") && !endpoint.starts_with("https://") {
+        return Some("Endpoint must be http or https URL".to_string());
+    }
+    None
+}
+
+fn validate_region(region: &str) -> Option<String> {
+    let re = regex::Regex::new(r"^[a-z]{2,}-[a-z]+-\d+$").unwrap();
+    if !re.is_match(region) {
+        return Some("Region must match format like us-east-1".to_string());
+    }
+    None
+}
+
+fn validate_priority(priority: i64) -> Option<String> {
+    if priority < 0 || priority > 1000 {
+        return Some("Priority must be between 0 and 1000".to_string());
+    }
+    None
+}
+
+pub async fn get_local_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+
+    if let Some(ref registry) = state.site_registry {
+        if let Some(local) = registry.get_local_site() {
+            return json_response(StatusCode::OK, serde_json::to_value(&local).unwrap());
+        }
+    }
+
+    json_error("NotFound", "Local site not configured", StatusCode::NOT_FOUND)
+}
+
+pub async fn update_local_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("InvalidRequest", "Site registry not available", StatusCode::BAD_REQUEST),
+    };
+
+    let payload = match read_json_body(body).await {
+        Some(v) => v,
+        None => return json_error("MalformedJSON", "Invalid JSON body", StatusCode::BAD_REQUEST),
+    };
+
+    let site_id = match payload.get("site_id").and_then(|v| v.as_str()) {
+        Some(s) => s.to_string(),
+        None => return json_error("ValidationError", "site_id is required", StatusCode::BAD_REQUEST),
+    };
+
+    if let Some(err) = validate_site_id(&site_id) {
+        return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+    }
+
+    let endpoint = payload.get("endpoint").and_then(|v| v.as_str()).unwrap_or("").to_string();
+    if !endpoint.is_empty() {
+        if let Some(err) = validate_endpoint(&endpoint) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+
+    if let Some(p) = payload.get("priority").and_then(|v| v.as_i64()) {
+        if let Some(err) = validate_priority(p) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+
+    if let Some(r) = payload.get("region").and_then(|v| v.as_str()) {
+        if let Some(err) = validate_region(r) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+
+    let existing = registry.get_local_site();
+    let site = SiteInfo {
+        site_id: site_id.clone(),
+        endpoint,
+        region: payload.get("region").and_then(|v| v.as_str()).unwrap_or("us-east-1").to_string(),
+        priority: payload.get("priority").and_then(|v| v.as_i64()).unwrap_or(100) as i32,
+        display_name: payload.get("display_name").and_then(|v| v.as_str()).unwrap_or(&site_id).to_string(),
+        created_at: existing.and_then(|e| e.created_at),
+    };
+
+    registry.set_local_site(site.clone());
+    json_response(StatusCode::OK, serde_json::to_value(&site).unwrap())
+}
+
+pub async fn list_all_sites(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_response(StatusCode::OK, serde_json::json!({"local": null, "peers": [], "total_peers": 0})),
+    };
+
+    let local = registry.get_local_site();
+    let peers = registry.list_peers();
+
+    json_response(StatusCode::OK, serde_json::json!({
+        "local": local,
+        "peers": peers,
+        "total_peers": peers.len(),
+    }))
+}
+
+pub async fn register_peer_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("InvalidRequest", "Site registry not available", StatusCode::BAD_REQUEST),
+    };
+
+    let payload = match read_json_body(body).await {
+        Some(v) => v,
+        None => return json_error("MalformedJSON", "Invalid JSON body", StatusCode::BAD_REQUEST),
+    };
+
+    let site_id = match payload.get("site_id").and_then(|v| v.as_str()) {
+        Some(s) => s.to_string(),
+        None => return json_error("ValidationError", "site_id is required", StatusCode::BAD_REQUEST),
+    };
+    if let Some(err) = validate_site_id(&site_id) {
+        return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+    }
+
+    let endpoint = match payload.get("endpoint").and_then(|v| v.as_str()) {
+        Some(e) => e.to_string(),
+        None => return json_error("ValidationError", "endpoint is required", StatusCode::BAD_REQUEST),
+    };
+    if let Some(err) = validate_endpoint(&endpoint) {
+        return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+    }
+
+    let region = payload.get("region").and_then(|v| v.as_str()).unwrap_or("us-east-1").to_string();
+    if let Some(err) = validate_region(&region) {
+        return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+    }
+
+    let priority = payload.get("priority").and_then(|v| v.as_i64()).unwrap_or(100);
+    if let Some(err) = validate_priority(priority) {
+        return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+    }
+
+    if registry.get_peer(&site_id).is_some() {
+        return json_error("AlreadyExists", &format!("Peer site '{}' already exists", site_id), StatusCode::CONFLICT);
+    }
+
+    let peer = PeerSite {
+        site_id: site_id.clone(),
+        endpoint,
+        region,
+        priority: priority as i32,
+        display_name: payload.get("display_name").and_then(|v| v.as_str()).unwrap_or(&site_id).to_string(),
+        connection_id: payload.get("connection_id").and_then(|v| v.as_str()).map(|s| s.to_string()),
+        created_at: Some(chrono::Utc::now().to_rfc3339()),
+        is_healthy: false,
+        last_health_check: None,
+    };
+
+    registry.add_peer(peer.clone());
+    json_response(StatusCode::CREATED, serde_json::to_value(&peer).unwrap())
+}
+
+pub async fn get_peer_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(site_id): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("NotFound", "Site registry not available", StatusCode::NOT_FOUND),
+    };
+
+    match registry.get_peer(&site_id) {
+        Some(peer) => json_response(StatusCode::OK, serde_json::to_value(&peer).unwrap()),
+        None => json_error("NotFound", &format!("Peer site '{}' not found", site_id), StatusCode::NOT_FOUND),
+    }
+}
+
+pub async fn update_peer_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(site_id): Path<String>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("NotFound", "Site registry not available", StatusCode::NOT_FOUND),
+    };
+
+    let existing = match registry.get_peer(&site_id) {
+        Some(p) => p,
+        None => return json_error("NotFound", &format!("Peer site '{}' not found", site_id), StatusCode::NOT_FOUND),
+    };
+
+    let payload = match read_json_body(body).await {
+        Some(v) => v,
+        None => return json_error("MalformedJSON", "Invalid JSON body", StatusCode::BAD_REQUEST),
+    };
+
+    if let Some(ep) = payload.get("endpoint").and_then(|v| v.as_str()) {
+        if let Some(err) = validate_endpoint(ep) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+    if let Some(p) = payload.get("priority").and_then(|v| v.as_i64()) {
+        if let Some(err) = validate_priority(p) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+    if let Some(r) = payload.get("region").and_then(|v| v.as_str()) {
+        if let Some(err) = validate_region(r) {
+            return json_error("ValidationError", &err, StatusCode::BAD_REQUEST);
+        }
+    }
+
+    let peer = PeerSite {
+        site_id: site_id.clone(),
+        endpoint: payload.get("endpoint").and_then(|v| v.as_str()).unwrap_or(&existing.endpoint).to_string(),
+        region: payload.get("region").and_then(|v| v.as_str()).unwrap_or(&existing.region).to_string(),
+        priority: payload.get("priority").and_then(|v| v.as_i64()).unwrap_or(existing.priority as i64) as i32,
+        display_name: payload.get("display_name").and_then(|v| v.as_str()).unwrap_or(&existing.display_name).to_string(),
+        connection_id: payload.get("connection_id").and_then(|v| v.as_str()).map(|s| s.to_string()).or(existing.connection_id),
+        created_at: existing.created_at,
+        is_healthy: existing.is_healthy,
+        last_health_check: existing.last_health_check,
+    };
+
+    registry.update_peer(peer.clone());
+    json_response(StatusCode::OK, serde_json::to_value(&peer).unwrap())
+}
+
+pub async fn delete_peer_site(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(site_id): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("NotFound", "Site registry not available", StatusCode::NOT_FOUND),
+    };
+
+    if !registry.delete_peer(&site_id) {
+        return json_error("NotFound", &format!("Peer site '{}' not found", site_id), StatusCode::NOT_FOUND);
+    }
+    StatusCode::NO_CONTENT.into_response()
+}
+
+pub async fn check_peer_health(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(site_id): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("NotFound", "Site registry not available", StatusCode::NOT_FOUND),
+    };
+
+    if registry.get_peer(&site_id).is_none() {
+        return json_error("NotFound", &format!("Peer site '{}' not found", site_id), StatusCode::NOT_FOUND);
+    }
+
+    json_response(StatusCode::OK, serde_json::json!({
+        "site_id": site_id,
+        "is_healthy": false,
+        "error": "Health check not implemented in standalone mode",
+        "checked_at": chrono::Utc::now().timestamp_millis() as f64 / 1000.0,
+    }))
+}
+
+pub async fn get_topology(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_response(StatusCode::OK, serde_json::json!({"sites": [], "total": 0, "healthy_count": 0})),
+    };
+
+    let local = registry.get_local_site();
+    let peers = registry.list_peers();
+
+    let mut sites: Vec<serde_json::Value> = Vec::new();
+    if let Some(l) = local {
+        let mut v = serde_json::to_value(&l).unwrap();
+        v.as_object_mut().unwrap().insert("is_local".to_string(), serde_json::json!(true));
+        v.as_object_mut().unwrap().insert("is_healthy".to_string(), serde_json::json!(true));
+        sites.push(v);
+    }
+    for p in &peers {
+        let mut v = serde_json::to_value(p).unwrap();
+        v.as_object_mut().unwrap().insert("is_local".to_string(), serde_json::json!(false));
+        sites.push(v);
+    }
+
+    sites.sort_by_key(|s| s.get("priority").and_then(|v| v.as_i64()).unwrap_or(100));
+
+    let healthy_count = sites.iter().filter(|s| s.get("is_healthy").and_then(|v| v.as_bool()).unwrap_or(false)).count();
+
+    json_response(StatusCode::OK, serde_json::json!({
+        "sites": sites,
+        "total": sites.len(),
+        "healthy_count": healthy_count,
+    }))
+}
+
+pub async fn check_bidirectional_status(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(site_id): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let registry = match &state.site_registry {
+        Some(r) => r,
+        None => return json_error("NotFound", "Site registry not available", StatusCode::NOT_FOUND),
+    };
+
+    if registry.get_peer(&site_id).is_none() {
+        return json_error("NotFound", &format!("Peer site '{}' not found", site_id), StatusCode::NOT_FOUND);
+    }
+
+    let local = registry.get_local_site();
+    json_response(StatusCode::OK, serde_json::json!({
+        "site_id": site_id,
+        "local_site_id": local.as_ref().map(|l| &l.site_id),
+        "local_endpoint": local.as_ref().map(|l| &l.endpoint),
+        "local_bidirectional_rules": [],
+        "local_site_sync_enabled": false,
+        "remote_status": null,
+        "issues": [{"code": "NOT_IMPLEMENTED", "message": "Bidirectional status check not implemented in standalone mode", "severity": "warning"}],
+        "is_fully_configured": false,
+    }))
+}
+
+pub async fn iam_list_users(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let users = state.iam.list_users().await;
+    json_response(StatusCode::OK, serde_json::json!({"users": users}))
+}
+
+pub async fn iam_get_user(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(identifier): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.get_user(&identifier).await {
+        Some(user) => json_response(StatusCode::OK, user),
+        None => json_error("NotFound", &format!("User '{}' not found", identifier), StatusCode::NOT_FOUND),
+    }
+}
+
+pub async fn iam_get_user_policies(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(identifier): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.get_user_policies(&identifier) {
+        Some(policies) => json_response(StatusCode::OK, serde_json::json!({"policies": policies})),
+        None => json_error("NotFound", &format!("User '{}' not found", identifier), StatusCode::NOT_FOUND),
+    }
+}
+
+pub async fn iam_create_access_key(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(identifier): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.create_access_key(&identifier) {
+        Ok(result) => json_response(StatusCode::CREATED, result),
+        Err(e) => json_error("InvalidRequest", &e, StatusCode::BAD_REQUEST),
+    }
+}
+
+pub async fn iam_delete_access_key(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path((_identifier, access_key)): Path<(String, String)>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.delete_access_key(&access_key) {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => json_error("InvalidRequest", &e, StatusCode::BAD_REQUEST),
+    }
+}
+
+pub async fn iam_disable_user(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(identifier): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.set_user_enabled(&identifier, false).await {
+        Ok(()) => json_response(StatusCode::OK, serde_json::json!({"status": "disabled"})),
+        Err(e) => json_error("InvalidRequest", &e, StatusCode::BAD_REQUEST),
+    }
+}
+
+pub async fn iam_enable_user(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(identifier): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match state.iam.set_user_enabled(&identifier, true).await {
+        Ok(()) => json_response(StatusCode::OK, serde_json::json!({"status": "enabled"})),
+        Err(e) => json_error("InvalidRequest", &e, StatusCode::BAD_REQUEST),
+    }
+}
+
+pub async fn list_website_domains(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let store = match &state.website_domains {
+        Some(s) => s,
+        None => return json_error("InvalidRequest", "Website hosting is not enabled", StatusCode::BAD_REQUEST),
+    };
+    json_response(StatusCode::OK, serde_json::json!(store.list_all()))
+}
+
+pub async fn create_website_domain(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let store = match &state.website_domains {
+        Some(s) => s,
+        None => return json_error("InvalidRequest", "Website hosting is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let payload = match read_json_body(body).await {
+        Some(v) => v,
+        None => return json_error("MalformedJSON", "Invalid JSON body", StatusCode::BAD_REQUEST),
+    };
+
+    let domain = normalize_domain(payload.get("domain").and_then(|v| v.as_str()).unwrap_or(""));
+    if domain.is_empty() {
+        return json_error("ValidationError", "domain is required", StatusCode::BAD_REQUEST);
+    }
+    if !is_valid_domain(&domain) {
+        return json_error("ValidationError", &format!("Invalid domain: '{}'", domain), StatusCode::BAD_REQUEST);
+    }
+
+    let bucket = payload.get("bucket").and_then(|v| v.as_str()).unwrap_or("").trim().to_string();
+    if bucket.is_empty() {
+        return json_error("ValidationError", "bucket is required", StatusCode::BAD_REQUEST);
+    }
+
+    match state.storage.bucket_exists(&bucket).await {
+        Ok(true) => {}
+        _ => return json_error("NoSuchBucket", &format!("Bucket '{}' does not exist", bucket), StatusCode::NOT_FOUND),
+    }
+
+    if store.get_bucket(&domain).is_some() {
+        return json_error("Conflict", &format!("Domain '{}' is already mapped", domain), StatusCode::CONFLICT);
+    }
+
+    store.set_mapping(&domain, &bucket);
+    json_response(StatusCode::CREATED, serde_json::json!({"domain": domain, "bucket": bucket}))
+}
+
+pub async fn get_website_domain(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(domain): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let store = match &state.website_domains {
+        Some(s) => s,
+        None => return json_error("InvalidRequest", "Website hosting is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let domain = normalize_domain(&domain);
+    match store.get_bucket(&domain) {
+        Some(bucket) => json_response(StatusCode::OK, serde_json::json!({"domain": domain, "bucket": bucket})),
+        None => json_error("NotFound", &format!("No mapping found for domain '{}'", domain), StatusCode::NOT_FOUND),
+    }
+}
+
+pub async fn update_website_domain(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(domain): Path<String>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let store = match &state.website_domains {
+        Some(s) => s,
+        None => return json_error("InvalidRequest", "Website hosting is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let domain = normalize_domain(&domain);
+    let payload = match read_json_body(body).await {
+        Some(v) => v,
+        None => return json_error("MalformedJSON", "Invalid JSON body", StatusCode::BAD_REQUEST),
+    };
+
+    let bucket = payload.get("bucket").and_then(|v| v.as_str()).unwrap_or("").trim().to_string();
+    if bucket.is_empty() {
+        return json_error("ValidationError", "bucket is required", StatusCode::BAD_REQUEST);
+    }
+
+    match state.storage.bucket_exists(&bucket).await {
+        Ok(true) => {}
+        _ => return json_error("NoSuchBucket", &format!("Bucket '{}' does not exist", bucket), StatusCode::NOT_FOUND),
+    }
+
+    if store.get_bucket(&domain).is_none() {
+        return json_error("NotFound", &format!("No mapping found for domain '{}'", domain), StatusCode::NOT_FOUND);
+    }
+
+    store.set_mapping(&domain, &bucket);
+    json_response(StatusCode::OK, serde_json::json!({"domain": domain, "bucket": bucket}))
+}
+
+pub async fn delete_website_domain(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(domain): Path<String>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let store = match &state.website_domains {
+        Some(s) => s,
+        None => return json_error("InvalidRequest", "Website hosting is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let domain = normalize_domain(&domain);
+    if !store.delete_mapping(&domain) {
+        return json_error("NotFound", &format!("No mapping found for domain '{}'", domain), StatusCode::NOT_FOUND);
+    }
+    StatusCode::NO_CONTENT.into_response()
+}
+
+#[derive(serde::Deserialize, Default)]
+pub struct PaginationQuery {
+    pub limit: Option<usize>,
+    pub offset: Option<usize>,
+}
+
+pub async fn gc_status(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match &state.gc {
+        Some(gc) => json_response(StatusCode::OK, gc.status().await),
+        None => json_response(StatusCode::OK, serde_json::json!({"enabled": false, "message": "GC is not enabled. Set GC_ENABLED=true to enable."})),
+    }
+}
+
+pub async fn gc_run(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let gc = match &state.gc {
+        Some(gc) => gc,
+        None => return json_error("InvalidRequest", "GC is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let payload = read_json_body(body).await.unwrap_or(serde_json::json!({}));
+    let dry_run = payload.get("dry_run").and_then(|v| v.as_bool()).unwrap_or(false);
+
+    match gc.run_now(dry_run).await {
+        Ok(result) => json_response(StatusCode::OK, result),
+        Err(e) => json_error("Conflict", &e, StatusCode::CONFLICT),
+    }
+}
+
+pub async fn gc_history(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match &state.gc {
+        Some(gc) => json_response(StatusCode::OK, serde_json::json!({"executions": gc.history().await})),
+        None => json_response(StatusCode::OK, serde_json::json!({"executions": []})),
+    }
+}
+
+pub async fn integrity_status(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match &state.integrity {
+        Some(checker) => json_response(StatusCode::OK, checker.status().await),
+        None => json_response(StatusCode::OK, serde_json::json!({"enabled": false, "message": "Integrity checker is not enabled. Set INTEGRITY_ENABLED=true to enable."})),
+    }
+}
+
+pub async fn integrity_run(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    body: Body,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    let checker = match &state.integrity {
+        Some(c) => c,
+        None => return json_error("InvalidRequest", "Integrity checker is not enabled", StatusCode::BAD_REQUEST),
+    };
+
+    let payload = read_json_body(body).await.unwrap_or(serde_json::json!({}));
+    let dry_run = payload.get("dry_run").and_then(|v| v.as_bool()).unwrap_or(false);
+    let auto_heal = payload.get("auto_heal").and_then(|v| v.as_bool()).unwrap_or(false);
+
+    match checker.run_now(dry_run, auto_heal).await {
+        Ok(result) => json_response(StatusCode::OK, result),
+        Err(e) => json_error("Conflict", &e, StatusCode::CONFLICT),
+    }
+}
+
+pub async fn integrity_history(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+) -> Response {
+    if let Some(err) = require_admin(&principal) { return err; }
+    match &state.integrity {
+        Some(checker) => json_response(StatusCode::OK, serde_json::json!({"executions": checker.history().await})),
+        None => json_response(StatusCode::OK, serde_json::json!({"executions": []})),
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/handlers/chunked.rs

@@ -0,0 +1,182 @@
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use bytes::{Buf, BytesMut};
+use tokio::io::{AsyncRead, ReadBuf};
+
+enum State {
+    ReadSize,
+    ReadData(u64),
+    ReadTrailer,
+    Finished,
+}
+
+pub struct AwsChunkedStream<S> {
+    inner: S,
+    buffer: BytesMut,
+    state: State,
+    pending: BytesMut,
+    eof: bool,
+}
+
+impl<S> AwsChunkedStream<S> {
+    pub fn new(inner: S) -> Self {
+        Self {
+            inner,
+            buffer: BytesMut::with_capacity(8192),
+            state: State::ReadSize,
+            pending: BytesMut::new(),
+            eof: false,
+        }
+    }
+
+    fn find_crlf(&self) -> Option<usize> {
+        for i in 0..self.buffer.len().saturating_sub(1) {
+            if self.buffer[i] == b'\r' && self.buffer[i + 1] == b'\n' {
+                return Some(i);
+            }
+        }
+        None
+    }
+
+    fn parse_chunk_size(line: &[u8]) -> std::io::Result<u64> {
+        let text = std::str::from_utf8(line).map_err(|_| {
+            std::io::Error::new(std::io::ErrorKind::InvalidData, "invalid chunk size encoding")
+        })?;
+        let head = text.split(';').next().unwrap_or("").trim();
+        u64::from_str_radix(head, 16).map_err(|_| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid chunk size: {}", head),
+            )
+        })
+    }
+
+    fn try_advance(&mut self, out: &mut ReadBuf<'_>) -> std::io::Result<bool> {
+        loop {
+            if out.remaining() == 0 {
+                return Ok(true);
+            }
+
+            if !self.pending.is_empty() {
+                let take = std::cmp::min(self.pending.len(), out.remaining());
+                out.put_slice(&self.pending[..take]);
+                self.pending.advance(take);
+                continue;
+            }
+
+            match self.state {
+                State::Finished => return Ok(true),
+                State::ReadSize => {
+                    let idx = match self.find_crlf() {
+                        Some(i) => i,
+                        None => return Ok(false),
+                    };
+                    let line = self.buffer.split_to(idx);
+                    self.buffer.advance(2);
+                    let size = Self::parse_chunk_size(&line)?;
+                    if size == 0 {
+                        self.state = State::ReadTrailer;
+                    } else {
+                        self.state = State::ReadData(size);
+                    }
+                }
+                State::ReadData(remaining) => {
+                    if self.buffer.is_empty() {
+                        return Ok(false);
+                    }
+                    let avail = std::cmp::min(self.buffer.len() as u64, remaining) as usize;
+                    let take = std::cmp::min(avail, out.remaining());
+                    out.put_slice(&self.buffer[..take]);
+                    self.buffer.advance(take);
+                    let new_remaining = remaining - take as u64;
+                    if new_remaining == 0 {
+                        if self.buffer.len() < 2 {
+                            self.state = State::ReadData(0);
+                            return Ok(false);
+                        }
+                        if &self.buffer[..2] != b"\r\n" {
+                            return Err(std::io::Error::new(
+                                std::io::ErrorKind::InvalidData,
+                                "malformed chunk terminator",
+                            ));
+                        }
+                        self.buffer.advance(2);
+                        self.state = State::ReadSize;
+                    } else {
+                        self.state = State::ReadData(new_remaining);
+                    }
+                }
+                State::ReadTrailer => {
+                    let idx = match self.find_crlf() {
+                        Some(i) => i,
+                        None => return Ok(false),
+                    };
+                    if idx == 0 {
+                        self.buffer.advance(2);
+                        self.state = State::Finished;
+                    } else {
+                        self.buffer.advance(idx + 2);
+                    }
+                }
+            }
+        }
+    }
+}
+
+impl<S> AsyncRead for AwsChunkedStream<S>
+where
+    S: AsyncRead + Unpin,
+{
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<std::io::Result<()>> {
+        loop {
+            let before = buf.filled().len();
+            let done = match self.try_advance(buf) {
+                Ok(v) => v,
+                Err(e) => return Poll::Ready(Err(e)),
+            };
+            if buf.filled().len() > before {
+                return Poll::Ready(Ok(()));
+            }
+            if done {
+                return Poll::Ready(Ok(()));
+            }
+            if self.eof {
+                return Poll::Ready(Err(std::io::Error::new(
+                    std::io::ErrorKind::UnexpectedEof,
+                    "unexpected EOF in aws-chunked stream",
+                )));
+            }
+
+            let mut tmp = [0u8; 8192];
+            let mut rb = ReadBuf::new(&mut tmp);
+            match Pin::new(&mut self.inner).poll_read(cx, &mut rb) {
+                Poll::Ready(Ok(())) => {
+                    let n = rb.filled().len();
+                    if n == 0 {
+                        self.eof = true;
+                        continue;
+                    }
+                    self.buffer.extend_from_slice(rb.filled());
+                }
+                Poll::Ready(Err(e)) => return Poll::Ready(Err(e)),
+                Poll::Pending => return Poll::Pending,
+            }
+        }
+    }
+}
+
+pub fn decode_body(body: axum::body::Body) -> impl AsyncRead + Send + Unpin {
+    use futures::TryStreamExt;
+    let stream = tokio_util::io::StreamReader::new(
+        http_body_util::BodyStream::new(body)
+            .map_ok(|frame| frame.into_data().unwrap_or_default())
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e)),
+    );
+    AwsChunkedStream::new(stream)
+}
+

rust/myfsio-engine/crates/myfsio-server/src/handlers/kms.rs

@@ -0,0 +1,278 @@
+use axum::body::Body;
+use axum::extract::State;
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use base64::engine::general_purpose::STANDARD as B64;
+use base64::Engine;
+use serde_json::json;
+
+use crate::state::AppState;
+
+fn json_ok(value: serde_json::Value) -> Response {
+    (
+        StatusCode::OK,
+        [("content-type", "application/json")],
+        value.to_string(),
+    )
+        .into_response()
+}
+
+fn json_err(status: StatusCode, msg: &str) -> Response {
+    (
+        status,
+        [("content-type", "application/json")],
+        json!({"error": msg}).to_string(),
+    )
+        .into_response()
+}
+
+pub async fn list_keys(State(state): State<AppState>) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    let keys = kms.list_keys().await;
+    let keys_json: Vec<serde_json::Value> = keys
+        .iter()
+        .map(|k| {
+            json!({
+                "KeyId": k.key_id,
+                "Arn": k.arn,
+                "Description": k.description,
+                "CreationDate": k.creation_date.to_rfc3339(),
+                "Enabled": k.enabled,
+                "KeyState": k.key_state,
+                "KeyUsage": k.key_usage,
+                "KeySpec": k.key_spec,
+            })
+        })
+        .collect();
+
+    json_ok(json!({"keys": keys_json}))
+}
+
+pub async fn create_key(State(state): State<AppState>, body: Body) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    let body_bytes = match http_body_util::BodyExt::collect(body).await {
+        Ok(c) => c.to_bytes(),
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid request body"),
+    };
+
+    let description = if body_bytes.is_empty() {
+        String::new()
+    } else {
+        match serde_json::from_slice::<serde_json::Value>(&body_bytes) {
+            Ok(v) => v
+                .get("Description")
+                .or_else(|| v.get("description"))
+                .and_then(|d| d.as_str())
+                .unwrap_or("")
+                .to_string(),
+            Err(_) => String::new(),
+        }
+    };
+
+    match kms.create_key(&description).await {
+        Ok(key) => json_ok(json!({
+            "KeyId": key.key_id,
+            "Arn": key.arn,
+            "Description": key.description,
+            "CreationDate": key.creation_date.to_rfc3339(),
+            "Enabled": key.enabled,
+            "KeyState": key.key_state,
+        })),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn get_key(
+    State(state): State<AppState>,
+    axum::extract::Path(key_id): axum::extract::Path<String>,
+) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    match kms.get_key(&key_id).await {
+        Some(key) => json_ok(json!({
+            "KeyId": key.key_id,
+            "Arn": key.arn,
+            "Description": key.description,
+            "CreationDate": key.creation_date.to_rfc3339(),
+            "Enabled": key.enabled,
+            "KeyState": key.key_state,
+            "KeyUsage": key.key_usage,
+            "KeySpec": key.key_spec,
+        })),
+        None => json_err(StatusCode::NOT_FOUND, "Key not found"),
+    }
+}
+
+pub async fn delete_key(
+    State(state): State<AppState>,
+    axum::extract::Path(key_id): axum::extract::Path<String>,
+) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    match kms.delete_key(&key_id).await {
+        Ok(true) => StatusCode::NO_CONTENT.into_response(),
+        Ok(false) => json_err(StatusCode::NOT_FOUND, "Key not found"),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn enable_key(
+    State(state): State<AppState>,
+    axum::extract::Path(key_id): axum::extract::Path<String>,
+) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    match kms.enable_key(&key_id).await {
+        Ok(true) => json_ok(json!({"status": "enabled"})),
+        Ok(false) => json_err(StatusCode::NOT_FOUND, "Key not found"),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn disable_key(
+    State(state): State<AppState>,
+    axum::extract::Path(key_id): axum::extract::Path<String>,
+) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    match kms.disable_key(&key_id).await {
+        Ok(true) => json_ok(json!({"status": "disabled"})),
+        Ok(false) => json_err(StatusCode::NOT_FOUND, "Key not found"),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn encrypt(State(state): State<AppState>, body: Body) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    let body_bytes = match http_body_util::BodyExt::collect(body).await {
+        Ok(c) => c.to_bytes(),
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid request body"),
+    };
+
+    let req: serde_json::Value = match serde_json::from_slice(&body_bytes) {
+        Ok(v) => v,
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid JSON"),
+    };
+
+    let key_id = match req.get("KeyId").and_then(|v| v.as_str()) {
+        Some(k) => k,
+        None => return json_err(StatusCode::BAD_REQUEST, "Missing KeyId"),
+    };
+    let plaintext_b64 = match req.get("Plaintext").and_then(|v| v.as_str()) {
+        Some(p) => p,
+        None => return json_err(StatusCode::BAD_REQUEST, "Missing Plaintext"),
+    };
+    let plaintext = match B64.decode(plaintext_b64) {
+        Ok(p) => p,
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid base64 Plaintext"),
+    };
+
+    match kms.encrypt_data(key_id, &plaintext).await {
+        Ok(ct) => json_ok(json!({
+            "KeyId": key_id,
+            "CiphertextBlob": B64.encode(&ct),
+        })),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn decrypt(State(state): State<AppState>, body: Body) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    let body_bytes = match http_body_util::BodyExt::collect(body).await {
+        Ok(c) => c.to_bytes(),
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid request body"),
+    };
+
+    let req: serde_json::Value = match serde_json::from_slice(&body_bytes) {
+        Ok(v) => v,
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid JSON"),
+    };
+
+    let key_id = match req.get("KeyId").and_then(|v| v.as_str()) {
+        Some(k) => k,
+        None => return json_err(StatusCode::BAD_REQUEST, "Missing KeyId"),
+    };
+    let ct_b64 = match req.get("CiphertextBlob").and_then(|v| v.as_str()) {
+        Some(c) => c,
+        None => return json_err(StatusCode::BAD_REQUEST, "Missing CiphertextBlob"),
+    };
+    let ciphertext = match B64.decode(ct_b64) {
+        Ok(c) => c,
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid base64"),
+    };
+
+    match kms.decrypt_data(key_id, &ciphertext).await {
+        Ok(pt) => json_ok(json!({
+            "KeyId": key_id,
+            "Plaintext": B64.encode(&pt),
+        })),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
+pub async fn generate_data_key(State(state): State<AppState>, body: Body) -> Response {
+    let kms = match &state.kms {
+        Some(k) => k,
+        None => return json_err(StatusCode::SERVICE_UNAVAILABLE, "KMS not enabled"),
+    };
+
+    let body_bytes = match http_body_util::BodyExt::collect(body).await {
+        Ok(c) => c.to_bytes(),
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid request body"),
+    };
+
+    let req: serde_json::Value = match serde_json::from_slice(&body_bytes) {
+        Ok(v) => v,
+        Err(_) => return json_err(StatusCode::BAD_REQUEST, "Invalid JSON"),
+    };
+
+    let key_id = match req.get("KeyId").and_then(|v| v.as_str()) {
+        Some(k) => k,
+        None => return json_err(StatusCode::BAD_REQUEST, "Missing KeyId"),
+    };
+    let num_bytes = req
+        .get("NumberOfBytes")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(32) as usize;
+
+    if num_bytes < 1 || num_bytes > 1024 {
+        return json_err(StatusCode::BAD_REQUEST, "NumberOfBytes must be 1-1024");
+    }
+
+    match kms.generate_data_key(key_id, num_bytes).await {
+        Ok((plaintext, wrapped)) => json_ok(json!({
+            "KeyId": key_id,
+            "Plaintext": B64.encode(&plaintext),
+            "CiphertextBlob": B64.encode(&wrapped),
+        })),
+        Err(e) => json_err(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/handlers/select.rs

@@ -0,0 +1,552 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use axum::body::Body;
+use axum::http::{HeaderMap, HeaderName, StatusCode};
+use axum::response::{IntoResponse, Response};
+use base64::Engine;
+use bytes::Bytes;
+use crc32fast::Hasher;
+use duckdb::types::ValueRef;
+use duckdb::Connection;
+use futures::stream;
+use http_body_util::BodyExt;
+use myfsio_common::error::{S3Error, S3ErrorCode};
+use myfsio_storage::traits::StorageEngine;
+
+use crate::state::AppState;
+
+#[cfg(target_os = "windows")]
+#[link(name = "Rstrtmgr")]
+extern "system" {}
+
+const CHUNK_SIZE: usize = 65_536;
+
+pub async fn post_select_object_content(
+    state: &AppState,
+    bucket: &str,
+    key: &str,
+    headers: &HeaderMap,
+    body: Body,
+) -> Response {
+    if let Some(resp) = require_xml_content_type(headers) {
+        return resp;
+    }
+
+    let body_bytes = match body.collect().await {
+        Ok(collected) => collected.to_bytes(),
+        Err(_) => {
+            return s3_error_response(S3Error::new(
+                S3ErrorCode::MalformedXML,
+                "Unable to parse XML document",
+            ));
+        }
+    };
+
+    let request = match parse_select_request(&body_bytes) {
+        Ok(r) => r,
+        Err(err) => return s3_error_response(err),
+    };
+
+    let object_path = match state.storage.get_object_path(bucket, key).await {
+        Ok(path) => path,
+        Err(_) => {
+            return s3_error_response(S3Error::new(
+                S3ErrorCode::NoSuchKey,
+                "Object not found",
+            ));
+        }
+    };
+
+    let join_res = tokio::task::spawn_blocking(move || execute_select_query(object_path, request)).await;
+    let chunks = match join_res {
+        Ok(Ok(chunks)) => chunks,
+        Ok(Err(message)) => {
+            return s3_error_response(S3Error::new(S3ErrorCode::InvalidRequest, message));
+        }
+        Err(_) => {
+            return s3_error_response(S3Error::new(
+                S3ErrorCode::InternalError,
+                "SelectObjectContent execution failed",
+            ));
+        }
+    };
+
+    let bytes_returned: usize = chunks.iter().map(|c| c.len()).sum();
+    let mut events: Vec<Bytes> = Vec::with_capacity(chunks.len() + 2);
+    for chunk in chunks {
+        events.push(Bytes::from(encode_select_event("Records", &chunk)));
+    }
+
+    let stats_payload = build_stats_xml(0, bytes_returned);
+    events.push(Bytes::from(encode_select_event("Stats", stats_payload.as_bytes())));
+    events.push(Bytes::from(encode_select_event("End", b"")));
+
+    let stream = stream::iter(events.into_iter().map(Ok::<Bytes, std::io::Error>));
+    let body = Body::from_stream(stream);
+
+    let mut response = (StatusCode::OK, body).into_response();
+    response.headers_mut().insert(
+        HeaderName::from_static("content-type"),
+        "application/octet-stream".parse().unwrap(),
+    );
+    response.headers_mut().insert(
+        HeaderName::from_static("x-amz-request-charged"),
+        "requester".parse().unwrap(),
+    );
+    response
+}
+
+#[derive(Clone)]
+struct SelectRequest {
+    expression: String,
+    input_format: InputFormat,
+    output_format: OutputFormat,
+}
+
+#[derive(Clone)]
+enum InputFormat {
+    Csv(CsvInputConfig),
+    Json(JsonInputConfig),
+    Parquet,
+}
+
+#[derive(Clone)]
+struct CsvInputConfig {
+    file_header_info: String,
+    field_delimiter: String,
+    quote_character: String,
+}
+
+#[derive(Clone)]
+struct JsonInputConfig {
+    json_type: String,
+}
+
+#[derive(Clone)]
+enum OutputFormat {
+    Csv(CsvOutputConfig),
+    Json(JsonOutputConfig),
+}
+
+#[derive(Clone)]
+struct CsvOutputConfig {
+    field_delimiter: String,
+    record_delimiter: String,
+    quote_character: String,
+}
+
+#[derive(Clone)]
+struct JsonOutputConfig {
+    record_delimiter: String,
+}
+
+fn parse_select_request(payload: &[u8]) -> Result<SelectRequest, S3Error> {
+    let xml = String::from_utf8_lossy(payload);
+    let doc = roxmltree::Document::parse(&xml)
+        .map_err(|_| S3Error::new(S3ErrorCode::MalformedXML, "Unable to parse XML document"))?;
+
+    let root = doc.root_element();
+    if root.tag_name().name() != "SelectObjectContentRequest" {
+        return Err(S3Error::new(
+            S3ErrorCode::MalformedXML,
+            "Root element must be SelectObjectContentRequest",
+        ));
+    }
+
+    let expression = child_text(&root, "Expression")
+        .filter(|v| !v.is_empty())
+        .ok_or_else(|| S3Error::new(S3ErrorCode::InvalidRequest, "Expression is required"))?;
+
+    let expression_type = child_text(&root, "ExpressionType").unwrap_or_else(|| "SQL".to_string());
+    if !expression_type.eq_ignore_ascii_case("SQL") {
+        return Err(S3Error::new(
+            S3ErrorCode::InvalidRequest,
+            "Only SQL expression type is supported",
+        ));
+    }
+
+    let input_node = child(&root, "InputSerialization")
+        .ok_or_else(|| S3Error::new(S3ErrorCode::InvalidRequest, "InputSerialization is required"))?;
+    let output_node = child(&root, "OutputSerialization")
+        .ok_or_else(|| S3Error::new(S3ErrorCode::InvalidRequest, "OutputSerialization is required"))?;
+
+    let input_format = parse_input_format(&input_node)?;
+    let output_format = parse_output_format(&output_node)?;
+
+    Ok(SelectRequest {
+        expression,
+        input_format,
+        output_format,
+    })
+}
+
+fn parse_input_format(node: &roxmltree::Node<'_, '_>) -> Result<InputFormat, S3Error> {
+    if let Some(csv_node) = child(node, "CSV") {
+        return Ok(InputFormat::Csv(CsvInputConfig {
+            file_header_info: child_text(&csv_node, "FileHeaderInfo")
+                .unwrap_or_else(|| "NONE".to_string())
+                .to_ascii_uppercase(),
+            field_delimiter: child_text(&csv_node, "FieldDelimiter").unwrap_or_else(|| ",".to_string()),
+            quote_character: child_text(&csv_node, "QuoteCharacter").unwrap_or_else(|| "\"".to_string()),
+        }));
+    }
+
+    if let Some(json_node) = child(node, "JSON") {
+        return Ok(InputFormat::Json(JsonInputConfig {
+            json_type: child_text(&json_node, "Type")
+                .unwrap_or_else(|| "DOCUMENT".to_string())
+                .to_ascii_uppercase(),
+        }));
+    }
+
+    if child(node, "Parquet").is_some() {
+        return Ok(InputFormat::Parquet);
+    }
+
+    Err(S3Error::new(
+        S3ErrorCode::InvalidRequest,
+        "InputSerialization must specify CSV, JSON, or Parquet",
+    ))
+}
+
+fn parse_output_format(node: &roxmltree::Node<'_, '_>) -> Result<OutputFormat, S3Error> {
+    if let Some(csv_node) = child(node, "CSV") {
+        return Ok(OutputFormat::Csv(CsvOutputConfig {
+            field_delimiter: child_text(&csv_node, "FieldDelimiter").unwrap_or_else(|| ",".to_string()),
+            record_delimiter: child_text(&csv_node, "RecordDelimiter").unwrap_or_else(|| "\n".to_string()),
+            quote_character: child_text(&csv_node, "QuoteCharacter").unwrap_or_else(|| "\"".to_string()),
+        }));
+    }
+
+    if let Some(json_node) = child(node, "JSON") {
+        return Ok(OutputFormat::Json(JsonOutputConfig {
+            record_delimiter: child_text(&json_node, "RecordDelimiter").unwrap_or_else(|| "\n".to_string()),
+        }));
+    }
+
+    Err(S3Error::new(
+        S3ErrorCode::InvalidRequest,
+        "OutputSerialization must specify CSV or JSON",
+    ))
+}
+
+fn child<'a, 'input>(node: &'a roxmltree::Node<'a, 'input>, name: &str) -> Option<roxmltree::Node<'a, 'input>> {
+    node.children()
+        .find(|n| n.is_element() && n.tag_name().name() == name)
+}
+
+fn child_text(node: &roxmltree::Node<'_, '_>, name: &str) -> Option<String> {
+    child(node, name)
+        .and_then(|n| n.text())
+        .map(|s| s.to_string())
+}
+
+fn execute_select_query(path: PathBuf, request: SelectRequest) -> Result<Vec<Vec<u8>>, String> {
+    let conn = Connection::open_in_memory().map_err(|e| format!("DuckDB connection error: {}", e))?;
+
+    load_input_table(&conn, &path, &request.input_format)?;
+
+    let expression = request
+        .expression
+        .replace("s3object", "data")
+        .replace("S3Object", "data");
+
+    let mut stmt = conn
+        .prepare(&expression)
+        .map_err(|e| format!("SQL execution error: {}", e))?;
+    let mut rows = stmt
+        .query([])
+        .map_err(|e| format!("SQL execution error: {}", e))?;
+    let stmt_ref = rows
+        .as_ref()
+        .ok_or_else(|| "SQL execution error: statement metadata unavailable".to_string())?;
+    let col_count = stmt_ref.column_count();
+    let mut columns: Vec<String> = Vec::with_capacity(col_count);
+    for i in 0..col_count {
+        let name = stmt_ref
+            .column_name(i)
+            .map(|s| s.to_string())
+            .unwrap_or_else(|_| format!("_{}", i));
+        columns.push(name);
+    }
+
+    match request.output_format {
+        OutputFormat::Csv(cfg) => collect_csv_chunks(&mut rows, col_count, cfg),
+        OutputFormat::Json(cfg) => collect_json_chunks(&mut rows, col_count, &columns, cfg),
+    }
+}
+
+fn load_input_table(conn: &Connection, path: &Path, input: &InputFormat) -> Result<(), String> {
+    let path_str = path.to_string_lossy().replace('\\', "/");
+    match input {
+        InputFormat::Csv(cfg) => {
+            let header = cfg.file_header_info == "USE" || cfg.file_header_info == "IGNORE";
+            let delimiter = normalize_single_char(&cfg.field_delimiter, ',');
+            let quote = normalize_single_char(&cfg.quote_character, '"');
+
+            let sql = format!(
+                "CREATE TABLE data AS SELECT * FROM read_csv('{}', header={}, delim='{}', quote='{}')",
+                sql_escape(&path_str),
+                if header { "true" } else { "false" },
+                sql_escape(&delimiter),
+                sql_escape(&quote)
+            );
+            conn.execute_batch(&sql)
+                .map_err(|e| format!("Failed loading CSV data: {}", e))?;
+        }
+        InputFormat::Json(cfg) => {
+            let format = if cfg.json_type == "LINES" {
+                "newline_delimited"
+            } else {
+                "array"
+            };
+            let sql = format!(
+                "CREATE TABLE data AS SELECT * FROM read_json_auto('{}', format='{}')",
+                sql_escape(&path_str),
+                format
+            );
+            conn.execute_batch(&sql)
+                .map_err(|e| format!("Failed loading JSON data: {}", e))?;
+        }
+        InputFormat::Parquet => {
+            let sql = format!(
+                "CREATE TABLE data AS SELECT * FROM read_parquet('{}')",
+                sql_escape(&path_str)
+            );
+            conn.execute_batch(&sql)
+                .map_err(|e| format!("Failed loading Parquet data: {}", e))?;
+        }
+    }
+    Ok(())
+}
+
+fn sql_escape(value: &str) -> String {
+    value.replace('\'', "''")
+}
+
+fn normalize_single_char(value: &str, default_char: char) -> String {
+    value.chars().next().unwrap_or(default_char).to_string()
+}
+
+fn collect_csv_chunks(
+    rows: &mut duckdb::Rows<'_>,
+    col_count: usize,
+    cfg: CsvOutputConfig,
+) -> Result<Vec<Vec<u8>>, String> {
+    let delimiter = cfg.field_delimiter;
+    let record_delimiter = cfg.record_delimiter;
+    let quote = cfg.quote_character;
+
+    let mut chunks: Vec<Vec<u8>> = Vec::new();
+    let mut buffer = String::new();
+
+    while let Some(row) = rows.next().map_err(|e| format!("SQL execution error: {}", e))? {
+        let mut fields: Vec<String> = Vec::with_capacity(col_count);
+        for i in 0..col_count {
+            let value = row
+                .get_ref(i)
+                .map_err(|e| format!("SQL execution error: {}", e))?;
+            if matches!(value, ValueRef::Null) {
+                fields.push(String::new());
+                continue;
+            }
+
+            let mut text = value_ref_to_string(value);
+            if text.contains(&delimiter) || text.contains(&quote) || text.contains(&record_delimiter) {
+                text = text.replace(&quote, &(quote.clone() + &quote));
+                text = format!("{}{}{}", quote, text, quote);
+            }
+            fields.push(text);
+        }
+        buffer.push_str(&fields.join(&delimiter));
+        buffer.push_str(&record_delimiter);
+
+        while buffer.len() >= CHUNK_SIZE {
+            let rest = buffer.split_off(CHUNK_SIZE);
+            chunks.push(buffer.into_bytes());
+            buffer = rest;
+        }
+    }
+
+    if !buffer.is_empty() {
+        chunks.push(buffer.into_bytes());
+    }
+    Ok(chunks)
+}
+
+fn collect_json_chunks(
+    rows: &mut duckdb::Rows<'_>,
+    col_count: usize,
+    columns: &[String],
+    cfg: JsonOutputConfig,
+) -> Result<Vec<Vec<u8>>, String> {
+    let record_delimiter = cfg.record_delimiter;
+    let mut chunks: Vec<Vec<u8>> = Vec::new();
+    let mut buffer = String::new();
+
+    while let Some(row) = rows.next().map_err(|e| format!("SQL execution error: {}", e))? {
+        let mut record: HashMap<String, serde_json::Value> = HashMap::with_capacity(col_count);
+        for i in 0..col_count {
+            let value = row
+                .get_ref(i)
+                .map_err(|e| format!("SQL execution error: {}", e))?;
+            let key = columns
+                .get(i)
+                .cloned()
+                .unwrap_or_else(|| format!("_{}", i));
+            record.insert(key, value_ref_to_json(value));
+        }
+        let line = serde_json::to_string(&record)
+            .map_err(|e| format!("JSON output encoding failed: {}", e))?;
+        buffer.push_str(&line);
+        buffer.push_str(&record_delimiter);
+
+        while buffer.len() >= CHUNK_SIZE {
+            let rest = buffer.split_off(CHUNK_SIZE);
+            chunks.push(buffer.into_bytes());
+            buffer = rest;
+        }
+    }
+
+    if !buffer.is_empty() {
+        chunks.push(buffer.into_bytes());
+    }
+    Ok(chunks)
+}
+
+fn value_ref_to_string(value: ValueRef<'_>) -> String {
+    match value {
+        ValueRef::Null => String::new(),
+        ValueRef::Boolean(v) => v.to_string(),
+        ValueRef::TinyInt(v) => v.to_string(),
+        ValueRef::SmallInt(v) => v.to_string(),
+        ValueRef::Int(v) => v.to_string(),
+        ValueRef::BigInt(v) => v.to_string(),
+        ValueRef::UTinyInt(v) => v.to_string(),
+        ValueRef::USmallInt(v) => v.to_string(),
+        ValueRef::UInt(v) => v.to_string(),
+        ValueRef::UBigInt(v) => v.to_string(),
+        ValueRef::Float(v) => v.to_string(),
+        ValueRef::Double(v) => v.to_string(),
+        ValueRef::Decimal(v) => v.to_string(),
+        ValueRef::Text(v) => String::from_utf8_lossy(v).into_owned(),
+        ValueRef::Blob(v) => base64::engine::general_purpose::STANDARD.encode(v),
+        _ => format!("{:?}", value),
+    }
+}
+
+fn value_ref_to_json(value: ValueRef<'_>) -> serde_json::Value {
+    match value {
+        ValueRef::Null => serde_json::Value::Null,
+        ValueRef::Boolean(v) => serde_json::Value::Bool(v),
+        ValueRef::TinyInt(v) => serde_json::json!(v),
+        ValueRef::SmallInt(v) => serde_json::json!(v),
+        ValueRef::Int(v) => serde_json::json!(v),
+        ValueRef::BigInt(v) => serde_json::json!(v),
+        ValueRef::UTinyInt(v) => serde_json::json!(v),
+        ValueRef::USmallInt(v) => serde_json::json!(v),
+        ValueRef::UInt(v) => serde_json::json!(v),
+        ValueRef::UBigInt(v) => serde_json::json!(v),
+        ValueRef::Float(v) => serde_json::json!(v),
+        ValueRef::Double(v) => serde_json::json!(v),
+        ValueRef::Decimal(v) => serde_json::Value::String(v.to_string()),
+        ValueRef::Text(v) => serde_json::Value::String(String::from_utf8_lossy(v).into_owned()),
+        ValueRef::Blob(v) => serde_json::Value::String(base64::engine::general_purpose::STANDARD.encode(v)),
+        _ => serde_json::Value::String(format!("{:?}", value)),
+    }
+}
+
+fn require_xml_content_type(headers: &HeaderMap) -> Option<Response> {
+    let value = headers
+        .get("content-type")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("")
+        .trim();
+    if value.is_empty() {
+        return None;
+    }
+    let lowered = value.to_ascii_lowercase();
+    if lowered.starts_with("application/xml") || lowered.starts_with("text/xml") {
+        return None;
+    }
+    Some(s3_error_response(S3Error::new(
+        S3ErrorCode::InvalidRequest,
+        "Content-Type must be application/xml or text/xml",
+    )))
+}
+
+fn s3_error_response(err: S3Error) -> Response {
+    let status = StatusCode::from_u16(err.http_status()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    let resource = if err.resource.is_empty() {
+        "/".to_string()
+    } else {
+        err.resource.clone()
+    };
+    let body = err
+        .with_resource(resource)
+        .with_request_id(uuid::Uuid::new_v4().simple().to_string())
+        .to_xml();
+    (
+        status,
+        [("content-type", "application/xml")],
+        body,
+    )
+        .into_response()
+}
+
+fn build_stats_xml(bytes_scanned: usize, bytes_returned: usize) -> String {
+    format!(
+        "<Stats><BytesScanned>{}</BytesScanned><BytesProcessed>{}</BytesProcessed><BytesReturned>{}</BytesReturned></Stats>",
+        bytes_scanned,
+        bytes_scanned,
+        bytes_returned
+    )
+}
+
+fn encode_select_event(event_type: &str, payload: &[u8]) -> Vec<u8> {
+    let mut headers = Vec::new();
+    headers.extend(encode_select_header(":event-type", event_type));
+    if event_type == "Records" {
+        headers.extend(encode_select_header(":content-type", "application/octet-stream"));
+    } else if event_type == "Stats" {
+        headers.extend(encode_select_header(":content-type", "text/xml"));
+    }
+    headers.extend(encode_select_header(":message-type", "event"));
+
+    let headers_len = headers.len() as u32;
+    let total_len = 4 + 4 + 4 + headers.len() + payload.len() + 4;
+
+    let mut message = Vec::with_capacity(total_len);
+    let mut prelude = Vec::with_capacity(8);
+    prelude.extend((total_len as u32).to_be_bytes());
+    prelude.extend(headers_len.to_be_bytes());
+
+    let prelude_crc = crc32(&prelude);
+    message.extend(prelude);
+    message.extend(prelude_crc.to_be_bytes());
+    message.extend(headers);
+    message.extend(payload);
+
+    let msg_crc = crc32(&message);
+    message.extend(msg_crc.to_be_bytes());
+    message
+}
+
+fn encode_select_header(name: &str, value: &str) -> Vec<u8> {
+    let name_bytes = name.as_bytes();
+    let value_bytes = value.as_bytes();
+    let mut header = Vec::with_capacity(1 + name_bytes.len() + 1 + 2 + value_bytes.len());
+    header.push(name_bytes.len() as u8);
+    header.extend(name_bytes);
+    header.push(7);
+    header.extend((value_bytes.len() as u16).to_be_bytes());
+    header.extend(value_bytes);
+    header
+}
+
+fn crc32(data: &[u8]) -> u32 {
+    let mut hasher = Hasher::new();
+    hasher.update(data);
+    hasher.finalize()
+}

rust/myfsio-engine/crates/myfsio-server/src/handlers/ui.rs

@@ -0,0 +1,174 @@
+use std::collections::HashMap;
+
+use axum::extract::{Extension, Form, State};
+use axum::http::{header, HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Redirect, Response};
+use tera::Context;
+
+use crate::middleware::session::SessionHandle;
+use crate::session::FlashMessage;
+use crate::state::AppState;
+
+pub async fn login_page(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    if session.read(|s| s.is_authenticated()) {
+        return Redirect::to("/ui/buckets").into_response();
+    }
+
+    let mut ctx = base_context(&session, None);
+    let flashed = session.write(|s| s.take_flash());
+    inject_flash(&mut ctx, flashed);
+
+    render(&state, "login.html", &ctx)
+}
+
+#[derive(serde::Deserialize)]
+pub struct LoginForm {
+    pub access_key: String,
+    pub secret_key: String,
+    #[serde(default)]
+    pub csrf_token: String,
+    #[serde(default)]
+    pub next: Option<String>,
+}
+
+pub async fn login_submit(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+    Form(form): Form<LoginForm>,
+) -> Response {
+    let access_key = form.access_key.trim();
+    let secret_key = form.secret_key.trim();
+
+    match state.iam.get_secret_key(access_key) {
+        Some(expected) if constant_time_eq_str(&expected, secret_key) => {
+            let display = state
+                .iam
+                .get_user(access_key)
+                .await
+                .and_then(|v| {
+                    v.get("display_name")
+                        .and_then(|d| d.as_str())
+                        .map(|s| s.to_string())
+                })
+                .unwrap_or_else(|| access_key.to_string());
+
+            session.write(|s| {
+                s.user_id = Some(access_key.to_string());
+                s.display_name = Some(display);
+                s.rotate_csrf();
+                s.push_flash("success", "Signed in successfully.");
+            });
+
+            let next = form
+                .next
+                .as_deref()
+                .filter(|n| n.starts_with("/ui/") || *n == "/ui")
+                .unwrap_or("/ui/buckets")
+                .to_string();
+            Redirect::to(&next).into_response()
+        }
+        _ => {
+            session.write(|s| {
+                s.push_flash("danger", "Invalid access key or secret key.");
+            });
+            Redirect::to("/login").into_response()
+        }
+    }
+}
+
+pub async fn logout(Extension(session): Extension<SessionHandle>) -> Response {
+    session.write(|s| {
+        s.user_id = None;
+        s.display_name = None;
+        s.flash.clear();
+        s.rotate_csrf();
+        s.push_flash("info", "Signed out.");
+    });
+    Redirect::to("/login").into_response()
+}
+
+pub async fn csrf_error_page(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let ctx = base_context(&session, None);
+    let mut resp = render(&state, "csrf_error.html", &ctx);
+    *resp.status_mut() = StatusCode::FORBIDDEN;
+    resp
+}
+
+pub async fn not_found_page(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let ctx = base_context(&session, None);
+    let mut resp = render(&state, "404.html", &ctx);
+    *resp.status_mut() = StatusCode::NOT_FOUND;
+    resp
+}
+
+pub async fn require_login(
+    Extension(session): Extension<SessionHandle>,
+    req: axum::extract::Request,
+    next: axum::middleware::Next,
+) -> Response {
+    if session.read(|s| s.is_authenticated()) {
+        return next.run(req).await;
+    }
+    let path = req.uri().path().to_string();
+    let query = req.uri().query().map(|q| format!("?{}", q)).unwrap_or_default();
+    let next_url = format!("{}{}", path, query);
+    let encoded = percent_encoding::utf8_percent_encode(&next_url, percent_encoding::NON_ALPHANUMERIC).to_string();
+    let target = format!("/login?next={}", encoded);
+    Redirect::to(&target).into_response()
+}
+
+pub fn render(state: &AppState, template: &str, ctx: &Context) -> Response {
+    let engine = match &state.templates {
+        Some(e) => e,
+        None => {
+            return (StatusCode::INTERNAL_SERVER_ERROR, "Templates not configured").into_response();
+        }
+    };
+    match engine.render(template, ctx) {
+        Ok(html) => {
+            let mut headers = HeaderMap::new();
+            headers.insert(header::CONTENT_TYPE, "text/html; charset=utf-8".parse().unwrap());
+            (StatusCode::OK, headers, html).into_response()
+        }
+        Err(e) => {
+            tracing::error!("Template render failed ({}): {}", template, e);
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Template error: {}", e),
+            )
+                .into_response()
+        }
+    }
+}
+
+pub fn base_context(session: &SessionHandle, endpoint: Option<&str>) -> Context {
+    let mut ctx = Context::new();
+    let snapshot = session.snapshot();
+    ctx.insert("csrf_token_value", &snapshot.csrf_token);
+    ctx.insert("is_authenticated", &snapshot.user_id.is_some());
+    ctx.insert("current_user", &snapshot.user_id);
+    ctx.insert("current_user_display_name", &snapshot.display_name);
+    ctx.insert("current_endpoint", &endpoint.unwrap_or(""));
+    ctx.insert("request_args", &HashMap::<String, String>::new());
+    ctx
+}
+
+pub fn inject_flash(ctx: &mut Context, flashed: Vec<FlashMessage>) {
+    ctx.insert("flashed_messages", &flashed);
+}
+
+fn constant_time_eq_str(a: &str, b: &str) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    subtle::ConstantTimeEq::ct_eq(a.as_bytes(), b.as_bytes()).into()
+}

rust/myfsio-engine/crates/myfsio-server/src/handlers/ui_pages.rs

@@ -0,0 +1,320 @@
+use std::collections::HashMap;
+
+use axum::extract::{Extension, Path, Query, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Redirect, Response};
+use serde_json::{json, Value};
+use tera::Context;
+
+use crate::handlers::ui::{base_context, inject_flash, render};
+use crate::middleware::session::SessionHandle;
+use crate::state::AppState;
+use crate::templates::TemplateEngine;
+use myfsio_storage::traits::StorageEngine;
+
+pub fn register_ui_endpoints(engine: &TemplateEngine) {
+    engine.register_endpoints(&[
+        ("ui.login", "/login"),
+        ("ui.logout", "/logout"),
+        ("ui.buckets_overview", "/ui/buckets"),
+        ("ui.bucket_detail", "/ui/buckets/{bucket_name}"),
+        ("ui.create_bucket", "/ui/buckets/create"),
+        ("ui.delete_bucket", "/ui/buckets/{bucket_name}/delete"),
+        ("ui.update_bucket_versioning", "/ui/buckets/{bucket_name}/versioning"),
+        ("ui.update_bucket_quota", "/ui/buckets/{bucket_name}/quota"),
+        ("ui.update_bucket_encryption", "/ui/buckets/{bucket_name}/encryption"),
+        ("ui.update_bucket_policy", "/ui/buckets/{bucket_name}/policy"),
+        ("ui.update_bucket_replication", "/ui/buckets/{bucket_name}/replication"),
+        ("ui.update_bucket_website", "/ui/buckets/{bucket_name}/website"),
+        ("ui.upload_object", "/ui/buckets/{bucket_name}/upload"),
+        ("ui.bulk_delete_objects", "/ui/buckets/{bucket_name}/bulk-delete"),
+        ("ui.bulk_download_objects", "/ui/buckets/{bucket_name}/bulk-download"),
+        ("ui.archived_objects", "/ui/buckets/{bucket_name}/archived"),
+        ("ui.initiate_multipart_upload", "/ui/buckets/{bucket_name}/multipart/initiate"),
+        ("ui.upload_multipart_part", "/ui/buckets/{bucket_name}/multipart/{upload_id}/part/{part_number}"),
+        ("ui.complete_multipart_upload", "/ui/buckets/{bucket_name}/multipart/{upload_id}/complete"),
+        ("ui.abort_multipart_upload", "/ui/buckets/{bucket_name}/multipart/{upload_id}/abort"),
+        ("ui.get_lifecycle_history", "/ui/buckets/{bucket_name}/lifecycle/history"),
+        ("ui.get_replication_status", "/ui/buckets/{bucket_name}/replication/status"),
+        ("ui.get_replication_failures", "/ui/buckets/{bucket_name}/replication/failures"),
+        ("ui.clear_replication_failures", "/ui/buckets/{bucket_name}/replication/failures/clear"),
+        ("ui.retry_all_replication_failures", "/ui/buckets/{bucket_name}/replication/failures/retry-all"),
+        ("ui.retry_replication_failure", "/ui/buckets/{bucket_name}/replication/failures/retry"),
+        ("ui.dismiss_replication_failure", "/ui/buckets/{bucket_name}/replication/failures/dismiss"),
+        ("ui.replication_wizard", "/ui/replication/new"),
+        ("ui.create_peer_replication_rules", "/ui/replication/create"),
+        ("ui.iam_dashboard", "/ui/iam"),
+        ("ui.create_iam_user", "/ui/iam/users"),
+        ("ui.update_iam_user", "/ui/iam/users/{user_id}"),
+        ("ui.delete_iam_user", "/ui/iam/users/{user_id}/delete"),
+        ("ui.update_iam_policies", "/ui/iam/users/{user_id}/policies"),
+        ("ui.update_iam_expiry", "/ui/iam/users/{user_id}/expiry"),
+        ("ui.rotate_iam_secret", "/ui/iam/users/{user_id}/rotate-secret"),
+        ("ui.connections_dashboard", "/ui/connections"),
+        ("ui.create_connection", "/ui/connections/create"),
+        ("ui.update_connection", "/ui/connections/{connection_id}"),
+        ("ui.delete_connection", "/ui/connections/{connection_id}/delete"),
+        ("ui.test_connection", "/ui/connections/{connection_id}/test"),
+        ("ui.sites_dashboard", "/ui/sites"),
+        ("ui.update_local_site", "/ui/sites/local"),
+        ("ui.add_peer_site", "/ui/sites/peers"),
+        ("ui.metrics_dashboard", "/ui/metrics"),
+        ("ui.system_dashboard", "/ui/system"),
+        ("ui.system_gc_status", "/ui/system/gc/status"),
+        ("ui.system_gc_run", "/ui/system/gc/run"),
+        ("ui.system_gc_history", "/ui/system/gc/history"),
+        ("ui.system_integrity_status", "/ui/system/integrity/status"),
+        ("ui.system_integrity_run", "/ui/system/integrity/run"),
+        ("ui.system_integrity_history", "/ui/system/integrity/history"),
+        ("ui.website_domains_dashboard", "/ui/website-domains"),
+        ("ui.create_website_domain", "/ui/website-domains/create"),
+        ("ui.update_website_domain", "/ui/website-domains/{domain}"),
+        ("ui.delete_website_domain", "/ui/website-domains/{domain}/delete"),
+        ("ui.docs_page", "/ui/docs"),
+    ]);
+}
+
+fn page_context(
+    state: &AppState,
+    session: &SessionHandle,
+    endpoint: &str,
+) -> Context {
+    let mut ctx = base_context(session, Some(endpoint));
+    ctx.insert("principal", &session.read(|s| s.user_id.clone()));
+    ctx.insert("can_manage_iam", &true);
+    ctx.insert("can_manage_replication", &true);
+    ctx.insert("can_manage_sites", &true);
+    ctx.insert("can_manage_encryption", &state.config.encryption_enabled);
+    ctx.insert("website_hosting_nav", &state.config.website_hosting_enabled);
+    ctx.insert("encryption_enabled", &state.config.encryption_enabled);
+    ctx.insert("kms_enabled", &state.config.kms_enabled);
+
+    let flashed = session.write(|s| s.take_flash());
+    inject_flash(&mut ctx, flashed);
+    ctx
+}
+
+pub async fn buckets_overview(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.buckets_overview");
+
+    let buckets = match state.storage.list_buckets().await {
+        Ok(list) => list,
+        Err(e) => {
+            tracing::error!("list_buckets failed: {}", e);
+            Vec::new()
+        }
+    };
+
+    let items: Vec<Value> = buckets
+        .iter()
+        .map(|b| {
+            json!({
+                "meta": {
+                    "name": b.name,
+                    "creation_date": b.creation_date.to_rfc3339(),
+                },
+                "summary": {
+                    "human_size": "0 B",
+                    "objects": 0,
+                },
+                "detail_url": format!("/ui/buckets/{}", b.name),
+                "access_badge": "bg-secondary bg-opacity-10 text-secondary",
+                "access_label": "Private",
+            })
+        })
+        .collect();
+
+    ctx.insert("buckets", &items);
+    render(&state, "buckets.html", &ctx)
+}
+
+pub async fn bucket_detail(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+    Path(bucket_name): Path<String>,
+) -> Response {
+    if !matches!(state.storage.bucket_exists(&bucket_name).await, Ok(true)) {
+        return (StatusCode::NOT_FOUND, "Bucket not found").into_response();
+    }
+
+    let mut ctx = page_context(&state, &session, "ui.bucket_detail");
+    ctx.insert("bucket_name", &bucket_name);
+    ctx.insert("bucket", &json!({ "name": bucket_name }));
+    ctx.insert("objects", &Vec::<Value>::new());
+    ctx.insert("prefixes", &Vec::<Value>::new());
+    ctx.insert("total_objects", &0);
+    ctx.insert("total_bytes", &0);
+    ctx.insert("max_objects", &Value::Null);
+    ctx.insert("max_bytes", &Value::Null);
+    ctx.insert("versioning_status", &"Disabled");
+    ctx.insert("encryption_config", &json!({ "Rules": [] }));
+    ctx.insert("replication_rules", &Vec::<Value>::new());
+    ctx.insert("website_config", &Value::Null);
+    ctx.insert("bucket_policy", &"");
+    ctx.insert("connections", &Vec::<Value>::new());
+    ctx.insert("current_prefix", &"");
+    ctx.insert("parent_prefix", &"");
+    ctx.insert("has_more", &false);
+    ctx.insert("next_token", &"");
+    ctx.insert("active_tab", &"objects");
+    ctx.insert("multipart_uploads", &Vec::<Value>::new());
+    render(&state, "bucket_detail.html", &ctx)
+}
+
+pub async fn iam_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.iam_dashboard");
+    let users: Vec<Value> = state
+        .iam
+        .list_users()
+        .await
+        .into_iter()
+        .map(|u| {
+            let mut map = u.as_object().cloned().unwrap_or_default();
+            map.entry("policies".to_string()).or_insert(Value::Array(Vec::new()));
+            map.entry("expires_at".to_string()).or_insert(Value::Null);
+            map.entry("is_enabled".to_string()).or_insert(Value::Bool(true));
+            map.entry("display_name".to_string())
+                .or_insert_with(|| Value::String(String::new()));
+            Value::Object(map)
+        })
+        .collect();
+    ctx.insert("users", &users);
+    ctx.insert("iam_locked", &false);
+    ctx.insert("now_iso", &chrono::Utc::now().to_rfc3339());
+    ctx.insert(
+        "soon_iso",
+        &(chrono::Utc::now() + chrono::Duration::days(7)).to_rfc3339(),
+    );
+    ctx.insert("all_buckets", &Vec::<String>::new());
+    render(&state, "iam.html", &ctx)
+}
+
+pub async fn sites_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.sites_dashboard");
+    ctx.insert("local_site", &Value::Null);
+    ctx.insert("peers", &Vec::<Value>::new());
+    ctx.insert("topology", &json!({"sites": [], "connections": []}));
+    render(&state, "sites.html", &ctx)
+}
+
+pub async fn connections_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.connections_dashboard");
+    let conns = state.connections.list();
+    let items: Vec<Value> = conns
+        .into_iter()
+        .map(|c| {
+            json!({
+                "id": c.id,
+                "name": c.name,
+                "endpoint_url": c.endpoint_url,
+                "region": c.region,
+                "access_key": c.access_key,
+            })
+        })
+        .collect();
+    ctx.insert("connections", &items);
+    render(&state, "connections.html", &ctx)
+}
+
+pub async fn metrics_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.metrics_dashboard");
+    ctx.insert("metrics_enabled", &state.config.metrics_enabled);
+    ctx.insert("history", &Vec::<Value>::new());
+    ctx.insert("operation_metrics", &Vec::<Value>::new());
+    ctx.insert("summary", &json!({}));
+    render(&state, "metrics.html", &ctx)
+}
+
+pub async fn system_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.system_dashboard");
+    ctx.insert("gc_enabled", &state.config.gc_enabled);
+    ctx.insert("integrity_enabled", &state.config.integrity_enabled);
+    ctx.insert("gc_history", &Vec::<Value>::new());
+    ctx.insert("integrity_history", &Vec::<Value>::new());
+    ctx.insert("gc_status", &json!({"running": false}));
+    ctx.insert("integrity_status", &json!({"running": false}));
+    render(&state, "system.html", &ctx)
+}
+
+pub async fn website_domains_dashboard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.website_domains_dashboard");
+    ctx.insert("domains", &Vec::<Value>::new());
+    render(&state, "website_domains.html", &ctx)
+}
+
+pub async fn replication_wizard(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let mut ctx = page_context(&state, &session, "ui.replication_wizard");
+    ctx.insert("connections", &Vec::<Value>::new());
+    ctx.insert("local_site", &Value::Null);
+    ctx.insert("peers", &Vec::<Value>::new());
+    render(&state, "replication_wizard.html", &ctx)
+}
+
+pub async fn docs_page(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    let ctx = page_context(&state, &session, "ui.docs_page");
+    render(&state, "docs.html", &ctx)
+}
+
+#[derive(serde::Deserialize)]
+pub struct CreateBucketForm {
+    pub bucket_name: String,
+    #[serde(default)]
+    pub csrf_token: String,
+}
+
+pub async fn create_bucket(
+    State(state): State<AppState>,
+    Extension(session): Extension<SessionHandle>,
+    axum::extract::Form(form): axum::extract::Form<CreateBucketForm>,
+) -> Response {
+    match state.storage.create_bucket(form.bucket_name.trim()).await {
+        Ok(()) => {
+            session.write(|s| s.push_flash("success", format!("Bucket '{}' created.", form.bucket_name)));
+        }
+        Err(e) => {
+            session.write(|s| s.push_flash("danger", format!("Failed to create bucket: {}", e)));
+        }
+    }
+    Redirect::to("/ui/buckets").into_response()
+}
+
+pub async fn stub_post(
+    Extension(session): Extension<SessionHandle>,
+) -> Response {
+    session.write(|s| s.push_flash("info", "This action is not yet implemented in the Rust UI."));
+    Redirect::to("/ui/buckets").into_response()
+}
+
+#[derive(serde::Deserialize)]
+pub struct QueryArgs(#[serde(default)] pub HashMap<String, String>);
+
+pub async fn json_stub(Query(_q): Query<QueryArgs>) -> Response {
+    axum::Json(json!({"status": "not_implemented", "items": []})).into_response()
+}

rust/myfsio-engine/crates/myfsio-server/src/lib.rs

@@ -0,0 +1,124 @@
+pub mod config;
+pub mod handlers;
+pub mod middleware;
+pub mod services;
+pub mod session;
+pub mod state;
+pub mod stores;
+pub mod templates;
+
+use axum::Router;
+
+pub const SERVER_HEADER: &str = concat!("MyFSIO-Rust/", env!("CARGO_PKG_VERSION"));
+
+pub fn create_ui_router(state: state::AppState) -> Router {
+    use axum::routing::{get, post};
+    use handlers::ui;
+    use handlers::ui_pages;
+
+    let protected = Router::new()
+        .route("/ui/buckets", get(ui_pages::buckets_overview))
+        .route("/ui/buckets/create", post(ui_pages::create_bucket))
+        .route("/ui/buckets/{bucket_name}", get(ui_pages::bucket_detail))
+        .route("/ui/iam", get(ui_pages::iam_dashboard))
+        .route("/ui/sites", get(ui_pages::sites_dashboard))
+        .route("/ui/connections", get(ui_pages::connections_dashboard))
+        .route("/ui/metrics", get(ui_pages::metrics_dashboard))
+        .route("/ui/system", get(ui_pages::system_dashboard))
+        .route("/ui/website-domains", get(ui_pages::website_domains_dashboard))
+        .route("/ui/replication/new", get(ui_pages::replication_wizard))
+        .route("/ui/docs", get(ui_pages::docs_page))
+        .layer(axum::middleware::from_fn(ui::require_login));
+
+    let public = Router::new()
+        .route("/login", get(ui::login_page).post(ui::login_submit))
+        .route("/logout", post(ui::logout).get(ui::logout))
+        .route("/csrf-error", get(ui::csrf_error_page));
+
+    let session_state = middleware::SessionLayerState {
+        store: state.sessions.clone(),
+        secure: false,
+    };
+
+    protected
+        .merge(public)
+        .layer(axum::middleware::from_fn(middleware::csrf_layer))
+        .layer(axum::middleware::from_fn_with_state(
+            session_state,
+            middleware::session_layer,
+        ))
+        .with_state(state)
+}
+
+pub fn create_router(state: state::AppState) -> Router {
+    let mut router = Router::new()
+        .route("/", axum::routing::get(handlers::list_buckets))
+        .route(
+            "/{bucket}",
+            axum::routing::put(handlers::create_bucket)
+                .get(handlers::get_bucket)
+                .delete(handlers::delete_bucket)
+                .head(handlers::head_bucket)
+                .post(handlers::post_bucket),
+        )
+        .route(
+            "/{bucket}/{*key}",
+            axum::routing::put(handlers::put_object)
+                .get(handlers::get_object)
+                .delete(handlers::delete_object)
+                .head(handlers::head_object)
+                .post(handlers::post_object),
+        );
+
+    if state.config.kms_enabled {
+        router = router
+            .route("/kms/keys", axum::routing::get(handlers::kms::list_keys).post(handlers::kms::create_key))
+            .route("/kms/keys/{key_id}", axum::routing::get(handlers::kms::get_key).delete(handlers::kms::delete_key))
+            .route("/kms/keys/{key_id}/enable", axum::routing::post(handlers::kms::enable_key))
+            .route("/kms/keys/{key_id}/disable", axum::routing::post(handlers::kms::disable_key))
+            .route("/kms/encrypt", axum::routing::post(handlers::kms::encrypt))
+            .route("/kms/decrypt", axum::routing::post(handlers::kms::decrypt))
+            .route("/kms/generate-data-key", axum::routing::post(handlers::kms::generate_data_key));
+    }
+
+    router = router
+        .route("/admin/site/local", axum::routing::get(handlers::admin::get_local_site).put(handlers::admin::update_local_site))
+        .route("/admin/site/all", axum::routing::get(handlers::admin::list_all_sites))
+        .route("/admin/site/peers", axum::routing::post(handlers::admin::register_peer_site))
+        .route("/admin/site/peers/{site_id}", axum::routing::get(handlers::admin::get_peer_site).put(handlers::admin::update_peer_site).delete(handlers::admin::delete_peer_site))
+        .route("/admin/site/peers/{site_id}/health", axum::routing::post(handlers::admin::check_peer_health))
+        .route("/admin/site/topology", axum::routing::get(handlers::admin::get_topology))
+        .route("/admin/site/peers/{site_id}/bidirectional-status", axum::routing::get(handlers::admin::check_bidirectional_status))
+        .route("/admin/iam/users", axum::routing::get(handlers::admin::iam_list_users))
+        .route("/admin/iam/users/{identifier}", axum::routing::get(handlers::admin::iam_get_user))
+        .route("/admin/iam/users/{identifier}/policies", axum::routing::get(handlers::admin::iam_get_user_policies))
+        .route("/admin/iam/users/{identifier}/access-keys", axum::routing::post(handlers::admin::iam_create_access_key))
+        .route("/admin/iam/users/{identifier}/access-keys/{access_key}", axum::routing::delete(handlers::admin::iam_delete_access_key))
+        .route("/admin/iam/users/{identifier}/disable", axum::routing::post(handlers::admin::iam_disable_user))
+        .route("/admin/iam/users/{identifier}/enable", axum::routing::post(handlers::admin::iam_enable_user))
+        .route("/admin/website-domains", axum::routing::get(handlers::admin::list_website_domains).post(handlers::admin::create_website_domain))
+        .route("/admin/website-domains/{domain}", axum::routing::get(handlers::admin::get_website_domain).put(handlers::admin::update_website_domain).delete(handlers::admin::delete_website_domain))
+        .route("/admin/gc/status", axum::routing::get(handlers::admin::gc_status))
+        .route("/admin/gc/run", axum::routing::post(handlers::admin::gc_run))
+        .route("/admin/gc/history", axum::routing::get(handlers::admin::gc_history))
+        .route("/admin/integrity/status", axum::routing::get(handlers::admin::integrity_status))
+        .route("/admin/integrity/run", axum::routing::post(handlers::admin::integrity_run))
+        .route("/admin/integrity/history", axum::routing::get(handlers::admin::integrity_history));
+
+    let mut router = router
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            middleware::auth_layer,
+        ))
+        .layer(axum::middleware::from_fn(middleware::server_header))
+        .with_state(state.clone());
+
+    if state.config.ui_enabled {
+        let static_service = tower_http::services::ServeDir::new(&state.config.static_dir);
+        router = router
+            .nest_service("/static", static_service)
+            .merge(create_ui_router(state));
+    }
+
+    router
+}

rust/myfsio-engine/crates/myfsio-server/src/main.rs

@@ -0,0 +1,129 @@
+use clap::{Parser, Subcommand};
+use myfsio_server::config::ServerConfig;
+use myfsio_server::state::AppState;
+
+#[derive(Parser)]
+#[command(name = "myfsio", version, about = "MyFSIO S3-compatible storage engine")]
+struct Cli {
+    #[command(subcommand)]
+    command: Option<Command>,
+}
+
+#[derive(Subcommand)]
+enum Command {
+    Serve,
+    Version,
+}
+
+#[tokio::main]
+async fn main() {
+    tracing_subscriber::fmt::init();
+
+    let cli = Cli::parse();
+    match cli.command.unwrap_or(Command::Serve) {
+        Command::Version => {
+            println!("myfsio {}", env!("CARGO_PKG_VERSION"));
+            return;
+        }
+        Command::Serve => {}
+    }
+
+    let config = ServerConfig::from_env();
+    let bind_addr = config.bind_addr;
+
+    tracing::info!("MyFSIO Rust Engine starting on {}", bind_addr);
+    tracing::info!("Storage root: {}", config.storage_root.display());
+    tracing::info!("Region: {}", config.region);
+    tracing::info!(
+        "Encryption: {}, KMS: {}, GC: {}, Lifecycle: {}, Integrity: {}, Metrics: {}, UI: {}",
+        config.encryption_enabled,
+        config.kms_enabled,
+        config.gc_enabled,
+        config.lifecycle_enabled,
+        config.integrity_enabled,
+        config.metrics_enabled,
+        config.ui_enabled
+    );
+
+    let state = if config.encryption_enabled || config.kms_enabled {
+        AppState::new_with_encryption(config.clone()).await
+    } else {
+        AppState::new(config.clone())
+    };
+
+    let mut bg_handles: Vec<tokio::task::JoinHandle<()>> = Vec::new();
+
+    if let Some(ref gc) = state.gc {
+        bg_handles.push(gc.clone().start_background());
+        tracing::info!("GC background service started");
+    }
+
+    if let Some(ref integrity) = state.integrity {
+        bg_handles.push(integrity.clone().start_background());
+        tracing::info!("Integrity checker background service started");
+    }
+
+    if let Some(ref metrics) = state.metrics {
+        bg_handles.push(metrics.clone().start_background());
+        tracing::info!("Metrics collector background service started");
+    }
+
+    if config.lifecycle_enabled {
+        let lifecycle = std::sync::Arc::new(
+            myfsio_server::services::lifecycle::LifecycleService::new(
+                state.storage.clone(),
+                myfsio_server::services::lifecycle::LifecycleConfig::default(),
+            ),
+        );
+        bg_handles.push(lifecycle.start_background());
+        tracing::info!("Lifecycle manager background service started");
+    }
+
+    if let Some(ref site_sync) = state.site_sync {
+        let worker = site_sync.clone();
+        bg_handles.push(tokio::spawn(async move {
+            worker.run().await;
+        }));
+        tracing::info!("Site sync worker started");
+    }
+
+    let app = myfsio_server::create_router(state);
+
+    let listener = match tokio::net::TcpListener::bind(bind_addr).await {
+        Ok(listener) => listener,
+        Err(err) => {
+            if err.kind() == std::io::ErrorKind::AddrInUse {
+                tracing::error!("Port already in use: {}", bind_addr);
+            } else {
+                tracing::error!("Failed to bind {}: {}", bind_addr, err);
+            }
+            for handle in bg_handles {
+                handle.abort();
+            }
+            std::process::exit(1);
+        }
+    };
+    tracing::info!("Listening on {}", bind_addr);
+
+    if let Err(err) = axum::serve(listener, app)
+        .with_graceful_shutdown(shutdown_signal())
+        .await
+    {
+        tracing::error!("Server exited with error: {}", err);
+        for handle in bg_handles {
+            handle.abort();
+        }
+        std::process::exit(1);
+    }
+
+    for handle in bg_handles {
+        handle.abort();
+    }
+}
+
+async fn shutdown_signal() {
+    tokio::signal::ctrl_c()
+        .await
+        .expect("Failed to listen for Ctrl+C");
+    tracing::info!("Shutdown signal received");
+}

rust/myfsio-engine/crates/myfsio-server/src/middleware/auth.rs

@@ -0,0 +1,569 @@
+use axum::extract::{Request, State};
+use axum::http::{Method, StatusCode};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+
+use chrono::{NaiveDateTime, Utc};
+use myfsio_auth::sigv4;
+use myfsio_common::error::{S3Error, S3ErrorCode};
+use myfsio_common::types::Principal;
+
+use crate::state::AppState;
+
+pub async fn auth_layer(
+    State(state): State<AppState>,
+    mut req: Request,
+    next: Next,
+) -> Response {
+    let uri = req.uri().clone();
+    let path = uri.path().to_string();
+
+    if path == "/" && req.method() == axum::http::Method::GET {
+        match try_auth(&state, &req) {
+            AuthResult::Ok(principal) => {
+                if let Err(err) = authorize_request(&state, &principal, &req) {
+                    return error_response(err, &path);
+                }
+                req.extensions_mut().insert(principal);
+            }
+            AuthResult::Denied(err) => return error_response(err, &path),
+            AuthResult::NoAuth => {
+                return error_response(
+                    S3Error::new(S3ErrorCode::AccessDenied, "Missing credentials"),
+                    &path,
+                );
+            }
+        }
+        return next.run(req).await;
+    }
+
+    match try_auth(&state, &req) {
+        AuthResult::Ok(principal) => {
+            if let Err(err) = authorize_request(&state, &principal, &req) {
+                return error_response(err, &path);
+            }
+            req.extensions_mut().insert(principal);
+            next.run(req).await
+        }
+        AuthResult::Denied(err) => error_response(err, &path),
+        AuthResult::NoAuth => {
+            error_response(
+                S3Error::new(S3ErrorCode::AccessDenied, "Missing credentials"),
+                &path,
+            )
+        }
+    }
+}
+
+enum AuthResult {
+    Ok(Principal),
+    Denied(S3Error),
+    NoAuth,
+}
+
+fn authorize_request(state: &AppState, principal: &Principal, req: &Request) -> Result<(), S3Error> {
+    let path = req.uri().path();
+    if path == "/" {
+        if state.iam.authorize(principal, None, "list", None) {
+            return Ok(());
+        }
+        return Err(S3Error::new(S3ErrorCode::AccessDenied, "Access denied"));
+    }
+
+    if path.starts_with("/admin/") || path.starts_with("/kms/") {
+        return Ok(());
+    }
+
+    let mut segments = path.trim_start_matches('/').split('/').filter(|s| !s.is_empty());
+    let bucket = match segments.next() {
+        Some(b) => b,
+        None => {
+            return Err(S3Error::new(S3ErrorCode::AccessDenied, "Access denied"));
+        }
+    };
+    let remaining: Vec<&str> = segments.collect();
+    let query = req.uri().query().unwrap_or("");
+
+    if remaining.is_empty() {
+        let action = resolve_bucket_action(req.method(), query);
+        if state.iam.authorize(principal, Some(bucket), action, None) {
+            return Ok(());
+        }
+        return Err(S3Error::new(S3ErrorCode::AccessDenied, "Access denied"));
+    }
+
+    let object_key = remaining.join("/");
+    if req.method() == Method::PUT {
+        if let Some(copy_source) = req
+            .headers()
+            .get("x-amz-copy-source")
+            .and_then(|v| v.to_str().ok())
+        {
+            let source = copy_source.strip_prefix('/').unwrap_or(copy_source);
+            if let Some((src_bucket, src_key)) = source.split_once('/') {
+                let source_allowed =
+                    state.iam.authorize(principal, Some(src_bucket), "read", Some(src_key));
+                let dest_allowed =
+                    state.iam.authorize(principal, Some(bucket), "write", Some(&object_key));
+                if source_allowed && dest_allowed {
+                    return Ok(());
+                }
+                return Err(S3Error::new(S3ErrorCode::AccessDenied, "Access denied"));
+            }
+        }
+    }
+
+    let action = resolve_object_action(req.method(), query);
+    if state
+        .iam
+        .authorize(principal, Some(bucket), action, Some(&object_key))
+    {
+        return Ok(());
+    }
+
+    Err(S3Error::new(S3ErrorCode::AccessDenied, "Access denied"))
+}
+
+fn resolve_bucket_action(method: &Method, query: &str) -> &'static str {
+    if has_query_key(query, "versioning") {
+        return "versioning";
+    }
+    if has_query_key(query, "tagging") {
+        return "tagging";
+    }
+    if has_query_key(query, "cors") {
+        return "cors";
+    }
+    if has_query_key(query, "location") {
+        return "list";
+    }
+    if has_query_key(query, "encryption") {
+        return "encryption";
+    }
+    if has_query_key(query, "lifecycle") {
+        return "lifecycle";
+    }
+    if has_query_key(query, "acl") {
+        return "share";
+    }
+    if has_query_key(query, "policy") || has_query_key(query, "policyStatus") {
+        return "policy";
+    }
+    if has_query_key(query, "replication") {
+        return "replication";
+    }
+    if has_query_key(query, "quota") {
+        return "quota";
+    }
+    if has_query_key(query, "website") {
+        return "website";
+    }
+    if has_query_key(query, "object-lock") {
+        return "object_lock";
+    }
+    if has_query_key(query, "notification") {
+        return "notification";
+    }
+    if has_query_key(query, "logging") {
+        return "logging";
+    }
+    if has_query_key(query, "versions") || has_query_key(query, "uploads") {
+        return "list";
+    }
+    if has_query_key(query, "delete") {
+        return "delete";
+    }
+
+    match *method {
+        Method::GET => "list",
+        Method::HEAD => "read",
+        Method::PUT => "create_bucket",
+        Method::DELETE => "delete_bucket",
+        Method::POST => "write",
+        _ => "list",
+    }
+}
+
+fn resolve_object_action(method: &Method, query: &str) -> &'static str {
+    if has_query_key(query, "tagging") {
+        return if *method == Method::GET { "read" } else { "write" };
+    }
+    if has_query_key(query, "acl") {
+        return if *method == Method::GET { "read" } else { "write" };
+    }
+    if has_query_key(query, "retention") || has_query_key(query, "legal-hold") {
+        return "object_lock";
+    }
+    if has_query_key(query, "attributes") {
+        return "read";
+    }
+    if has_query_key(query, "uploads") || has_query_key(query, "uploadId") {
+        return match *method {
+            Method::GET => "read",
+            _ => "write",
+        };
+    }
+    if has_query_key(query, "select") {
+        return "read";
+    }
+
+    match *method {
+        Method::GET | Method::HEAD => "read",
+        Method::PUT => "write",
+        Method::DELETE => "delete",
+        Method::POST => "write",
+        _ => "read",
+    }
+}
+
+fn has_query_key(query: &str, key: &str) -> bool {
+    if query.is_empty() {
+        return false;
+    }
+    query
+        .split('&')
+        .filter(|part| !part.is_empty())
+        .any(|part| part == key || part.starts_with(&format!("{}=", key)))
+}
+
+fn try_auth(state: &AppState, req: &Request) -> AuthResult {
+    if let Some(auth_header) = req.headers().get("authorization") {
+        if let Ok(auth_str) = auth_header.to_str() {
+            if auth_str.starts_with("AWS4-HMAC-SHA256 ") {
+                return verify_sigv4_header(state, req, auth_str);
+            }
+        }
+    }
+
+    let query = req.uri().query().unwrap_or("");
+    if query.contains("X-Amz-Algorithm=AWS4-HMAC-SHA256") {
+        return verify_sigv4_query(state, req);
+    }
+
+    if let (Some(ak), Some(sk)) = (
+        req.headers().get("x-access-key").and_then(|v| v.to_str().ok()),
+        req.headers().get("x-secret-key").and_then(|v| v.to_str().ok()),
+    ) {
+        return match state.iam.authenticate(ak, sk) {
+            Some(principal) => AuthResult::Ok(principal),
+            None => AuthResult::Denied(
+                S3Error::from_code(S3ErrorCode::SignatureDoesNotMatch),
+            ),
+        };
+    }
+
+    AuthResult::NoAuth
+}
+
+fn verify_sigv4_header(state: &AppState, req: &Request, auth_str: &str) -> AuthResult {
+    let parts: Vec<&str> = auth_str
+        .strip_prefix("AWS4-HMAC-SHA256 ")
+        .unwrap()
+        .split(", ")
+        .collect();
+
+    if parts.len() != 3 {
+        return AuthResult::Denied(
+            S3Error::new(S3ErrorCode::InvalidArgument, "Malformed Authorization header"),
+        );
+    }
+
+    let credential = parts[0].strip_prefix("Credential=").unwrap_or("");
+    let signed_headers_str = parts[1].strip_prefix("SignedHeaders=").unwrap_or("");
+    let provided_signature = parts[2].strip_prefix("Signature=").unwrap_or("");
+
+    let cred_parts: Vec<&str> = credential.split('/').collect();
+    if cred_parts.len() != 5 {
+        return AuthResult::Denied(
+            S3Error::new(S3ErrorCode::InvalidArgument, "Malformed credential"),
+        );
+    }
+
+    let access_key = cred_parts[0];
+    let date_stamp = cred_parts[1];
+    let region = cred_parts[2];
+    let service = cred_parts[3];
+
+    let amz_date = req
+        .headers()
+        .get("x-amz-date")
+        .or_else(|| req.headers().get("date"))
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("");
+
+    if amz_date.is_empty() {
+        return AuthResult::Denied(
+            S3Error::new(S3ErrorCode::AccessDenied, "Missing Date header"),
+        );
+    }
+
+    if let Some(err) = check_timestamp_freshness(amz_date, state.config.sigv4_timestamp_tolerance_secs) {
+        return AuthResult::Denied(err);
+    }
+
+    let secret_key = match state.iam.get_secret_key(access_key) {
+        Some(sk) => sk,
+        None => {
+            return AuthResult::Denied(
+                S3Error::from_code(S3ErrorCode::InvalidAccessKeyId),
+            );
+        }
+    };
+
+    let method = req.method().as_str();
+    let canonical_uri = req.uri().path();
+
+    let query_params = parse_query_params(req.uri().query().unwrap_or(""));
+
+    let payload_hash = req
+        .headers()
+        .get("x-amz-content-sha256")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("UNSIGNED-PAYLOAD");
+
+    let signed_headers: Vec<&str> = signed_headers_str.split(';').collect();
+    let header_values: Vec<(String, String)> = signed_headers
+        .iter()
+        .map(|&name| {
+            let value = req
+                .headers()
+                .get(name)
+                .and_then(|v| v.to_str().ok())
+                .unwrap_or("");
+            (name.to_string(), value.to_string())
+        })
+        .collect();
+
+    let verified = sigv4::verify_sigv4_signature(
+        method,
+        canonical_uri,
+        &query_params,
+        signed_headers_str,
+        &header_values,
+        payload_hash,
+        amz_date,
+        date_stamp,
+        region,
+        service,
+        &secret_key,
+        provided_signature,
+    );
+
+    if !verified {
+        return AuthResult::Denied(
+            S3Error::from_code(S3ErrorCode::SignatureDoesNotMatch),
+        );
+    }
+
+    match state.iam.get_principal(access_key) {
+        Some(p) => AuthResult::Ok(p),
+        None => AuthResult::Denied(
+            S3Error::from_code(S3ErrorCode::InvalidAccessKeyId),
+        ),
+    }
+}
+
+fn verify_sigv4_query(state: &AppState, req: &Request) -> AuthResult {
+    let query = req.uri().query().unwrap_or("");
+    let params = parse_query_params(query);
+    let param_map: std::collections::HashMap<&str, &str> = params
+        .iter()
+        .map(|(k, v)| (k.as_str(), v.as_str()))
+        .collect();
+
+    let credential = match param_map.get("X-Amz-Credential") {
+        Some(c) => *c,
+        None => {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::InvalidArgument, "Missing X-Amz-Credential"),
+            );
+        }
+    };
+
+    let signed_headers_str = param_map
+        .get("X-Amz-SignedHeaders")
+        .copied()
+        .unwrap_or("host");
+    let provided_signature = match param_map.get("X-Amz-Signature") {
+        Some(s) => *s,
+        None => {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::InvalidArgument, "Missing X-Amz-Signature"),
+            );
+        }
+    };
+    let amz_date = match param_map.get("X-Amz-Date") {
+        Some(d) => *d,
+        None => {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::InvalidArgument, "Missing X-Amz-Date"),
+            );
+        }
+    };
+    let expires_str = match param_map.get("X-Amz-Expires") {
+        Some(e) => *e,
+        None => {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::InvalidArgument, "Missing X-Amz-Expires"),
+            );
+        }
+    };
+
+    let cred_parts: Vec<&str> = credential.split('/').collect();
+    if cred_parts.len() != 5 {
+        return AuthResult::Denied(
+            S3Error::new(S3ErrorCode::InvalidArgument, "Malformed credential"),
+        );
+    }
+
+    let access_key = cred_parts[0];
+    let date_stamp = cred_parts[1];
+    let region = cred_parts[2];
+    let service = cred_parts[3];
+
+    let expires: u64 = match expires_str.parse() {
+        Ok(e) => e,
+        Err(_) => {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::InvalidArgument, "Invalid X-Amz-Expires"),
+            );
+        }
+    };
+
+    if expires < state.config.presigned_url_min_expiry
+        || expires > state.config.presigned_url_max_expiry
+    {
+        return AuthResult::Denied(
+            S3Error::new(S3ErrorCode::InvalidArgument, "X-Amz-Expires out of range"),
+        );
+    }
+
+    if let Ok(request_time) =
+        NaiveDateTime::parse_from_str(amz_date, "%Y%m%dT%H%M%SZ")
+    {
+        let request_utc = request_time.and_utc();
+        let now = Utc::now();
+        let elapsed = (now - request_utc).num_seconds();
+        if elapsed > expires as i64 {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::AccessDenied, "Request has expired"),
+            );
+        }
+        if elapsed < -(state.config.sigv4_timestamp_tolerance_secs as i64) {
+            return AuthResult::Denied(
+                S3Error::new(S3ErrorCode::AccessDenied, "Request is too far in the future"),
+            );
+        }
+    }
+
+    let secret_key = match state.iam.get_secret_key(access_key) {
+        Some(sk) => sk,
+        None => {
+            return AuthResult::Denied(
+                S3Error::from_code(S3ErrorCode::InvalidAccessKeyId),
+            );
+        }
+    };
+
+    let method = req.method().as_str();
+    let canonical_uri = req.uri().path();
+
+    let query_params_no_sig: Vec<(String, String)> = params
+        .iter()
+        .filter(|(k, _)| k != "X-Amz-Signature")
+        .cloned()
+        .collect();
+
+    let payload_hash = "UNSIGNED-PAYLOAD";
+
+    let signed_headers: Vec<&str> = signed_headers_str.split(';').collect();
+    let header_values: Vec<(String, String)> = signed_headers
+        .iter()
+        .map(|&name| {
+            let value = req
+                .headers()
+                .get(name)
+                .and_then(|v| v.to_str().ok())
+                .unwrap_or("");
+            (name.to_string(), value.to_string())
+        })
+        .collect();
+
+    let verified = sigv4::verify_sigv4_signature(
+        method,
+        canonical_uri,
+        &query_params_no_sig,
+        signed_headers_str,
+        &header_values,
+        payload_hash,
+        amz_date,
+        date_stamp,
+        region,
+        service,
+        &secret_key,
+        provided_signature,
+    );
+
+    if !verified {
+        return AuthResult::Denied(
+            S3Error::from_code(S3ErrorCode::SignatureDoesNotMatch),
+        );
+    }
+
+    match state.iam.get_principal(access_key) {
+        Some(p) => AuthResult::Ok(p),
+        None => AuthResult::Denied(
+            S3Error::from_code(S3ErrorCode::InvalidAccessKeyId),
+        ),
+    }
+}
+
+fn check_timestamp_freshness(amz_date: &str, tolerance_secs: u64) -> Option<S3Error> {
+    let request_time = NaiveDateTime::parse_from_str(amz_date, "%Y%m%dT%H%M%SZ").ok()?;
+    let request_utc = request_time.and_utc();
+    let now = Utc::now();
+    let diff = (now - request_utc).num_seconds().unsigned_abs();
+
+    if diff > tolerance_secs {
+        return Some(S3Error::new(
+            S3ErrorCode::AccessDenied,
+            "Request timestamp too old or too far in the future",
+        ));
+    }
+    None
+}
+
+fn parse_query_params(query: &str) -> Vec<(String, String)> {
+    if query.is_empty() {
+        return Vec::new();
+    }
+    query
+        .split('&')
+        .filter_map(|pair| {
+            let mut parts = pair.splitn(2, '=');
+            let key = parts.next()?;
+            let value = parts.next().unwrap_or("");
+            Some((
+                urlencoding_decode(key),
+                urlencoding_decode(value),
+            ))
+        })
+        .collect()
+}
+
+fn urlencoding_decode(s: &str) -> String {
+    percent_encoding::percent_decode_str(s)
+        .decode_utf8_lossy()
+        .into_owned()
+}
+
+fn error_response(err: S3Error, resource: &str) -> Response {
+    let status =
+        StatusCode::from_u16(err.http_status()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    let request_id = uuid::Uuid::new_v4().simple().to_string();
+    let body = err
+        .with_resource(resource.to_string())
+        .with_request_id(request_id)
+        .to_xml();
+    (status, [("content-type", "application/xml")], body).into_response()
+}

rust/myfsio-engine/crates/myfsio-server/src/middleware/mod.rs

@@ -0,0 +1,18 @@
+mod auth;
+pub mod session;
+
+pub use auth::auth_layer;
+pub use session::{csrf_layer, session_layer, SessionHandle, SessionLayerState};
+
+use axum::extract::Request;
+use axum::middleware::Next;
+use axum::response::Response;
+
+pub async fn server_header(req: Request, next: Next) -> Response {
+    let mut resp = next.run(req).await;
+    resp.headers_mut().insert(
+        "server",
+        crate::SERVER_HEADER.parse().unwrap(),
+    );
+    resp
+}

rust/myfsio-engine/crates/myfsio-server/src/middleware/session.rs

@@ -0,0 +1,203 @@
+use std::sync::Arc;
+
+use axum::extract::{Request, State};
+use axum::http::{header, HeaderValue, StatusCode};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use cookie::{Cookie, SameSite};
+use parking_lot::Mutex;
+
+use crate::session::{
+    csrf_tokens_match, SessionData, SessionStore, CSRF_FIELD_NAME, CSRF_HEADER_NAME,
+    SESSION_COOKIE_NAME,
+};
+
+#[derive(Clone)]
+pub struct SessionLayerState {
+    pub store: Arc<SessionStore>,
+    pub secure: bool,
+}
+
+#[derive(Clone)]
+pub struct SessionHandle {
+    pub id: String,
+    inner: Arc<Mutex<SessionData>>,
+    dirty: Arc<Mutex<bool>>,
+}
+
+impl SessionHandle {
+    pub fn new(id: String, data: SessionData) -> Self {
+        Self {
+            id,
+            inner: Arc::new(Mutex::new(data)),
+            dirty: Arc::new(Mutex::new(false)),
+        }
+    }
+
+    pub fn read<R>(&self, f: impl FnOnce(&SessionData) -> R) -> R {
+        let guard = self.inner.lock();
+        f(&guard)
+    }
+
+    pub fn write<R>(&self, f: impl FnOnce(&mut SessionData) -> R) -> R {
+        let mut guard = self.inner.lock();
+        let out = f(&mut guard);
+        *self.dirty.lock() = true;
+        out
+    }
+
+    pub fn snapshot(&self) -> SessionData {
+        self.inner.lock().clone()
+    }
+
+    pub fn is_dirty(&self) -> bool {
+        *self.dirty.lock()
+    }
+}
+
+pub async fn session_layer(
+    State(state): State<SessionLayerState>,
+    mut req: Request,
+    next: Next,
+) -> Response {
+    let cookie_id = extract_session_cookie(&req);
+
+    let (session_id, session_data, is_new) = match cookie_id.and_then(|id| {
+        state
+            .store
+            .get(&id)
+            .map(|data| (id.clone(), data))
+    }) {
+        Some((id, data)) => (id, data, false),
+        None => {
+            let (id, data) = state.store.create();
+            (id, data, true)
+        }
+    };
+
+    let handle = SessionHandle::new(session_id.clone(), session_data);
+    req.extensions_mut().insert(handle.clone());
+
+    let mut resp = next.run(req).await;
+
+    if handle.is_dirty() {
+        state.store.save(&handle.id, handle.snapshot());
+    }
+
+    if is_new {
+        let cookie = build_session_cookie(&session_id, state.secure);
+        if let Ok(value) = HeaderValue::from_str(&cookie.to_string()) {
+            resp.headers_mut().append(header::SET_COOKIE, value);
+        }
+    }
+
+    resp
+}
+
+pub async fn csrf_layer(req: Request, next: Next) -> Response {
+    let method = req.method().clone();
+    let needs_check = matches!(
+        method,
+        axum::http::Method::POST
+            | axum::http::Method::PUT
+            | axum::http::Method::PATCH
+            | axum::http::Method::DELETE
+    );
+
+    if !needs_check {
+        return next.run(req).await;
+    }
+
+    let is_ui = req.uri().path().starts_with("/ui/")
+        || req.uri().path() == "/ui"
+        || req.uri().path() == "/login"
+        || req.uri().path() == "/logout";
+    if !is_ui {
+        return next.run(req).await;
+    }
+
+    let handle = match req.extensions().get::<SessionHandle>() {
+        Some(h) => h.clone(),
+        None => return (StatusCode::FORBIDDEN, "Missing session").into_response(),
+    };
+
+    let expected = handle.read(|s| s.csrf_token.clone());
+
+    let header_token = req
+        .headers()
+        .get(CSRF_HEADER_NAME)
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string());
+
+    if let Some(token) = header_token {
+        if csrf_tokens_match(&expected, &token) {
+            return next.run(req).await;
+        }
+    }
+
+    let (parts, body) = req.into_parts();
+    let bytes = match axum::body::to_bytes(body, usize::MAX).await {
+        Ok(b) => b,
+        Err(_) => return (StatusCode::BAD_REQUEST, "Body read failed").into_response(),
+    };
+
+    let content_type = parts
+        .headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("");
+
+    let form_token = if content_type.starts_with("application/x-www-form-urlencoded") {
+        extract_form_token(&bytes)
+    } else {
+        None
+    };
+
+    if let Some(token) = form_token {
+        if csrf_tokens_match(&expected, &token) {
+            let req = Request::from_parts(parts, axum::body::Body::from(bytes));
+            return next.run(req).await;
+        }
+    }
+
+    (StatusCode::FORBIDDEN, "Invalid CSRF token").into_response()
+}
+
+fn extract_session_cookie(req: &Request) -> Option<String> {
+    let raw = req.headers().get(header::COOKIE)?.to_str().ok()?;
+    for pair in raw.split(';') {
+        if let Ok(cookie) = Cookie::parse(pair.trim().to_string()) {
+            if cookie.name() == SESSION_COOKIE_NAME {
+                return Some(cookie.value().to_string());
+            }
+        }
+    }
+    None
+}
+
+fn build_session_cookie(id: &str, secure: bool) -> Cookie<'static> {
+    let mut cookie = Cookie::new(SESSION_COOKIE_NAME, id.to_string());
+    cookie.set_http_only(true);
+    cookie.set_same_site(SameSite::Lax);
+    cookie.set_secure(secure);
+    cookie.set_path("/");
+    cookie
+}
+
+fn extract_form_token(body: &[u8]) -> Option<String> {
+    let text = std::str::from_utf8(body).ok()?;
+    let prefix = format!("{}=", CSRF_FIELD_NAME);
+    for pair in text.split('&') {
+        if let Some(rest) = pair.strip_prefix(&prefix) {
+            return urldecode(rest);
+        }
+    }
+    None
+}
+
+fn urldecode(s: &str) -> Option<String> {
+    percent_encoding::percent_decode_str(&s.replace('+', " "))
+        .decode_utf8()
+        .ok()
+        .map(|c| c.into_owned())
+}

rust/myfsio-engine/crates/myfsio-server/src/services/gc.rs

@@ -0,0 +1,263 @@
+use serde_json::{json, Value};
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Instant;
+use tokio::sync::RwLock;
+
+pub struct GcConfig {
+    pub interval_hours: f64,
+    pub temp_file_max_age_hours: f64,
+    pub multipart_max_age_days: u64,
+    pub lock_file_max_age_hours: f64,
+    pub dry_run: bool,
+}
+
+impl Default for GcConfig {
+    fn default() -> Self {
+        Self {
+            interval_hours: 6.0,
+            temp_file_max_age_hours: 24.0,
+            multipart_max_age_days: 7,
+            lock_file_max_age_hours: 1.0,
+            dry_run: false,
+        }
+    }
+}
+
+pub struct GcService {
+    storage_root: PathBuf,
+    config: GcConfig,
+    running: Arc<RwLock<bool>>,
+    history: Arc<RwLock<Vec<Value>>>,
+    history_path: PathBuf,
+}
+
+impl GcService {
+    pub fn new(storage_root: PathBuf, config: GcConfig) -> Self {
+        let history_path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("gc_history.json");
+
+        let history = if history_path.exists() {
+            std::fs::read_to_string(&history_path)
+                .ok()
+                .and_then(|s| serde_json::from_str::<Value>(&s).ok())
+                .and_then(|v| v.get("executions").and_then(|e| e.as_array().cloned()))
+                .unwrap_or_default()
+        } else {
+            Vec::new()
+        };
+
+        Self {
+            storage_root,
+            config,
+            running: Arc::new(RwLock::new(false)),
+            history: Arc::new(RwLock::new(history)),
+            history_path,
+        }
+    }
+
+    pub async fn status(&self) -> Value {
+        let running = *self.running.read().await;
+        json!({
+            "enabled": true,
+            "running": running,
+            "interval_hours": self.config.interval_hours,
+            "temp_file_max_age_hours": self.config.temp_file_max_age_hours,
+            "multipart_max_age_days": self.config.multipart_max_age_days,
+            "lock_file_max_age_hours": self.config.lock_file_max_age_hours,
+            "dry_run": self.config.dry_run,
+        })
+    }
+
+    pub async fn history(&self) -> Value {
+        let history = self.history.read().await;
+        json!({ "executions": *history })
+    }
+
+    pub async fn run_now(&self, dry_run: bool) -> Result<Value, String> {
+        {
+            let mut running = self.running.write().await;
+            if *running {
+                return Err("GC already running".to_string());
+            }
+            *running = true;
+        }
+
+        let start = Instant::now();
+        let result = self.execute_gc(dry_run || self.config.dry_run).await;
+        let elapsed = start.elapsed().as_secs_f64();
+
+        *self.running.write().await = false;
+
+        let mut result_json = result.clone();
+        if let Some(obj) = result_json.as_object_mut() {
+            obj.insert("execution_time_seconds".to_string(), json!(elapsed));
+        }
+
+        let record = json!({
+            "timestamp": chrono::Utc::now().timestamp_millis() as f64 / 1000.0,
+            "dry_run": dry_run || self.config.dry_run,
+            "result": result_json,
+        });
+
+        {
+            let mut history = self.history.write().await;
+            history.push(record);
+            if history.len() > 50 {
+                let excess = history.len() - 50;
+                history.drain(..excess);
+            }
+        }
+        self.save_history().await;
+
+        Ok(result)
+    }
+
+    async fn execute_gc(&self, dry_run: bool) -> Value {
+        let mut temp_files_deleted = 0u64;
+        let mut temp_bytes_freed = 0u64;
+        let mut multipart_uploads_deleted = 0u64;
+        let mut lock_files_deleted = 0u64;
+        let mut empty_dirs_removed = 0u64;
+        let mut errors: Vec<String> = Vec::new();
+
+        let now = std::time::SystemTime::now();
+        let temp_max_age = std::time::Duration::from_secs_f64(self.config.temp_file_max_age_hours * 3600.0);
+        let multipart_max_age = std::time::Duration::from_secs(self.config.multipart_max_age_days * 86400);
+        let lock_max_age = std::time::Duration::from_secs_f64(self.config.lock_file_max_age_hours * 3600.0);
+
+        let tmp_dir = self.storage_root.join(".myfsio.sys").join("tmp");
+        if tmp_dir.exists() {
+            match std::fs::read_dir(&tmp_dir) {
+                Ok(entries) => {
+                    for entry in entries.flatten() {
+                        if let Ok(metadata) = entry.metadata() {
+                            if let Ok(modified) = metadata.modified() {
+                                if let Ok(age) = now.duration_since(modified) {
+                                    if age > temp_max_age {
+                                        let size = metadata.len();
+                                        if !dry_run {
+                                            if let Err(e) = std::fs::remove_file(entry.path()) {
+                                                errors.push(format!("Failed to remove temp file: {}", e));
+                                                continue;
+                                            }
+                                        }
+                                        temp_files_deleted += 1;
+                                        temp_bytes_freed += size;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                Err(e) => errors.push(format!("Failed to read tmp dir: {}", e)),
+            }
+        }
+
+        let multipart_dir = self.storage_root.join(".myfsio.sys").join("multipart");
+        if multipart_dir.exists() {
+            if let Ok(bucket_dirs) = std::fs::read_dir(&multipart_dir) {
+                for bucket_entry in bucket_dirs.flatten() {
+                    if let Ok(uploads) = std::fs::read_dir(bucket_entry.path()) {
+                        for upload in uploads.flatten() {
+                            if let Ok(metadata) = upload.metadata() {
+                                if let Ok(modified) = metadata.modified() {
+                                    if let Ok(age) = now.duration_since(modified) {
+                                        if age > multipart_max_age {
+                                            if !dry_run {
+                                                let _ = std::fs::remove_dir_all(upload.path());
+                                            }
+                                            multipart_uploads_deleted += 1;
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        let buckets_dir = self.storage_root.join(".myfsio.sys").join("buckets");
+        if buckets_dir.exists() {
+            if let Ok(bucket_dirs) = std::fs::read_dir(&buckets_dir) {
+                for bucket_entry in bucket_dirs.flatten() {
+                    let locks_dir = bucket_entry.path().join("locks");
+                    if locks_dir.exists() {
+                        if let Ok(locks) = std::fs::read_dir(&locks_dir) {
+                            for lock in locks.flatten() {
+                                if let Ok(metadata) = lock.metadata() {
+                                    if let Ok(modified) = metadata.modified() {
+                                        if let Ok(age) = now.duration_since(modified) {
+                                            if age > lock_max_age {
+                                                if !dry_run {
+                                                    let _ = std::fs::remove_file(lock.path());
+                                                }
+                                                lock_files_deleted += 1;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        if !dry_run {
+            for dir in [&tmp_dir, &multipart_dir] {
+                if dir.exists() {
+                    if let Ok(entries) = std::fs::read_dir(dir) {
+                        for entry in entries.flatten() {
+                            if entry.path().is_dir() {
+                                if let Ok(mut contents) = std::fs::read_dir(entry.path()) {
+                                    if contents.next().is_none() {
+                                        let _ = std::fs::remove_dir(entry.path());
+                                        empty_dirs_removed += 1;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        json!({
+            "temp_files_deleted": temp_files_deleted,
+            "temp_bytes_freed": temp_bytes_freed,
+            "multipart_uploads_deleted": multipart_uploads_deleted,
+            "lock_files_deleted": lock_files_deleted,
+            "empty_dirs_removed": empty_dirs_removed,
+            "errors": errors,
+        })
+    }
+
+    async fn save_history(&self) {
+        let history = self.history.read().await;
+        let data = json!({ "executions": *history });
+        if let Some(parent) = self.history_path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let _ = std::fs::write(&self.history_path, serde_json::to_string_pretty(&data).unwrap_or_default());
+    }
+
+    pub fn start_background(self: Arc<Self>) -> tokio::task::JoinHandle<()> {
+        let interval = std::time::Duration::from_secs_f64(self.config.interval_hours * 3600.0);
+        tokio::spawn(async move {
+            let mut timer = tokio::time::interval(interval);
+            timer.tick().await;
+            loop {
+                timer.tick().await;
+                tracing::info!("GC cycle starting");
+                match self.run_now(false).await {
+                    Ok(result) => tracing::info!("GC cycle complete: {:?}", result),
+                    Err(e) => tracing::warn!("GC cycle failed: {}", e),
+                }
+            }
+        })
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/services/integrity.rs

@@ -0,0 +1,204 @@
+use myfsio_storage::fs_backend::FsStorageBackend;
+use myfsio_storage::traits::StorageEngine;
+use serde_json::{json, Value};
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Instant;
+use tokio::sync::RwLock;
+
+pub struct IntegrityConfig {
+    pub interval_hours: f64,
+    pub batch_size: usize,
+    pub auto_heal: bool,
+    pub dry_run: bool,
+}
+
+impl Default for IntegrityConfig {
+    fn default() -> Self {
+        Self {
+            interval_hours: 24.0,
+            batch_size: 1000,
+            auto_heal: false,
+            dry_run: false,
+        }
+    }
+}
+
+pub struct IntegrityService {
+    storage: Arc<FsStorageBackend>,
+    config: IntegrityConfig,
+    running: Arc<RwLock<bool>>,
+    history: Arc<RwLock<Vec<Value>>>,
+    history_path: PathBuf,
+}
+
+impl IntegrityService {
+    pub fn new(
+        storage: Arc<FsStorageBackend>,
+        storage_root: &std::path::Path,
+        config: IntegrityConfig,
+    ) -> Self {
+        let history_path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("integrity_history.json");
+
+        let history = if history_path.exists() {
+            std::fs::read_to_string(&history_path)
+                .ok()
+                .and_then(|s| serde_json::from_str::<Value>(&s).ok())
+                .and_then(|v| v.get("executions").and_then(|e| e.as_array().cloned()))
+                .unwrap_or_default()
+        } else {
+            Vec::new()
+        };
+
+        Self {
+            storage,
+            config,
+            running: Arc::new(RwLock::new(false)),
+            history: Arc::new(RwLock::new(history)),
+            history_path,
+        }
+    }
+
+    pub async fn status(&self) -> Value {
+        let running = *self.running.read().await;
+        json!({
+            "enabled": true,
+            "running": running,
+            "interval_hours": self.config.interval_hours,
+            "batch_size": self.config.batch_size,
+            "auto_heal": self.config.auto_heal,
+            "dry_run": self.config.dry_run,
+        })
+    }
+
+    pub async fn history(&self) -> Value {
+        let history = self.history.read().await;
+        json!({ "executions": *history })
+    }
+
+    pub async fn run_now(&self, dry_run: bool, auto_heal: bool) -> Result<Value, String> {
+        {
+            let mut running = self.running.write().await;
+            if *running {
+                return Err("Integrity check already running".to_string());
+            }
+            *running = true;
+        }
+
+        let start = Instant::now();
+        let result = self.check_integrity(dry_run, auto_heal).await;
+        let elapsed = start.elapsed().as_secs_f64();
+
+        *self.running.write().await = false;
+
+        let mut result_json = result.clone();
+        if let Some(obj) = result_json.as_object_mut() {
+            obj.insert("execution_time_seconds".to_string(), json!(elapsed));
+        }
+
+        let record = json!({
+            "timestamp": chrono::Utc::now().timestamp_millis() as f64 / 1000.0,
+            "dry_run": dry_run,
+            "auto_heal": auto_heal,
+            "result": result_json,
+        });
+
+        {
+            let mut history = self.history.write().await;
+            history.push(record);
+            if history.len() > 50 {
+                let excess = history.len() - 50;
+                history.drain(..excess);
+            }
+        }
+        self.save_history().await;
+
+        Ok(result)
+    }
+
+    async fn check_integrity(&self, _dry_run: bool, _auto_heal: bool) -> Value {
+        let buckets = match self.storage.list_buckets().await {
+            Ok(b) => b,
+            Err(e) => return json!({"error": e.to_string()}),
+        };
+
+        let mut objects_scanned = 0u64;
+        let mut corrupted = 0u64;
+        let mut phantom_metadata = 0u64;
+        let mut errors: Vec<String> = Vec::new();
+
+        for bucket in &buckets {
+            let params = myfsio_common::types::ListParams {
+                max_keys: self.config.batch_size,
+                ..Default::default()
+            };
+            let objects = match self.storage.list_objects(&bucket.name, &params).await {
+                Ok(r) => r.objects,
+                Err(e) => {
+                    errors.push(format!("{}: {}", bucket.name, e));
+                    continue;
+                }
+            };
+
+            for obj in &objects {
+                objects_scanned += 1;
+                match self.storage.get_object_path(&bucket.name, &obj.key).await {
+                    Ok(path) => {
+                        if !path.exists() {
+                            phantom_metadata += 1;
+                        } else if let Some(ref expected_etag) = obj.etag {
+                            match myfsio_crypto::hashing::md5_file(&path) {
+                                Ok(actual_etag) => {
+                                    if &actual_etag != expected_etag {
+                                        corrupted += 1;
+                                    }
+                                }
+                                Err(e) => errors.push(format!("{}:{}: {}", bucket.name, obj.key, e)),
+                            }
+                        }
+                    }
+                    Err(e) => errors.push(format!("{}:{}: {}", bucket.name, obj.key, e)),
+                }
+            }
+        }
+
+        json!({
+            "objects_scanned": objects_scanned,
+            "buckets_scanned": buckets.len(),
+            "corrupted_objects": corrupted,
+            "phantom_metadata": phantom_metadata,
+            "errors": errors,
+        })
+    }
+
+    async fn save_history(&self) {
+        let history = self.history.read().await;
+        let data = json!({ "executions": *history });
+        if let Some(parent) = self.history_path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let _ = std::fs::write(
+            &self.history_path,
+            serde_json::to_string_pretty(&data).unwrap_or_default(),
+        );
+    }
+
+    pub fn start_background(self: Arc<Self>) -> tokio::task::JoinHandle<()> {
+        let interval = std::time::Duration::from_secs_f64(self.config.interval_hours * 3600.0);
+        tokio::spawn(async move {
+            let mut timer = tokio::time::interval(interval);
+            timer.tick().await;
+            loop {
+                timer.tick().await;
+                tracing::info!("Integrity check starting");
+                match self.run_now(false, false).await {
+                    Ok(result) => tracing::info!("Integrity check complete: {:?}", result),
+                    Err(e) => tracing::warn!("Integrity check failed: {}", e),
+                }
+            }
+        })
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/services/lifecycle.rs

@@ -0,0 +1,153 @@
+use myfsio_storage::fs_backend::FsStorageBackend;
+use myfsio_storage::traits::StorageEngine;
+use serde_json::{json, Value};
+use std::sync::Arc;
+use tokio::sync::RwLock;
+
+pub struct LifecycleConfig {
+    pub interval_seconds: u64,
+}
+
+impl Default for LifecycleConfig {
+    fn default() -> Self {
+        Self {
+            interval_seconds: 3600,
+        }
+    }
+}
+
+pub struct LifecycleService {
+    storage: Arc<FsStorageBackend>,
+    config: LifecycleConfig,
+    running: Arc<RwLock<bool>>,
+}
+
+impl LifecycleService {
+    pub fn new(storage: Arc<FsStorageBackend>, config: LifecycleConfig) -> Self {
+        Self {
+            storage,
+            config,
+            running: Arc::new(RwLock::new(false)),
+        }
+    }
+
+    pub async fn run_cycle(&self) -> Result<Value, String> {
+        {
+            let mut running = self.running.write().await;
+            if *running {
+                return Err("Lifecycle already running".to_string());
+            }
+            *running = true;
+        }
+
+        let result = self.evaluate_rules().await;
+        *self.running.write().await = false;
+        Ok(result)
+    }
+
+    async fn evaluate_rules(&self) -> Value {
+        let buckets = match self.storage.list_buckets().await {
+            Ok(b) => b,
+            Err(e) => return json!({"error": e.to_string()}),
+        };
+
+        let mut total_expired = 0u64;
+        let mut total_multipart_aborted = 0u64;
+        let mut errors: Vec<String> = Vec::new();
+
+        for bucket in &buckets {
+            let config = match self.storage.get_bucket_config(&bucket.name).await {
+                Ok(c) => c,
+                Err(_) => continue,
+            };
+
+            let lifecycle = match &config.lifecycle {
+                Some(lc) => lc,
+                None => continue,
+            };
+
+            let rules = match lifecycle.as_str().and_then(|s| serde_json::from_str::<Value>(s).ok()) {
+                Some(v) => v,
+                None => continue,
+            };
+
+            let rules_arr = match rules.get("Rules").and_then(|r| r.as_array()) {
+                Some(a) => a.clone(),
+                None => continue,
+            };
+
+            for rule in &rules_arr {
+                if rule.get("Status").and_then(|s| s.as_str()) != Some("Enabled") {
+                    continue;
+                }
+
+                let prefix = rule
+                    .get("Filter")
+                    .and_then(|f| f.get("Prefix"))
+                    .and_then(|p| p.as_str())
+                    .or_else(|| rule.get("Prefix").and_then(|p| p.as_str()))
+                    .unwrap_or("");
+
+                if let Some(exp) = rule.get("Expiration") {
+                    if let Some(days) = exp.get("Days").and_then(|d| d.as_u64()) {
+                        let cutoff = chrono::Utc::now() - chrono::Duration::days(days as i64);
+                        let params = myfsio_common::types::ListParams {
+                            max_keys: 1000,
+                            prefix: if prefix.is_empty() { None } else { Some(prefix.to_string()) },
+                            ..Default::default()
+                        };
+                        if let Ok(result) = self.storage.list_objects(&bucket.name, &params).await {
+                            for obj in &result.objects {
+                                if obj.last_modified < cutoff {
+                                    match self.storage.delete_object(&bucket.name, &obj.key).await {
+                                        Ok(()) => total_expired += 1,
+                                        Err(e) => errors.push(format!("{}:{}: {}", bucket.name, obj.key, e)),
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+
+                if let Some(abort) = rule.get("AbortIncompleteMultipartUpload") {
+                    if let Some(days) = abort.get("DaysAfterInitiation").and_then(|d| d.as_u64()) {
+                        let cutoff = chrono::Utc::now() - chrono::Duration::days(days as i64);
+                        if let Ok(uploads) = self.storage.list_multipart_uploads(&bucket.name).await {
+                            for upload in &uploads {
+                                if upload.initiated < cutoff {
+                                    match self.storage.abort_multipart(&bucket.name, &upload.upload_id).await {
+                                        Ok(()) => total_multipart_aborted += 1,
+                                        Err(e) => errors.push(format!("abort {}: {}", upload.upload_id, e)),
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        json!({
+            "objects_expired": total_expired,
+            "multipart_aborted": total_multipart_aborted,
+            "buckets_evaluated": buckets.len(),
+            "errors": errors,
+        })
+    }
+
+    pub fn start_background(self: Arc<Self>) -> tokio::task::JoinHandle<()> {
+        let interval = std::time::Duration::from_secs(self.config.interval_seconds);
+        tokio::spawn(async move {
+            let mut timer = tokio::time::interval(interval);
+            timer.tick().await;
+            loop {
+                timer.tick().await;
+                tracing::info!("Lifecycle evaluation starting");
+                match self.run_cycle().await {
+                    Ok(result) => tracing::info!("Lifecycle cycle complete: {:?}", result),
+                    Err(e) => tracing::warn!("Lifecycle cycle failed: {}", e),
+                }
+            }
+        })
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/services/metrics.rs

@@ -0,0 +1,365 @@
+use chrono::{DateTime, Utc};
+use parking_lot::Mutex;
+use rand::Rng;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+const MAX_LATENCY_SAMPLES: usize = 5000;
+
+pub struct MetricsConfig {
+    pub interval_minutes: u64,
+    pub retention_hours: u64,
+}
+
+impl Default for MetricsConfig {
+    fn default() -> Self {
+        Self {
+            interval_minutes: 5,
+            retention_hours: 24,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+struct OperationStats {
+    count: u64,
+    success_count: u64,
+    error_count: u64,
+    latency_sum_ms: f64,
+    latency_min_ms: f64,
+    latency_max_ms: f64,
+    bytes_in: u64,
+    bytes_out: u64,
+    latency_samples: Vec<f64>,
+}
+
+impl Default for OperationStats {
+    fn default() -> Self {
+        Self {
+            count: 0,
+            success_count: 0,
+            error_count: 0,
+            latency_sum_ms: 0.0,
+            latency_min_ms: f64::INFINITY,
+            latency_max_ms: 0.0,
+            bytes_in: 0,
+            bytes_out: 0,
+            latency_samples: Vec::new(),
+        }
+    }
+}
+
+impl OperationStats {
+    fn record(&mut self, latency_ms: f64, success: bool, bytes_in: u64, bytes_out: u64) {
+        self.count += 1;
+        if success {
+            self.success_count += 1;
+        } else {
+            self.error_count += 1;
+        }
+        self.latency_sum_ms += latency_ms;
+        if latency_ms < self.latency_min_ms {
+            self.latency_min_ms = latency_ms;
+        }
+        if latency_ms > self.latency_max_ms {
+            self.latency_max_ms = latency_ms;
+        }
+        self.bytes_in += bytes_in;
+        self.bytes_out += bytes_out;
+
+        if self.latency_samples.len() < MAX_LATENCY_SAMPLES {
+            self.latency_samples.push(latency_ms);
+        } else {
+            let mut rng = rand::thread_rng();
+            let j = rng.gen_range(0..self.count as usize);
+            if j < MAX_LATENCY_SAMPLES {
+                self.latency_samples[j] = latency_ms;
+            }
+        }
+    }
+
+    fn compute_percentile(sorted: &[f64], p: f64) -> f64 {
+        if sorted.is_empty() {
+            return 0.0;
+        }
+        let k = (sorted.len() - 1) as f64 * (p / 100.0);
+        let f = k.floor() as usize;
+        let c = (f + 1).min(sorted.len() - 1);
+        let d = k - f as f64;
+        sorted[f] + d * (sorted[c] - sorted[f])
+    }
+
+    fn to_json(&self) -> Value {
+        let avg = if self.count > 0 {
+            self.latency_sum_ms / self.count as f64
+        } else {
+            0.0
+        };
+        let min = if self.latency_min_ms.is_infinite() {
+            0.0
+        } else {
+            self.latency_min_ms
+        };
+        let mut sorted = self.latency_samples.clone();
+        sorted.sort_by(|a, b| a.partial_cmp(b).unwrap_or(std::cmp::Ordering::Equal));
+        json!({
+            "count": self.count,
+            "success_count": self.success_count,
+            "error_count": self.error_count,
+            "latency_avg_ms": round2(avg),
+            "latency_min_ms": round2(min),
+            "latency_max_ms": round2(self.latency_max_ms),
+            "latency_p50_ms": round2(Self::compute_percentile(&sorted, 50.0)),
+            "latency_p95_ms": round2(Self::compute_percentile(&sorted, 95.0)),
+            "latency_p99_ms": round2(Self::compute_percentile(&sorted, 99.0)),
+            "bytes_in": self.bytes_in,
+            "bytes_out": self.bytes_out,
+        })
+    }
+}
+
+fn round2(v: f64) -> f64 {
+    (v * 100.0).round() / 100.0
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MetricsSnapshot {
+    pub timestamp: DateTime<Utc>,
+    pub window_seconds: u64,
+    pub by_method: HashMap<String, Value>,
+    pub by_endpoint: HashMap<String, Value>,
+    pub by_status_class: HashMap<String, u64>,
+    pub error_codes: HashMap<String, u64>,
+    pub totals: Value,
+}
+
+struct Inner {
+    by_method: HashMap<String, OperationStats>,
+    by_endpoint: HashMap<String, OperationStats>,
+    by_status_class: HashMap<String, u64>,
+    error_codes: HashMap<String, u64>,
+    totals: OperationStats,
+    window_start: f64,
+    snapshots: Vec<MetricsSnapshot>,
+}
+
+pub struct MetricsService {
+    config: MetricsConfig,
+    inner: Arc<Mutex<Inner>>,
+    snapshots_path: PathBuf,
+}
+
+impl MetricsService {
+    pub fn new(storage_root: &Path, config: MetricsConfig) -> Self {
+        let snapshots_path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("operation_metrics.json");
+
+        let mut snapshots: Vec<MetricsSnapshot> = if snapshots_path.exists() {
+            std::fs::read_to_string(&snapshots_path)
+                .ok()
+                .and_then(|s| serde_json::from_str::<Value>(&s).ok())
+                .and_then(|v| {
+                    v.get("snapshots")
+                        .and_then(|s| serde_json::from_value::<Vec<MetricsSnapshot>>(s.clone()).ok())
+                })
+                .unwrap_or_default()
+        } else {
+            Vec::new()
+        };
+        let cutoff = now_secs() - (config.retention_hours * 3600) as f64;
+        snapshots.retain(|s| s.timestamp.timestamp() as f64 > cutoff);
+
+        Self {
+            config,
+            inner: Arc::new(Mutex::new(Inner {
+                by_method: HashMap::new(),
+                by_endpoint: HashMap::new(),
+                by_status_class: HashMap::new(),
+                error_codes: HashMap::new(),
+                totals: OperationStats::default(),
+                window_start: now_secs(),
+                snapshots,
+            })),
+            snapshots_path,
+        }
+    }
+
+    pub fn record_request(
+        &self,
+        method: &str,
+        endpoint_type: &str,
+        status_code: u16,
+        latency_ms: f64,
+        bytes_in: u64,
+        bytes_out: u64,
+        error_code: Option<&str>,
+    ) {
+        let success = (200..400).contains(&status_code);
+        let status_class = format!("{}xx", status_code / 100);
+
+        let mut inner = self.inner.lock();
+        inner
+            .by_method
+            .entry(method.to_string())
+            .or_default()
+            .record(latency_ms, success, bytes_in, bytes_out);
+        inner
+            .by_endpoint
+            .entry(endpoint_type.to_string())
+            .or_default()
+            .record(latency_ms, success, bytes_in, bytes_out);
+        *inner.by_status_class.entry(status_class).or_insert(0) += 1;
+        if let Some(code) = error_code {
+            *inner.error_codes.entry(code.to_string()).or_insert(0) += 1;
+        }
+        inner.totals.record(latency_ms, success, bytes_in, bytes_out);
+    }
+
+    pub fn get_current_stats(&self) -> Value {
+        let inner = self.inner.lock();
+        let window_seconds = (now_secs() - inner.window_start).max(0.0) as u64;
+        let by_method: HashMap<String, Value> = inner
+            .by_method
+            .iter()
+            .map(|(k, v)| (k.clone(), v.to_json()))
+            .collect();
+        let by_endpoint: HashMap<String, Value> = inner
+            .by_endpoint
+            .iter()
+            .map(|(k, v)| (k.clone(), v.to_json()))
+            .collect();
+        json!({
+            "timestamp": Utc::now().to_rfc3339(),
+            "window_seconds": window_seconds,
+            "by_method": by_method,
+            "by_endpoint": by_endpoint,
+            "by_status_class": inner.by_status_class,
+            "error_codes": inner.error_codes,
+            "totals": inner.totals.to_json(),
+        })
+    }
+
+    pub fn get_history(&self, hours: Option<u64>) -> Vec<MetricsSnapshot> {
+        let inner = self.inner.lock();
+        let mut snapshots = inner.snapshots.clone();
+        if let Some(h) = hours {
+            let cutoff = now_secs() - (h * 3600) as f64;
+            snapshots.retain(|s| s.timestamp.timestamp() as f64 > cutoff);
+        }
+        snapshots
+    }
+
+    pub fn snapshot(&self) -> Value {
+        let current = self.get_current_stats();
+        let history = self.get_history(None);
+        json!({
+            "enabled": true,
+            "current": current,
+            "snapshots": history,
+        })
+    }
+
+    fn take_snapshot(&self) {
+        let snapshot = {
+            let mut inner = self.inner.lock();
+            let window_seconds = (now_secs() - inner.window_start).max(0.0) as u64;
+
+            let by_method: HashMap<String, Value> = inner
+                .by_method
+                .iter()
+                .map(|(k, v)| (k.clone(), v.to_json()))
+                .collect();
+            let by_endpoint: HashMap<String, Value> = inner
+                .by_endpoint
+                .iter()
+                .map(|(k, v)| (k.clone(), v.to_json()))
+                .collect();
+
+            let snap = MetricsSnapshot {
+                timestamp: Utc::now(),
+                window_seconds,
+                by_method,
+                by_endpoint,
+                by_status_class: inner.by_status_class.clone(),
+                error_codes: inner.error_codes.clone(),
+                totals: inner.totals.to_json(),
+            };
+
+            inner.snapshots.push(snap.clone());
+            let cutoff = now_secs() - (self.config.retention_hours * 3600) as f64;
+            inner
+                .snapshots
+                .retain(|s| s.timestamp.timestamp() as f64 > cutoff);
+
+            inner.by_method.clear();
+            inner.by_endpoint.clear();
+            inner.by_status_class.clear();
+            inner.error_codes.clear();
+            inner.totals = OperationStats::default();
+            inner.window_start = now_secs();
+
+            snap
+        };
+        let _ = snapshot;
+        self.save_snapshots();
+    }
+
+    fn save_snapshots(&self) {
+        let snapshots = { self.inner.lock().snapshots.clone() };
+        if let Some(parent) = self.snapshots_path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let data = json!({ "snapshots": snapshots });
+        let _ = std::fs::write(
+            &self.snapshots_path,
+            serde_json::to_string_pretty(&data).unwrap_or_default(),
+        );
+    }
+
+    pub fn start_background(self: Arc<Self>) -> tokio::task::JoinHandle<()> {
+        let interval = std::time::Duration::from_secs(self.config.interval_minutes * 60);
+        tokio::spawn(async move {
+            let mut timer = tokio::time::interval(interval);
+            timer.tick().await;
+            loop {
+                timer.tick().await;
+                self.take_snapshot();
+            }
+        })
+    }
+}
+
+pub fn classify_endpoint(path: &str) -> &'static str {
+    if path.is_empty() || path == "/" {
+        return "service";
+    }
+    let trimmed = path.trim_end_matches('/');
+    if trimmed.starts_with("/ui") {
+        return "ui";
+    }
+    if trimmed.starts_with("/kms") {
+        return "kms";
+    }
+    if trimmed.starts_with("/myfsio") {
+        return "service";
+    }
+    let parts: Vec<&str> = trimmed.trim_start_matches('/').split('/').collect();
+    match parts.len() {
+        0 => "service",
+        1 => "bucket",
+        _ => "object",
+    }
+}
+
+fn now_secs() -> f64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs_f64())
+        .unwrap_or(0.0)
+}

rust/myfsio-engine/crates/myfsio-server/src/services/mod.rs

@@ -0,0 +1,9 @@
+pub mod gc;
+pub mod lifecycle;
+pub mod integrity;
+pub mod metrics;
+pub mod replication;
+pub mod s3_client;
+pub mod site_registry;
+pub mod site_sync;
+pub mod website_domains;

rust/myfsio-engine/crates/myfsio-server/src/services/replication.rs

@@ -0,0 +1,604 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use aws_sdk_s3::primitives::ByteStream;
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use tokio::sync::Semaphore;
+
+use myfsio_storage::fs_backend::FsStorageBackend;
+use myfsio_storage::traits::StorageEngine;
+
+use crate::services::s3_client::{build_client, check_endpoint_health, ClientOptions};
+use crate::stores::connections::{ConnectionStore, RemoteConnection};
+
+pub const MODE_NEW_ONLY: &str = "new_only";
+pub const MODE_ALL: &str = "all";
+pub const MODE_BIDIRECTIONAL: &str = "bidirectional";
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ReplicationStats {
+    #[serde(default)]
+    pub objects_synced: u64,
+    #[serde(default)]
+    pub objects_pending: u64,
+    #[serde(default)]
+    pub objects_orphaned: u64,
+    #[serde(default)]
+    pub bytes_synced: u64,
+    #[serde(default)]
+    pub last_sync_at: Option<f64>,
+    #[serde(default)]
+    pub last_sync_key: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReplicationRule {
+    pub bucket_name: String,
+    pub target_connection_id: String,
+    pub target_bucket: String,
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    #[serde(default = "default_mode")]
+    pub mode: String,
+    #[serde(default)]
+    pub created_at: Option<f64>,
+    #[serde(default)]
+    pub stats: ReplicationStats,
+    #[serde(default = "default_true")]
+    pub sync_deletions: bool,
+    #[serde(default)]
+    pub last_pull_at: Option<f64>,
+    #[serde(default)]
+    pub filter_prefix: Option<String>,
+}
+
+fn default_true() -> bool {
+    true
+}
+fn default_mode() -> String {
+    MODE_NEW_ONLY.to_string()
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReplicationFailure {
+    pub object_key: String,
+    pub error_message: String,
+    pub timestamp: f64,
+    pub failure_count: u32,
+    pub bucket_name: String,
+    pub action: String,
+    #[serde(default)]
+    pub last_error_code: Option<String>,
+}
+
+pub struct ReplicationFailureStore {
+    storage_root: PathBuf,
+    max_failures_per_bucket: usize,
+    cache: Mutex<HashMap<String, Vec<ReplicationFailure>>>,
+}
+
+impl ReplicationFailureStore {
+    pub fn new(storage_root: PathBuf, max_failures_per_bucket: usize) -> Self {
+        Self {
+            storage_root,
+            max_failures_per_bucket,
+            cache: Mutex::new(HashMap::new()),
+        }
+    }
+
+    fn path(&self, bucket: &str) -> PathBuf {
+        self.storage_root
+            .join(".myfsio.sys")
+            .join("buckets")
+            .join(bucket)
+            .join("replication_failures.json")
+    }
+
+    fn load_from_disk(&self, bucket: &str) -> Vec<ReplicationFailure> {
+        let path = self.path(bucket);
+        if !path.exists() {
+            return Vec::new();
+        }
+        match std::fs::read_to_string(&path) {
+            Ok(text) => {
+                let parsed: serde_json::Value = match serde_json::from_str(&text) {
+                    Ok(v) => v,
+                    Err(_) => return Vec::new(),
+                };
+                parsed
+                    .get("failures")
+                    .and_then(|v| serde_json::from_value(v.clone()).ok())
+                    .unwrap_or_default()
+            }
+            Err(_) => Vec::new(),
+        }
+    }
+
+    fn save_to_disk(&self, bucket: &str, failures: &[ReplicationFailure]) {
+        let path = self.path(bucket);
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let trimmed = &failures[..failures.len().min(self.max_failures_per_bucket)];
+        let data = serde_json::json!({ "failures": trimmed });
+        let _ = std::fs::write(&path, serde_json::to_string_pretty(&data).unwrap_or_default());
+    }
+
+    pub fn load(&self, bucket: &str) -> Vec<ReplicationFailure> {
+        let mut cache = self.cache.lock();
+        if let Some(existing) = cache.get(bucket) {
+            return existing.clone();
+        }
+        let loaded = self.load_from_disk(bucket);
+        cache.insert(bucket.to_string(), loaded.clone());
+        loaded
+    }
+
+    pub fn save(&self, bucket: &str, failures: Vec<ReplicationFailure>) {
+        let trimmed: Vec<ReplicationFailure> = failures
+            .into_iter()
+            .take(self.max_failures_per_bucket)
+            .collect();
+        self.save_to_disk(bucket, &trimmed);
+        self.cache.lock().insert(bucket.to_string(), trimmed);
+    }
+
+    pub fn add(&self, bucket: &str, failure: ReplicationFailure) {
+        let mut failures = self.load(bucket);
+        if let Some(existing) = failures.iter_mut().find(|f| f.object_key == failure.object_key) {
+            existing.failure_count += 1;
+            existing.timestamp = failure.timestamp;
+            existing.error_message = failure.error_message.clone();
+            existing.last_error_code = failure.last_error_code.clone();
+        } else {
+            failures.insert(0, failure);
+        }
+        self.save(bucket, failures);
+    }
+
+    pub fn remove(&self, bucket: &str, object_key: &str) -> bool {
+        let failures = self.load(bucket);
+        let before = failures.len();
+        let after: Vec<_> = failures
+            .into_iter()
+            .filter(|f| f.object_key != object_key)
+            .collect();
+        if after.len() != before {
+            self.save(bucket, after);
+            true
+        } else {
+            false
+        }
+    }
+
+    pub fn clear(&self, bucket: &str) {
+        self.cache.lock().remove(bucket);
+        let path = self.path(bucket);
+        let _ = std::fs::remove_file(path);
+    }
+
+    pub fn get(&self, bucket: &str, object_key: &str) -> Option<ReplicationFailure> {
+        self.load(bucket)
+            .into_iter()
+            .find(|f| f.object_key == object_key)
+    }
+
+    pub fn count(&self, bucket: &str) -> usize {
+        self.load(bucket).len()
+    }
+}
+
+pub struct ReplicationManager {
+    storage: Arc<FsStorageBackend>,
+    connections: Arc<ConnectionStore>,
+    rules_path: PathBuf,
+    rules: Mutex<HashMap<String, ReplicationRule>>,
+    client_options: ClientOptions,
+    streaming_threshold_bytes: u64,
+    pub failures: Arc<ReplicationFailureStore>,
+    semaphore: Arc<Semaphore>,
+}
+
+impl ReplicationManager {
+    pub fn new(
+        storage: Arc<FsStorageBackend>,
+        connections: Arc<ConnectionStore>,
+        storage_root: &Path,
+        connect_timeout: Duration,
+        read_timeout: Duration,
+        max_retries: u32,
+        streaming_threshold_bytes: u64,
+        max_failures_per_bucket: usize,
+    ) -> Self {
+        let rules_path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("replication_rules.json");
+        let rules = load_rules(&rules_path);
+        let failures = Arc::new(ReplicationFailureStore::new(
+            storage_root.to_path_buf(),
+            max_failures_per_bucket,
+        ));
+        let client_options = ClientOptions {
+            connect_timeout,
+            read_timeout,
+            max_attempts: max_retries,
+        };
+        Self {
+            storage,
+            connections,
+            rules_path,
+            rules: Mutex::new(rules),
+            client_options,
+            streaming_threshold_bytes,
+            failures,
+            semaphore: Arc::new(Semaphore::new(4)),
+        }
+    }
+
+    pub fn reload_rules(&self) {
+        *self.rules.lock() = load_rules(&self.rules_path);
+    }
+
+    pub fn list_rules(&self) -> Vec<ReplicationRule> {
+        self.rules.lock().values().cloned().collect()
+    }
+
+    pub fn get_rule(&self, bucket: &str) -> Option<ReplicationRule> {
+        self.rules.lock().get(bucket).cloned()
+    }
+
+    pub fn set_rule(&self, rule: ReplicationRule) {
+        {
+            let mut guard = self.rules.lock();
+            guard.insert(rule.bucket_name.clone(), rule);
+        }
+        self.save_rules();
+    }
+
+    pub fn delete_rule(&self, bucket: &str) {
+        {
+            let mut guard = self.rules.lock();
+            guard.remove(bucket);
+        }
+        self.save_rules();
+    }
+
+    pub fn save_rules(&self) {
+        let snapshot: HashMap<String, ReplicationRule> = self.rules.lock().clone();
+        if let Some(parent) = self.rules_path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Ok(text) = serde_json::to_string_pretty(&snapshot) {
+            let _ = std::fs::write(&self.rules_path, text);
+        }
+    }
+
+    fn update_last_sync(&self, bucket: &str, key: &str) {
+        {
+            let mut guard = self.rules.lock();
+            if let Some(rule) = guard.get_mut(bucket) {
+                rule.stats.last_sync_at = Some(now_secs());
+                rule.stats.last_sync_key = Some(key.to_string());
+            }
+        }
+        self.save_rules();
+    }
+
+    pub async fn trigger(self: Arc<Self>, bucket: String, key: String, action: String) {
+        let rule = match self.get_rule(&bucket) {
+            Some(r) if r.enabled => r,
+            _ => return,
+        };
+        let connection = match self.connections.get(&rule.target_connection_id) {
+            Some(c) => c,
+            None => {
+                tracing::warn!(
+                    "Replication skipped for {}/{}: connection {} not found",
+                    bucket,
+                    key,
+                    rule.target_connection_id
+                );
+                return;
+            }
+        };
+        let permit = match self.semaphore.clone().try_acquire_owned() {
+            Ok(p) => p,
+            Err(_) => {
+                let sem = self.semaphore.clone();
+                match sem.acquire_owned().await {
+                    Ok(p) => p,
+                    Err(_) => return,
+                }
+            }
+        };
+        let manager = self.clone();
+        tokio::spawn(async move {
+            let _permit = permit;
+            manager.replicate_task(&bucket, &key, &rule, &connection, &action).await;
+        });
+    }
+
+    async fn replicate_task(
+        &self,
+        bucket: &str,
+        object_key: &str,
+        rule: &ReplicationRule,
+        conn: &RemoteConnection,
+        action: &str,
+    ) {
+        if object_key.contains("..") || object_key.starts_with('/') || object_key.starts_with('\\') {
+            tracing::error!("Invalid object key (path traversal): {}", object_key);
+            return;
+        }
+
+        let client = build_client(conn, &self.client_options);
+
+        if action == "delete" {
+            match client
+                .delete_object()
+                .bucket(&rule.target_bucket)
+                .key(object_key)
+                .send()
+                .await
+            {
+                Ok(_) => {
+                    tracing::info!(
+                        "Replicated DELETE {}/{} to {} ({})",
+                        bucket,
+                        object_key,
+                        conn.name,
+                        rule.target_bucket
+                    );
+                    self.update_last_sync(bucket, object_key);
+                    self.failures.remove(bucket, object_key);
+                }
+                Err(err) => {
+                    let msg = format!("{:?}", err);
+                    tracing::error!("Replication DELETE failed {}/{}: {}", bucket, object_key, msg);
+                    self.failures.add(
+                        bucket,
+                        ReplicationFailure {
+                            object_key: object_key.to_string(),
+                            error_message: msg,
+                            timestamp: now_secs(),
+                            failure_count: 1,
+                            bucket_name: bucket.to_string(),
+                            action: "delete".to_string(),
+                            last_error_code: None,
+                        },
+                    );
+                }
+            }
+            return;
+        }
+
+        let src_path = match self.storage.get_object_path(bucket, object_key).await {
+            Ok(p) => p,
+            Err(_) => {
+                tracing::error!("Source object not found: {}/{}", bucket, object_key);
+                return;
+            }
+        };
+        let file_size = match tokio::fs::metadata(&src_path).await {
+            Ok(m) => m.len(),
+            Err(_) => 0,
+        };
+        let content_type = mime_guess::from_path(&src_path)
+            .first_raw()
+            .map(|s| s.to_string());
+
+        let upload_result = upload_object(
+            &client,
+            &rule.target_bucket,
+            object_key,
+            &src_path,
+            file_size,
+            self.streaming_threshold_bytes,
+            content_type.as_deref(),
+        )
+        .await;
+
+        let final_result = match upload_result {
+            Err(err) if is_no_such_bucket(&err) => {
+                tracing::info!(
+                    "Target bucket {} not found, creating it",
+                    rule.target_bucket
+                );
+                match client
+                    .create_bucket()
+                    .bucket(&rule.target_bucket)
+                    .send()
+                    .await
+                {
+                    Ok(_) | Err(_) => upload_object(
+                        &client,
+                        &rule.target_bucket,
+                        object_key,
+                        &src_path,
+                        file_size,
+                        self.streaming_threshold_bytes,
+                        content_type.as_deref(),
+                    )
+                    .await,
+                }
+            }
+            other => other,
+        };
+
+        match final_result {
+            Ok(()) => {
+                tracing::info!(
+                    "Replicated {}/{} to {} ({})",
+                    bucket,
+                    object_key,
+                    conn.name,
+                    rule.target_bucket
+                );
+                self.update_last_sync(bucket, object_key);
+                self.failures.remove(bucket, object_key);
+            }
+            Err(err) => {
+                let msg = err.to_string();
+                tracing::error!("Replication failed {}/{}: {}", bucket, object_key, msg);
+                self.failures.add(
+                    bucket,
+                    ReplicationFailure {
+                        object_key: object_key.to_string(),
+                        error_message: msg,
+                        timestamp: now_secs(),
+                        failure_count: 1,
+                        bucket_name: bucket.to_string(),
+                        action: action.to_string(),
+                        last_error_code: None,
+                    },
+                );
+            }
+        }
+    }
+
+    pub async fn check_endpoint(&self, conn: &RemoteConnection) -> bool {
+        let client = build_client(conn, &self.client_options);
+        check_endpoint_health(&client).await
+    }
+
+    pub async fn retry_failed(&self, bucket: &str, object_key: &str) -> bool {
+        let failure = match self.failures.get(bucket, object_key) {
+            Some(f) => f,
+            None => return false,
+        };
+        let rule = match self.get_rule(bucket) {
+            Some(r) if r.enabled => r,
+            _ => return false,
+        };
+        let conn = match self.connections.get(&rule.target_connection_id) {
+            Some(c) => c,
+            None => return false,
+        };
+        self.replicate_task(bucket, object_key, &rule, &conn, &failure.action)
+            .await;
+        true
+    }
+
+    pub async fn retry_all(&self, bucket: &str) -> (usize, usize) {
+        let failures = self.failures.load(bucket);
+        if failures.is_empty() {
+            return (0, 0);
+        }
+        let rule = match self.get_rule(bucket) {
+            Some(r) if r.enabled => r,
+            _ => return (0, failures.len()),
+        };
+        let conn = match self.connections.get(&rule.target_connection_id) {
+            Some(c) => c,
+            None => return (0, failures.len()),
+        };
+        let mut submitted = 0;
+        for failure in failures {
+            self.replicate_task(bucket, &failure.object_key, &rule, &conn, &failure.action)
+                .await;
+            submitted += 1;
+        }
+        (submitted, 0)
+    }
+
+    pub fn get_failure_count(&self, bucket: &str) -> usize {
+        self.failures.count(bucket)
+    }
+
+    pub fn get_failed_items(
+        &self,
+        bucket: &str,
+        limit: usize,
+        offset: usize,
+    ) -> Vec<ReplicationFailure> {
+        self.failures
+            .load(bucket)
+            .into_iter()
+            .skip(offset)
+            .take(limit)
+            .collect()
+    }
+
+    pub fn dismiss_failure(&self, bucket: &str, key: &str) -> bool {
+        self.failures.remove(bucket, key)
+    }
+
+    pub fn clear_failures(&self, bucket: &str) {
+        self.failures.clear(bucket);
+    }
+
+    pub fn rules_snapshot(&self) -> HashMap<String, ReplicationRule> {
+        self.rules.lock().clone()
+    }
+
+    pub fn update_last_pull(&self, bucket: &str, at: f64) {
+        {
+            let mut guard = self.rules.lock();
+            if let Some(rule) = guard.get_mut(bucket) {
+                rule.last_pull_at = Some(at);
+            }
+        }
+        self.save_rules();
+    }
+
+    pub fn client_options(&self) -> &ClientOptions {
+        &self.client_options
+    }
+}
+
+fn is_no_such_bucket<E: std::fmt::Debug>(err: &E) -> bool {
+    let text = format!("{:?}", err);
+    text.contains("NoSuchBucket")
+}
+
+async fn upload_object(
+    client: &aws_sdk_s3::Client,
+    bucket: &str,
+    key: &str,
+    path: &Path,
+    file_size: u64,
+    streaming_threshold: u64,
+    content_type: Option<&str>,
+) -> Result<(), aws_sdk_s3::error::SdkError<aws_sdk_s3::operation::put_object::PutObjectError>> {
+    let mut req = client.put_object().bucket(bucket).key(key);
+    if let Some(ct) = content_type {
+        req = req.content_type(ct);
+    }
+
+    let body = if file_size >= streaming_threshold {
+        ByteStream::from_path(path).await.map_err(|e| {
+            aws_sdk_s3::error::SdkError::construction_failure(Box::new(std::io::Error::new(
+                std::io::ErrorKind::Other,
+                e,
+            )))
+        })?
+    } else {
+        let bytes = tokio::fs::read(path).await.map_err(|e| {
+            aws_sdk_s3::error::SdkError::construction_failure(Box::new(e))
+        })?;
+        ByteStream::from(bytes)
+    };
+
+    req.body(body).send().await.map(|_| ())
+}
+
+fn load_rules(path: &Path) -> HashMap<String, ReplicationRule> {
+    if !path.exists() {
+        return HashMap::new();
+    }
+    match std::fs::read_to_string(path) {
+        Ok(text) => serde_json::from_str(&text).unwrap_or_default(),
+        Err(_) => HashMap::new(),
+    }
+}
+
+fn now_secs() -> f64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs_f64())
+        .unwrap_or(0.0)
+}

rust/myfsio-engine/crates/myfsio-server/src/services/s3_client.rs

@@ -0,0 +1,64 @@
+use std::time::Duration;
+
+use aws_config::BehaviorVersion;
+use aws_credential_types::Credentials;
+use aws_sdk_s3::config::{Region, SharedCredentialsProvider};
+use aws_sdk_s3::Client;
+
+use crate::stores::connections::RemoteConnection;
+
+pub struct ClientOptions {
+    pub connect_timeout: Duration,
+    pub read_timeout: Duration,
+    pub max_attempts: u32,
+}
+
+impl Default for ClientOptions {
+    fn default() -> Self {
+        Self {
+            connect_timeout: Duration::from_secs(5),
+            read_timeout: Duration::from_secs(30),
+            max_attempts: 2,
+        }
+    }
+}
+
+pub fn build_client(connection: &RemoteConnection, options: &ClientOptions) -> Client {
+    let credentials = Credentials::new(
+        connection.access_key.clone(),
+        connection.secret_key.clone(),
+        None,
+        None,
+        "myfsio-replication",
+    );
+
+    let timeout_config = aws_smithy_types::timeout::TimeoutConfig::builder()
+        .connect_timeout(options.connect_timeout)
+        .read_timeout(options.read_timeout)
+        .build();
+
+    let retry_config = aws_smithy_types::retry::RetryConfig::standard()
+        .with_max_attempts(options.max_attempts);
+
+    let config = aws_sdk_s3::config::Builder::new()
+        .behavior_version(BehaviorVersion::latest())
+        .credentials_provider(SharedCredentialsProvider::new(credentials))
+        .region(Region::new(connection.region.clone()))
+        .endpoint_url(connection.endpoint_url.clone())
+        .force_path_style(true)
+        .timeout_config(timeout_config)
+        .retry_config(retry_config)
+        .build();
+
+    Client::from_conf(config)
+}
+
+pub async fn check_endpoint_health(client: &Client) -> bool {
+    match client.list_buckets().send().await {
+        Ok(_) => true,
+        Err(err) => {
+            tracing::warn!("Endpoint health check failed: {:?}", err);
+            false
+        }
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/services/site_registry.rs

@@ -0,0 +1,143 @@
+use chrono::Utc;
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+use std::sync::Arc;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SiteInfo {
+    pub site_id: String,
+    pub endpoint: String,
+    #[serde(default = "default_region")]
+    pub region: String,
+    #[serde(default = "default_priority")]
+    pub priority: i32,
+    #[serde(default)]
+    pub display_name: String,
+    #[serde(default)]
+    pub created_at: Option<String>,
+}
+
+fn default_region() -> String {
+    "us-east-1".to_string()
+}
+fn default_priority() -> i32 {
+    100
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PeerSite {
+    pub site_id: String,
+    pub endpoint: String,
+    #[serde(default = "default_region")]
+    pub region: String,
+    #[serde(default = "default_priority")]
+    pub priority: i32,
+    #[serde(default)]
+    pub display_name: String,
+    #[serde(default)]
+    pub connection_id: Option<String>,
+    #[serde(default)]
+    pub created_at: Option<String>,
+    #[serde(default)]
+    pub is_healthy: bool,
+    #[serde(default)]
+    pub last_health_check: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+struct RegistryData {
+    #[serde(default)]
+    local: Option<SiteInfo>,
+    #[serde(default)]
+    peers: Vec<PeerSite>,
+}
+
+pub struct SiteRegistry {
+    path: PathBuf,
+    data: Arc<RwLock<RegistryData>>,
+}
+
+impl SiteRegistry {
+    pub fn new(storage_root: &std::path::Path) -> Self {
+        let path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("site_registry.json");
+        let data = if path.exists() {
+            std::fs::read_to_string(&path)
+                .ok()
+                .and_then(|s| serde_json::from_str(&s).ok())
+                .unwrap_or_default()
+        } else {
+            RegistryData::default()
+        };
+        Self {
+            path,
+            data: Arc::new(RwLock::new(data)),
+        }
+    }
+
+    fn save(&self) {
+        let data = self.data.read();
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Ok(json) = serde_json::to_string_pretty(&*data) {
+            let _ = std::fs::write(&self.path, json);
+        }
+    }
+
+    pub fn get_local_site(&self) -> Option<SiteInfo> {
+        self.data.read().local.clone()
+    }
+
+    pub fn set_local_site(&self, site: SiteInfo) {
+        self.data.write().local = Some(site);
+        self.save();
+    }
+
+    pub fn list_peers(&self) -> Vec<PeerSite> {
+        self.data.read().peers.clone()
+    }
+
+    pub fn get_peer(&self, site_id: &str) -> Option<PeerSite> {
+        self.data.read().peers.iter().find(|p| p.site_id == site_id).cloned()
+    }
+
+    pub fn add_peer(&self, peer: PeerSite) {
+        self.data.write().peers.push(peer);
+        self.save();
+    }
+
+    pub fn update_peer(&self, peer: PeerSite) {
+        let mut data = self.data.write();
+        if let Some(existing) = data.peers.iter_mut().find(|p| p.site_id == peer.site_id) {
+            *existing = peer;
+        }
+        drop(data);
+        self.save();
+    }
+
+    pub fn delete_peer(&self, site_id: &str) -> bool {
+        let mut data = self.data.write();
+        let len_before = data.peers.len();
+        data.peers.retain(|p| p.site_id != site_id);
+        let removed = data.peers.len() < len_before;
+        drop(data);
+        if removed {
+            self.save();
+        }
+        removed
+    }
+
+    pub fn update_health(&self, site_id: &str, is_healthy: bool) {
+        let mut data = self.data.write();
+        if let Some(peer) = data.peers.iter_mut().find(|p| p.site_id == site_id) {
+            peer.is_healthy = is_healthy;
+            peer.last_health_check = Some(Utc::now().to_rfc3339());
+        }
+        drop(data);
+        self.save();
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/services/site_sync.rs

@@ -0,0 +1,485 @@
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use aws_sdk_s3::Client;
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use tokio::io::AsyncRead;
+use tokio::sync::Notify;
+
+use myfsio_common::types::{ListParams, ObjectMeta};
+use myfsio_storage::fs_backend::FsStorageBackend;
+use myfsio_storage::traits::StorageEngine;
+
+use crate::services::replication::{ReplicationManager, ReplicationRule, MODE_BIDIRECTIONAL};
+use crate::services::s3_client::{build_client, ClientOptions};
+use crate::stores::connections::ConnectionStore;
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SyncedObjectInfo {
+    pub last_synced_at: f64,
+    pub remote_etag: String,
+    pub source: String,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct SyncState {
+    #[serde(default)]
+    pub synced_objects: HashMap<String, SyncedObjectInfo>,
+    #[serde(default)]
+    pub last_full_sync: Option<f64>,
+}
+
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct SiteSyncStats {
+    pub last_sync_at: Option<f64>,
+    pub objects_pulled: u64,
+    pub objects_skipped: u64,
+    pub conflicts_resolved: u64,
+    pub deletions_applied: u64,
+    pub errors: u64,
+}
+
+#[derive(Debug, Clone)]
+struct RemoteObjectMeta {
+    last_modified: f64,
+    etag: String,
+}
+
+pub struct SiteSyncWorker {
+    storage: Arc<FsStorageBackend>,
+    connections: Arc<ConnectionStore>,
+    replication: Arc<ReplicationManager>,
+    storage_root: PathBuf,
+    interval: Duration,
+    batch_size: usize,
+    clock_skew_tolerance: f64,
+    client_options: ClientOptions,
+    bucket_stats: Mutex<HashMap<String, SiteSyncStats>>,
+    shutdown: Arc<Notify>,
+}
+
+impl SiteSyncWorker {
+    pub fn new(
+        storage: Arc<FsStorageBackend>,
+        connections: Arc<ConnectionStore>,
+        replication: Arc<ReplicationManager>,
+        storage_root: PathBuf,
+        interval_seconds: u64,
+        batch_size: usize,
+        connect_timeout: Duration,
+        read_timeout: Duration,
+        max_retries: u32,
+        clock_skew_tolerance: f64,
+    ) -> Self {
+        Self {
+            storage,
+            connections,
+            replication,
+            storage_root,
+            interval: Duration::from_secs(interval_seconds),
+            batch_size,
+            clock_skew_tolerance,
+            client_options: ClientOptions {
+                connect_timeout,
+                read_timeout,
+                max_attempts: max_retries,
+            },
+            bucket_stats: Mutex::new(HashMap::new()),
+            shutdown: Arc::new(Notify::new()),
+        }
+    }
+
+    pub fn shutdown(&self) {
+        self.shutdown.notify_waiters();
+    }
+
+    pub fn get_stats(&self, bucket: &str) -> Option<SiteSyncStats> {
+        self.bucket_stats.lock().get(bucket).cloned()
+    }
+
+    pub async fn run(self: Arc<Self>) {
+        tracing::info!("Site sync worker started (interval={}s)", self.interval.as_secs());
+        loop {
+            tokio::select! {
+                _ = tokio::time::sleep(self.interval) => {}
+                _ = self.shutdown.notified() => {
+                    tracing::info!("Site sync worker shutting down");
+                    return;
+                }
+            }
+            self.run_cycle().await;
+        }
+    }
+
+    async fn run_cycle(&self) {
+        let rules = self.replication.rules_snapshot();
+        for (bucket, rule) in rules {
+            if rule.mode != MODE_BIDIRECTIONAL || !rule.enabled {
+                continue;
+            }
+            match self.sync_bucket(&rule).await {
+                Ok(stats) => {
+                    self.bucket_stats.lock().insert(bucket, stats);
+                }
+                Err(e) => {
+                    tracing::error!("Site sync failed for bucket {}: {}", bucket, e);
+                }
+            }
+        }
+    }
+
+    pub async fn trigger_sync(&self, bucket: &str) -> Option<SiteSyncStats> {
+        let rule = self.replication.get_rule(bucket)?;
+        if rule.mode != MODE_BIDIRECTIONAL || !rule.enabled {
+            return None;
+        }
+        match self.sync_bucket(&rule).await {
+            Ok(stats) => {
+                self.bucket_stats
+                    .lock()
+                    .insert(bucket.to_string(), stats.clone());
+                Some(stats)
+            }
+            Err(e) => {
+                tracing::error!("Site sync trigger failed for {}: {}", bucket, e);
+                None
+            }
+        }
+    }
+
+    async fn sync_bucket(&self, rule: &ReplicationRule) -> Result<SiteSyncStats, String> {
+        let mut stats = SiteSyncStats::default();
+        let connection = self
+            .connections
+            .get(&rule.target_connection_id)
+            .ok_or_else(|| format!("connection {} not found", rule.target_connection_id))?;
+
+        let local_objects = self
+            .list_local_objects(&rule.bucket_name)
+            .await
+            .map_err(|e| format!("list local failed: {}", e))?;
+
+        let client = build_client(&connection, &self.client_options);
+        let remote_objects = self
+            .list_remote_objects(&client, &rule.target_bucket)
+            .await
+            .map_err(|e| format!("list remote failed: {}", e))?;
+
+        let mut sync_state = self.load_sync_state(&rule.bucket_name);
+
+        let mut to_pull: Vec<String> = Vec::new();
+        for (key, remote_meta) in &remote_objects {
+            if let Some(local_meta) = local_objects.get(key) {
+                match self.resolve_conflict(local_meta, remote_meta) {
+                    "pull" => {
+                        to_pull.push(key.clone());
+                        stats.conflicts_resolved += 1;
+                    }
+                    _ => {
+                        stats.objects_skipped += 1;
+                    }
+                }
+            } else {
+                to_pull.push(key.clone());
+            }
+        }
+
+        let mut pulled = 0usize;
+        for key in &to_pull {
+            if pulled >= self.batch_size {
+                break;
+            }
+            let remote_meta = match remote_objects.get(key) {
+                Some(m) => m,
+                None => continue,
+            };
+            if self
+                .pull_object(&client, &rule.target_bucket, &rule.bucket_name, key)
+                .await
+            {
+                stats.objects_pulled += 1;
+                pulled += 1;
+                sync_state.synced_objects.insert(
+                    key.clone(),
+                    SyncedObjectInfo {
+                        last_synced_at: now_secs(),
+                        remote_etag: remote_meta.etag.clone(),
+                        source: "remote".to_string(),
+                    },
+                );
+            } else {
+                stats.errors += 1;
+            }
+        }
+
+        if rule.sync_deletions {
+            let tracked_keys: Vec<String> = sync_state.synced_objects.keys().cloned().collect();
+            for key in tracked_keys {
+                if remote_objects.contains_key(&key) {
+                    continue;
+                }
+                let local_meta = match local_objects.get(&key) {
+                    Some(m) => m,
+                    None => continue,
+                };
+                let tracked = match sync_state.synced_objects.get(&key) {
+                    Some(t) => t.clone(),
+                    None => continue,
+                };
+                if tracked.source != "remote" {
+                    continue;
+                }
+                let local_ts = local_meta.last_modified.timestamp() as f64;
+                if local_ts <= tracked.last_synced_at
+                    && self.apply_remote_deletion(&rule.bucket_name, &key).await
+                {
+                    stats.deletions_applied += 1;
+                    sync_state.synced_objects.remove(&key);
+                }
+            }
+        }
+
+        sync_state.last_full_sync = Some(now_secs());
+        self.save_sync_state(&rule.bucket_name, &sync_state);
+
+        self.replication
+            .update_last_pull(&rule.bucket_name, now_secs());
+
+        stats.last_sync_at = Some(now_secs());
+        tracing::info!(
+            "Site sync completed for {}: pulled={}, skipped={}, conflicts={}, deletions={}, errors={}",
+            rule.bucket_name,
+            stats.objects_pulled,
+            stats.objects_skipped,
+            stats.conflicts_resolved,
+            stats.deletions_applied,
+            stats.errors,
+        );
+        Ok(stats)
+    }
+
+    async fn list_local_objects(
+        &self,
+        bucket: &str,
+    ) -> Result<HashMap<String, ObjectMeta>, String> {
+        let mut result = HashMap::new();
+        let mut token: Option<String> = None;
+        loop {
+            let params = ListParams {
+                max_keys: 1000,
+                continuation_token: token.clone(),
+                prefix: None,
+                start_after: None,
+            };
+            let page = self
+                .storage
+                .list_objects(bucket, &params)
+                .await
+                .map_err(|e| e.to_string())?;
+            for obj in page.objects {
+                result.insert(obj.key.clone(), obj);
+            }
+            if !page.is_truncated {
+                break;
+            }
+            token = page.next_continuation_token;
+            if token.is_none() {
+                break;
+            }
+        }
+        Ok(result)
+    }
+
+    async fn list_remote_objects(
+        &self,
+        client: &Client,
+        bucket: &str,
+    ) -> Result<HashMap<String, RemoteObjectMeta>, String> {
+        let mut result = HashMap::new();
+        let mut continuation: Option<String> = None;
+        loop {
+            let mut req = client.list_objects_v2().bucket(bucket);
+            if let Some(ref t) = continuation {
+                req = req.continuation_token(t);
+            }
+            let resp = match req.send().await {
+                Ok(r) => r,
+                Err(err) => {
+                    let msg = format!("{:?}", err);
+                    if msg.contains("NoSuchBucket") {
+                        return Ok(result);
+                    }
+                    return Err(msg);
+                }
+            };
+            for obj in resp.contents() {
+                let key = match obj.key() {
+                    Some(k) => k.to_string(),
+                    None => continue,
+                };
+                let last_modified = obj
+                    .last_modified()
+                    .and_then(|t| {
+                        let secs = t.secs();
+                        let nanos = t.subsec_nanos();
+                        Some(secs as f64 + nanos as f64 / 1_000_000_000.0)
+                    })
+                    .unwrap_or(0.0);
+                let etag = obj.e_tag().unwrap_or("").trim_matches('"').to_string();
+                result.insert(
+                    key,
+                    RemoteObjectMeta {
+                        last_modified,
+                        etag,
+                    },
+                );
+            }
+            if resp.is_truncated().unwrap_or(false) {
+                continuation = resp.next_continuation_token().map(|s| s.to_string());
+                if continuation.is_none() {
+                    break;
+                }
+            } else {
+                break;
+            }
+        }
+        Ok(result)
+    }
+
+    fn resolve_conflict(&self, local: &ObjectMeta, remote: &RemoteObjectMeta) -> &'static str {
+        let local_ts = local.last_modified.timestamp() as f64
+            + local.last_modified.timestamp_subsec_nanos() as f64 / 1_000_000_000.0;
+        let remote_ts = remote.last_modified;
+
+        if (remote_ts - local_ts).abs() < self.clock_skew_tolerance {
+            let local_etag = local.etag.clone().unwrap_or_default();
+            let local_etag_trim = local_etag.trim_matches('"');
+            if remote.etag == local_etag_trim {
+                return "skip";
+            }
+            if remote.etag.as_str() > local_etag_trim {
+                return "pull";
+            }
+            return "keep";
+        }
+
+        if remote_ts > local_ts {
+            "pull"
+        } else {
+            "keep"
+        }
+    }
+
+    async fn pull_object(
+        &self,
+        client: &Client,
+        remote_bucket: &str,
+        local_bucket: &str,
+        key: &str,
+    ) -> bool {
+        let resp = match client
+            .get_object()
+            .bucket(remote_bucket)
+            .key(key)
+            .send()
+            .await
+        {
+            Ok(r) => r,
+            Err(err) => {
+                tracing::error!("Pull GetObject failed {}/{}: {:?}", local_bucket, key, err);
+                return false;
+            }
+        };
+
+        let head = match client
+            .head_object()
+            .bucket(remote_bucket)
+            .key(key)
+            .send()
+            .await
+        {
+            Ok(r) => r,
+            Err(err) => {
+                tracing::error!("Pull HeadObject failed {}/{}: {:?}", local_bucket, key, err);
+                return false;
+            }
+        };
+
+        let metadata: Option<HashMap<String, String>> = head.metadata().map(|m| {
+            m.iter()
+                .map(|(k, v)| (k.clone(), v.clone()))
+                .collect()
+        });
+
+        let stream = resp.body.into_async_read();
+        let boxed: Pin<Box<dyn AsyncRead + Send>> = Box::pin(stream);
+
+        match self
+            .storage
+            .put_object(local_bucket, key, boxed, metadata)
+            .await
+        {
+            Ok(_) => {
+                tracing::debug!("Pulled object {}/{} from remote", local_bucket, key);
+                true
+            }
+            Err(err) => {
+                tracing::error!("Store pulled object failed {}/{}: {}", local_bucket, key, err);
+                false
+            }
+        }
+    }
+
+    async fn apply_remote_deletion(&self, bucket: &str, key: &str) -> bool {
+        match self.storage.delete_object(bucket, key).await {
+            Ok(_) => {
+                tracing::debug!("Applied remote deletion for {}/{}", bucket, key);
+                true
+            }
+            Err(err) => {
+                tracing::error!("Remote deletion failed {}/{}: {}", bucket, key, err);
+                false
+            }
+        }
+    }
+
+    fn sync_state_path(&self, bucket: &str) -> PathBuf {
+        self.storage_root
+            .join(".myfsio.sys")
+            .join("buckets")
+            .join(bucket)
+            .join("site_sync_state.json")
+    }
+
+    fn load_sync_state(&self, bucket: &str) -> SyncState {
+        let path = self.sync_state_path(bucket);
+        if !path.exists() {
+            return SyncState::default();
+        }
+        match std::fs::read_to_string(&path) {
+            Ok(text) => serde_json::from_str(&text).unwrap_or_default(),
+            Err(_) => SyncState::default(),
+        }
+    }
+
+    fn save_sync_state(&self, bucket: &str, state: &SyncState) {
+        let path = self.sync_state_path(bucket);
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Ok(text) = serde_json::to_string_pretty(state) {
+            let _ = std::fs::write(&path, text);
+        }
+    }
+}
+
+fn now_secs() -> f64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs_f64())
+        .unwrap_or(0.0)
+}

rust/myfsio-engine/crates/myfsio-server/src/services/website_domains.rs

@@ -0,0 +1,104 @@
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+struct DomainData {
+    #[serde(default)]
+    mappings: HashMap<String, String>,
+}
+
+pub struct WebsiteDomainStore {
+    path: PathBuf,
+    data: Arc<RwLock<DomainData>>,
+}
+
+impl WebsiteDomainStore {
+    pub fn new(storage_root: &std::path::Path) -> Self {
+        let path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("website_domains.json");
+        let data = if path.exists() {
+            std::fs::read_to_string(&path)
+                .ok()
+                .and_then(|s| serde_json::from_str(&s).ok())
+                .unwrap_or_default()
+        } else {
+            DomainData::default()
+        };
+        Self {
+            path,
+            data: Arc::new(RwLock::new(data)),
+        }
+    }
+
+    fn save(&self) {
+        let data = self.data.read();
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        if let Ok(json) = serde_json::to_string_pretty(&*data) {
+            let _ = std::fs::write(&self.path, json);
+        }
+    }
+
+    pub fn list_all(&self) -> Vec<serde_json::Value> {
+        self.data
+            .read()
+            .mappings
+            .iter()
+            .map(|(domain, bucket)| {
+                serde_json::json!({
+                    "domain": domain,
+                    "bucket": bucket,
+                })
+            })
+            .collect()
+    }
+
+    pub fn get_bucket(&self, domain: &str) -> Option<String> {
+        self.data.read().mappings.get(domain).cloned()
+    }
+
+    pub fn set_mapping(&self, domain: &str, bucket: &str) {
+        self.data.write().mappings.insert(domain.to_string(), bucket.to_string());
+        self.save();
+    }
+
+    pub fn delete_mapping(&self, domain: &str) -> bool {
+        let removed = self.data.write().mappings.remove(domain).is_some();
+        if removed {
+            self.save();
+        }
+        removed
+    }
+}
+
+pub fn normalize_domain(domain: &str) -> String {
+    domain.trim().to_ascii_lowercase()
+}
+
+pub fn is_valid_domain(domain: &str) -> bool {
+    if domain.is_empty() || domain.len() > 253 {
+        return false;
+    }
+    let labels: Vec<&str> = domain.split('.').collect();
+    if labels.len() < 2 {
+        return false;
+    }
+    for label in &labels {
+        if label.is_empty() || label.len() > 63 {
+            return false;
+        }
+        if !label.chars().all(|c| c.is_ascii_alphanumeric() || c == '-') {
+            return false;
+        }
+        if label.starts_with('-') || label.ends_with('-') {
+            return false;
+        }
+    }
+    true
+}

rust/myfsio-engine/crates/myfsio-server/src/session.rs

@@ -0,0 +1,136 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use parking_lot::RwLock;
+use rand::RngCore;
+use serde::{Deserialize, Serialize};
+
+pub const SESSION_COOKIE_NAME: &str = "myfsio_session";
+pub const CSRF_FIELD_NAME: &str = "csrf_token";
+pub const CSRF_HEADER_NAME: &str = "x-csrf-token";
+
+const SESSION_ID_BYTES: usize = 32;
+const CSRF_TOKEN_BYTES: usize = 32;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct FlashMessage {
+    pub category: String,
+    pub message: String,
+}
+
+#[derive(Clone, Debug)]
+pub struct SessionData {
+    pub user_id: Option<String>,
+    pub display_name: Option<String>,
+    pub csrf_token: String,
+    pub flash: Vec<FlashMessage>,
+    pub extra: HashMap<String, String>,
+    created_at: Instant,
+    last_accessed: Instant,
+}
+
+impl SessionData {
+    pub fn new() -> Self {
+        let now = Instant::now();
+        Self {
+            user_id: None,
+            display_name: None,
+            csrf_token: generate_token(CSRF_TOKEN_BYTES),
+            flash: Vec::new(),
+            extra: HashMap::new(),
+            created_at: now,
+            last_accessed: now,
+        }
+    }
+
+    pub fn is_authenticated(&self) -> bool {
+        self.user_id.is_some()
+    }
+
+    pub fn push_flash(&mut self, category: impl Into<String>, message: impl Into<String>) {
+        self.flash.push(FlashMessage {
+            category: category.into(),
+            message: message.into(),
+        });
+    }
+
+    pub fn take_flash(&mut self) -> Vec<FlashMessage> {
+        std::mem::take(&mut self.flash)
+    }
+
+    pub fn rotate_csrf(&mut self) {
+        self.csrf_token = generate_token(CSRF_TOKEN_BYTES);
+    }
+}
+
+impl Default for SessionData {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+pub struct SessionStore {
+    sessions: RwLock<HashMap<String, SessionData>>,
+    ttl: Duration,
+}
+
+impl SessionStore {
+    pub fn new(ttl: Duration) -> Self {
+        Self {
+            sessions: RwLock::new(HashMap::new()),
+            ttl,
+        }
+    }
+
+    pub fn create(&self) -> (String, SessionData) {
+        let id = generate_token(SESSION_ID_BYTES);
+        let data = SessionData::new();
+        self.sessions.write().insert(id.clone(), data.clone());
+        (id, data)
+    }
+
+    pub fn get(&self, id: &str) -> Option<SessionData> {
+        let mut guard = self.sessions.write();
+        let entry = guard.get_mut(id)?;
+        if entry.last_accessed.elapsed() > self.ttl {
+            guard.remove(id);
+            return None;
+        }
+        entry.last_accessed = Instant::now();
+        Some(entry.clone())
+    }
+
+    pub fn save(&self, id: &str, data: SessionData) {
+        let mut guard = self.sessions.write();
+        let mut updated = data;
+        updated.last_accessed = Instant::now();
+        guard.insert(id.to_string(), updated);
+    }
+
+    pub fn destroy(&self, id: &str) {
+        self.sessions.write().remove(id);
+    }
+
+    pub fn sweep(&self) {
+        let ttl = self.ttl;
+        let mut guard = self.sessions.write();
+        guard.retain(|_, data| data.last_accessed.elapsed() <= ttl);
+    }
+}
+
+pub type SharedSessionStore = Arc<SessionStore>;
+
+pub fn generate_token(bytes: usize) -> String {
+    let mut buf = vec![0u8; bytes];
+    rand::thread_rng().fill_bytes(&mut buf);
+    URL_SAFE_NO_PAD.encode(&buf)
+}
+
+pub fn csrf_tokens_match(a: &str, b: &str) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    subtle::ConstantTimeEq::ct_eq(a.as_bytes(), b.as_bytes()).into()
+}

rust/myfsio-engine/crates/myfsio-server/src/state.rs

@@ -0,0 +1,182 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::config::ServerConfig;
+use crate::session::SessionStore;
+use crate::templates::TemplateEngine;
+use crate::services::gc::GcService;
+use crate::services::integrity::IntegrityService;
+use crate::services::metrics::MetricsService;
+use crate::services::replication::ReplicationManager;
+use crate::services::site_registry::SiteRegistry;
+use crate::services::site_sync::SiteSyncWorker;
+use crate::services::website_domains::WebsiteDomainStore;
+use crate::stores::connections::ConnectionStore;
+use myfsio_auth::iam::IamService;
+use myfsio_crypto::encryption::EncryptionService;
+use myfsio_crypto::kms::KmsService;
+use myfsio_storage::fs_backend::FsStorageBackend;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub config: ServerConfig,
+    pub storage: Arc<FsStorageBackend>,
+    pub iam: Arc<IamService>,
+    pub encryption: Option<Arc<EncryptionService>>,
+    pub kms: Option<Arc<KmsService>>,
+    pub gc: Option<Arc<GcService>>,
+    pub integrity: Option<Arc<IntegrityService>>,
+    pub metrics: Option<Arc<MetricsService>>,
+    pub site_registry: Option<Arc<SiteRegistry>>,
+    pub website_domains: Option<Arc<WebsiteDomainStore>>,
+    pub connections: Arc<ConnectionStore>,
+    pub replication: Arc<ReplicationManager>,
+    pub site_sync: Option<Arc<SiteSyncWorker>>,
+    pub templates: Option<Arc<TemplateEngine>>,
+    pub sessions: Arc<SessionStore>,
+}
+
+impl AppState {
+    pub fn new(config: ServerConfig) -> Self {
+        let storage = Arc::new(FsStorageBackend::new(config.storage_root.clone()));
+        let iam = Arc::new(IamService::new_with_secret(
+            config.iam_config_path.clone(),
+            config.secret_key.clone(),
+        ));
+
+        let gc = if config.gc_enabled {
+            Some(Arc::new(GcService::new(
+                config.storage_root.clone(),
+                crate::services::gc::GcConfig::default(),
+            )))
+        } else {
+            None
+        };
+
+        let integrity = if config.integrity_enabled {
+            Some(Arc::new(IntegrityService::new(
+                storage.clone(),
+                &config.storage_root,
+                crate::services::integrity::IntegrityConfig::default(),
+            )))
+        } else {
+            None
+        };
+
+        let metrics = if config.metrics_enabled {
+            Some(Arc::new(MetricsService::new(
+                &config.storage_root,
+                crate::services::metrics::MetricsConfig::default(),
+            )))
+        } else {
+            None
+        };
+
+        let site_registry = Some(Arc::new(SiteRegistry::new(&config.storage_root)));
+
+        let website_domains = if config.website_hosting_enabled {
+            Some(Arc::new(WebsiteDomainStore::new(&config.storage_root)))
+        } else {
+            None
+        };
+
+        let connections = Arc::new(ConnectionStore::new(&config.storage_root));
+
+        let replication = Arc::new(ReplicationManager::new(
+            storage.clone(),
+            connections.clone(),
+            &config.storage_root,
+            Duration::from_secs(config.replication_connect_timeout_secs),
+            Duration::from_secs(config.replication_read_timeout_secs),
+            config.replication_max_retries,
+            config.replication_streaming_threshold_bytes,
+            config.replication_max_failures_per_bucket,
+        ));
+
+        let site_sync = if config.site_sync_enabled {
+            Some(Arc::new(SiteSyncWorker::new(
+                storage.clone(),
+                connections.clone(),
+                replication.clone(),
+                config.storage_root.clone(),
+                config.site_sync_interval_secs,
+                config.site_sync_batch_size,
+                Duration::from_secs(config.site_sync_connect_timeout_secs),
+                Duration::from_secs(config.site_sync_read_timeout_secs),
+                config.site_sync_max_retries,
+                config.site_sync_clock_skew_tolerance,
+            )))
+        } else {
+            None
+        };
+
+        let templates = init_templates(&config.templates_dir);
+        Self {
+            config,
+            storage,
+            iam,
+            encryption: None,
+            kms: None,
+            gc,
+            integrity,
+            metrics,
+            site_registry,
+            website_domains,
+            connections,
+            replication,
+            site_sync,
+            templates,
+            sessions: Arc::new(SessionStore::new(Duration::from_secs(60 * 60 * 12))),
+        }
+    }
+
+    pub async fn new_with_encryption(config: ServerConfig) -> Self {
+        let mut state = Self::new(config.clone());
+
+        let keys_dir = config.storage_root.join(".myfsio.sys").join("keys");
+
+        let kms = if config.kms_enabled {
+            match KmsService::new(&keys_dir).await {
+                Ok(k) => Some(Arc::new(k)),
+                Err(e) => {
+                    tracing::error!("Failed to initialize KMS: {}", e);
+                    None
+                }
+            }
+        } else {
+            None
+        };
+
+        let encryption = if config.encryption_enabled {
+            match myfsio_crypto::kms::load_or_create_master_key(&keys_dir).await {
+                Ok(master_key) => {
+                    Some(Arc::new(EncryptionService::new(master_key, kms.clone())))
+                }
+                Err(e) => {
+                    tracing::error!("Failed to initialize encryption: {}", e);
+                    None
+                }
+            }
+        } else {
+            None
+        };
+
+        state.encryption = encryption;
+        state.kms = kms;
+        state
+    }
+}
+
+fn init_templates(templates_dir: &std::path::Path) -> Option<Arc<TemplateEngine>> {
+    let glob = format!("{}/*.html", templates_dir.display()).replace('\\', "/");
+    match TemplateEngine::new(&glob) {
+        Ok(engine) => {
+            crate::handlers::ui_pages::register_ui_endpoints(&engine);
+            Some(Arc::new(engine))
+        }
+        Err(e) => {
+            tracing::error!("Template engine init failed: {}", e);
+            None
+        }
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/stores/connections.rs

@@ -0,0 +1,94 @@
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RemoteConnection {
+    pub id: String,
+    pub name: String,
+    pub endpoint_url: String,
+    pub access_key: String,
+    pub secret_key: String,
+    #[serde(default = "default_region")]
+    pub region: String,
+}
+
+fn default_region() -> String {
+    "us-east-1".to_string()
+}
+
+pub struct ConnectionStore {
+    path: PathBuf,
+    inner: Arc<RwLock<Vec<RemoteConnection>>>,
+}
+
+impl ConnectionStore {
+    pub fn new(storage_root: &Path) -> Self {
+        let path = storage_root
+            .join(".myfsio.sys")
+            .join("config")
+            .join("connections.json");
+        let inner = Arc::new(RwLock::new(load_from_disk(&path)));
+        Self { path, inner }
+    }
+
+    pub fn reload(&self) {
+        let loaded = load_from_disk(&self.path);
+        *self.inner.write() = loaded;
+    }
+
+    pub fn list(&self) -> Vec<RemoteConnection> {
+        self.inner.read().clone()
+    }
+
+    pub fn get(&self, id: &str) -> Option<RemoteConnection> {
+        self.inner.read().iter().find(|c| c.id == id).cloned()
+    }
+
+    pub fn add(&self, connection: RemoteConnection) -> std::io::Result<()> {
+        {
+            let mut guard = self.inner.write();
+            if let Some(existing) = guard.iter_mut().find(|c| c.id == connection.id) {
+                *existing = connection;
+            } else {
+                guard.push(connection);
+            }
+        }
+        self.save()
+    }
+
+    pub fn delete(&self, id: &str) -> std::io::Result<bool> {
+        let removed = {
+            let mut guard = self.inner.write();
+            let before = guard.len();
+            guard.retain(|c| c.id != id);
+            guard.len() != before
+        };
+        if removed {
+            self.save()?;
+        }
+        Ok(removed)
+    }
+
+    fn save(&self) -> std::io::Result<()> {
+        if let Some(parent) = self.path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+        let snapshot = self.inner.read().clone();
+        let bytes = serde_json::to_vec_pretty(&snapshot)
+            .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+        std::fs::write(&self.path, bytes)
+    }
+}
+
+fn load_from_disk(path: &Path) -> Vec<RemoteConnection> {
+    if !path.exists() {
+        return Vec::new();
+    }
+    match std::fs::read_to_string(path) {
+        Ok(text) => serde_json::from_str(&text).unwrap_or_default(),
+        Err(_) => Vec::new(),
+    }
+}

rust/myfsio-engine/crates/myfsio-server/src/stores/mod.rs

@@ -0,0 +1 @@
+pub mod connections;

rust/myfsio-engine/crates/myfsio-server/src/templates.rs

@@ -0,0 +1,282 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use chrono::{DateTime, Utc};
+use parking_lot::RwLock;
+use serde_json::Value;
+use tera::{Context, Error as TeraError, Tera};
+
+pub type EndpointResolver = Arc<dyn Fn(&str, &HashMap<String, Value>) -> Option<String> + Send + Sync>;
+
+#[derive(Clone)]
+pub struct TemplateEngine {
+    tera: Arc<RwLock<Tera>>,
+    endpoints: Arc<RwLock<HashMap<String, String>>>,
+}
+
+impl TemplateEngine {
+    pub fn new(template_glob: &str) -> Result<Self, TeraError> {
+        let mut tera = Tera::new(template_glob)?;
+        register_filters(&mut tera);
+
+        let endpoints: Arc<RwLock<HashMap<String, String>>> =
+            Arc::new(RwLock::new(HashMap::new()));
+
+        register_functions(&mut tera, endpoints.clone());
+
+        Ok(Self {
+            tera: Arc::new(RwLock::new(tera)),
+            endpoints,
+        })
+    }
+
+    pub fn register_endpoint(&self, name: &str, path_template: &str) {
+        self.endpoints
+            .write()
+            .insert(name.to_string(), path_template.to_string());
+    }
+
+    pub fn register_endpoints(&self, pairs: &[(&str, &str)]) {
+        let mut guard = self.endpoints.write();
+        for (n, p) in pairs {
+            guard.insert((*n).to_string(), (*p).to_string());
+        }
+    }
+
+    pub fn render(&self, name: &str, context: &Context) -> Result<String, TeraError> {
+        self.tera.read().render(name, context)
+    }
+
+    pub fn reload(&self) -> Result<(), TeraError> {
+        self.tera.write().full_reload()
+    }
+}
+
+fn register_filters(tera: &mut Tera) {
+    tera.register_filter("format_datetime", format_datetime_filter);
+    tera.register_filter("filesizeformat", filesizeformat_filter);
+}
+
+fn register_functions(tera: &mut Tera, endpoints: Arc<RwLock<HashMap<String, String>>>) {
+    let endpoints_for_url = endpoints.clone();
+    tera.register_function(
+        "url_for",
+        move |args: &HashMap<String, Value>| -> tera::Result<Value> {
+            let endpoint = args
+                .get("endpoint")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| tera::Error::msg("url_for requires endpoint"))?;
+            if endpoint == "static" {
+                let filename = args
+                    .get("filename")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("");
+                return Ok(Value::String(format!("/static/{}", filename)));
+            }
+            let path = match endpoints_for_url.read().get(endpoint) {
+                Some(p) => p.clone(),
+                None => {
+                    return Ok(Value::String(format!("/__missing__/{}", endpoint)));
+                }
+            };
+            Ok(Value::String(substitute_path_params(&path, args)))
+        },
+    );
+
+    tera.register_function(
+        "csrf_token",
+        |args: &HashMap<String, Value>| -> tera::Result<Value> {
+            if let Some(token) = args.get("token").and_then(|v| v.as_str()) {
+                return Ok(Value::String(token.to_string()));
+            }
+            Ok(Value::String(String::new()))
+        },
+    );
+}
+
+fn substitute_path_params(template: &str, args: &HashMap<String, Value>) -> String {
+    let mut path = template.to_string();
+    let mut query: Vec<(String, String)> = Vec::new();
+    for (k, v) in args {
+        if k == "endpoint" || k == "filename" {
+            continue;
+        }
+        let value_str = value_to_string(v);
+        let placeholder = format!("{{{}}}", k);
+        if path.contains(&placeholder) {
+            let encoded = urlencode_path(&value_str);
+            path = path.replace(&placeholder, &encoded);
+        } else {
+            query.push((k.clone(), value_str));
+        }
+    }
+    if !query.is_empty() {
+        let qs: Vec<String> = query
+            .into_iter()
+            .map(|(k, v)| format!("{}={}", urlencode_query(&k), urlencode_query(&v)))
+            .collect();
+        path.push('?');
+        path.push_str(&qs.join("&"));
+    }
+    path
+}
+
+fn value_to_string(v: &Value) -> String {
+    match v {
+        Value::String(s) => s.clone(),
+        Value::Number(n) => n.to_string(),
+        Value::Bool(b) => b.to_string(),
+        Value::Null => String::new(),
+        other => other.to_string(),
+    }
+}
+
+const UNRESERVED: &percent_encoding::AsciiSet = &percent_encoding::NON_ALPHANUMERIC
+    .remove(b'-')
+    .remove(b'_')
+    .remove(b'.')
+    .remove(b'~');
+
+fn urlencode_path(s: &str) -> String {
+    percent_encoding::utf8_percent_encode(s, UNRESERVED).to_string()
+}
+
+fn urlencode_query(s: &str) -> String {
+    percent_encoding::utf8_percent_encode(s, UNRESERVED).to_string()
+}
+
+fn format_datetime_filter(value: &Value, args: &HashMap<String, Value>) -> tera::Result<Value> {
+    let format = args
+        .get("format")
+        .and_then(|v| v.as_str())
+        .unwrap_or("%Y-%m-%d %H:%M:%S UTC");
+
+    let dt: Option<DateTime<Utc>> = match value {
+        Value::String(s) => DateTime::parse_from_rfc3339(s)
+            .ok()
+            .map(|d| d.with_timezone(&Utc))
+            .or_else(|| DateTime::parse_from_rfc2822(s).ok().map(|d| d.with_timezone(&Utc))),
+        Value::Number(n) => n.as_f64().and_then(|f| {
+            let secs = f as i64;
+            let nanos = ((f - secs as f64) * 1_000_000_000.0) as u32;
+            DateTime::<Utc>::from_timestamp(secs, nanos)
+        }),
+        _ => None,
+    };
+
+    match dt {
+        Some(d) => Ok(Value::String(d.format(format).to_string())),
+        None => Ok(value.clone()),
+    }
+}
+
+fn filesizeformat_filter(value: &Value, _args: &HashMap<String, Value>) -> tera::Result<Value> {
+    let bytes = match value {
+        Value::Number(n) => n.as_f64().unwrap_or(0.0),
+        Value::String(s) => s.parse::<f64>().unwrap_or(0.0),
+        _ => 0.0,
+    };
+
+    const UNITS: [&str; 6] = ["B", "KB", "MB", "GB", "TB", "PB"];
+    let mut size = bytes;
+    let mut unit = 0;
+    while size >= 1024.0 && unit < UNITS.len() - 1 {
+        size /= 1024.0;
+        unit += 1;
+    }
+    let formatted = if unit == 0 {
+        format!("{} {}", size as u64, UNITS[unit])
+    } else {
+        format!("{:.1} {}", size, UNITS[unit])
+    };
+    Ok(Value::String(formatted))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_engine() -> TemplateEngine {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let tpl = tmp.path().join("t.html");
+        std::fs::write(&tpl, "").unwrap();
+        let glob = format!("{}/*.html", tmp.path().display());
+        let engine = TemplateEngine::new(&glob).unwrap();
+        engine.register_endpoints(&[
+            ("ui.buckets_overview", "/ui/buckets"),
+            ("ui.bucket_detail", "/ui/buckets/{bucket_name}"),
+            ("ui.abort_multipart_upload", "/ui/buckets/{bucket_name}/multipart/{upload_id}/abort"),
+        ]);
+        engine
+    }
+
+    fn render_inline(engine: &TemplateEngine, tpl: &str) -> String {
+        let mut tera = engine.tera.write();
+        tera.add_raw_template("__inline__", tpl).unwrap();
+        drop(tera);
+        engine.render("__inline__", &Context::new()).unwrap()
+    }
+
+    #[test]
+    fn static_url() {
+        let e = test_engine();
+        let out = render_inline(&e, "{{ url_for(endpoint='static', filename='css/main.css') }}");
+        assert_eq!(out, "/static/css/main.css");
+    }
+
+    #[test]
+    fn path_param_substitution() {
+        let e = test_engine();
+        let out = render_inline(
+            &e,
+            "{{ url_for(endpoint='ui.bucket_detail', bucket_name='my-bucket') }}",
+        );
+        assert_eq!(out, "/ui/buckets/my-bucket");
+    }
+
+    #[test]
+    fn extra_args_become_query() {
+        let e = test_engine();
+        let out = render_inline(
+            &e,
+            "{{ url_for(endpoint='ui.bucket_detail', bucket_name='b', tab='replication') }}",
+        );
+        assert_eq!(out, "/ui/buckets/b?tab=replication");
+    }
+
+    #[test]
+    fn filesizeformat_basic() {
+        let v = filesizeformat_filter(&Value::Number(1024.into()), &HashMap::new()).unwrap();
+        assert_eq!(v, Value::String("1.0 KB".into()));
+        let v = filesizeformat_filter(&Value::Number(1_048_576.into()), &HashMap::new()).unwrap();
+        assert_eq!(v, Value::String("1.0 MB".into()));
+        let v = filesizeformat_filter(&Value::Number(500.into()), &HashMap::new()).unwrap();
+        assert_eq!(v, Value::String("500 B".into()));
+    }
+
+    #[test]
+    fn project_templates_parse() {
+        let mut path = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+        path.push("templates");
+        path.push("*.html");
+        let glob = path.to_string_lossy().replace('\\', "/");
+        let engine = TemplateEngine::new(&glob).expect("Tera parse failed");
+        let names: Vec<String> = engine
+            .tera
+            .read()
+            .get_template_names()
+            .map(|s| s.to_string())
+            .collect();
+        assert!(names.len() >= 10, "expected 10+ templates, got {}", names.len());
+    }
+
+    #[test]
+    fn format_datetime_rfc3339() {
+        let v = format_datetime_filter(
+            &Value::String("2024-06-15T12:34:56Z".into()),
+            &HashMap::new(),
+        )
+        .unwrap();
+        assert_eq!(v, Value::String("2024-06-15 12:34:56 UTC".into()));
+    }
+}