feat: add workspace and claude messages support

src/routes/mod.rs

@@ -31,6 +31,7 @@ mod tasks;
 mod update_center;
 mod user;
 mod user_api_keys;
+mod workspace;
 // Two implementations of /api/video-agent/*: legacy singleton (default)
 // vs per-user pool. Exactly one is mounted, picked at compile time by
 // the `multi_tenant_comfy` feature flag.
@@ -71,6 +72,7 @@ pub fn build_router(state: AppState) -> Router {
         .merge(update_center::routes())
         .merge(user::routes())
         .merge(user_api_keys::routes())
+        .merge(workspace::routes())
         .merge(video_agent::routes())
         .with_state(state);
 

src/routes/picture_agent.rs

@@ -318,7 +318,31 @@ fn proxy_client() -> Client {
         .unwrap_or_else(|_| Client::new())
 }
 
-async fn upstream_response_to_axum(response: reqwest::Response) -> AppResult<Response<Body>> {
+async fn archive_picture_agent_response(
+    state: &AppState,
+    auth: &PictureAgentAuth,
+    prompt: Option<String>,
+    model: Option<String>,
+    payload: &Value,
+) {
+    crate::services::workspace::record_image_assets_from_response(
+        state,
+        auth.user_id,
+        "picture-agent",
+        prompt,
+        model,
+        payload,
+    )
+    .await;
+}
+
+async fn upstream_json_response_to_axum_and_archive(
+    state: &AppState,
+    auth: &PictureAgentAuth,
+    response: reqwest::Response,
+    prompt: Option<String>,
+    model: Option<String>,
+) -> AppResult<Response<Body>> {
     let status = StatusCode::from_u16(response.status().as_u16())
         .unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
     let content_type = response
@@ -332,6 +356,12 @@ async fn upstream_response_to_axum(response: reqwest::Response) -> AppResult<Res
         .await
         .map_err(|err| AppError::UpstreamError(err.to_string()))?;
 
+    if status.is_success() {
+        if let Ok(payload) = serde_json::from_slice::<Value>(&bytes) {
+            archive_picture_agent_response(state, auth, prompt, model, &payload).await;
+        }
+    }
+
     Ok(Response::builder()
         .status(status)
         .header(header::CONTENT_TYPE, content_type)
@@ -345,15 +375,27 @@ async fn images_generations(
     Json(body): Json<Value>,
 ) -> AppResult<Response<Body>> {
     let auth = resolve_picture_agent_auth(&headers, &state).await?;
+    let prompt = body
+        .get("prompt")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string);
+    let model = body
+        .get("model")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string);
     let url = format!("{}/images/generations", local_v1_base(&state));
     let response = proxy_client()
         .post(url)
-        .bearer_auth(auth.outbound_key)
+        .bearer_auth(auth.outbound_key.clone())
         .json(&body)
         .send()
         .await
         .map_err(|err| AppError::UpstreamError(err.to_string()))?;
-    upstream_response_to_axum(response).await
+    upstream_json_response_to_axum_and_archive(&state, &auth, response, prompt, model).await
 }
 
 async fn images_edits(
@@ -363,6 +405,8 @@ async fn images_edits(
 ) -> AppResult<Response<Body>> {
     let auth = resolve_picture_agent_auth(&headers, &state).await?;
     let mut form = reqwest::multipart::Form::new();
+    let mut prompt: Option<String> = None;
+    let mut model: Option<String> = None;
 
     while let Some(field) = multipart
         .next_field()
@@ -401,6 +445,11 @@ async fn images_edits(
                 .text()
                 .await
                 .map_err(|err| AppError::BadRequest(format!("failed to read field: {err}")))?;
+            if name == "prompt" {
+                prompt = Some(text.clone());
+            } else if name == "model" {
+                model = Some(text.clone());
+            }
             form = form.text(name, text);
         }
     }
@@ -408,10 +457,10 @@ async fn images_edits(
     let url = format!("{}/images/edits", local_v1_base(&state));
     let response = proxy_client()
         .post(url)
-        .bearer_auth(auth.outbound_key)
+        .bearer_auth(auth.outbound_key.clone())
         .multipart(form)
         .send()
         .await
         .map_err(|err| AppError::UpstreamError(err.to_string()))?;
-    upstream_response_to_axum(response).await
+    upstream_json_response_to_axum_and_archive(&state, &auth, response, prompt, model).await
 }

src/routes/proxy/mod.rs

@@ -51,6 +51,7 @@ pub enum DownstreamSource {
 pub fn routes() -> Router<AppState> {
     Router::new()
         .route("/v1/chat/completions", post(chat_completions))
+        .route("/v1/messages", post(messages_handler))
         .route("/v1/responses", post(responses_handler))
         .route("/v1/completions", post(completions_handler))
         .route("/v1/embeddings", post(embeddings_handler))
@@ -88,6 +89,31 @@ pub fn routes() -> Router<AppState> {
 
 // ── Handlers ───────────────────────────────────────────────────────────
 
+/// POST /v1/messages — Anthropic Claude Messages API compatibility.
+async fn messages_handler(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> Result<Response, AppError> {
+    info!("POST /v1/messages");
+
+    let key_id = check_auth(&state, &headers).await?;
+    let canonical = crate::transformers::anthropic::messages::parse_messages_request(&body)
+        .map_err(AppError::BadRequest)?;
+    let model = canonical.model.clone();
+
+    if canonical.stream {
+        let chunks = execute_messages_stream_with_conductor(state, key_id, model, canonical).await?;
+        let sse = Sse::new(stream::iter(chunks).map(|chunk| {
+            Ok::<_, Infallible>(axum::response::sse::Event::default().data(chunk))
+        }));
+        Ok(sse.into_response())
+    } else {
+        let result = execute_messages_with_conductor(state, key_id, model, canonical).await?;
+        Ok(Json(result).into_response())
+    }
+}
+
 /// POST /v1/responses — OpenAI Responses API (non-stream + stream).
 ///
 /// Behaves like /v1/chat/completions: routes through ProxyConductor for
@@ -722,6 +748,213 @@ fn upstream_status_from_error(err: &AppError) -> Option<u16> {
         .and_then(|value| value.parse::<u16>().ok())
 }
 
+async fn execute_messages_with_conductor(
+    state: AppState,
+    key_id: Option<i64>,
+    model: String,
+    request: crate::transformers::canonical::CanonicalRequest,
+) -> AppResult<Value> {
+    let started_at = Instant::now();
+    let conductor = build_conductor(&state);
+    let billing_state = state.clone();
+    let billing_model = model.clone();
+    let result = conductor
+        .execute(ExecuteInput {
+            requested_model: model,
+            downstream_policy: None,
+            attempt_fn: Box::new(move |ctx| {
+                let mut request = request.clone();
+                request.model = ctx.selected.actual_model.clone();
+                async move {
+                    match executors::execute_anthropic_messages(
+                        selected_channel_to_route(ctx.selected),
+                        request,
+                    )
+                    .await
+                    {
+                        Ok(response) => AttemptResult::Success {
+                            response,
+                            latency_ms: None,
+                            cost: None,
+                        },
+                        Err(err) => AttemptResult::Failure {
+                            action: crate::proxy::conductor::AttemptFailureAction::Failover,
+                            status: upstream_status_from_error(&err),
+                            raw_error_text: Some(err.to_string()),
+                        },
+                    }
+                }
+                .boxed()
+            }),
+            on_terminal_failure: None,
+        })
+        .await;
+
+    match result {
+        ExecuteResult::Success {
+            selected,
+            response,
+            attempts,
+        } => {
+            let (prompt, completion) = extract_usage(&response);
+            record_proxy_log_success(
+                &billing_state,
+                key_id,
+                &selected,
+                &billing_model,
+                Some(elapsed_ms_since(started_at)),
+                prompt,
+                completion,
+                0.0,
+                attempts,
+                false,
+            )
+            .await;
+            record_billing(
+                &billing_state,
+                key_id,
+                &billing_model,
+                prompt,
+                completion,
+                0.0,
+            )
+            .await;
+            Ok(response)
+        }
+        ExecuteResult::Failure {
+            reason,
+            selected,
+            status,
+            raw_error_text,
+            attempts,
+        } => {
+            record_proxy_log_failure(
+                &billing_state,
+                key_id,
+                selected.as_ref(),
+                &billing_model,
+                status,
+                Some(elapsed_ms_since(started_at)),
+                raw_error_text.as_deref(),
+                attempts,
+                false,
+            )
+            .await;
+            Err(AppError::UpstreamError(format!(
+                "Proxy conductor failed after {attempts} attempts ({reason:?}, status: {:?}): {}",
+                status,
+                raw_error_text.unwrap_or_else(|| "no upstream error text".to_string())
+            )))
+        }
+    }
+}
+
+async fn execute_messages_stream_with_conductor(
+    state: AppState,
+    key_id: Option<i64>,
+    model: String,
+    request: crate::transformers::canonical::CanonicalRequest,
+) -> AppResult<Vec<String>> {
+    let started_at = Instant::now();
+    let conductor = build_conductor(&state);
+    let billing_state = state.clone();
+    let billing_model = model.clone();
+    let result = conductor
+        .execute(ExecuteInput {
+            requested_model: model,
+            downstream_policy: None,
+            attempt_fn: Box::new(move |ctx| {
+                let mut request = request.clone();
+                request.model = ctx.selected.actual_model.clone();
+                async move {
+                    match executors::execute_anthropic_messages_stream(
+                        selected_channel_to_route(ctx.selected),
+                        request,
+                    )
+                    .await
+                    {
+                        Ok(chunks) => AttemptResult::Success {
+                            response: Value::Array(chunks.into_iter().map(Value::String).collect()),
+                            latency_ms: None,
+                            cost: None,
+                        },
+                        Err(err) => AttemptResult::Failure {
+                            action: crate::proxy::conductor::AttemptFailureAction::Failover,
+                            status: upstream_status_from_error(&err),
+                            raw_error_text: Some(err.to_string()),
+                        },
+                    }
+                }
+                .boxed()
+            }),
+            on_terminal_failure: None,
+        })
+        .await;
+
+    let (selected, attempts, chunks) = match result {
+        ExecuteResult::Success {
+            selected,
+            response,
+            attempts,
+        } => match response {
+            Value::Array(chunks) => (
+                selected,
+                attempts,
+                chunks
+                    .into_iter()
+                    .filter_map(|chunk| chunk.as_str().map(str::to_string))
+                    .collect::<Vec<_>>(),
+            ),
+            _ => {
+                return Err(AppError::UpstreamError(
+                    "Invalid streaming response from conductor".into(),
+                ))
+            }
+        },
+        ExecuteResult::Failure {
+            reason,
+            selected,
+            status,
+            raw_error_text,
+            attempts,
+        } => {
+            record_proxy_log_failure(
+                &billing_state,
+                key_id,
+                selected.as_ref(),
+                &billing_model,
+                status,
+                Some(elapsed_ms_since(started_at)),
+                raw_error_text.as_deref(),
+                attempts,
+                true,
+            )
+            .await;
+            return Err(AppError::UpstreamError(format!(
+                "Proxy conductor failed after {attempts} attempts ({reason:?}, status: {:?}): {}",
+                status,
+                raw_error_text.unwrap_or_else(|| "no upstream error text".to_string())
+            )));
+        }
+    };
+
+    record_proxy_log_success(
+        &billing_state,
+        key_id,
+        &selected,
+        &billing_model,
+        Some(elapsed_ms_since(started_at)),
+        0,
+        0,
+        0.0,
+        attempts,
+        true,
+    )
+    .await;
+    record_billing(&billing_state, key_id, &billing_model, 0, 0, 0.0).await;
+    Ok(chunks)
+}
+
 async fn execute_chat_completions_with_conductor(
     state: AppState,
     key_id: Option<i64>,

src/routes/site_announcements.rs

@@ -1,9 +1,14 @@
-// Site Announcements routes — upstream provider notifications per site
+//! User announcement routes.
+//!
+//! The public route names keep the old `site-announcements` path for frontend
+//! compatibility, but the resource is now admin-authored announcements shown to
+//! normal users.
 
-use crate::{db::models::site_announcement::SiteAnnouncement, error::AppResult, AppState};
+use crate::{auth::jwt::validate_jwt, error::AppResult, AppState};
 use axum::{
     extract::{Path, Query, State},
-    routing::{get, post},
+    http::HeaderMap,
+    routing::{get, post, put},
     Json, Router,
 };
 use serde::Deserialize;
@@ -14,159 +19,522 @@ use tracing::info;
 pub struct ListAnnouncementsQuery {
     limit: Option<i64>,
     offset: Option<i64>,
-    site_id: Option<i64>,
-    platform: Option<String>,
-    read: Option<String>,   // "true" | "false"
-    status: Option<String>, // "active" | "expired" | "dismissed"
+    read: Option<String>,
+    status: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct AnnouncementPayload {
+    title: String,
+    content: String,
+    level: Option<String>,
+    status: Option<String>,
+    #[serde(alias = "startsAt")]
+    starts_at: Option<String>,
+    #[serde(alias = "endsAt")]
+    ends_at: Option<String>,
 }
 
 pub fn routes() -> Router<AppState> {
     Router::new()
         .route(
             "/api/site-announcements",
-            get(list_announcements).delete(delete_all),
+            get(list_admin_announcements)
+                .post(create_announcement)
+                .delete(delete_all),
+        )
+        .route(
+            "/api/site-announcements/{id}",
+            put(update_announcement).delete(delete_announcement),
+        )
+        .route("/api/site-announcements/{id}/read", post(mark_read_admin))
+        .route("/api/site-announcements/read-all", post(mark_all_read_admin))
+        .route("/api/user/announcements", get(list_user_announcements))
+        .route("/api/user/announcements/{id}/read", post(mark_read_user))
+        .route(
+            "/api/user/announcements/read-all",
+            post(mark_all_read_user),
         )
-        .route("/api/site-announcements/{id}/read", post(mark_read))
-        .route("/api/site-announcements/read-all", post(mark_all_read))
 }
 
-/// GET /api/site-announcements — list announcements with optional filters
-async fn list_announcements(
+async fn list_admin_announcements(
     State(state): State<AppState>,
+    headers: HeaderMap,
     Query(q): Query<ListAnnouncementsQuery>,
 ) -> AppResult<Json<Value>> {
-    info!("Listing site announcements");
-    let limit = q.limit.unwrap_or(50).clamp(1, 500);
+    require_admin(&headers, &state)?;
+    info!("Listing user announcements for admin");
+    let limit = q.limit.unwrap_or(100).clamp(1, 500);
     let offset = q.offset.unwrap_or(0).max(0);
+    let status = q
+        .status
+        .as_deref()
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_string);
 
-    let mut sql = "SELECT * FROM site_announcements WHERE 1=1".to_string();
-    let mut params: Vec<String> = vec![];
-    let mut bind_idx = 0;
-
-    if let Some(site_id) = q.site_id {
-        bind_idx += 1;
-        sql.push_str(&format!(" AND site_id = ?{}", bind_idx));
-        params.push(site_id.to_string());
+    let mut sql = "SELECT
+            a.id, a.title, a.content, a.level, a.status, a.audience,
+            a.starts_at, a.ends_at, a.created_at, a.updated_at, a.published_at,
+            COUNT(r.user_id) AS read_count
+        FROM user_announcements a
+        LEFT JOIN user_announcement_reads r ON r.announcement_id = a.id
+        WHERE 1=1"
+        .to_string();
+    if status.is_some() {
+        sql.push_str(" AND a.status = ?");
     }
-    if let Some(ref platform) = q.platform {
-        if !platform.is_empty() {
-            bind_idx += 1;
-            sql.push_str(&format!(" AND platform = ?{}", bind_idx));
-            params.push(platform.clone());
-        }
-    }
-    if let Some(ref r) = q.read {
-        if r == "true" {
-            sql.push_str(" AND read_at IS NOT NULL");
-        } else if r == "false" {
-            sql.push_str(" AND read_at IS NULL");
-        }
+    sql.push_str(
+        " GROUP BY a.id
+          ORDER BY a.created_at DESC
+          LIMIT ? OFFSET ?",
+    );
+
+    let mut query = sqlx::query_as::<_, AnnouncementRow>(&sql);
+    if let Some(status) = status {
+        query = query.bind(status);
     }
+    let rows = query
+        .bind(limit)
+        .bind(offset)
+        .fetch_all(&*state.db)
+        .await?;
 
-    // status filter: active = NOT dismissed AND (ends_at IS NULL OR ends_at > now)
-    // We fetch all and apply status filter in Rust for simplicity
-    // (the "expired" vs "active" logic references ends_at which is a datetime comparison)
-
-    sql.push_str(" ORDER BY first_seen_at DESC");
-
-    let mut query = sqlx::query_as::<_, SiteAnnouncement>(&sql);
-    for p in &params {
-        query = query.bind(p);
-    }
-    let announcements: Vec<SiteAnnouncement> = query.fetch_all(&*state.db).await?;
-
-    // Apply status filter in-memory (matches Node.js behaviour)
-    let filtered = if let Some(ref status) = q.status {
-        let now = chrono::Utc::now().timestamp_millis();
-        let status = status.trim().to_lowercase();
-        announcements
-            .into_iter()
-            .filter(|a| {
-                if status == "dismissed" {
-                    a.dismissed_at.is_some()
-                } else if status == "expired" {
-                    a.dismissed_at.is_none()
-                        && a.ends_at.as_ref().is_some_and(|e| parse_dt_millis(e) < now)
-                } else if status == "active" {
-                    a.dismissed_at.is_none()
-                        && a.ends_at.as_ref().is_none_or(|e| parse_dt_millis(e) >= now)
-                } else {
-                    true
-                }
-            })
-            .collect()
-    } else {
-        announcements
-    };
-
-    // Apply pagination in-memory
-    let paginated: Vec<Value> = filtered
-        .into_iter()
-        .skip(offset as usize)
-        .take(limit as usize)
-        .map(|a| {
-            json!({
-                "id": a.id,
-                "siteId": a.site_id,
-                "platform": a.platform,
-                "sourceKey": a.source_key,
-                "title": a.title,
-                "content": a.content,
-                "level": a.level,
-                "sourceUrl": a.source_url,
-                "startsAt": a.starts_at,
-                "endsAt": a.ends_at,
-                "upstreamCreatedAt": a.upstream_created_at,
-                "upstreamUpdatedAt": a.upstream_updated_at,
-                "firstSeenAt": a.first_seen_at,
-                "lastSeenAt": a.last_seen_at,
-                "readAt": a.read_at,
-                "dismissedAt": a.dismissed_at,
-                "rawPayload": a.raw_payload,
-            })
-        })
-        .collect();
-
-    Ok(Json(Value::Array(paginated)))
+    Ok(Json(Value::Array(
+        rows.into_iter().map(|row| row.into_admin_json()).collect(),
+    )))
 }
 
-/// POST /api/site-announcements/{id}/read
-async fn mark_read(State(state): State<AppState>, Path(id): Path<i64>) -> AppResult<Json<Value>> {
-    info!("Marking site announcement {} as read", id);
-    sqlx::query("UPDATE site_announcements SET read_at = datetime('now') WHERE id = ?")
+async fn list_user_announcements(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Query(q): Query<ListAnnouncementsQuery>,
+) -> AppResult<Json<Value>> {
+    let user_id = current_user_id(&headers, &state)?;
+    let limit = q.limit.unwrap_or(50).clamp(1, 200);
+    let offset = q.offset.unwrap_or(0).max(0);
+    let read_filter = q.read.as_deref().map(str::trim);
+
+    let mut sql = "SELECT
+            a.id, a.title, a.content, a.level, a.status, a.audience,
+            a.starts_at, a.ends_at, a.created_at, a.updated_at, a.published_at,
+            CASE WHEN r.read_at IS NULL THEN 0 ELSE 1 END AS read,
+            r.read_at AS read_at
+        FROM user_announcements a
+        LEFT JOIN user_announcement_reads r
+            ON r.announcement_id = a.id AND r.user_id = ?
+        WHERE a.status = 'published'
+          AND (a.starts_at IS NULL OR a.starts_at <= datetime('now'))
+          AND (a.ends_at IS NULL OR a.ends_at >= datetime('now'))"
+        .to_string();
+
+    if read_filter == Some("true") {
+        sql.push_str(" AND r.read_at IS NOT NULL");
+    } else if read_filter == Some("false") {
+        sql.push_str(" AND r.read_at IS NULL");
+    }
+
+    sql.push_str(" ORDER BY COALESCE(a.published_at, a.created_at) DESC, a.id DESC LIMIT ? OFFSET ?");
+
+    let rows: Vec<UserAnnouncementRow> = sqlx::query_as(&sql)
+        .bind(user_id)
+        .bind(limit)
+        .bind(offset)
+        .fetch_all(&*state.db)
+        .await?;
+
+    Ok(Json(Value::Array(
+        rows.into_iter().map(|row| row.into_user_json()).collect(),
+    )))
+}
+
+async fn create_announcement(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(payload): Json<AnnouncementPayload>,
+) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    let payload = normalize_payload(payload)?;
+    let result = sqlx::query(
+        "INSERT INTO user_announcements
+         (title, content, level, status, audience, starts_at, ends_at, published_at)
+         VALUES (?, ?, ?, ?, 'all', ?, ?, CASE WHEN ? = 'published' THEN datetime('now') ELSE NULL END)",
+    )
+    .bind(&payload.title)
+    .bind(&payload.content)
+    .bind(&payload.level)
+    .bind(&payload.status)
+    .bind(&payload.starts_at)
+    .bind(&payload.ends_at)
+    .bind(&payload.status)
+    .execute(&*state.db)
+    .await?;
+
+    let row = fetch_admin_row(&state, result.last_insert_rowid()).await?;
+    Ok(Json(row.into_admin_json()))
+}
+
+async fn update_announcement(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+    Json(payload): Json<AnnouncementPayload>,
+) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    let payload = normalize_payload(payload)?;
+    let result = sqlx::query(
+        "UPDATE user_announcements
+         SET title = ?,
+             content = ?,
+             level = ?,
+             status = ?,
+             starts_at = ?,
+             ends_at = ?,
+             published_at = CASE
+                 WHEN status != 'published' AND ? = 'published' THEN datetime('now')
+                 ELSE published_at
+             END,
+             updated_at = datetime('now')
+         WHERE id = ?",
+    )
+    .bind(&payload.title)
+    .bind(&payload.content)
+    .bind(&payload.level)
+    .bind(&payload.status)
+    .bind(&payload.starts_at)
+    .bind(&payload.ends_at)
+    .bind(&payload.status)
+    .bind(id)
+    .execute(&*state.db)
+    .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(crate::error::AppError::NotFound(
+            "announcement not found".into(),
+        ));
+    }
+
+    let row = fetch_admin_row(&state, id).await?;
+    Ok(Json(row.into_admin_json()))
+}
+
+async fn delete_announcement(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    let result = sqlx::query("DELETE FROM user_announcements WHERE id = ?")
         .bind(id)
         .execute(&*state.db)
         .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(crate::error::AppError::NotFound(
+            "announcement not found".into(),
+        ));
+    }
+
     Ok(Json(json!({ "success": true })))
 }
 
-/// POST /api/site-announcements/read-all
-async fn mark_all_read(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    info!("Marking all site announcements as read");
-    sqlx::query("UPDATE site_announcements SET read_at = datetime('now') WHERE read_at IS NULL")
+async fn mark_read_admin(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    sqlx::query(
+        "INSERT INTO user_announcement_reads (announcement_id, user_id, read_at)
+         SELECT ?, id, datetime('now') FROM users WHERE role = 'user'
+         ON CONFLICT(announcement_id, user_id) DO UPDATE SET read_at = excluded.read_at",
+    )
+    .bind(id)
+    .execute(&*state.db)
+    .await?;
+    Ok(Json(json!({ "success": true })))
+}
+
+async fn mark_all_read_admin(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    sqlx::query(
+        "INSERT INTO user_announcement_reads (announcement_id, user_id, read_at)
+         SELECT a.id, u.id, datetime('now')
+         FROM user_announcements a
+         CROSS JOIN users u
+         WHERE u.role = 'user'
+         ON CONFLICT(announcement_id, user_id) DO UPDATE SET read_at = excluded.read_at",
+    )
+    .execute(&*state.db)
+    .await?;
+    Ok(Json(json!({ "success": true })))
+}
+
+async fn mark_read_user(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<i64>,
+) -> AppResult<Json<Value>> {
+    let user_id = current_user_id(&headers, &state)?;
+    ensure_visible_to_user(&state, id).await?;
+    sqlx::query(
+        "INSERT INTO user_announcement_reads (announcement_id, user_id, read_at)
+         VALUES (?, ?, datetime('now'))
+         ON CONFLICT(announcement_id, user_id) DO UPDATE SET read_at = excluded.read_at",
+    )
+    .bind(id)
+    .bind(user_id)
+    .execute(&*state.db)
+    .await?;
+    Ok(Json(json!({ "success": true })))
+}
+
+async fn mark_all_read_user(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+) -> AppResult<Json<Value>> {
+    let user_id = current_user_id(&headers, &state)?;
+    sqlx::query(
+        "INSERT INTO user_announcement_reads (announcement_id, user_id, read_at)
+         SELECT id, ?, datetime('now')
+         FROM user_announcements
+         WHERE status = 'published'
+           AND (starts_at IS NULL OR starts_at <= datetime('now'))
+           AND (ends_at IS NULL OR ends_at >= datetime('now'))
+         ON CONFLICT(announcement_id, user_id) DO UPDATE SET read_at = excluded.read_at",
+    )
+    .bind(user_id)
+    .execute(&*state.db)
+    .await?;
+    Ok(Json(json!({ "success": true })))
+}
+
+async fn delete_all(State(state): State<AppState>, headers: HeaderMap) -> AppResult<Json<Value>> {
+    require_admin(&headers, &state)?;
+    info!("Deleting all user announcements");
+    sqlx::query("DELETE FROM user_announcements")
         .execute(&*state.db)
         .await?;
     Ok(Json(json!({ "success": true })))
 }
 
-/// DELETE /api/site-announcements
-async fn delete_all(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    info!("Deleting all site announcements");
-    sqlx::query("DELETE FROM site_announcements")
-        .execute(&*state.db)
-        .await?;
-    Ok(Json(json!({ "success": true })))
+async fn fetch_admin_row(state: &AppState, id: i64) -> AppResult<AnnouncementRow> {
+    let row = sqlx::query_as::<_, AnnouncementRow>(
+        "SELECT
+            a.id, a.title, a.content, a.level, a.status, a.audience,
+            a.starts_at, a.ends_at, a.created_at, a.updated_at, a.published_at,
+            COUNT(r.user_id) AS read_count
+         FROM user_announcements a
+         LEFT JOIN user_announcement_reads r ON r.announcement_id = a.id
+         WHERE a.id = ?
+         GROUP BY a.id",
+    )
+    .bind(id)
+    .fetch_one(&*state.db)
+    .await?;
+    Ok(row)
 }
 
-/// Parse a datetime string like "2026-05-15 10:30:00" or ISO to milliseconds since epoch.
-fn parse_dt_millis(s: &str) -> i64 {
-    if let Ok(dt) = chrono::NaiveDateTime::parse_from_str(s.trim(), "%Y-%m-%d %H:%M:%S") {
-        dt.and_utc().timestamp_millis()
-    } else if let Ok(dt) = chrono::DateTime::parse_from_rfc3339(s.trim()) {
-        dt.timestamp_millis()
-    } else if let Ok(dt) = chrono::NaiveDateTime::parse_from_str(s.trim(), "%Y-%m-%dT%H:%M:%S") {
-        dt.and_utc().timestamp_millis()
-    } else {
-        0
+async fn ensure_visible_to_user(state: &AppState, id: i64) -> AppResult<()> {
+    let exists: Option<i64> = sqlx::query_scalar(
+        "SELECT id
+         FROM user_announcements
+         WHERE id = ?
+           AND status = 'published'
+           AND (starts_at IS NULL OR starts_at <= datetime('now'))
+           AND (ends_at IS NULL OR ends_at >= datetime('now'))",
+    )
+    .bind(id)
+    .fetch_optional(&*state.db)
+    .await?;
+
+    if exists.is_none() {
+        return Err(crate::error::AppError::NotFound(
+            "announcement not found".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn current_user_id(headers: &HeaderMap, state: &AppState) -> AppResult<i64> {
+    let auth = headers
+        .get("Authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .ok_or_else(|| {
+            crate::error::AppError::Unauthorized("Missing or invalid Authorization header".into())
+        })?;
+
+    let claims = validate_jwt(&state.config.auth.jwt_secret, auth)
+        .map_err(|_| crate::error::AppError::Unauthorized("Invalid or expired token".into()))?;
+
+    if claims.role != "user" && claims.role != "admin" {
+        return Err(crate::error::AppError::Forbidden(
+            "user account is required".into(),
+        ));
+    }
+
+    claims
+        .sub
+        .parse()
+        .map_err(|_| crate::error::AppError::Unauthorized("Invalid user ID in token".into()))
+}
+
+fn require_admin(headers: &HeaderMap, state: &AppState) -> AppResult<()> {
+    let auth = headers
+        .get("Authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .ok_or_else(|| {
+            crate::error::AppError::Unauthorized("Missing or invalid Authorization header".into())
+        })?;
+
+    if auth == state.config.auth.auth_token {
+        return Ok(());
+    }
+
+    let claims = validate_jwt(&state.config.auth.jwt_secret, auth)
+        .map_err(|_| crate::error::AppError::Unauthorized("Invalid admin token".into()))?;
+    if claims.role != "admin" {
+        return Err(crate::error::AppError::Forbidden(
+            "Admin account is required for this route".into(),
+        ));
+    }
+
+    Ok(())
+}
+
+fn normalize_payload(payload: AnnouncementPayload) -> AppResult<NormalizedAnnouncementPayload> {
+    let title = payload.title.trim().to_string();
+    let content = payload.content.trim().to_string();
+    if title.is_empty() {
+        return Err(crate::error::AppError::BadRequest("title is required".into()));
+    }
+    if content.is_empty() {
+        return Err(crate::error::AppError::BadRequest("content is required".into()));
+    }
+
+    let level = payload
+        .level
+        .unwrap_or_else(|| "info".to_string())
+        .trim()
+        .to_lowercase();
+    if !["info", "warning", "error"].contains(&level.as_str()) {
+        return Err(crate::error::AppError::BadRequest(
+            "level must be info, warning, or error".into(),
+        ));
+    }
+
+    let status = payload
+        .status
+        .unwrap_or_else(|| "published".to_string())
+        .trim()
+        .to_lowercase();
+    if !["draft", "published", "archived"].contains(&status.as_str()) {
+        return Err(crate::error::AppError::BadRequest(
+            "status must be draft, published, or archived".into(),
+        ));
+    }
+
+    Ok(NormalizedAnnouncementPayload {
+        title,
+        content,
+        level,
+        status,
+        starts_at: payload.starts_at.filter(|s| !s.trim().is_empty()),
+        ends_at: payload.ends_at.filter(|s| !s.trim().is_empty()),
+    })
+}
+
+struct NormalizedAnnouncementPayload {
+    title: String,
+    content: String,
+    level: String,
+    status: String,
+    starts_at: Option<String>,
+    ends_at: Option<String>,
+}
+
+#[derive(sqlx::FromRow)]
+struct AnnouncementRow {
+    id: i64,
+    title: String,
+    content: String,
+    level: String,
+    status: String,
+    audience: String,
+    starts_at: Option<String>,
+    ends_at: Option<String>,
+    created_at: String,
+    updated_at: String,
+    published_at: Option<String>,
+    read_count: i64,
+}
+
+impl AnnouncementRow {
+    fn into_admin_json(self) -> Value {
+        json!({
+            "id": self.id,
+            "siteId": 0,
+            "platform": "boosapi",
+            "sourceKey": format!("user-announcement:{}", self.id),
+            "title": self.title,
+            "content": self.content,
+            "level": self.level,
+            "status": self.status,
+            "audience": self.audience,
+            "startsAt": self.starts_at,
+            "endsAt": self.ends_at,
+            "firstSeenAt": self.created_at,
+            "lastSeenAt": self.updated_at,
+            "publishedAt": self.published_at,
+            "readCount": self.read_count,
+            "readAt": null,
+            "dismissedAt": if self.status == "archived" { Some(self.updated_at) } else { None },
+        })
+    }
+}
+
+#[derive(sqlx::FromRow)]
+struct UserAnnouncementRow {
+    id: i64,
+    title: String,
+    content: String,
+    level: String,
+    status: String,
+    audience: String,
+    starts_at: Option<String>,
+    ends_at: Option<String>,
+    created_at: String,
+    updated_at: String,
+    published_at: Option<String>,
+    read: i64,
+    read_at: Option<String>,
+}
+
+impl UserAnnouncementRow {
+    fn into_user_json(self) -> Value {
+        json!({
+            "id": self.id,
+            "siteId": 0,
+            "platform": "boosapi",
+            "sourceKey": format!("user-announcement:{}", self.id),
+            "title": self.title,
+            "content": self.content,
+            "level": self.level,
+            "status": self.status,
+            "audience": self.audience,
+            "startsAt": self.starts_at,
+            "endsAt": self.ends_at,
+            "firstSeenAt": self.published_at.clone().unwrap_or(self.created_at),
+            "lastSeenAt": self.updated_at,
+            "publishedAt": self.published_at,
+            "read": self.read != 0,
+            "readAt": self.read_at,
+        })
     }
 }

src/routes/user/mod.rs

@@ -200,8 +200,25 @@ async fn get_user_logs(
 
     let items: Vec<Value> = sqlx::query_as::<_, crate::routes::stats::ProxyLogRow>(
         r#"
-        SELECT l.* FROM proxy_logs l
+        SELECT
+            l.id, l.route_id, l.channel_id, l.account_id, l.downstream_api_key_id,
+            l.model_requested, l.model_actual, l.status, l.http_status,
+            l.latency_ms, l.first_byte_latency_ms,
+            l.prompt_tokens, l.completion_tokens, l.total_tokens, l.estimated_cost,
+            l.error_message, l.retry_count, l.is_stream,
+            l.client_family, l.client_app_id, l.client_app_name, l.client_confidence,
+            l.created_at,
+            a.site_id AS site_id,
+            COALESCE(NULLIF(a.username, ''), CASE WHEN a.id IS NULL THEN NULL ELSE '账号 #' || a.id END) AS username,
+            s.name AS site_name,
+            s.url AS site_url,
+            k.name AS downstream_key_name,
+            k.group_name AS downstream_key_group_name,
+            k.tags AS downstream_key_tags
+        FROM proxy_logs l
         JOIN downstream_api_keys k ON l.downstream_api_key_id = k.id
+        LEFT JOIN accounts a ON a.id = l.account_id
+        LEFT JOIN sites s ON s.id = a.site_id
         WHERE k.user_id = ?
           AND (? IS NULL OR l.model_requested LIKE ?)
           AND (? IS NULL OR l.status = ?)

src/routes/workspace.rs

@@ -0,0 +1,390 @@
+use crate::{
+    auth::jwt::validate_jwt,
+    error::{AppError, AppResult},
+    AppState,
+};
+use axum::{
+    body::Body,
+    extract::{Path, Query, State},
+    http::{header, HeaderMap, Response, StatusCode},
+    routing::get,
+    Json, Router,
+};
+use serde::Deserialize;
+use serde_json::{json, Value};
+use std::path::PathBuf;
+
+#[derive(Debug, Clone)]
+enum WorkspaceCaller {
+    Admin,
+    User { user_id: i64 },
+}
+
+#[derive(Debug, Deserialize)]
+struct AssetQuery {
+    source: Option<String>,
+    kind: Option<String>,
+    q: Option<String>,
+    user_id: Option<i64>,
+    #[serde(alias = "userId")]
+    user_id_camel: Option<i64>,
+    page: Option<i64>,
+    #[serde(alias = "pageSize")]
+    page_size: Option<i64>,
+}
+
+pub fn routes() -> Router<AppState> {
+    Router::new()
+        .route("/api/workspace/assets", get(list_admin_assets))
+        .route("/api/workspace/assets/{public_id}", get(get_admin_asset).delete(delete_admin_asset))
+        .route("/api/workspace/assets/{public_id}/file", get(get_admin_asset_file))
+        .route("/api/user/workspace/assets", get(list_user_assets))
+        .route("/api/user/workspace/assets/{public_id}", get(get_user_asset).delete(delete_user_asset))
+        .route("/api/user/workspace/assets/{public_id}/file", get(get_user_asset_file))
+}
+
+fn bearer(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| {
+            value
+                .strip_prefix("Bearer ")
+                .or_else(|| value.strip_prefix("bearer "))
+        })
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+}
+
+fn resolve_caller(headers: &HeaderMap, state: &AppState, admin_required: bool) -> AppResult<WorkspaceCaller> {
+    let token = bearer(headers)
+        .ok_or_else(|| AppError::Unauthorized("Missing Authorization header".into()))?;
+
+    if token == state.config.auth.auth_token || token == state.config.auth.proxy_token {
+        return Ok(WorkspaceCaller::Admin);
+    }
+
+    let claims = validate_jwt(&state.config.auth.jwt_secret, token)
+        .map_err(|_| AppError::Unauthorized("Invalid or expired token".into()))?;
+    if claims.role == "admin" {
+        return Ok(WorkspaceCaller::Admin);
+    }
+    if claims.role == "user" && !admin_required {
+        let user_id = claims
+            .sub
+            .parse::<i64>()
+            .map_err(|_| AppError::Unauthorized("Invalid user ID in token".into()))?;
+        return Ok(WorkspaceCaller::User { user_id });
+    }
+    Err(AppError::Forbidden("Workspace access denied".into()))
+}
+
+fn normalize_query(query: &AssetQuery) -> (i64, i64, Option<String>, Option<String>, Option<String>, Option<i64>) {
+    let page_size = query.page_size.unwrap_or(36).clamp(1, 120);
+    let page = query.page.unwrap_or(1).max(1);
+    let offset = (page - 1) * page_size;
+    let source = query
+        .source
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && *value != "all")
+        .map(str::to_string);
+    let kind = query
+        .kind
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && *value != "all")
+        .map(str::to_string);
+    let q = query
+        .q
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(|value| format!("%{value}%"));
+    let user_id = query.user_id.or(query.user_id_camel);
+    (page_size, offset, source, kind, q, user_id)
+}
+
+fn row_to_json(row: sqlx::sqlite::SqliteRow) -> Value {
+    use sqlx::Row;
+    let metadata_raw: String = row.try_get("metadata").unwrap_or_else(|_| "{}".to_string());
+    let metadata = serde_json::from_str::<Value>(&metadata_raw).unwrap_or_else(|_| json!({}));
+    let public_id: String = row.try_get("public_id").unwrap_or_default();
+    let file_path: Option<String> = row.try_get("file_path").ok();
+    json!({
+        "id": row.try_get::<i64, _>("id").unwrap_or_default(),
+        "publicId": public_id,
+        "userId": row.try_get::<Option<i64>, _>("user_id").unwrap_or(None),
+        "source": row.try_get::<String, _>("source").unwrap_or_default(),
+        "kind": row.try_get::<String, _>("kind").unwrap_or_default(),
+        "title": row.try_get::<Option<String>, _>("title").unwrap_or(None),
+        "prompt": row.try_get::<Option<String>, _>("prompt").unwrap_or(None),
+        "model": row.try_get::<Option<String>, _>("model").unwrap_or(None),
+        "status": row.try_get::<String, _>("status").unwrap_or_else(|_| "completed".to_string()),
+        "mimeType": row.try_get::<Option<String>, _>("mime_type").unwrap_or(None),
+        "fileName": row.try_get::<Option<String>, _>("file_name").unwrap_or(None),
+        "hasLocalFile": file_path.as_deref().map(|value| !value.is_empty()).unwrap_or(false),
+        "remoteUrl": row.try_get::<Option<String>, _>("remote_url").unwrap_or(None),
+        "sizeBytes": row.try_get::<i64, _>("size_bytes").unwrap_or_default(),
+        "metadata": metadata,
+        "createdAt": row.try_get::<String, _>("created_at").unwrap_or_default(),
+        "updatedAt": row.try_get::<String, _>("updated_at").unwrap_or_default(),
+    })
+}
+
+async fn list_assets(
+    state: AppState,
+    caller: WorkspaceCaller,
+    query: AssetQuery,
+) -> AppResult<Json<Value>> {
+    let (page_size, offset, source, kind, q, requested_user_id) = normalize_query(&query);
+    let scoped_user_id = match caller {
+        WorkspaceCaller::Admin => requested_user_id,
+        WorkspaceCaller::User { user_id } => Some(user_id),
+    };
+
+    let items = sqlx::query(
+        "SELECT *
+         FROM workspace_assets
+         WHERE deleted_at IS NULL
+           AND (? IS NULL OR user_id = ?)
+           AND (? IS NULL OR source = ?)
+           AND (? IS NULL OR kind = ?)
+           AND (
+             ? IS NULL
+             OR title LIKE ?
+             OR prompt LIKE ?
+             OR model LIKE ?
+             OR source LIKE ?
+           )
+         ORDER BY datetime(created_at) DESC, id DESC
+         LIMIT ? OFFSET ?",
+    )
+    .bind(scoped_user_id)
+    .bind(scoped_user_id)
+    .bind(&source)
+    .bind(&source)
+    .bind(&kind)
+    .bind(&kind)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .bind(page_size)
+    .bind(offset)
+    .map(row_to_json)
+    .fetch_all(&*state.db)
+    .await?;
+
+    let total: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*)
+         FROM workspace_assets
+         WHERE deleted_at IS NULL
+           AND (? IS NULL OR user_id = ?)
+           AND (? IS NULL OR source = ?)
+           AND (? IS NULL OR kind = ?)
+           AND (
+             ? IS NULL
+             OR title LIKE ?
+             OR prompt LIKE ?
+             OR model LIKE ?
+             OR source LIKE ?
+           )",
+    )
+    .bind(scoped_user_id)
+    .bind(scoped_user_id)
+    .bind(&source)
+    .bind(&source)
+    .bind(&kind)
+    .bind(&kind)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .bind(&q)
+    .fetch_one(&*state.db)
+    .await?;
+
+    Ok(Json(json!({
+        "success": true,
+        "items": items,
+        "total": total,
+        "page": query.page.unwrap_or(1).max(1),
+        "pageSize": page_size,
+    })))
+}
+
+async fn get_asset_row(
+    state: &AppState,
+    public_id: &str,
+    caller: WorkspaceCaller,
+) -> AppResult<sqlx::sqlite::SqliteRow> {
+    let scoped_user_id = match caller {
+        WorkspaceCaller::Admin => None,
+        WorkspaceCaller::User { user_id } => Some(user_id),
+    };
+    let row = sqlx::query(
+        "SELECT *
+         FROM workspace_assets
+         WHERE public_id = ?
+           AND deleted_at IS NULL
+           AND (? IS NULL OR user_id = ?)
+         LIMIT 1",
+    )
+    .bind(public_id)
+    .bind(scoped_user_id)
+    .bind(scoped_user_id)
+    .fetch_optional(&*state.db)
+    .await?
+    .ok_or_else(|| AppError::NotFound("Workspace asset not found".into()))?;
+    Ok(row)
+}
+
+async fn get_asset(
+    state: AppState,
+    caller: WorkspaceCaller,
+    public_id: String,
+) -> AppResult<Json<Value>> {
+    Ok(Json(json!({
+        "success": true,
+        "asset": row_to_json(get_asset_row(&state, &public_id, caller).await?),
+    })))
+}
+
+async fn delete_asset(
+    state: AppState,
+    caller: WorkspaceCaller,
+    public_id: String,
+) -> AppResult<StatusCode> {
+    let scoped_user_id = match caller {
+        WorkspaceCaller::Admin => None,
+        WorkspaceCaller::User { user_id } => Some(user_id),
+    };
+    let result = sqlx::query(
+        "UPDATE workspace_assets
+         SET deleted_at = datetime('now'), updated_at = datetime('now')
+         WHERE public_id = ?
+           AND deleted_at IS NULL
+           AND (? IS NULL OR user_id = ?)",
+    )
+    .bind(public_id)
+    .bind(scoped_user_id)
+    .bind(scoped_user_id)
+    .execute(&*state.db)
+    .await?;
+    if result.rows_affected() == 0 {
+        return Err(AppError::NotFound("Workspace asset not found".into()));
+    }
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn get_asset_file(
+    state: AppState,
+    caller: WorkspaceCaller,
+    public_id: String,
+) -> AppResult<Response<Body>> {
+    use sqlx::Row;
+    let row = get_asset_row(&state, &public_id, caller).await?;
+    let file_path = row
+        .try_get::<Option<String>, _>("file_path")
+        .ok()
+        .flatten()
+        .filter(|value| !value.trim().is_empty())
+        .ok_or_else(|| AppError::NotFound("Workspace asset file is not archived locally".into()))?;
+    let path = PathBuf::from(file_path);
+    let bytes = tokio::fs::read(&path)
+        .await
+        .map_err(|_| AppError::NotFound("Workspace asset file not found".into()))?;
+    let mime_type = row
+        .try_get::<Option<String>, _>("mime_type")
+        .ok()
+        .flatten()
+        .unwrap_or_else(|| "application/octet-stream".to_string());
+    let file_name = row
+        .try_get::<Option<String>, _>("file_name")
+        .ok()
+        .flatten()
+        .unwrap_or_else(|| format!("{public_id}.bin"));
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, mime_type)
+        .header(
+            header::CONTENT_DISPOSITION,
+            format!("inline; filename=\"{}\"", file_name.replace('"', "")),
+        )
+        .body(Body::from(bytes))
+        .map_err(|err| AppError::Internal(anyhow::anyhow!(err)))
+}
+
+async fn list_admin_assets(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Query(query): Query<AssetQuery>,
+) -> AppResult<Json<Value>> {
+    let caller = resolve_caller(&headers, &state, true)?;
+    list_assets(state, caller, query).await
+}
+
+async fn get_admin_asset(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<Json<Value>> {
+    let caller = resolve_caller(&headers, &state, true)?;
+    get_asset(state, caller, public_id).await
+}
+
+async fn get_admin_asset_file(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<Response<Body>> {
+    let caller = resolve_caller(&headers, &state, true)?;
+    get_asset_file(state, caller, public_id).await
+}
+
+async fn delete_admin_asset(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<StatusCode> {
+    let caller = resolve_caller(&headers, &state, true)?;
+    delete_asset(state, caller, public_id).await
+}
+
+async fn list_user_assets(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Query(query): Query<AssetQuery>,
+) -> AppResult<Json<Value>> {
+    let caller = resolve_caller(&headers, &state, false)?;
+    list_assets(state, caller, query).await
+}
+
+async fn get_user_asset(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<Json<Value>> {
+    let caller = resolve_caller(&headers, &state, false)?;
+    get_asset(state, caller, public_id).await
+}
+
+async fn get_user_asset_file(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<Response<Body>> {
+    let caller = resolve_caller(&headers, &state, false)?;
+    get_asset_file(state, caller, public_id).await
+}
+
+async fn delete_user_asset(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(public_id): Path<String>,
+) -> AppResult<StatusCode> {
+    let caller = resolve_caller(&headers, &state, false)?;
+    delete_asset(state, caller, public_id).await
+}