Break out into a multi-module project

service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java

@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.whispersystems.textsecuregcm.configuration.*;
+import org.whispersystems.websocket.configuration.WebSocketConfiguration;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+import io.dropwizard.Configuration;
+import io.dropwizard.client.JerseyClientConfiguration;
+
+/** @noinspection MismatchedQueryAndUpdateOfCollection, WeakerAccess */
+public class WhisperServerConfiguration extends Configuration {
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private TwilioConfiguration twilio;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private PushConfiguration push;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private AttachmentsConfiguration attachments;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private ProfilesConfiguration profiles;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private RedisConfiguration cache;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private DirectoryConfiguration directory;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private AccountDatabaseCrawlerConfiguration accountDatabaseCrawler;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private RedisConfiguration pushScheduler;
+
+  @NotNull
+  @Valid
+  @JsonProperty
+  private MessageCacheConfiguration messageCache;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private DatabaseConfiguration messageStore;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private DatabaseConfiguration abuseDatabase;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private List<TestDeviceConfiguration> testDevices = new LinkedList<>();
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private List<MaxDeviceConfiguration> maxDevices = new LinkedList<>();
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private DatabaseConfiguration database = new DatabaseConfiguration();
+
+  @JsonProperty
+  private DatabaseConfiguration read_database;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private RateLimitsConfiguration limits = new RateLimitsConfiguration();
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private JerseyClientConfiguration httpClient = new JerseyClientConfiguration();
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private WebSocketConfiguration webSocket = new WebSocketConfiguration();
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private TurnConfiguration turn;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private GcmConfiguration gcm;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private ApnConfiguration apn;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private UnidentifiedDeliveryConfiguration unidentifiedDelivery;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private VoiceVerificationConfiguration voiceVerification;
+
+  @Valid
+  @NotNull
+  @JsonProperty
+  private RecaptchaConfiguration recaptcha;
+
+  private Map<String, String> transparentDataIndex = new HashMap<>();
+
+  public RecaptchaConfiguration getRecaptchaConfiguration() {
+    return recaptcha;
+  }
+
+  public VoiceVerificationConfiguration getVoiceVerificationConfiguration() {
+    return voiceVerification;
+  }
+
+  public WebSocketConfiguration getWebSocketConfiguration() {
+    return webSocket;
+  }
+
+  public TwilioConfiguration getTwilioConfiguration() {
+    return twilio;
+  }
+
+  public PushConfiguration getPushConfiguration() {
+    return push;
+  }
+
+  public JerseyClientConfiguration getJerseyClientConfiguration() {
+    return httpClient;
+  }
+
+  public AttachmentsConfiguration getAttachmentsConfiguration() {
+    return attachments;
+  }
+
+  public RedisConfiguration getCacheConfiguration() {
+    return cache;
+  }
+
+  public DirectoryConfiguration getDirectoryConfiguration() {
+    return directory;
+  }
+
+  public AccountDatabaseCrawlerConfiguration getAccountDatabaseCrawlerConfiguration() {
+    return accountDatabaseCrawler;
+  }
+
+  public MessageCacheConfiguration getMessageCacheConfiguration() {
+    return messageCache;
+  }
+
+  public RedisConfiguration getPushScheduler() {
+    return pushScheduler;
+  }
+
+  public DatabaseConfiguration getMessageStoreConfiguration() {
+    return messageStore;
+  }
+
+  public DatabaseConfiguration getAbuseDatabaseConfiguration() {
+    return abuseDatabase;
+  }
+
+  public DatabaseConfiguration getAccountsDatabaseConfiguration() {
+    return database;
+  }
+
+  public DatabaseConfiguration getAccountsReadDatabaseConfiguration() {
+    return read_database;
+  }
+
+  public RateLimitsConfiguration getLimitsConfiguration() {
+    return limits;
+  }
+
+  public TurnConfiguration getTurnConfiguration() {
+    return turn;
+  }
+
+  public GcmConfiguration getGcmConfiguration() {
+    return gcm;
+  }
+
+  public ApnConfiguration getApnConfiguration() {
+    return apn;
+  }
+
+  public ProfilesConfiguration getProfilesConfiguration() {
+    return profiles;
+  }
+
+  public UnidentifiedDeliveryConfiguration getDeliveryCertificate() {
+    return unidentifiedDelivery;
+  }
+
+  public Map<String, Integer> getTestDevices() {
+    Map<String, Integer> results = new HashMap<>();
+
+    for (TestDeviceConfiguration testDeviceConfiguration : testDevices) {
+      results.put(testDeviceConfiguration.getNumber(),
+                  testDeviceConfiguration.getCode());
+    }
+
+    return results;
+  }
+
+  public Map<String, Integer> getMaxDevices() {
+    Map<String, Integer> results = new HashMap<>();
+
+    for (MaxDeviceConfiguration maxDeviceConfiguration : maxDevices) {
+      results.put(maxDeviceConfiguration.getNumber(),
+                  maxDeviceConfiguration.getCount());
+    }
+
+    return results;
+  }
+
+  public Map<String, String> getTransparentDataIndex() {
+    return transparentDataIndex;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java

@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm;
+
+import com.codahale.metrics.SharedMetricRegistries;
+import com.codahale.metrics.jdbi3.strategies.DefaultNameStrategy;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.eclipse.jetty.servlets.CrossOriginFilter;
+import org.jdbi.v3.core.Jdbi;
+import org.whispersystems.dispatch.DispatchManager;
+import org.whispersystems.textsecuregcm.auth.AccountAuthenticator;
+import org.whispersystems.textsecuregcm.auth.CertificateGenerator;
+import org.whispersystems.textsecuregcm.auth.DirectoryCredentialsGenerator;
+import org.whispersystems.textsecuregcm.auth.TurnTokenGenerator;
+import org.whispersystems.textsecuregcm.controllers.AccountController;
+import org.whispersystems.textsecuregcm.controllers.AttachmentControllerV1;
+import org.whispersystems.textsecuregcm.controllers.AttachmentControllerV2;
+import org.whispersystems.textsecuregcm.controllers.CertificateController;
+import org.whispersystems.textsecuregcm.controllers.DeviceController;
+import org.whispersystems.textsecuregcm.controllers.DirectoryController;
+import org.whispersystems.textsecuregcm.controllers.KeepAliveController;
+import org.whispersystems.textsecuregcm.controllers.KeysController;
+import org.whispersystems.textsecuregcm.controllers.MessageController;
+import org.whispersystems.textsecuregcm.controllers.ProfileController;
+import org.whispersystems.textsecuregcm.controllers.ProvisioningController;
+import org.whispersystems.textsecuregcm.controllers.TransparentDataController;
+import org.whispersystems.textsecuregcm.controllers.VoiceVerificationController;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.liquibase.NameableMigrationsBundle;
+import org.whispersystems.textsecuregcm.mappers.DeviceLimitExceededExceptionMapper;
+import org.whispersystems.textsecuregcm.mappers.IOExceptionMapper;
+import org.whispersystems.textsecuregcm.mappers.InvalidWebsocketAddressExceptionMapper;
+import org.whispersystems.textsecuregcm.mappers.RateLimitExceededExceptionMapper;
+import org.whispersystems.textsecuregcm.metrics.CpuUsageGauge;
+import org.whispersystems.textsecuregcm.metrics.FileDescriptorGauge;
+import org.whispersystems.textsecuregcm.metrics.FreeMemoryGauge;
+import org.whispersystems.textsecuregcm.metrics.NetworkReceivedGauge;
+import org.whispersystems.textsecuregcm.metrics.NetworkSentGauge;
+import org.whispersystems.textsecuregcm.providers.RedisClientFactory;
+import org.whispersystems.textsecuregcm.providers.RedisHealthCheck;
+import org.whispersystems.textsecuregcm.push.APNSender;
+import org.whispersystems.textsecuregcm.push.ApnFallbackManager;
+import org.whispersystems.textsecuregcm.push.GCMSender;
+import org.whispersystems.textsecuregcm.push.PushSender;
+import org.whispersystems.textsecuregcm.push.ReceiptSender;
+import org.whispersystems.textsecuregcm.push.WebsocketSender;
+import org.whispersystems.textsecuregcm.recaptcha.RecaptchaClient;
+import org.whispersystems.textsecuregcm.redis.ReplicatedJedisPool;
+import org.whispersystems.textsecuregcm.sms.SmsSender;
+import org.whispersystems.textsecuregcm.sms.TwilioSmsSender;
+import org.whispersystems.textsecuregcm.sqs.DirectoryQueue;
+import org.whispersystems.textsecuregcm.storage.*;
+import org.whispersystems.textsecuregcm.util.Constants;
+import org.whispersystems.textsecuregcm.websocket.AuthenticatedConnectListener;
+import org.whispersystems.textsecuregcm.websocket.DeadLetterHandler;
+import org.whispersystems.textsecuregcm.websocket.ProvisioningConnectListener;
+import org.whispersystems.textsecuregcm.websocket.WebSocketAccountAuthenticator;
+import org.whispersystems.textsecuregcm.workers.CertificateCommand;
+import org.whispersystems.textsecuregcm.workers.DeleteUserCommand;
+import org.whispersystems.textsecuregcm.workers.VacuumCommand;
+import org.whispersystems.websocket.WebSocketResourceProviderFactory;
+import org.whispersystems.websocket.setup.WebSocketEnvironment;
+
+import javax.servlet.DispatcherType;
+import javax.servlet.FilterRegistration;
+import javax.servlet.ServletRegistration;
+import java.security.Security;
+import java.util.Arrays;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Optional;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.Application;
+import io.dropwizard.auth.AuthDynamicFeature;
+import io.dropwizard.auth.AuthValueFactoryProvider;
+import io.dropwizard.auth.basic.BasicCredentialAuthFilter;
+import io.dropwizard.db.DataSourceFactory;
+import io.dropwizard.db.PooledDataSourceFactory;
+import io.dropwizard.jdbi3.JdbiFactory;
+import io.dropwizard.setup.Bootstrap;
+import io.dropwizard.setup.Environment;
+
+public class WhisperServerService extends Application<WhisperServerConfiguration> {
+
+  static {
+    Security.addProvider(new BouncyCastleProvider());
+  }
+
+  @Override
+  public void initialize(Bootstrap<WhisperServerConfiguration> bootstrap) {
+    bootstrap.addCommand(new VacuumCommand());
+    bootstrap.addCommand(new DeleteUserCommand());
+    bootstrap.addCommand(new CertificateCommand());
+    bootstrap.addBundle(new NameableMigrationsBundle<WhisperServerConfiguration>("accountdb", "accountsdb.xml") {
+      @Override
+      public DataSourceFactory getDataSourceFactory(WhisperServerConfiguration configuration) {
+        return configuration.getAccountsDatabaseConfiguration();
+      }
+    });
+
+    bootstrap.addBundle(new NameableMigrationsBundle<WhisperServerConfiguration>("messagedb", "messagedb.xml") {
+      @Override
+      public DataSourceFactory getDataSourceFactory(WhisperServerConfiguration configuration) {
+        return configuration.getMessageStoreConfiguration();
+      }
+    });
+
+    bootstrap.addBundle(new NameableMigrationsBundle<WhisperServerConfiguration>("abusedb", "abusedb.xml") {
+      @Override
+      public PooledDataSourceFactory getDataSourceFactory(WhisperServerConfiguration configuration) {
+        return configuration.getAbuseDatabaseConfiguration();
+      }
+    });
+  }
+
+  @Override
+  public String getName() {
+    return "whisper-server";
+  }
+
+  @Override
+  public void run(WhisperServerConfiguration config, Environment environment)
+      throws Exception
+  {
+    SharedMetricRegistries.add(Constants.METRICS_NAME, environment.metrics());
+    environment.getObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+    environment.getObjectMapper().setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.NONE);
+    environment.getObjectMapper().setVisibility(PropertyAccessor.FIELD, JsonAutoDetect.Visibility.ANY);
+
+    JdbiFactory jdbiFactory = new JdbiFactory(DefaultNameStrategy.CHECK_EMPTY);
+    Jdbi        accountJdbi = jdbiFactory.build(environment, config.getAccountsDatabaseConfiguration(), "accountdb");
+    Jdbi        messageJdbi = jdbiFactory.build(environment, config.getMessageStoreConfiguration(), "messagedb"    );
+    Jdbi        abuseJdbi   = jdbiFactory.build(environment, config.getAbuseDatabaseConfiguration   (), "abusedb"  );
+
+    FaultTolerantDatabase accountDatabase = new FaultTolerantDatabase("accounts_database", accountJdbi, config.getAccountsDatabaseConfiguration().getCircuitBreakerConfiguration());
+    FaultTolerantDatabase messageDatabase = new FaultTolerantDatabase("message_database", messageJdbi, config.getMessageStoreConfiguration().getCircuitBreakerConfiguration());
+    FaultTolerantDatabase abuseDatabase   = new FaultTolerantDatabase("abuse_database", abuseJdbi, config.getAbuseDatabaseConfiguration().getCircuitBreakerConfiguration());
+
+    Accounts         accounts         = new Accounts(accountDatabase);
+    PendingAccounts  pendingAccounts  = new PendingAccounts(accountDatabase);
+    PendingDevices   pendingDevices   = new PendingDevices(accountDatabase);
+    Keys             keys             = new Keys(accountDatabase);
+    Messages         messages         = new Messages(messageDatabase);
+    AbusiveHostRules abusiveHostRules = new AbusiveHostRules(abuseDatabase);
+
+    RedisClientFactory cacheClientFactory         = new RedisClientFactory("main_cache", config.getCacheConfiguration().getUrl(), config.getCacheConfiguration().getReplicaUrls(), config.getCacheConfiguration().getCircuitBreakerConfiguration());
+    RedisClientFactory directoryClientFactory     = new RedisClientFactory("directory_cache", config.getDirectoryConfiguration().getRedisConfiguration().getUrl(), config.getDirectoryConfiguration().getRedisConfiguration().getReplicaUrls(), config.getDirectoryConfiguration().getRedisConfiguration().getCircuitBreakerConfiguration());
+    RedisClientFactory messagesClientFactory      = new RedisClientFactory("message_cache", config.getMessageCacheConfiguration().getRedisConfiguration().getUrl(), config.getMessageCacheConfiguration().getRedisConfiguration().getReplicaUrls(), config.getMessageCacheConfiguration().getRedisConfiguration().getCircuitBreakerConfiguration());
+    RedisClientFactory pushSchedulerClientFactory = new RedisClientFactory("push_scheduler_cache", config.getPushScheduler().getUrl(), config.getPushScheduler().getReplicaUrls(), config.getPushScheduler().getCircuitBreakerConfiguration());
+
+    ReplicatedJedisPool cacheClient         = cacheClientFactory.getRedisClientPool();
+    ReplicatedJedisPool directoryClient     = directoryClientFactory.getRedisClientPool();
+    ReplicatedJedisPool messagesClient      = messagesClientFactory.getRedisClientPool();
+    ReplicatedJedisPool pushSchedulerClient = pushSchedulerClientFactory.getRedisClientPool();
+
+    DirectoryManager           directory                  = new DirectoryManager(directoryClient);
+    DirectoryQueue             directoryQueue             = new DirectoryQueue(config.getDirectoryConfiguration().getSqsConfiguration());
+    PendingAccountsManager     pendingAccountsManager     = new PendingAccountsManager(pendingAccounts, cacheClient);
+    PendingDevicesManager      pendingDevicesManager      = new PendingDevicesManager (pendingDevices, cacheClient );
+    AccountsManager            accountsManager            = new AccountsManager(accounts, directory, cacheClient);
+    MessagesCache              messagesCache              = new MessagesCache(messagesClient, messages, accountsManager, config.getMessageCacheConfiguration().getPersistDelayMinutes());
+    MessagesManager            messagesManager            = new MessagesManager(messages, messagesCache);
+    DeadLetterHandler          deadLetterHandler          = new DeadLetterHandler(messagesManager);
+    DispatchManager            dispatchManager            = new DispatchManager(cacheClientFactory, Optional.of(deadLetterHandler));
+    PubSubManager              pubSubManager              = new PubSubManager(cacheClient, dispatchManager);
+    APNSender                  apnSender                  = new APNSender(accountsManager, config.getApnConfiguration());
+    GCMSender                  gcmSender                  = new GCMSender(accountsManager, config.getGcmConfiguration().getApiKey(), directoryQueue);
+    WebsocketSender            websocketSender            = new WebsocketSender(messagesManager, pubSubManager);
+    AccountAuthenticator       deviceAuthenticator        = new AccountAuthenticator(accountsManager                 );
+    RateLimiters               rateLimiters               = new RateLimiters(config.getLimitsConfiguration(), cacheClient);
+
+    ApnFallbackManager       apnFallbackManager  = new ApnFallbackManager(pushSchedulerClient, apnSender, accountsManager);
+    TwilioSmsSender          twilioSmsSender     = new TwilioSmsSender(config.getTwilioConfiguration());
+    SmsSender                smsSender           = new SmsSender(twilioSmsSender);
+    PushSender               pushSender          = new PushSender(apnFallbackManager, gcmSender, apnSender, websocketSender, config.getPushConfiguration().getQueueSize());
+    ReceiptSender            receiptSender       = new ReceiptSender(accountsManager, pushSender);
+    TurnTokenGenerator       turnTokenGenerator  = new TurnTokenGenerator(config.getTurnConfiguration());
+    RecaptchaClient          recaptchaClient     = new RecaptchaClient(config.getRecaptchaConfiguration().getSecret());
+
+    DirectoryCredentialsGenerator directoryCredentialsGenerator = new DirectoryCredentialsGenerator(config.getDirectoryConfiguration().getDirectoryClientConfiguration().getUserAuthenticationTokenSharedSecret(),
+                                                                                                    config.getDirectoryConfiguration().getDirectoryClientConfiguration().getUserAuthenticationTokenUserIdSecret());
+    DirectoryReconciliationClient directoryReconciliationClient = new DirectoryReconciliationClient(config.getDirectoryConfiguration().getDirectoryServerConfiguration());
+
+    DirectoryReconciler                        directoryReconciler             = new DirectoryReconciler(directoryReconciliationClient, directory);
+    ActiveUserCounter                          activeUserCounter               = new ActiveUserCounter(config.getMetricsFactory(), cacheClient);
+    List<AccountDatabaseCrawlerListener>       accountDatabaseCrawlerListeners = Arrays.asList(activeUserCounter, directoryReconciler);
+
+    AccountDatabaseCrawlerCache accountDatabaseCrawlerCache = new AccountDatabaseCrawlerCache(cacheClient);
+    AccountDatabaseCrawler      accountDatabaseCrawler      = new AccountDatabaseCrawler(accounts, accountDatabaseCrawlerCache, accountDatabaseCrawlerListeners, config.getAccountDatabaseCrawlerConfiguration().getChunkSize(), config.getAccountDatabaseCrawlerConfiguration().getChunkIntervalMs());
+
+    messagesCache.setPubSubManager(pubSubManager, pushSender);
+
+    apnSender.setApnFallbackManager(apnFallbackManager);
+    environment.lifecycle().manage(apnFallbackManager);
+    environment.lifecycle().manage(pubSubManager);
+    environment.lifecycle().manage(pushSender);
+    environment.lifecycle().manage(messagesCache);
+    environment.lifecycle().manage(accountDatabaseCrawler);
+
+    AttachmentControllerV1 attachmentControllerV1 = new AttachmentControllerV1(rateLimiters, config.getAttachmentsConfiguration().getAccessKey(), config.getAttachmentsConfiguration().getAccessSecret(), config.getAttachmentsConfiguration().getBucket()                                                  );
+    AttachmentControllerV2 attachmentControllerV2 = new AttachmentControllerV2(rateLimiters, config.getAttachmentsConfiguration().getAccessKey(), config.getAttachmentsConfiguration().getAccessSecret(), config.getAttachmentsConfiguration().getRegion(), config.getAttachmentsConfiguration().getBucket());
+    KeysController         keysController         = new KeysController(rateLimiters, keys, accountsManager, directoryQueue);
+    MessageController      messageController      = new MessageController(rateLimiters, pushSender, receiptSender, accountsManager, messagesManager, apnFallbackManager);
+    ProfileController      profileController      = new ProfileController(rateLimiters, accountsManager, config.getProfilesConfiguration());
+
+    environment.jersey().register(new AuthDynamicFeature(new BasicCredentialAuthFilter.Builder<Account>()
+                                                             .setAuthenticator(deviceAuthenticator)
+                                                             .buildAuthFilter()));
+    environment.jersey().register(new AuthValueFactoryProvider.Binder<>(Account.class));
+
+    environment.jersey().register(new AccountController(pendingAccountsManager, accountsManager, abusiveHostRules, rateLimiters, smsSender, directoryQueue, messagesManager, turnTokenGenerator, config.getTestDevices(), recaptchaClient));
+    environment.jersey().register(new DeviceController(pendingDevicesManager, accountsManager, messagesManager, directoryQueue, rateLimiters, config.getMaxDevices()));
+    environment.jersey().register(new DirectoryController(rateLimiters, directory, directoryCredentialsGenerator));
+    environment.jersey().register(new ProvisioningController(rateLimiters, pushSender));
+    environment.jersey().register(new CertificateController(new CertificateGenerator(config.getDeliveryCertificate().getCertificate(), config.getDeliveryCertificate().getPrivateKey(), config.getDeliveryCertificate().getExpiresDays())));
+    environment.jersey().register(new VoiceVerificationController(config.getVoiceVerificationConfiguration().getUrl(), config.getVoiceVerificationConfiguration().getLocales()));
+    environment.jersey().register(new TransparentDataController(accountsManager, config.getTransparentDataIndex()));
+    environment.jersey().register(attachmentControllerV1);
+    environment.jersey().register(attachmentControllerV2);
+    environment.jersey().register(keysController);
+    environment.jersey().register(messageController);
+    environment.jersey().register(profileController);
+
+    ///
+    WebSocketEnvironment webSocketEnvironment = new WebSocketEnvironment(environment, config.getWebSocketConfiguration(), 90000);
+    webSocketEnvironment.setAuthenticator(new WebSocketAccountAuthenticator(deviceAuthenticator));
+    webSocketEnvironment.setConnectListener(new AuthenticatedConnectListener(pushSender, receiptSender, messagesManager, pubSubManager, apnFallbackManager));
+    webSocketEnvironment.jersey().register(new KeepAliveController(pubSubManager));
+    webSocketEnvironment.jersey().register(messageController);
+    webSocketEnvironment.jersey().register(profileController);
+    webSocketEnvironment.jersey().register(attachmentControllerV1);
+    webSocketEnvironment.jersey().register(attachmentControllerV2);
+
+    WebSocketEnvironment provisioningEnvironment = new WebSocketEnvironment(environment, webSocketEnvironment.getRequestLog(), 60000);
+    provisioningEnvironment.setConnectListener(new ProvisioningConnectListener(pubSubManager));
+    provisioningEnvironment.jersey().register(new KeepAliveController(pubSubManager));
+
+    WebSocketResourceProviderFactory webSocketServlet    = new WebSocketResourceProviderFactory(webSocketEnvironment   );
+    WebSocketResourceProviderFactory provisioningServlet = new WebSocketResourceProviderFactory(provisioningEnvironment);
+
+    ServletRegistration.Dynamic websocket    = environment.servlets().addServlet("WebSocket", webSocketServlet      );
+    ServletRegistration.Dynamic provisioning = environment.servlets().addServlet("Provisioning", provisioningServlet);
+
+    websocket.addMapping("/v1/websocket/");
+    websocket.setAsyncSupported(true);
+
+    provisioning.addMapping("/v1/websocket/provisioning/");
+    provisioning.setAsyncSupported(true);
+
+    webSocketServlet.start();
+    provisioningServlet.start();
+
+    FilterRegistration.Dynamic filter = environment.servlets().addFilter("CORS", CrossOriginFilter.class);
+    filter.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
+    filter.setInitParameter("allowedOrigins", "*");
+    filter.setInitParameter("allowedHeaders", "Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Signal-Agent");
+    filter.setInitParameter("allowedMethods", "GET,PUT,POST,DELETE,OPTIONS");
+    filter.setInitParameter("preflightMaxAge", "5184000");
+    filter.setInitParameter("allowCredentials", "true");
+///
+
+    environment.healthChecks().register("directory", new RedisHealthCheck(directoryClient));
+    environment.healthChecks().register("cache", new RedisHealthCheck(cacheClient));
+
+    environment.jersey().register(new IOExceptionMapper());
+    environment.jersey().register(new RateLimitExceededExceptionMapper());
+    environment.jersey().register(new InvalidWebsocketAddressExceptionMapper());
+    environment.jersey().register(new DeviceLimitExceededExceptionMapper());
+
+    environment.metrics().register(name(CpuUsageGauge.class, "cpu"), new CpuUsageGauge());
+    environment.metrics().register(name(FreeMemoryGauge.class, "free_memory"), new FreeMemoryGauge());
+    environment.metrics().register(name(NetworkSentGauge.class, "bytes_sent"), new NetworkSentGauge());
+    environment.metrics().register(name(NetworkReceivedGauge.class, "bytes_received"), new NetworkReceivedGauge());
+    environment.metrics().register(name(FileDescriptorGauge.class, "fd_count"), new FileDescriptorGauge());
+  }
+
+  public static void main(String[] args) throws Exception {
+    new WhisperServerService().run(args);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+import com.codahale.metrics.Meter;
+import com.codahale.metrics.MetricRegistry;
+import com.codahale.metrics.SharedMetricRegistries;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Constants;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import java.util.Optional;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.auth.AuthenticationException;
+import io.dropwizard.auth.Authenticator;
+import io.dropwizard.auth.basic.BasicCredentials;
+
+public class AccountAuthenticator implements Authenticator<BasicCredentials, Account> {
+
+  private final MetricRegistry metricRegistry               = SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME);
+  private final Meter          authenticationFailedMeter    = metricRegistry.meter(name(getClass(), "authentication", "failed"   ));
+  private final Meter          authenticationSucceededMeter = metricRegistry.meter(name(getClass(), "authentication", "succeeded"));
+
+  private final Logger logger = LoggerFactory.getLogger(AccountAuthenticator.class);
+
+  private final AccountsManager accountsManager;
+
+  public AccountAuthenticator(AccountsManager accountsManager) {
+    this.accountsManager = accountsManager;
+  }
+
+  @Override
+  public Optional<Account> authenticate(BasicCredentials basicCredentials)
+      throws AuthenticationException
+  {
+    try {
+      AuthorizationHeader authorizationHeader = AuthorizationHeader.fromUserAndPassword(basicCredentials.getUsername(), basicCredentials.getPassword());
+      Optional<Account>   account             = accountsManager.get(authorizationHeader.getNumber());
+
+      if (!account.isPresent()) {
+        return Optional.empty();
+      }
+
+      Optional<Device> device = account.get().getDevice(authorizationHeader.getDeviceId());
+
+      if (!device.isPresent()) {
+        return Optional.empty();
+      }
+
+      if (!device.get().isMaster() && device.get().isIdleInactive()) {
+        return Optional.empty();
+      }
+
+      if (device.get().getAuthenticationCredentials().verify(basicCredentials.getPassword())) {
+        authenticationSucceededMeter.mark();
+        account.get().setAuthenticatedDevice(device.get());
+        updateLastSeen(account.get(), device.get());
+        return account;
+      }
+
+      authenticationFailedMeter.mark();
+      return Optional.empty();
+    } catch (InvalidAuthorizationHeaderException iahe) {
+      return Optional.empty();
+    }
+  }
+
+  private void updateLastSeen(Account account, Device device) {
+    if (device.getLastSeen() != Util.todayInMillis()) {
+      device.setLastSeen(Util.todayInMillis());
+      accountsManager.update(account);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/Anonymous.java

@@ -0,0 +1,24 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+
+public class Anonymous {
+
+  private final byte[] unidentifiedSenderAccessKey;
+
+  public Anonymous(String header) {
+    try {
+      this.unidentifiedSenderAccessKey = Base64.decode(header);
+    } catch (IOException e) {
+      throw new WebApplicationException(e, Response.Status.UNAUTHORIZED);
+    }
+  }
+
+  public byte[] getAccessKey() {
+    return unidentifiedSenderAccessKey;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/AuthenticationCredentials.java

@@ -0,0 +1,72 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+
+public class AuthenticationCredentials {
+
+  private final Logger logger = LoggerFactory.getLogger(AuthenticationCredentials.class);
+
+  private final String hashedAuthenticationToken;
+  private final String salt;
+
+  public AuthenticationCredentials(String hashedAuthenticationToken, String salt) {
+    this.hashedAuthenticationToken = hashedAuthenticationToken;
+    this.salt                      = salt;
+  }
+
+  public AuthenticationCredentials(String authenticationToken) {
+    this.salt                      = Math.abs(new SecureRandom().nextInt()) + "";
+    this.hashedAuthenticationToken = getHashedValue(salt, authenticationToken);
+  }
+
+  public String getHashedAuthenticationToken() {
+    return hashedAuthenticationToken;
+  }
+
+  public String getSalt() {
+    return salt;
+  }
+
+  public boolean verify(String authenticationToken) {
+    String theirValue = getHashedValue(salt, authenticationToken);
+
+    logger.debug("Comparing: " + theirValue + " , " + this.hashedAuthenticationToken);
+
+    return theirValue.equals(this.hashedAuthenticationToken);
+  }
+
+  private static String getHashedValue(String salt, String token) {
+    Logger logger = LoggerFactory.getLogger(AuthenticationCredentials.class);
+    logger.debug("Getting hashed token: " + salt + " , " + token);
+
+    try {
+      return new String(Hex.encodeHex(MessageDigest.getInstance("SHA1").digest((salt + token).getBytes("UTF-8"))));
+    } catch (NoSuchAlgorithmException | UnsupportedEncodingException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/AuthorizationHeader.java

@@ -0,0 +1,93 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import java.io.IOException;
+
+public class AuthorizationHeader {
+
+  private final String number;
+  private final long   accountId;
+  private final String password;
+
+  private AuthorizationHeader(String number, long accountId, String password) {
+    this.number    = number;
+    this.accountId = accountId;
+    this.password  = password;
+  }
+
+  public static AuthorizationHeader fromUserAndPassword(String user, String password) throws InvalidAuthorizationHeaderException {
+    try {
+      String[] numberAndId = user.split("\\.");
+      return new AuthorizationHeader(numberAndId[0],
+                                     numberAndId.length > 1 ? Long.parseLong(numberAndId[1]) : 1,
+                                     password);
+    } catch (NumberFormatException nfe) {
+      throw new InvalidAuthorizationHeaderException(nfe);
+    }
+  }
+
+  public static AuthorizationHeader fromFullHeader(String header) throws InvalidAuthorizationHeaderException {
+    try {
+      if (header == null) {
+        throw new InvalidAuthorizationHeaderException("Null header");
+      }
+
+      String[] headerParts = header.split(" ");
+
+      if (headerParts == null || headerParts.length < 2) {
+        throw new InvalidAuthorizationHeaderException("Invalid authorization header: " + header);
+      }
+
+      if (!"Basic".equals(headerParts[0])) {
+        throw new InvalidAuthorizationHeaderException("Unsupported authorization method: " + headerParts[0]);
+      }
+
+      String concatenatedValues = new String(Base64.decode(headerParts[1]));
+
+      if (Util.isEmpty(concatenatedValues)) {
+        throw new InvalidAuthorizationHeaderException("Bad decoded value: " + concatenatedValues);
+      }
+
+      String[] credentialParts = concatenatedValues.split(":");
+
+      if (credentialParts == null || credentialParts.length < 2) {
+        throw new InvalidAuthorizationHeaderException("Badly formated credentials: " + concatenatedValues);
+      }
+
+      return fromUserAndPassword(credentialParts[0], credentialParts[1]);
+    } catch (IOException ioe) {
+      throw new InvalidAuthorizationHeaderException(ioe);
+    }
+  }
+
+  public String getNumber() {
+    return number;
+  }
+
+  public long getDeviceId() {
+    return accountId;
+  }
+
+  public String getPassword() {
+    return password;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/CertificateGenerator.java

@@ -0,0 +1,50 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.google.protobuf.ByteString;
+import com.google.protobuf.InvalidProtocolBufferException;
+import org.whispersystems.textsecuregcm.crypto.Curve;
+import org.whispersystems.textsecuregcm.crypto.ECPrivateKey;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.SenderCertificate;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.ServerCertificate;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import java.io.IOException;
+import java.security.InvalidKeyException;
+import java.util.concurrent.TimeUnit;
+
+public class CertificateGenerator {
+
+  private final ECPrivateKey      privateKey;
+  private final int               expiresDays;
+  private final ServerCertificate serverCertificate;
+
+  public CertificateGenerator(byte[] serverCertificate, ECPrivateKey privateKey, int expiresDays)
+      throws InvalidProtocolBufferException
+  {
+    this.privateKey        = privateKey;
+    this.expiresDays       = expiresDays;
+    this.serverCertificate = ServerCertificate.parseFrom(serverCertificate);
+  }
+
+  public byte[] createFor(Account account, Device device) throws IOException, InvalidKeyException {
+    byte[] certificate = SenderCertificate.Certificate.newBuilder()
+                                                      .setSender(account.getNumber())
+                                                      .setSenderDevice(Math.toIntExact(device.getId()))
+                                                      .setExpires(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(expiresDays))
+                                                      .setIdentityKey(ByteString.copyFrom(Base64.decode(account.getIdentityKey())))
+                                                      .setSigner(serverCertificate)
+                                                      .build()
+                                                      .toByteArray();
+
+    byte[] signature = Curve.calculateSignature(privateKey, certificate);
+
+    return SenderCertificate.newBuilder()
+                            .setCertificate(ByteString.copyFrom(certificate))
+                            .setSignature(ByteString.copyFrom(signature))
+                            .build()
+                            .toByteArray();
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/DirectoryCredentials.java

@@ -0,0 +1,28 @@
+package org.whispersystems.textsecuregcm.auth;
+
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class DirectoryCredentials {
+
+  @JsonProperty
+  private String username;
+
+  @JsonProperty
+  private String password;
+
+  public DirectoryCredentials(String username, String password) {
+    this.username = username;
+    this.password = password;
+  }
+
+  public DirectoryCredentials() {}
+
+  public String getUsername() {
+    return username;
+  }
+
+  public String getPassword() {
+    return password;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/DirectoryCredentialsGenerator.java

@@ -0,0 +1,105 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.google.common.base.Optional;
+import org.apache.commons.codec.DecoderException;
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.concurrent.TimeUnit;
+
+public class DirectoryCredentialsGenerator {
+
+  private final Logger logger = LoggerFactory.getLogger(DirectoryCredentialsGenerator.class);
+
+  private final byte[] key;
+  private final byte[] userIdKey;
+
+  public DirectoryCredentialsGenerator(byte[] key, byte[] userIdKey) {
+    this.key       = key;
+    this.userIdKey = userIdKey;
+  }
+
+  public DirectoryCredentials generateFor(String number) {
+    Mac    mac                = getMacInstance();
+    String username           = getUserId(number, mac);
+    long   currentTimeSeconds = System.currentTimeMillis() / 1000;
+    String prefix             = username + ":"  + currentTimeSeconds;
+    String output             = Hex.encodeHexString(Util.truncate(getHmac(key, prefix.getBytes(), mac), 10));
+    String token              = prefix + ":" + output;
+
+    return new DirectoryCredentials(username, token);
+  }
+
+
+  public boolean isValid(String token, String number, long currentTimeMillis) {
+    String[] parts = token.split(":");
+    Mac      mac   = getMacInstance();
+
+    if (parts.length != 3) {
+      return false;
+    }
+
+    if (!getUserId(number, mac).equals(parts[0])) {
+      return false;
+    }
+
+    if (!isValidTime(parts[1], currentTimeMillis)) {
+      return false;
+    }
+
+    return isValidSignature(parts[0] + ":" + parts[1], parts[2], mac);
+  }
+
+  private String getUserId(String number, Mac mac) {
+      return Hex.encodeHexString(Util.truncate(getHmac(userIdKey, number.getBytes(), mac), 10));
+  }
+
+  private boolean isValidTime(String timeString, long currentTimeMillis) {
+    try {
+      long tokenTime = Long.parseLong(timeString);
+      long ourTime   = TimeUnit.MILLISECONDS.toSeconds(currentTimeMillis);
+
+      return TimeUnit.SECONDS.toHours(Math.abs(ourTime - tokenTime)) < 24;
+    } catch (NumberFormatException e) {
+      logger.warn("Number Format", e);
+      return false;
+    }
+  }
+
+  private boolean isValidSignature(String prefix, String suffix, Mac mac) {
+    try {
+      byte[] ourSuffix   = Util.truncate(getHmac(key, prefix.getBytes(), mac), 10);
+      byte[] theirSuffix = Hex.decodeHex(suffix.toCharArray());
+
+      return MessageDigest.isEqual(ourSuffix, theirSuffix);
+    } catch (DecoderException e) {
+      logger.warn("DirectoryCredentials", e);
+      return false;
+    }
+  }
+
+  private Mac getMacInstance() {
+    try {
+      return Mac.getInstance("HmacSHA256");
+    } catch (NoSuchAlgorithmException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+  private byte[] getHmac(byte[] key, byte[] input, Mac mac) {
+    try {
+      mac.init(new SecretKeySpec(key, "HmacSHA256"));
+      return mac.doFinal(input);
+    } catch (InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/InvalidAuthorizationHeaderException.java

@@ -0,0 +1,28 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.auth;
+
+
+public class InvalidAuthorizationHeaderException extends Exception {
+  public InvalidAuthorizationHeaderException(String s) {
+    super(s);
+  }
+
+  public InvalidAuthorizationHeaderException(Exception e) {
+    super(e);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/OptionalAccess.java

@@ -0,0 +1,74 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.util.Hex;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Response;
+import java.security.MessageDigest;
+import java.util.Optional;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+public class OptionalAccess {
+
+  public static final String UNIDENTIFIED = "Unidentified-Access-Key";
+
+  public static void verify(Optional<Account>   requestAccount,
+                            Optional<Anonymous> accessKey,
+                            Optional<Account>   targetAccount,
+                            String              deviceSelector)
+  {
+    try {
+      verify(requestAccount, accessKey, targetAccount);
+
+      if (!deviceSelector.equals("*")) {
+        long deviceId = Long.parseLong(deviceSelector);
+
+        Optional<Device> targetDevice = targetAccount.get().getDevice(deviceId);
+
+        if (targetDevice.isPresent() && targetDevice.get().isActive()) {
+          return;
+        }
+
+        if (requestAccount.isPresent()) {
+          throw new WebApplicationException(Response.Status.NOT_FOUND);
+        } else {
+          throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+        }
+      }
+    } catch (NumberFormatException e) {
+      throw new WebApplicationException(Response.status(422).build());
+    }
+  }
+
+  public static void verify(Optional<Account>   requestAccount,
+                            Optional<Anonymous> accessKey,
+                            Optional<Account>   targetAccount)
+  {
+    if (requestAccount.isPresent() && targetAccount.isPresent() && targetAccount.get().isActive()) {
+      return;
+    }
+
+    //noinspection ConstantConditions
+    if (requestAccount.isPresent() && (!targetAccount.isPresent() || (targetAccount.isPresent() && !targetAccount.get().isActive()))) {
+      throw new WebApplicationException(Response.Status.NOT_FOUND);
+    }
+
+    if (accessKey.isPresent() && targetAccount.isPresent() && targetAccount.get().isActive() && targetAccount.get().isUnrestrictedUnidentifiedAccess()) {
+      return;
+    }
+
+    if (accessKey.isPresent()                                      &&
+        targetAccount.isPresent()                                  &&
+        targetAccount.get().getUnidentifiedAccessKey().isPresent() &&
+        targetAccount.get().isActive()                             &&
+        MessageDigest.isEqual(accessKey.get().getAccessKey(), targetAccount.get().getUnidentifiedAccessKey().get()))
+    {
+      return;
+    }
+
+    throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/StoredVerificationCode.java

@@ -0,0 +1,41 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.security.MessageDigest;
+import java.util.concurrent.TimeUnit;
+
+public class StoredVerificationCode {
+
+  @JsonProperty
+  private String code;
+
+  @JsonProperty
+  private long   timestamp;
+
+  public StoredVerificationCode() {}
+
+  public StoredVerificationCode(String code, long timestamp) {
+    this.code      = code;
+    this.timestamp = timestamp;
+  }
+
+  public String getCode() {
+    return code;
+  }
+
+  public long getTimestamp() {
+    return timestamp;
+  }
+
+  public boolean isValid(String theirCodeString) {
+    if (timestamp + TimeUnit.MINUTES.toMillis(30) < System.currentTimeMillis()) {
+      return false;
+    }
+
+    byte[] ourCode   = code.getBytes();
+    byte[] theirCode = theirCodeString.getBytes();
+
+    return MessageDigest.isEqual(ourCode, theirCode);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/TurnToken.java

@@ -0,0 +1,23 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.List;
+
+public class TurnToken {
+
+  @JsonProperty
+  private String username;
+
+  @JsonProperty
+  private String password;
+
+  @JsonProperty
+  private List<String> urls;
+
+  public TurnToken(String username, String password, List<String> urls) {
+    this.username = username;
+    this.password = password;
+    this.urls     = urls;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/TurnTokenGenerator.java

@@ -0,0 +1,39 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.configuration.TurnConfiguration;
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+
+public class TurnTokenGenerator {
+
+  private final byte[]       key;
+  private final List<String> urls;
+
+  public TurnTokenGenerator(TurnConfiguration configuration) {
+    this.key  = configuration.getSecret().getBytes();
+    this.urls = configuration.getUris();
+  }
+
+  public TurnToken generate() {
+    try {
+      Mac    mac                = Mac.getInstance("HmacSHA1");
+      long   validUntilSeconds  = (System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1)) / 1000;
+      long   user               = Math.abs(new SecureRandom().nextInt());
+      String userTime           = validUntilSeconds + ":"  + user;
+
+      mac.init(new SecretKeySpec(key, "HmacSHA1"));
+      String password = Base64.encodeBytes(mac.doFinal(userTime.getBytes()));
+
+      return new TurnToken(userTime, password, urls);
+    } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/auth/UnidentifiedAccessChecksum.java

@@ -0,0 +1,27 @@
+package org.whispersystems.textsecuregcm.auth;
+
+import org.whispersystems.textsecuregcm.util.Base64;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Optional;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+public class UnidentifiedAccessChecksum {
+
+  public static String generateFor(Optional<byte[]> unidentifiedAccessKey) {
+    try {
+      if (!unidentifiedAccessKey.isPresent()|| unidentifiedAccessKey.get().length != 16) return null;
+
+      Mac mac = Mac.getInstance("HmacSHA256");
+      mac.init(new SecretKeySpec(unidentifiedAccessKey.get(), "HmacSHA256"));
+
+      return Base64.encodeBytes(mac.doFinal(new byte[32]));
+    } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+      throw new AssertionError(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/AccountDatabaseCrawlerConfiguration.java

@@ -0,0 +1,36 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class AccountDatabaseCrawlerConfiguration {
+
+  @JsonProperty
+  private int chunkSize = 1000;
+
+  @JsonProperty
+  private long chunkIntervalMs = 8000L;
+
+  public int getChunkSize() {
+    return chunkSize;
+  }
+
+  public long getChunkIntervalMs() {
+    return chunkIntervalMs;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/ApnConfiguration.java

@@ -0,0 +1,55 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+
+public class ApnConfiguration {
+
+  @NotEmpty
+  @JsonProperty
+  private String pushCertificate;
+
+  @NotEmpty
+  @JsonProperty
+  private String pushKey;
+
+  @NotEmpty
+  @JsonProperty
+  private String bundleId;
+
+  @JsonProperty
+  private boolean sandbox = false;
+
+  public String getPushCertificate() {
+    return pushCertificate;
+  }
+
+  public String getPushKey() {
+    return pushKey;
+  }
+
+  public String getBundleId() {
+    return bundleId;
+  }
+
+  public boolean isSandboxEnabled() {
+    return sandbox;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/AttachmentsConfiguration.java

@@ -0,0 +1,55 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class AttachmentsConfiguration {
+
+  @NotEmpty
+  @JsonProperty
+  private String accessKey;
+
+  @NotEmpty
+  @JsonProperty
+  private String accessSecret;
+
+  @NotEmpty
+  @JsonProperty
+  private String bucket;
+
+  @NotEmpty
+  @JsonProperty
+  private String region;
+
+  public String getAccessKey() {
+    return accessKey;
+  }
+
+  public String getAccessSecret() {
+    return accessSecret;
+  }
+
+  public String getBucket() {
+    return bucket;
+  }
+
+  public String getRegion() {
+    return region;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/CircuitBreakerConfiguration.java

@@ -0,0 +1,82 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+import javax.validation.constraints.Max;
+import javax.validation.constraints.Min;
+import javax.validation.constraints.NotNull;
+
+import java.time.Duration;
+
+import io.github.resilience4j.circuitbreaker.CircuitBreakerConfig;
+
+public class CircuitBreakerConfiguration {
+
+  @JsonProperty
+  @NotNull
+  @Min(1)
+  @Max(100)
+  private int failureRateThreshold = 50;
+
+  @JsonProperty
+  @NotNull
+  @Min(1)
+  private int ringBufferSizeInHalfOpenState = 10;
+
+  @JsonProperty
+  @NotNull
+  @Min(1)
+  private int ringBufferSizeInClosedState = 100;
+
+  @JsonProperty
+  @NotNull
+  @Min(1)
+  private long waitDurationInOpenStateInSeconds = 10;
+
+
+  public int getFailureRateThreshold() {
+    return failureRateThreshold;
+  }
+
+  public int getRingBufferSizeInHalfOpenState() {
+    return ringBufferSizeInHalfOpenState;
+  }
+
+  public int getRingBufferSizeInClosedState() {
+    return ringBufferSizeInClosedState;
+  }
+
+  public long getWaitDurationInOpenStateInSeconds() {
+    return waitDurationInOpenStateInSeconds;
+  }
+
+  @VisibleForTesting
+  public void setFailureRateThreshold(int failureRateThreshold) {
+    this.failureRateThreshold = failureRateThreshold;
+  }
+
+  @VisibleForTesting
+  public void setRingBufferSizeInClosedState(int size) {
+    this.ringBufferSizeInClosedState = size;
+  }
+
+  @VisibleForTesting
+  public void setRingBufferSizeInHalfOpenState(int size) {
+    this.ringBufferSizeInHalfOpenState = size;
+  }
+
+  @VisibleForTesting
+  public void setWaitDurationInOpenStateInSeconds(int seconds) {
+    this.waitDurationInOpenStateInSeconds = seconds;
+  }
+
+  public CircuitBreakerConfig toCircuitBreakerConfig() {
+    return CircuitBreakerConfig.custom()
+                        .failureRateThreshold(getFailureRateThreshold())
+                        .ringBufferSizeInHalfOpenState(getRingBufferSizeInHalfOpenState())
+                        .waitDurationInOpenState(Duration.ofSeconds(getWaitDurationInOpenStateInSeconds()))
+                        .ringBufferSizeInClosedState(getRingBufferSizeInClosedState())
+                        .build();
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/DatabaseConfiguration.java

@@ -0,0 +1,19 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.constraints.NotNull;
+
+import io.dropwizard.db.DataSourceFactory;
+
+public class DatabaseConfiguration extends DataSourceFactory {
+
+  @NotNull
+  @JsonProperty
+  private CircuitBreakerConfiguration circuitBreaker = new CircuitBreakerConfiguration();
+
+  public CircuitBreakerConfiguration getCircuitBreakerConfiguration() {
+    return circuitBreaker;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryClientConfiguration.java

@@ -0,0 +1,42 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.apache.commons.codec.DecoderException;
+import org.apache.commons.codec.binary.Hex;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class DirectoryClientConfiguration {
+
+  @NotEmpty
+  @JsonProperty
+  private String userAuthenticationTokenSharedSecret;
+
+  @NotEmpty
+  @JsonProperty
+  private String userAuthenticationTokenUserIdSecret;
+
+  public byte[] getUserAuthenticationTokenSharedSecret() throws DecoderException {
+    return Hex.decodeHex(userAuthenticationTokenSharedSecret.toCharArray());
+  }
+
+  public byte[] getUserAuthenticationTokenUserIdSecret() throws DecoderException {
+    return Hex.decodeHex(userAuthenticationTokenUserIdSecret.toCharArray());
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryConfiguration.java

@@ -0,0 +1,62 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+
+public class DirectoryConfiguration {
+
+  @JsonProperty
+  @NotNull
+  @Valid
+  private RedisConfiguration redis;
+    
+  @JsonProperty
+  @NotNull
+  @Valid
+  private SqsConfiguration sqs;
+    
+  @JsonProperty
+  @NotNull
+  @Valid
+  private DirectoryClientConfiguration client;
+
+  @JsonProperty
+  @NotNull
+  @Valid
+  private DirectoryServerConfiguration server;
+
+  public RedisConfiguration getRedisConfiguration() {
+    return redis;
+  }
+
+  public SqsConfiguration getSqsConfiguration() {
+    return sqs;
+  }
+
+  public DirectoryClientConfiguration getDirectoryClientConfiguration() {
+    return client;
+  }
+
+  public DirectoryServerConfiguration getDirectoryServerConfiguration() {
+    return server;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryServerConfiguration.java

@@ -0,0 +1,48 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class DirectoryServerConfiguration {
+
+  @NotEmpty
+  @JsonProperty
+  private String replicationUrl;
+
+  @NotEmpty
+  @JsonProperty
+  private String replicationPassword;
+
+  @NotEmpty
+  @JsonProperty
+  private String replicationCaCertificate;
+
+  public String getReplicationUrl() {
+    return replicationUrl;
+  }
+
+  public String getReplicationPassword() {
+    return replicationPassword;
+  }
+
+  public String getReplicationCaCertificate() {
+    return replicationCaCertificate;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/GcmConfiguration.java

@@ -0,0 +1,42 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.NotNull;
+
+public class GcmConfiguration {
+
+  @NotNull
+  @JsonProperty
+  private long senderId;
+
+  @NotEmpty
+  @JsonProperty
+  private String apiKey;
+
+  public String getApiKey() {
+    return apiKey;
+  }
+
+  public long getSenderId() {
+    return senderId;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/GraphiteConfiguration.java

@@ -0,0 +1,39 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class GraphiteConfiguration {
+  @JsonProperty
+  private String host;
+
+  @JsonProperty
+  private int port;
+
+  public String getHost() {
+    return host;
+  }
+
+  public int getPort() {
+    return port;
+  }
+
+  public boolean isEnabled() {
+    return host != null && port != 0;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/MaxDeviceConfiguration.java

@@ -0,0 +1,27 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.NotNull;
+
+public class MaxDeviceConfiguration {
+
+  @JsonProperty
+  @NotEmpty
+  private String number;
+
+  @JsonProperty
+  @NotNull
+  private int count;
+
+  public String getNumber() {
+    return number;
+  }
+
+  public int getCount() {
+    return count;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/MessageCacheConfiguration.java

@@ -0,0 +1,26 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+
+public class MessageCacheConfiguration {
+
+  @JsonProperty
+  @NotNull
+  @Valid
+  private RedisConfiguration redis;
+
+  @JsonProperty
+  private int persistDelayMinutes = 10;
+
+  public RedisConfiguration getRedisConfiguration() {
+    return redis;
+  }
+
+  public int getPersistDelayMinutes() {
+    return persistDelayMinutes;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/ProfilesConfiguration.java

@@ -0,0 +1,39 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class ProfilesConfiguration {
+  @NotEmpty
+  @JsonProperty
+  private String accessKey;
+
+  @NotEmpty
+  @JsonProperty
+  private String accessSecret;
+
+  @NotEmpty
+  @JsonProperty
+  private String bucket;
+
+  @NotEmpty
+  @JsonProperty
+  private String region;
+
+  public String getAccessKey() {
+    return accessKey;
+  }
+
+  public String getAccessSecret() {
+    return accessSecret;
+  }
+
+  public String getBucket() {
+    return bucket;
+  }
+
+  public String getRegion() {
+    return region;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/PushConfiguration.java

@@ -0,0 +1,17 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.Min;
+
+public class PushConfiguration {
+
+  @JsonProperty
+  @Min(0)
+  private int queueSize = 200;
+
+  public int getQueueSize() {
+    return queueSize;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/RateLimitsConfiguration.java

@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class RateLimitsConfiguration {
+
+  @JsonProperty
+  private RateLimitConfiguration smsDestination = new RateLimitConfiguration(2, 2);
+
+  @JsonProperty
+  private RateLimitConfiguration voiceDestination = new RateLimitConfiguration(2, 1.0 / 2.0);
+
+  @JsonProperty
+  private RateLimitConfiguration voiceDestinationDaily = new RateLimitConfiguration(10, 10.0 / (24.0 * 60.0));
+
+  @JsonProperty
+  private RateLimitConfiguration smsVoiceIp = new RateLimitConfiguration(1000, 1000);
+
+  @JsonProperty
+  private RateLimitConfiguration smsVoicePrefix = new RateLimitConfiguration(1000, 1000);
+
+  @JsonProperty
+  private RateLimitConfiguration autoBlock = new RateLimitConfiguration(500, 500);
+
+  @JsonProperty
+  private RateLimitConfiguration verifyNumber = new RateLimitConfiguration(2, 2);
+
+  @JsonProperty
+  private RateLimitConfiguration verifyPin = new RateLimitConfiguration(10, 1 / (24.0 * 60.0));
+
+  @JsonProperty
+  private RateLimitConfiguration attachments = new RateLimitConfiguration(50, 50);
+
+  @JsonProperty
+  private RateLimitConfiguration contactQueries = new RateLimitConfiguration(50000, 50000);
+
+  @JsonProperty
+  private RateLimitConfiguration prekeys = new RateLimitConfiguration(3, 1.0 / 10.0);
+
+  @JsonProperty
+  private RateLimitConfiguration messages = new RateLimitConfiguration(60, 60);
+
+  @JsonProperty
+  private RateLimitConfiguration allocateDevice = new RateLimitConfiguration(2, 1.0 / 2.0);
+
+  @JsonProperty
+  private RateLimitConfiguration verifyDevice = new RateLimitConfiguration(2, 2);
+
+  @JsonProperty
+  private RateLimitConfiguration turnAllocations = new RateLimitConfiguration(60, 60);
+
+  @JsonProperty
+  private RateLimitConfiguration profile = new RateLimitConfiguration(4320, 3);
+
+  public RateLimitConfiguration getAutoBlock() {
+    return autoBlock;
+  }
+
+  public RateLimitConfiguration getAllocateDevice() {
+    return allocateDevice;
+  }
+
+  public RateLimitConfiguration getVerifyDevice() {
+    return verifyDevice;
+  }
+
+  public RateLimitConfiguration getMessages() {
+    return messages;
+  }
+
+  public RateLimitConfiguration getPreKeys() {
+    return prekeys;
+  }
+
+  public RateLimitConfiguration getContactQueries() {
+    return contactQueries;
+  }
+
+  public RateLimitConfiguration getAttachments() {
+    return attachments;
+  }
+
+  public RateLimitConfiguration getSmsDestination() {
+    return smsDestination;
+  }
+
+  public RateLimitConfiguration getVoiceDestination() {
+    return voiceDestination;
+  }
+
+  public RateLimitConfiguration getVoiceDestinationDaily() {
+    return voiceDestinationDaily;
+  }
+
+  public RateLimitConfiguration getSmsVoiceIp() {
+    return smsVoiceIp;
+  }
+
+  public RateLimitConfiguration getSmsVoicePrefix() {
+    return smsVoicePrefix;
+  }
+
+  public RateLimitConfiguration getVerifyNumber() {
+    return verifyNumber;
+  }
+
+  public RateLimitConfiguration getVerifyPin() {
+    return verifyPin;
+  }
+
+  public RateLimitConfiguration getTurnAllocations() {
+    return turnAllocations;
+  }
+
+  public RateLimitConfiguration getProfile() {
+    return profile;
+  }
+
+  public static class RateLimitConfiguration {
+    @JsonProperty
+    private int bucketSize;
+
+    @JsonProperty
+    private double leakRatePerMinute;
+
+    public RateLimitConfiguration(int bucketSize, double leakRatePerMinute) {
+      this.bucketSize        = bucketSize;
+      this.leakRatePerMinute = leakRatePerMinute;
+    }
+
+    public RateLimitConfiguration() {}
+
+    public int getBucketSize() {
+      return bucketSize;
+    }
+
+    public double getLeakRatePerMinute() {
+      return leakRatePerMinute;
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/RecaptchaConfiguration.java

@@ -0,0 +1,16 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class RecaptchaConfiguration {
+
+  @JsonProperty
+  @NotEmpty
+  private String secret;
+
+  public String getSecret() {
+    return secret;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/RedisConfiguration.java

@@ -0,0 +1,54 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+import org.hibernate.validator.constraints.URL;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import java.util.List;
+
+public class RedisConfiguration {
+
+  @JsonProperty
+  @NotEmpty
+  private String url;
+
+  @JsonProperty
+  @NotNull
+  private List<String> replicaUrls;
+
+  @JsonProperty
+  @NotNull
+  @Valid
+  private CircuitBreakerConfiguration circuitBreaker = new CircuitBreakerConfiguration();
+
+  public String getUrl() {
+    return url;
+  }
+
+  public List<String> getReplicaUrls() {
+    return replicaUrls;
+  }
+
+  public CircuitBreakerConfiguration getCircuitBreakerConfiguration() {
+    return circuitBreaker;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/RetryConfiguration.java

@@ -0,0 +1,38 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.constraints.Min;
+
+import java.time.Duration;
+
+import io.github.resilience4j.retry.RetryConfig;
+
+public class RetryConfiguration {
+
+  @JsonProperty
+  @Min(1)
+  private int maxAttempts = RetryConfig.DEFAULT_MAX_ATTEMPTS;
+
+  @JsonProperty
+  @Min(1)
+  private long waitDuration = RetryConfig.DEFAULT_WAIT_DURATION;
+
+  public int getMaxAttempts() {
+    return maxAttempts;
+  }
+
+  public long getWaitDuration() {
+    return waitDuration;
+  }
+
+  public RetryConfig toRetryConfig() {
+    return toRetryConfigBuilder().build();
+  }
+
+  public <T> RetryConfig.Builder<T> toRetryConfigBuilder() {
+    return RetryConfig.<T>custom()
+                      .maxAttempts(getMaxAttempts())
+                      .waitDuration(Duration.ofMillis(getWaitDuration()));
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/SqsConfiguration.java

@@ -0,0 +1,56 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class SqsConfiguration {
+  @NotEmpty
+  @JsonProperty
+  private String accessKey;
+
+  @NotEmpty
+  @JsonProperty
+  private String accessSecret;
+
+  @NotEmpty
+  @JsonProperty
+  private String queueUrl;
+
+  @NotEmpty
+  @JsonProperty
+  private String region = "us-east-1";
+
+  public String getAccessKey() {
+    return accessKey;
+  }
+
+  public String getAccessSecret() {
+    return accessSecret;
+  }
+
+  public String getQueueUrl() {
+    return queueUrl;
+  }
+
+  public String getRegion() {
+    return region;
+  }
+}
+
+   

service/src/main/java/org/whispersystems/textsecuregcm/configuration/TestDeviceConfiguration.java

@@ -0,0 +1,25 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.NotNull;
+
+public class TestDeviceConfiguration {
+
+  @JsonProperty
+  @NotEmpty
+  private String number;
+
+  @JsonProperty
+  @NotNull
+  private int code;
+
+  public String getNumber() {
+    return number;
+  }
+
+  public int getCode() {
+    return code;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/TurnConfiguration.java

@@ -0,0 +1,26 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.NotNull;
+import java.util.List;
+
+public class TurnConfiguration {
+
+  @JsonProperty
+  @NotEmpty
+  private String secret;
+
+  @JsonProperty
+  @NotNull
+  private List<String> uris;
+
+  public List<String> getUris() {
+    return uris;
+  }
+
+  public String getSecret() {
+    return secret;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/TwilioConfiguration.java

@@ -0,0 +1,118 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import java.util.List;
+
+public class TwilioConfiguration {
+
+  @NotEmpty
+  @JsonProperty
+  private String accountId;
+
+  @NotEmpty
+  @JsonProperty
+  private String accountToken;
+
+  @NotNull
+  @JsonProperty
+  private List<String> numbers;
+
+  @NotEmpty
+  @JsonProperty
+  private String localDomain;
+
+  @JsonProperty
+  private String messagingServicesId;
+
+  @NotNull
+  @Valid
+  private CircuitBreakerConfiguration circuitBreaker = new CircuitBreakerConfiguration();
+
+  @NotNull
+  @Valid
+  private RetryConfiguration retry = new RetryConfiguration();
+
+  public String getAccountId() {
+    return accountId;
+  }
+
+  @VisibleForTesting
+  public void setAccountId(String accountId) {
+    this.accountId = accountId;
+  }
+
+  public String getAccountToken() {
+    return accountToken;
+  }
+
+  @VisibleForTesting
+  public void setAccountToken(String accountToken) {
+    this.accountToken = accountToken;
+  }
+
+  public List<String> getNumbers() {
+    return numbers;
+  }
+
+  @VisibleForTesting
+  public void setNumbers(List<String> numbers) {
+    this.numbers = numbers;
+  }
+
+  public String getLocalDomain() {
+    return localDomain;
+  }
+
+  @VisibleForTesting
+  public void setLocalDomain(String localDomain) {
+    this.localDomain = localDomain;
+  }
+
+  public String getMessagingServicesId() {
+    return messagingServicesId;
+  }
+
+  @VisibleForTesting
+  public void setMessagingServicesId(String messagingServicesId) {
+    this.messagingServicesId = messagingServicesId;
+  }
+
+  public CircuitBreakerConfiguration getCircuitBreaker() {
+    return circuitBreaker;
+  }
+
+  @VisibleForTesting
+  public void setCircuitBreaker(CircuitBreakerConfiguration circuitBreaker) {
+    this.circuitBreaker = circuitBreaker;
+  }
+
+  public RetryConfiguration getRetry() {
+    return retry;
+  }
+
+  @VisibleForTesting
+  public void setRetry(RetryConfiguration retry) {
+    this.retry = retry;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/UnidentifiedDeliveryConfiguration.java

@@ -0,0 +1,42 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import org.whispersystems.textsecuregcm.crypto.Curve;
+import org.whispersystems.textsecuregcm.crypto.ECPrivateKey;
+import org.whispersystems.textsecuregcm.util.ByteArrayAdapter;
+
+import javax.validation.constraints.NotNull;
+import javax.validation.constraints.Size;
+
+public class UnidentifiedDeliveryConfiguration {
+
+  @JsonProperty
+  @JsonSerialize(using = ByteArrayAdapter.Serializing.class)
+  @JsonDeserialize(using = ByteArrayAdapter.Deserializing.class)
+  @NotNull
+  private byte[] certificate;
+
+  @JsonProperty
+  @JsonSerialize(using = ByteArrayAdapter.Serializing.class)
+  @JsonDeserialize(using = ByteArrayAdapter.Deserializing.class)
+  @NotNull
+  @Size(min = 32, max = 32)
+  private byte[] privateKey;
+
+  @NotNull
+  private int expiresDays;
+
+  public byte[] getCertificate() {
+    return certificate;
+  }
+
+  public ECPrivateKey getPrivateKey() {
+    return Curve.decodePrivatePoint(privateKey);
+  }
+
+  public int getExpiresDays() {
+    return expiresDays;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/configuration/VoiceVerificationConfiguration.java

@@ -0,0 +1,32 @@
+package org.whispersystems.textsecuregcm.configuration;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+public class VoiceVerificationConfiguration {
+
+  @JsonProperty
+  @Valid
+  @NotEmpty
+  private String url;
+
+  @JsonProperty
+  @Valid
+  @NotNull
+  private List<String> locales;
+
+  public String getUrl() {
+    return url;
+  }
+
+  public Set<String> getLocales() {
+    return new HashSet<>(locales);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java

@@ -0,0 +1,516 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.Meter;
+import com.codahale.metrics.MetricRegistry;
+import com.codahale.metrics.SharedMetricRegistries;
+import com.codahale.metrics.annotation.Timed;
+import com.google.common.annotations.VisibleForTesting;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.AuthenticationCredentials;
+import org.whispersystems.textsecuregcm.auth.AuthorizationHeader;
+import org.whispersystems.textsecuregcm.auth.InvalidAuthorizationHeaderException;
+import org.whispersystems.textsecuregcm.auth.StoredVerificationCode;
+import org.whispersystems.textsecuregcm.auth.TurnToken;
+import org.whispersystems.textsecuregcm.auth.TurnTokenGenerator;
+import org.whispersystems.textsecuregcm.entities.AccountAttributes;
+import org.whispersystems.textsecuregcm.entities.ApnRegistrationId;
+import org.whispersystems.textsecuregcm.entities.DeviceName;
+import org.whispersystems.textsecuregcm.entities.GcmRegistrationId;
+import org.whispersystems.textsecuregcm.entities.RegistrationLock;
+import org.whispersystems.textsecuregcm.entities.RegistrationLockFailure;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.recaptcha.RecaptchaClient;
+import org.whispersystems.textsecuregcm.sms.SmsSender;
+import org.whispersystems.textsecuregcm.sqs.DirectoryQueue;
+import org.whispersystems.textsecuregcm.storage.AbusiveHostRule;
+import org.whispersystems.textsecuregcm.storage.AbusiveHostRules;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.MessagesManager;
+import org.whispersystems.textsecuregcm.storage.PendingAccountsManager;
+import org.whispersystems.textsecuregcm.util.Constants;
+import org.whispersystems.textsecuregcm.util.Util;
+import org.whispersystems.textsecuregcm.util.VerificationCode;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.TimeUnit;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.auth.Auth;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+@Path("/v1/accounts")
+public class AccountController {
+
+  private final Logger         logger                 = LoggerFactory.getLogger(AccountController.class);
+  private final MetricRegistry metricRegistry         = SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME);
+  private final Meter          newUserMeter           = metricRegistry.meter(name(AccountController.class, "brand_new_user"     ));
+  private final Meter          blockedHostMeter       = metricRegistry.meter(name(AccountController.class, "blocked_host"       ));
+  private final Meter          filteredHostMeter      = metricRegistry.meter(name(AccountController.class, "filtered_host"      ));
+  private final Meter          rateLimitedHostMeter   = metricRegistry.meter(name(AccountController.class, "rate_limited_host"  ));
+  private final Meter          rateLimitedPrefixMeter = metricRegistry.meter(name(AccountController.class, "rate_limited_prefix"));
+  private final Meter          captchaSuccessMeter    = metricRegistry.meter(name(AccountController.class, "captcha_success"    ));
+  private final Meter          captchaFailureMeter    = metricRegistry.meter(name(AccountController.class, "captcha_failure"    ));
+
+
+  private final PendingAccountsManager                pendingAccounts;
+  private final AccountsManager                       accounts;
+  private final AbusiveHostRules                      abusiveHostRules;
+  private final RateLimiters                          rateLimiters;
+  private final SmsSender                             smsSender;
+  private final DirectoryQueue                        directoryQueue;
+  private final MessagesManager                       messagesManager;
+  private final TurnTokenGenerator                    turnTokenGenerator;
+  private final Map<String, Integer>                  testDevices;
+  private final RecaptchaClient                       recaptchaClient;
+
+  public AccountController(PendingAccountsManager pendingAccounts,
+                           AccountsManager accounts,
+                           AbusiveHostRules abusiveHostRules,
+                           RateLimiters rateLimiters,
+                           SmsSender smsSenderFactory,
+                           DirectoryQueue directoryQueue,
+                           MessagesManager messagesManager,
+                           TurnTokenGenerator turnTokenGenerator,
+                           Map<String, Integer> testDevices,
+                           RecaptchaClient recaptchaClient)
+  {
+    this.pendingAccounts    = pendingAccounts;
+    this.accounts           = accounts;
+    this.abusiveHostRules   = abusiveHostRules;
+    this.rateLimiters       = rateLimiters;
+    this.smsSender          = smsSenderFactory;
+    this.directoryQueue     = directoryQueue;
+    this.messagesManager    = messagesManager;
+    this.testDevices        = testDevices;
+    this.turnTokenGenerator = turnTokenGenerator;
+    this.recaptchaClient    = recaptchaClient;
+  }
+
+  @Timed
+  @GET
+  @Path("/{transport}/code/{number}")
+  public Response createAccount(@PathParam("transport")         String transport,
+                                @PathParam("number")            String number,
+                                @HeaderParam("X-Forwarded-For") String forwardedFor,
+                                @HeaderParam("Accept-Language") Optional<String> locale,
+                                @QueryParam("client")           Optional<String> client,
+                                @QueryParam("captcha")          Optional<String> captcha)
+      throws RateLimitExceededException
+  {
+    if (!Util.isValidNumber(number)) {
+      logger.info("Invalid number: " + number);
+      throw new WebApplicationException(Response.status(400).build());
+    }
+
+    String requester = Arrays.stream(forwardedFor.split(","))
+                             .map(String::trim)
+                             .reduce((a, b) -> b)
+                             .orElseThrow();
+
+    CaptchaRequirement requirement = requiresCaptcha(number, transport, forwardedFor, requester, captcha);
+
+    if (requirement.isCaptchaRequired()) {
+      if (requirement.isAutoBlock() && shouldAutoBlock(requester)) {
+        logger.info("Auto-block: " + requester);
+        abusiveHostRules.setBlockedHost(requester, "Auto-Block");
+      }
+
+      return Response.status(402).build();
+    }
+
+    switch (transport) {
+      case "sms":
+        rateLimiters.getSmsDestinationLimiter().validate(number);
+        break;
+      case "voice":
+        rateLimiters.getVoiceDestinationLimiter().validate(number);
+        rateLimiters.getVoiceDestinationDailyLimiter().validate(number);
+        break;
+      default:
+        throw new WebApplicationException(Response.status(422).build());
+    }
+
+    VerificationCode       verificationCode       = generateVerificationCode(number);
+    StoredVerificationCode storedVerificationCode = new StoredVerificationCode(verificationCode.getVerificationCode(),
+                                                                               System.currentTimeMillis());
+
+    pendingAccounts.store(number, storedVerificationCode);
+
+    if (testDevices.containsKey(number)) {
+      // noop
+    } else if (transport.equals("sms")) {
+      smsSender.deliverSmsVerification(number, client, verificationCode.getVerificationCodeDisplay());
+    } else if (transport.equals("voice")) {
+      smsSender.deliverVoxVerification(number, verificationCode.getVerificationCode(), locale);
+    }
+
+    metricRegistry.meter(name(AccountController.class, "create", Util.getCountryCode(number))).mark();
+
+    return Response.ok().build();
+  }
+
+  @Timed
+  @PUT
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/code/{verification_code}")
+  public void verifyAccount(@PathParam("verification_code") String verificationCode,
+                            @HeaderParam("Authorization")   String authorizationHeader,
+                            @HeaderParam("X-Signal-Agent")  String userAgent,
+                            @Valid                          AccountAttributes accountAttributes)
+      throws RateLimitExceededException
+  {
+    try {
+      AuthorizationHeader header = AuthorizationHeader.fromFullHeader(authorizationHeader);
+      String number              = header.getNumber();
+      String password            = header.getPassword();
+
+      rateLimiters.getVerifyLimiter().validate(number);
+
+      Optional<StoredVerificationCode> storedVerificationCode = pendingAccounts.getCodeForNumber(number);
+
+      if (!storedVerificationCode.isPresent() || !storedVerificationCode.get().isValid(verificationCode)) {
+        throw new WebApplicationException(Response.status(403).build());
+      }
+
+      Optional<Account> existingAccount = accounts.get(number);
+
+      if (existingAccount.isPresent()                &&
+          existingAccount.get().getPin().isPresent() &&
+          System.currentTimeMillis() - existingAccount.get().getLastSeen() < TimeUnit.DAYS.toMillis(7))
+      {
+        rateLimiters.getVerifyLimiter().clear(number);
+
+        long timeRemaining = TimeUnit.DAYS.toMillis(7) - (System.currentTimeMillis() - existingAccount.get().getLastSeen());
+
+        if (accountAttributes.getPin() == null) {
+          throw new WebApplicationException(Response.status(423)
+                                                    .entity(new RegistrationLockFailure(timeRemaining))
+                                                    .build());
+        }
+
+        rateLimiters.getPinLimiter().validate(number);
+
+        if (!MessageDigest.isEqual(existingAccount.get().getPin().get().getBytes(), accountAttributes.getPin().getBytes())) {
+          throw new WebApplicationException(Response.status(423)
+                                                    .entity(new RegistrationLockFailure(timeRemaining))
+                                                    .build());
+        }
+
+        rateLimiters.getPinLimiter().clear(number);
+      }
+
+      createAccount(number, password, userAgent, accountAttributes);
+
+      metricRegistry.meter(name(AccountController.class, "verify", Util.getCountryCode(number))).mark();
+    } catch (InvalidAuthorizationHeaderException e) {
+      logger.info("Bad Authorization Header", e);
+      throw new WebApplicationException(Response.status(401).build());
+    }
+  }
+
+  @Timed
+  @GET
+  @Path("/turn/")
+  @Produces(MediaType.APPLICATION_JSON)
+  public TurnToken getTurnToken(@Auth Account account) throws RateLimitExceededException {
+    rateLimiters.getTurnLimiter().validate(account.getNumber());
+    return turnTokenGenerator.generate();
+  }
+
+  @Timed
+  @PUT
+  @Path("/gcm/")
+  @Consumes(MediaType.APPLICATION_JSON)
+  public void setGcmRegistrationId(@Auth Account account, @Valid GcmRegistrationId registrationId) {
+    Device  device           = account.getAuthenticatedDevice().get();
+    boolean wasAccountActive = account.isActive();
+
+    if (device.getGcmId() != null &&
+        device.getGcmId().equals(registrationId.getGcmRegistrationId()))
+    {
+      return;
+    }
+
+    device.setApnId(null);
+    device.setVoipApnId(null);
+    device.setGcmId(registrationId.getGcmRegistrationId());
+    device.setFetchesMessages(false);
+
+    accounts.update(account);
+
+    if (!wasAccountActive && account.isActive()) {
+      directoryQueue.addRegisteredUser(account.getNumber());
+    }
+  }
+
+  @Timed
+  @DELETE
+  @Path("/gcm/")
+  public void deleteGcmRegistrationId(@Auth Account account) {
+    Device device = account.getAuthenticatedDevice().get();
+    device.setGcmId(null);
+    device.setFetchesMessages(false);
+
+    accounts.update(account);
+
+    if (!account.isActive()) {
+      directoryQueue.deleteRegisteredUser(account.getNumber());
+    }
+  }
+
+  @Timed
+  @PUT
+  @Path("/apn/")
+  @Consumes(MediaType.APPLICATION_JSON)
+  public void setApnRegistrationId(@Auth Account account, @Valid ApnRegistrationId registrationId) {
+    Device  device           = account.getAuthenticatedDevice().get();
+    boolean wasAccountActive = account.isActive();
+
+    device.setApnId(registrationId.getApnRegistrationId());
+    device.setVoipApnId(registrationId.getVoipRegistrationId());
+    device.setGcmId(null);
+    device.setFetchesMessages(false);
+    accounts.update(account);
+
+    if (!wasAccountActive && account.isActive()) {
+      directoryQueue.addRegisteredUser(account.getNumber());
+    }
+  }
+
+  @Timed
+  @DELETE
+  @Path("/apn/")
+  public void deleteApnRegistrationId(@Auth Account account) {
+    Device device = account.getAuthenticatedDevice().get();
+    device.setApnId(null);
+    device.setFetchesMessages(false);
+
+    accounts.update(account);
+
+    if (!account.isActive()) {
+      directoryQueue.deleteRegisteredUser(account.getNumber());
+    }
+  }
+
+  @Timed
+  @PUT
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/pin/")
+  public void setPin(@Auth Account account, @Valid RegistrationLock accountLock) {
+    account.setPin(accountLock.getPin());
+    accounts.update(account);
+  }
+
+  @Timed
+  @DELETE
+  @Path("/pin/")
+  public void removePin(@Auth Account account) {
+    account.setPin(null);
+    accounts.update(account);
+  }
+
+  @Timed
+  @PUT
+  @Path("/name/")
+  public void setName(@Auth Account account, @Valid DeviceName deviceName) {
+    account.getAuthenticatedDevice().get().setName(deviceName.getDeviceName());
+    accounts.update(account);
+  }
+
+  @Timed
+  @DELETE
+  @Path("/signaling_key")
+  public void removeSignalingKey(@Auth Account account) {
+    account.getAuthenticatedDevice().get().setSignalingKey(null);
+    accounts.update(account);
+  }
+
+  @Timed
+  @PUT
+  @Path("/attributes/")
+  @Consumes(MediaType.APPLICATION_JSON)
+  public void setAccountAttributes(@Auth Account account,
+                                   @HeaderParam("X-Signal-Agent") String userAgent,
+                                   @Valid AccountAttributes attributes)
+  {
+    Device device = account.getAuthenticatedDevice().get();
+
+    device.setFetchesMessages(attributes.getFetchesMessages());
+    device.setName(attributes.getName());
+    device.setLastSeen(Util.todayInMillis());
+    device.setUnauthenticatedDeliverySupported(attributes.getUnidentifiedAccessKey() != null);
+    device.setRegistrationId(attributes.getRegistrationId());
+    device.setSignalingKey(attributes.getSignalingKey());
+    device.setUserAgent(userAgent);
+
+    account.setPin(attributes.getPin());
+    account.setUnidentifiedAccessKey(attributes.getUnidentifiedAccessKey());
+    account.setUnrestrictedUnidentifiedAccess(attributes.isUnrestrictedUnidentifiedAccess());
+
+    accounts.update(account);
+  }
+
+  private CaptchaRequirement requiresCaptcha(String number, String transport, String forwardedFor,
+                                             String requester, Optional<String> captchaToken)
+  {
+
+    if (captchaToken.isPresent()) {
+      boolean validToken = recaptchaClient.verify(captchaToken.get());
+
+      if (validToken) {
+        captchaSuccessMeter.mark();
+        return new CaptchaRequirement(false, false);
+      } else {
+        captchaFailureMeter.mark();
+        return new CaptchaRequirement(true, false);
+      }
+    }
+
+    List<AbusiveHostRule> abuseRules = abusiveHostRules.getAbusiveHostRulesFor(requester);
+
+    for (AbusiveHostRule abuseRule : abuseRules) {
+      if (abuseRule.isBlocked()) {
+        logger.info("Blocked host: " + transport + ", " + number + ", " + requester + " (" + forwardedFor + ")");
+        blockedHostMeter.mark();
+        return new CaptchaRequirement(true, false);
+      }
+
+      if (!abuseRule.getRegions().isEmpty()) {
+        if (abuseRule.getRegions().stream().noneMatch(number::startsWith)) {
+          logger.info("Restricted host: " + transport + ", " + number + ", " + requester + " (" + forwardedFor + ")");
+          filteredHostMeter.mark();
+          return new CaptchaRequirement(true, false);
+        }
+      }
+    }
+
+    try {
+      rateLimiters.getSmsVoiceIpLimiter().validate(requester);
+    } catch (RateLimitExceededException e) {
+      logger.info("Rate limited exceeded: " + transport + ", " + number + ", " + requester + " (" + forwardedFor + ")");
+      rateLimitedHostMeter.mark();
+      return new CaptchaRequirement(true, true);
+    }
+
+    try {
+      rateLimiters.getSmsVoicePrefixLimiter().validate(Util.getNumberPrefix(number));
+    } catch (RateLimitExceededException e) {
+      logger.info("Prefix rate limit exceeded: " + transport + ", " + number + ", (" + forwardedFor + ")");
+      rateLimitedPrefixMeter.mark();
+      return new CaptchaRequirement(true, true);
+    }
+
+    return new CaptchaRequirement(false, false);
+  }
+
+  private boolean shouldAutoBlock(String requester) {
+    try {
+      rateLimiters.getAutoBlockLimiter().validate(requester);
+    } catch (RateLimitExceededException e) {
+      return true;
+    }
+
+    return false;
+  }
+
+  private void createAccount(String number, String password, String userAgent, AccountAttributes accountAttributes) {
+    Device device = new Device();
+    device.setId(Device.MASTER_ID);
+    device.setAuthenticationCredentials(new AuthenticationCredentials(password));
+    device.setSignalingKey(accountAttributes.getSignalingKey());
+    device.setFetchesMessages(accountAttributes.getFetchesMessages());
+    device.setRegistrationId(accountAttributes.getRegistrationId());
+    device.setName(accountAttributes.getName());
+    device.setUnauthenticatedDeliverySupported(accountAttributes.getUnidentifiedAccessKey() != null);
+    device.setCreated(System.currentTimeMillis());
+    device.setLastSeen(Util.todayInMillis());
+    device.setUserAgent(userAgent);
+
+    Account account = new Account();
+    account.setNumber(number);
+    account.addDevice(device);
+    account.setPin(accountAttributes.getPin());
+    account.setUnidentifiedAccessKey(accountAttributes.getUnidentifiedAccessKey());
+    account.setUnrestrictedUnidentifiedAccess(accountAttributes.isUnrestrictedUnidentifiedAccess());
+
+    if (accounts.create(account)) {
+      newUserMeter.mark();
+    }
+
+    if (account.isActive()) {
+      directoryQueue.addRegisteredUser(number);
+    } else {
+      directoryQueue.deleteRegisteredUser(number);
+    }
+
+    messagesManager.clear(number);
+    pendingAccounts.remove(number);
+  }
+
+  @VisibleForTesting protected VerificationCode generateVerificationCode(String number) {
+    if (testDevices.containsKey(number)) {
+      return new VerificationCode(testDevices.get(number));
+    }
+
+    SecureRandom random = new SecureRandom();
+    int randomInt       = 100000 + random.nextInt(900000);
+    return new VerificationCode(randomInt);
+  }
+
+  private static class CaptchaRequirement {
+    private final boolean captchaRequired;
+    private final boolean autoBlock;
+
+    private CaptchaRequirement(boolean captchaRequired, boolean autoBlock) {
+      this.captchaRequired = captchaRequired;
+      this.autoBlock       = autoBlock;
+    }
+
+    boolean isCaptchaRequired() {
+      return captchaRequired;
+    }
+
+    boolean isAutoBlock() {
+      return autoBlock;
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/AttachmentControllerBase.java

@@ -0,0 +1,17 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import org.whispersystems.textsecuregcm.util.Conversions;
+
+import java.security.SecureRandom;
+
+public class AttachmentControllerBase {
+
+  protected long generateAttachmentId() {
+    byte[] attachmentBytes = new byte[8];
+    new SecureRandom().nextBytes(attachmentBytes);
+
+    attachmentBytes[0] = (byte)(attachmentBytes[0] & 0x7F);
+    return Conversions.byteArrayToLong(attachmentBytes);
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/AttachmentControllerV1.java

@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.amazonaws.HttpMethod;
+import com.codahale.metrics.annotation.Timed;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.entities.AttachmentDescriptorV1;
+import org.whispersystems.textsecuregcm.entities.AttachmentUri;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.s3.UrlSigner;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.util.Conversions;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import java.io.IOException;
+import java.net.URL;
+import java.security.SecureRandom;
+import java.util.stream.Stream;
+
+import io.dropwizard.auth.Auth;
+
+
+@Path("/v1/attachments")
+public class AttachmentControllerV1 extends AttachmentControllerBase {
+
+  @SuppressWarnings("unused")
+  private final Logger logger = LoggerFactory.getLogger(AttachmentControllerV1.class);
+
+  private static final String[] UNACCELERATED_REGIONS = {"+20", "+971", "+968", "+974"};
+
+  private final RateLimiters rateLimiters;
+  private final UrlSigner    urlSigner;
+
+  public AttachmentControllerV1(RateLimiters rateLimiters, String accessKey, String accessSecret, String bucket) {
+    this.rateLimiters = rateLimiters;
+    this.urlSigner    = new UrlSigner(accessKey, accessSecret, bucket);
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  public AttachmentDescriptorV1 allocateAttachment(@Auth Account account)
+      throws RateLimitExceededException
+  {
+    if (account.isRateLimited()) {
+      rateLimiters.getAttachmentLimiter().validate(account.getNumber());
+    }
+
+    long attachmentId = generateAttachmentId();
+    URL  url          = urlSigner.getPreSignedUrl(attachmentId, HttpMethod.PUT, Stream.of(UNACCELERATED_REGIONS).anyMatch(region -> account.getNumber().startsWith(region)));
+
+    return new AttachmentDescriptorV1(attachmentId, url.toExternalForm());
+
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/{attachmentId}")
+  public AttachmentUri redirectToAttachment(@Auth                      Account account,
+                                            @PathParam("attachmentId") long    attachmentId)
+      throws IOException
+  {
+    return new AttachmentUri(urlSigner.getPreSignedUrl(attachmentId, HttpMethod.GET, Stream.of(UNACCELERATED_REGIONS).anyMatch(region -> account.getNumber().startsWith(region))));
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/AttachmentControllerV2.java

@@ -0,0 +1,54 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import org.whispersystems.textsecuregcm.entities.AttachmentDescriptorV2;
+import org.whispersystems.textsecuregcm.limits.RateLimiter;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.s3.PolicySigner;
+import org.whispersystems.textsecuregcm.s3.PostPolicyGenerator;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.util.Pair;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+
+import io.dropwizard.auth.Auth;
+
+@Path("/v2/attachments")
+public class AttachmentControllerV2 extends AttachmentControllerBase {
+
+  private final PostPolicyGenerator policyGenerator;
+  private final PolicySigner        policySigner;
+  private final RateLimiter         rateLimiter;
+
+  public AttachmentControllerV2(RateLimiters rateLimiters, String accessKey, String accessSecret, String region, String bucket) {
+    this.rateLimiter      = rateLimiters.getAttachmentLimiter();
+    this.policyGenerator  = new PostPolicyGenerator(region, bucket, accessKey);
+    this.policySigner     = new PolicySigner(accessSecret, region);
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/form/upload")
+  public AttachmentDescriptorV2 getAttachmentUploadForm(@Auth Account account) throws RateLimitExceededException {
+    rateLimiter.validate(account.getNumber());
+
+    ZonedDateTime        now          = ZonedDateTime.now(ZoneOffset.UTC);
+    long                 attachmentId = generateAttachmentId();
+    String               objectName   = String.valueOf(attachmentId);
+    Pair<String, String> policy       = policyGenerator.createFor(now, String.valueOf(objectName));
+    String               signature    = policySigner.getSignature(now, policy.second());
+
+    return new AttachmentDescriptorV2(attachmentId, objectName, policy.first(),
+                                      "private", "AWS4-HMAC-SHA256",
+                                      now.format(PostPolicyGenerator.AWS_DATE_TIME),
+                                      policy.second(), signature);
+  }
+
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/CertificateController.java

@@ -0,0 +1,48 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.CertificateGenerator;
+import org.whispersystems.textsecuregcm.entities.DeliveryCertificate;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+
+import java.io.IOException;
+import java.security.InvalidKeyException;
+
+import io.dropwizard.auth.Auth;
+
+@Path("/v1/certificate")
+public class CertificateController {
+
+  private final Logger logger = LoggerFactory.getLogger(CertificateController.class);
+
+  private final CertificateGenerator certificateGenerator;
+
+  public CertificateController(CertificateGenerator certificateGenerator) {
+    this.certificateGenerator = certificateGenerator;
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/delivery")
+  public DeliveryCertificate getDeliveryCertificate(@Auth Account account) throws IOException, InvalidKeyException {
+    if (!account.getAuthenticatedDevice().isPresent()) throw new AssertionError();
+
+    if (Util.isEmpty(account.getIdentityKey())) {
+      throw new WebApplicationException(Response.Status.BAD_REQUEST);
+    }
+
+    return new DeliveryCertificate(certificateGenerator.createFor(account, account.getAuthenticatedDevice().get()));
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/DeviceController.java

@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2013-2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import com.google.common.annotations.VisibleForTesting;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.AuthenticationCredentials;
+import org.whispersystems.textsecuregcm.auth.AuthorizationHeader;
+import org.whispersystems.textsecuregcm.auth.InvalidAuthorizationHeaderException;
+import org.whispersystems.textsecuregcm.auth.StoredVerificationCode;
+import org.whispersystems.textsecuregcm.entities.AccountAttributes;
+import org.whispersystems.textsecuregcm.entities.DeviceInfo;
+import org.whispersystems.textsecuregcm.entities.DeviceInfoList;
+import org.whispersystems.textsecuregcm.entities.DeviceResponse;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.sqs.DirectoryQueue;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.MessagesManager;
+import org.whispersystems.textsecuregcm.storage.PendingDevicesManager;
+import org.whispersystems.textsecuregcm.util.Util;
+import org.whispersystems.textsecuregcm.util.VerificationCode;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.security.SecureRandom;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import io.dropwizard.auth.Auth;
+
+@Path("/v1/devices")
+public class DeviceController {
+
+  private final Logger logger = LoggerFactory.getLogger(DeviceController.class);
+
+  private static final int MAX_DEVICES = 6;
+
+  private final PendingDevicesManager pendingDevices;
+  private final AccountsManager       accounts;
+  private final MessagesManager       messages;
+  private final RateLimiters          rateLimiters;
+  private final Map<String, Integer>  maxDeviceConfiguration;
+  private final DirectoryQueue        directoryQueue;
+
+  public DeviceController(PendingDevicesManager pendingDevices,
+                          AccountsManager accounts,
+                          MessagesManager messages,
+                          DirectoryQueue directoryQueue,
+                          RateLimiters rateLimiters,
+                          Map<String, Integer> maxDeviceConfiguration)
+  {
+    this.pendingDevices         = pendingDevices;
+    this.accounts               = accounts;
+    this.messages               = messages;
+    this.directoryQueue         = directoryQueue;
+    this.rateLimiters           = rateLimiters;
+    this.maxDeviceConfiguration = maxDeviceConfiguration;
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  public DeviceInfoList getDevices(@Auth Account account) {
+    List<DeviceInfo> devices = new LinkedList<>();
+
+    for (Device device : account.getDevices()) {
+      devices.add(new DeviceInfo(device.getId(), device.getName(),
+                                 device.getLastSeen(), device.getCreated()));
+    }
+
+    return new DeviceInfoList(devices);
+  }
+
+  @Timed
+  @DELETE
+  @Path("/{device_id}")
+  public void removeDevice(@Auth Account account, @PathParam("device_id") long deviceId) {
+    if (account.getAuthenticatedDevice().get().getId() != Device.MASTER_ID) {
+      throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+    }
+
+    account.removeDevice(deviceId);
+    accounts.update(account);
+
+    if (!account.isActive()) {
+      directoryQueue.deleteRegisteredUser(account.getNumber());
+    }
+
+    messages.clear(account.getNumber(), deviceId);
+  }
+
+  @Timed
+  @GET
+  @Path("/provisioning/code")
+  @Produces(MediaType.APPLICATION_JSON)
+  public VerificationCode createDeviceToken(@Auth Account account)
+      throws RateLimitExceededException, DeviceLimitExceededException
+  {
+    rateLimiters.getAllocateDeviceLimiter().validate(account.getNumber());
+
+    int maxDeviceLimit = MAX_DEVICES;
+
+    if (maxDeviceConfiguration.containsKey(account.getNumber())) {
+      maxDeviceLimit = maxDeviceConfiguration.get(account.getNumber());
+    }
+
+    if (account.getActiveDeviceCount() >= maxDeviceLimit) {
+      throw new DeviceLimitExceededException(account.getDevices().size(), MAX_DEVICES);
+    }
+
+    if (account.getAuthenticatedDevice().get().getId() != Device.MASTER_ID) {
+      throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+    }
+
+    VerificationCode       verificationCode       = generateVerificationCode();
+    StoredVerificationCode storedVerificationCode = new StoredVerificationCode(verificationCode.getVerificationCode(),
+                                                                               System.currentTimeMillis());
+
+    pendingDevices.store(account.getNumber(), storedVerificationCode);
+
+    return verificationCode;
+  }
+
+  @Timed
+  @PUT
+  @Produces(MediaType.APPLICATION_JSON)
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Path("/{verification_code}")
+  public DeviceResponse verifyDeviceToken(@PathParam("verification_code") String verificationCode,
+                                          @HeaderParam("Authorization")   String authorizationHeader,
+                                          @Valid                          AccountAttributes accountAttributes)
+      throws RateLimitExceededException, DeviceLimitExceededException
+  {
+    try {
+      AuthorizationHeader header = AuthorizationHeader.fromFullHeader(authorizationHeader);
+      String number              = header.getNumber();
+      String password            = header.getPassword();
+
+      rateLimiters.getVerifyDeviceLimiter().validate(number);
+
+      Optional<StoredVerificationCode> storedVerificationCode = pendingDevices.getCodeForNumber(number);
+
+      if (!storedVerificationCode.isPresent() || !storedVerificationCode.get().isValid(verificationCode)) {
+        throw new WebApplicationException(Response.status(403).build());
+      }
+
+      Optional<Account> account = accounts.get(number);
+
+      if (!account.isPresent()) {
+        throw new WebApplicationException(Response.status(403).build());
+      }
+
+      int maxDeviceLimit = MAX_DEVICES;
+
+      if (maxDeviceConfiguration.containsKey(account.get().getNumber())) {
+        maxDeviceLimit = maxDeviceConfiguration.get(account.get().getNumber());
+      }
+
+      if (account.get().getActiveDeviceCount() >= maxDeviceLimit) {
+        throw new DeviceLimitExceededException(account.get().getDevices().size(), MAX_DEVICES);
+      }
+
+      Device device = new Device();
+      device.setName(accountAttributes.getName());
+      device.setAuthenticationCredentials(new AuthenticationCredentials(password));
+      device.setSignalingKey(accountAttributes.getSignalingKey());
+      device.setFetchesMessages(accountAttributes.getFetchesMessages());
+      device.setId(account.get().getNextDeviceId());
+      device.setRegistrationId(accountAttributes.getRegistrationId());
+      device.setLastSeen(Util.todayInMillis());
+      device.setCreated(System.currentTimeMillis());
+
+      account.get().addDevice(device);
+      messages.clear(account.get().getNumber(), device.getId());
+      accounts.update(account.get());
+
+      pendingDevices.remove(number);
+
+      return new DeviceResponse(device.getId());
+    } catch (InvalidAuthorizationHeaderException e) {
+      logger.info("Bad Authorization Header", e);
+      throw new WebApplicationException(Response.status(401).build());
+    }
+  }
+
+  @Timed
+  @PUT
+  @Path("/unauthenticated_delivery")
+  public void setUnauthenticatedDelivery(@Auth Account account) {
+    assert(account.getAuthenticatedDevice().isPresent());
+    account.getAuthenticatedDevice().get().setUnauthenticatedDeliverySupported(true);
+    accounts.update(account);
+  }
+
+  @VisibleForTesting protected VerificationCode generateVerificationCode() {
+    SecureRandom random = new SecureRandom();
+    int randomInt       = 100000 + random.nextInt(900000);
+    return new VerificationCode(randomInt);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/DeviceLimitExceededException.java

@@ -0,0 +1,21 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+
+public class DeviceLimitExceededException extends Exception {
+
+  private final int currentDevices;
+  private final int maxDevices;
+
+  public DeviceLimitExceededException(int currentDevices, int maxDevices) {
+    this.currentDevices = currentDevices;
+    this.maxDevices     = maxDevices;
+  }
+
+  public int getCurrentDevices() {
+    return currentDevices;
+  }
+
+  public int getMaxDevices() {
+    return maxDevices;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/DirectoryController.java

@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.Histogram;
+import com.codahale.metrics.Meter;
+import com.codahale.metrics.MetricRegistry;
+import com.codahale.metrics.SharedMetricRegistries;
+import com.codahale.metrics.annotation.Timed;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.DirectoryCredentialsGenerator;
+import org.whispersystems.textsecuregcm.entities.ClientContact;
+import org.whispersystems.textsecuregcm.entities.ClientContactTokens;
+import org.whispersystems.textsecuregcm.entities.ClientContacts;
+import org.whispersystems.textsecuregcm.entities.DirectoryFeedbackRequest;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.DirectoryManager;
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.Constants;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.GET;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.Response.Status;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.auth.Auth;
+
+@Path("/v1/directory")
+public class DirectoryController {
+
+  private static final String[] FEEDBACK_STATUSES = {
+      "ok",
+      "mismatch",
+      "attestation-error",
+      "unexpected-error",
+  };
+
+  private final Logger         logger            = LoggerFactory.getLogger(DirectoryController.class);
+  private final MetricRegistry metricRegistry    = SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME);
+  private final Histogram      contactsHistogram = metricRegistry.histogram(name(getClass(), "contacts"));
+
+  private final Map<String, Meter> iosFeedbackMeters = new HashMap<String, Meter>() {{
+    for (String status : FEEDBACK_STATUSES) {
+      put(status, metricRegistry.meter(name(DirectoryController.class, "feedback-v2", "ios", status)));
+    }
+  }};
+  private final Map<String, Meter> androidFeedbackMeters = new HashMap<String, Meter>() {{
+    for (String status : FEEDBACK_STATUSES) {
+      put(status, metricRegistry.meter(name(DirectoryController.class, "feedback-v2", "android", status)));
+    }
+  }};
+  private final Map<String, Meter> unknownFeedbackMeters = new HashMap<String, Meter>() {{
+    for (String status : FEEDBACK_STATUSES) {
+      put(status, metricRegistry.meter(name(DirectoryController.class, "feedback-v2", "unknown", status)));
+    }
+  }};
+
+  private final RateLimiters                  rateLimiters;
+  private final DirectoryManager              directory;
+  private final DirectoryCredentialsGenerator userTokenGenerator;
+
+  public DirectoryController(RateLimiters rateLimiters,
+                             DirectoryManager directory,
+                             DirectoryCredentialsGenerator userTokenGenerator)
+  {
+    this.directory          = directory;
+    this.rateLimiters       = rateLimiters;
+    this.userTokenGenerator = userTokenGenerator;
+  }
+
+  @Timed
+  @GET
+  @Path("/auth")
+  @Produces(MediaType.APPLICATION_JSON)
+  public Response getAuthToken(@Auth Account account) {
+    return Response.ok().entity(userTokenGenerator.generateFor(account.getNumber())).build();
+  }
+
+  @PUT
+  @Path("/feedback-v2/{status}")
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Produces(MediaType.APPLICATION_JSON)
+  public Response setFeedback(@Auth                Account                  account,
+                              @PathParam("status") String                   status,
+                              @Valid               DirectoryFeedbackRequest request)
+  {
+    Map<String, Meter> platformFeedbackMeters = unknownFeedbackMeters;
+    String             platformName           = "unknown";
+
+    Optional<Device> masterDevice = account.getMasterDevice();
+    if (masterDevice.isPresent()) {
+      if (masterDevice.get().getApnId() != null) {
+        platformFeedbackMeters = iosFeedbackMeters;
+      } else if (masterDevice.get().getGcmId() != null) {
+        platformFeedbackMeters = androidFeedbackMeters;
+      }
+    }
+
+    Optional<Meter> meter = Optional.ofNullable(platformFeedbackMeters.get(status));
+    if (meter.isPresent()) {
+      meter.get().mark();
+
+//      if (!"ok".equals(status) &&
+//          request != null &&
+//          request.getReason().isPresent() &&
+//          request.getReason().get().length() != 0)
+//      {
+//        logger.info("directory feedback platform=" + platformName + " status=" + status + ": " + request.getReason().get());
+//      }
+
+      return Response.ok().build();
+    } else {
+      return Response.status(Status.NOT_FOUND).build();
+    }
+  }
+
+
+  @Timed
+  @GET
+  @Path("/{token}")
+  @Produces(MediaType.APPLICATION_JSON)
+  public Response getTokenPresence(@Auth Account account, @PathParam("token") String token)
+      throws RateLimitExceededException
+  {
+    rateLimiters.getContactsLimiter().validate(account.getNumber());
+
+    try {
+      Optional<ClientContact> contact = directory.get(decodeToken(token));
+
+      if (contact.isPresent()) return Response.ok().entity(contact.get()).build();
+      else                     return Response.status(404).build();
+
+    } catch (IOException e) {
+      logger.info("Bad token", e);
+      return Response.status(404).build();
+    }
+  }
+
+  @Timed
+  @PUT
+  @Path("/tokens")
+  @Produces(MediaType.APPLICATION_JSON)
+  @Consumes(MediaType.APPLICATION_JSON)
+  public ClientContacts getContactIntersection(@Auth Account account, @Valid ClientContactTokens contacts)
+      throws RateLimitExceededException
+  {
+    rateLimiters.getContactsLimiter().validate(account.getNumber(), contacts.getContacts().size());
+    contactsHistogram.update(contacts.getContacts().size());
+
+    try {
+      List<byte[]> tokens = new LinkedList<>();
+
+      for (String encodedContact : contacts.getContacts()) {
+        tokens.add(decodeToken(encodedContact));
+      }
+
+      List<ClientContact> intersection = directory.get(tokens);
+      return new ClientContacts(intersection);
+    } catch (IOException e) {
+      logger.info("Bad token", e);
+      throw new WebApplicationException(Response.status(400).build());
+    }
+  }
+
+  private byte[] decodeToken(String encoded) throws IOException {
+    return Base64.decodeWithoutPadding(encoded.replace('-', '+').replace('_', '/'));
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/InvalidDestinationException.java

@@ -0,0 +1,7 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+public class InvalidDestinationException extends Exception {
+  public InvalidDestinationException(String message) {
+    super(message);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/KeepAliveController.java

@@ -0,0 +1,55 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.PubSubManager;
+import org.whispersystems.textsecuregcm.websocket.WebsocketAddress;
+import org.whispersystems.websocket.session.WebSocketSession;
+import org.whispersystems.websocket.session.WebSocketSessionContext;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Response;
+
+import io.dropwizard.auth.Auth;
+
+
+@Path("/v1/keepalive")
+public class KeepAliveController {
+
+  private final Logger logger = LoggerFactory.getLogger(KeepAliveController.class);
+
+  private final PubSubManager pubSubManager;
+
+  public KeepAliveController(PubSubManager pubSubManager) {
+    this.pubSubManager = pubSubManager;
+  }
+
+  @Timed
+  @GET
+  public Response getKeepAlive(@Auth             Account account,
+                               @WebSocketSession WebSocketSessionContext context)
+  {
+    if (account != null) {
+      WebsocketAddress address = new WebsocketAddress(account.getNumber(),
+                                                      account.getAuthenticatedDevice().get().getId());
+
+      if (!pubSubManager.hasLocalSubscription(address)) {
+        logger.warn("***** No local subscription found for: " + address);
+        context.getClient().close(1000, "OK");
+      }
+    }
+
+    return Response.ok().build();
+  }
+
+  @Timed
+  @GET
+  @Path("/provisioning")
+  public Response getProvisioningKeepAlive() {
+    return Response.ok().build();
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/KeysController.java

@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2014 Open Whisper Systems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.Anonymous;
+import org.whispersystems.textsecuregcm.auth.OptionalAccess;
+import org.whispersystems.textsecuregcm.entities.PreKey;
+import org.whispersystems.textsecuregcm.entities.PreKeyCount;
+import org.whispersystems.textsecuregcm.entities.PreKeyResponse;
+import org.whispersystems.textsecuregcm.entities.PreKeyResponseItem;
+import org.whispersystems.textsecuregcm.entities.PreKeyState;
+import org.whispersystems.textsecuregcm.entities.SignedPreKey;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.sqs.DirectoryQueue;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.KeyRecord;
+import org.whispersystems.textsecuregcm.storage.Keys;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Optional;
+
+import io.dropwizard.auth.Auth;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+@Path("/v2/keys")
+public class KeysController {
+
+  private static final Logger logger = LoggerFactory.getLogger(KeysController.class);
+
+  private final RateLimiters    rateLimiters;
+  private final Keys            keys;
+  private final AccountsManager accounts;
+  private final DirectoryQueue  directoryQueue;
+
+  public KeysController(RateLimiters rateLimiters, Keys keys, AccountsManager accounts, DirectoryQueue directoryQueue) {
+    this.rateLimiters   = rateLimiters;
+    this.keys           = keys;
+    this.accounts       = accounts;
+    this.directoryQueue = directoryQueue;
+  }
+
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  public PreKeyCount getStatus(@Auth Account account) {
+    int count = keys.getCount(account.getNumber(), account.getAuthenticatedDevice().get().getId());
+
+    if (count > 0) {
+      count = count - 1;
+    }
+
+    return new PreKeyCount(count);
+  }
+
+  @Timed
+  @PUT
+  @Consumes(MediaType.APPLICATION_JSON)
+  public void setKeys(@Auth Account account, @Valid PreKeyState preKeys)  {
+    Device  device           = account.getAuthenticatedDevice().get();
+    boolean wasAccountActive = account.isActive();
+    boolean updateAccount    = false;
+
+    if (!preKeys.getSignedPreKey().equals(device.getSignedPreKey())) {
+      device.setSignedPreKey(preKeys.getSignedPreKey());
+      updateAccount = true;
+    }
+
+    if (!preKeys.getIdentityKey().equals(account.getIdentityKey())) {
+      account.setIdentityKey(preKeys.getIdentityKey());
+      updateAccount = true;
+    }
+
+    if (updateAccount) {
+      accounts.update(account);
+
+      if (!wasAccountActive && account.isActive()) {
+        directoryQueue.addRegisteredUser(account.getNumber());
+      }
+    }
+
+    keys.store(account.getNumber(), device.getId(), preKeys.getPreKeys());
+  }
+
+  @Timed
+  @GET
+  @Path("/{number}/{device_id}")
+  @Produces(MediaType.APPLICATION_JSON)
+  public Optional<PreKeyResponse> getDeviceKeys(@Auth                                     Optional<Account> account,
+                                                @HeaderParam(OptionalAccess.UNIDENTIFIED) Optional<Anonymous> accessKey,
+                                                @PathParam("number")                      String number,
+                                                @PathParam("device_id")                   String deviceId)
+      throws RateLimitExceededException
+  {
+    if (!account.isPresent() && !accessKey.isPresent()) {
+      throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+    }
+
+    Optional<Account> target = accounts.get(number);
+    OptionalAccess.verify(account, accessKey, target, deviceId);
+
+    assert(target.isPresent());
+
+    if (account.isPresent()) {
+      rateLimiters.getPreKeysLimiter().validate(account.get().getNumber() +  "__" + number + "." + deviceId);
+    }
+
+    List<KeyRecord>          targetKeys = getLocalKeys(target.get(), deviceId);
+    List<PreKeyResponseItem> devices    = new LinkedList<>();
+
+    for (Device device : target.get().getDevices()) {
+      if (device.isActive() && (deviceId.equals("*") || device.getId() == Long.parseLong(deviceId))) {
+        SignedPreKey signedPreKey = device.getSignedPreKey();
+        PreKey preKey       = null;
+
+        for (KeyRecord keyRecord : targetKeys) {
+          if (keyRecord.getDeviceId() == device.getId()) {
+              preKey = new PreKey(keyRecord.getKeyId(), keyRecord.getPublicKey());
+          }
+        }
+
+        if (signedPreKey != null || preKey != null) {
+          devices.add(new PreKeyResponseItem(device.getId(), device.getRegistrationId(), signedPreKey, preKey));
+        }
+      }
+    }
+
+    if (devices.isEmpty()) return Optional.empty();
+    else                   return Optional.of(new PreKeyResponse(target.get().getIdentityKey(), devices));
+  }
+
+  @Timed
+  @PUT
+  @Path("/signed")
+  @Consumes(MediaType.APPLICATION_JSON)
+  public void setSignedKey(@Auth Account account, @Valid SignedPreKey signedPreKey) {
+    Device  device           = account.getAuthenticatedDevice().get();
+    boolean wasAccountActive = account.isActive();
+
+    device.setSignedPreKey(signedPreKey);
+    accounts.update(account);
+
+    if (!wasAccountActive && account.isActive()) {
+      directoryQueue.addRegisteredUser(account.getNumber());
+    }
+  }
+
+  @Timed
+  @GET
+  @Path("/signed")
+  @Produces(MediaType.APPLICATION_JSON)
+  public Optional<SignedPreKey> getSignedKey(@Auth Account account) {
+    Device       device       = account.getAuthenticatedDevice().get();
+    SignedPreKey signedPreKey = device.getSignedPreKey();
+
+    if (signedPreKey != null) return Optional.of(signedPreKey);
+    else                      return Optional.empty();
+  }
+
+  private List<KeyRecord> getLocalKeys(Account destination, String deviceIdSelector) {
+    try {
+      if (deviceIdSelector.equals("*")) {
+        return keys.get(destination.getNumber());
+      }
+
+      long deviceId = Long.parseLong(deviceIdSelector);
+
+      return keys.get(destination.getNumber(), deviceId);
+    } catch (NumberFormatException e) {
+      throw new WebApplicationException(Response.status(422).build());
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/MessageController.java

@@ -0,0 +1,347 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.Meter;
+import com.codahale.metrics.MetricRegistry;
+import com.codahale.metrics.SharedMetricRegistries;
+import com.codahale.metrics.annotation.Timed;
+import com.google.protobuf.ByteString;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.auth.Anonymous;
+import org.whispersystems.textsecuregcm.auth.OptionalAccess;
+import org.whispersystems.textsecuregcm.entities.IncomingMessage;
+import org.whispersystems.textsecuregcm.entities.IncomingMessageList;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.Envelope;
+import org.whispersystems.textsecuregcm.entities.MismatchedDevices;
+import org.whispersystems.textsecuregcm.entities.OutgoingMessageEntity;
+import org.whispersystems.textsecuregcm.entities.OutgoingMessageEntityList;
+import org.whispersystems.textsecuregcm.entities.SendMessageResponse;
+import org.whispersystems.textsecuregcm.entities.StaleDevices;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.push.ApnFallbackManager;
+import org.whispersystems.textsecuregcm.push.NotPushRegisteredException;
+import org.whispersystems.textsecuregcm.push.PushSender;
+import org.whispersystems.textsecuregcm.push.ReceiptSender;
+import org.whispersystems.textsecuregcm.redis.RedisOperation;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.Device;
+import org.whispersystems.textsecuregcm.storage.MessagesManager;
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.Constants;
+import org.whispersystems.textsecuregcm.util.Util;
+import org.whispersystems.textsecuregcm.websocket.WebSocketConnection;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+
+import static com.codahale.metrics.MetricRegistry.name;
+import io.dropwizard.auth.Auth;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+@Path("/v1/messages")
+public class MessageController {
+
+  private final Logger         logger            = LoggerFactory.getLogger(MessageController.class);
+  private final MetricRegistry metricRegistry    = SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME);
+  private final Meter          unidentifiedMeter = metricRegistry.meter(name(getClass(), "delivery", "unidentified"));
+  private final Meter          identifiedMeter   = metricRegistry.meter(name(getClass(), "delivery", "identified"  ));
+
+  private final RateLimiters           rateLimiters;
+  private final PushSender             pushSender;
+  private final ReceiptSender          receiptSender;
+  private final AccountsManager        accountsManager;
+  private final MessagesManager        messagesManager;
+  private final ApnFallbackManager     apnFallbackManager;
+
+  public MessageController(RateLimiters rateLimiters,
+                           PushSender pushSender,
+                           ReceiptSender receiptSender,
+                           AccountsManager accountsManager,
+                           MessagesManager messagesManager,
+                           ApnFallbackManager apnFallbackManager)
+  {
+    this.rateLimiters           = rateLimiters;
+    this.pushSender             = pushSender;
+    this.receiptSender          = receiptSender;
+    this.accountsManager        = accountsManager;
+    this.messagesManager        = messagesManager;
+    this.apnFallbackManager     = apnFallbackManager;
+  }
+
+  @Timed
+  @Path("/{destination}")
+  @PUT
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Produces(MediaType.APPLICATION_JSON)
+  public SendMessageResponse sendMessage(@Auth                                     Optional<Account>   source,
+                                         @HeaderParam(OptionalAccess.UNIDENTIFIED) Optional<Anonymous> accessKey,
+                                         @PathParam("destination")                 String              destinationName,
+                                         @Valid                                    IncomingMessageList messages)
+      throws RateLimitExceededException
+  {
+    if (!source.isPresent() && !accessKey.isPresent()) {
+      throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+    }
+
+    if (source.isPresent() && !source.get().getNumber().equals(destinationName)) {
+      rateLimiters.getMessagesLimiter().validate(source.get().getNumber() + "__" + destinationName);
+    }
+
+    if (source.isPresent() && !source.get().getNumber().equals(destinationName)) {
+      identifiedMeter.mark();
+    } else {
+      unidentifiedMeter.mark();
+    }
+
+    try {
+      boolean isSyncMessage = source.isPresent() && source.get().getNumber().equals(destinationName);
+
+      Optional<Account> destination;
+
+      if (!isSyncMessage) destination = accountsManager.get(destinationName);
+      else                destination = source;
+
+      OptionalAccess.verify(source, accessKey, destination);
+      assert(destination.isPresent());
+
+      validateCompleteDeviceList(destination.get(), messages.getMessages(), isSyncMessage);
+      validateRegistrationIds(destination.get(), messages.getMessages());
+
+      for (IncomingMessage incomingMessage : messages.getMessages()) {
+        Optional<Device> destinationDevice = destination.get().getDevice(incomingMessage.getDestinationDeviceId());
+
+        if (destinationDevice.isPresent()) {
+          sendMessage(source, destination.get(), destinationDevice.get(), messages.getTimestamp(), messages.isOnline(), incomingMessage);
+        }
+      }
+
+      return new SendMessageResponse(!isSyncMessage && source.isPresent() && source.get().getActiveDeviceCount() > 1);
+    } catch (NoSuchUserException e) {
+      throw new WebApplicationException(Response.status(404).build());
+    } catch (MismatchedDevicesException e) {
+      throw new WebApplicationException(Response.status(409)
+                                                .type(MediaType.APPLICATION_JSON_TYPE)
+                                                .entity(new MismatchedDevices(e.getMissingDevices(),
+                                                                              e.getExtraDevices()))
+                                                .build());
+    } catch (StaleDevicesException e) {
+      throw new WebApplicationException(Response.status(410)
+                                                .type(MediaType.APPLICATION_JSON)
+                                                .entity(new StaleDevices(e.getStaleDevices()))
+                                                .build());
+    }
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  public OutgoingMessageEntityList getPendingMessages(@Auth Account account) {
+    assert account.getAuthenticatedDevice().isPresent();
+
+    if (!Util.isEmpty(account.getAuthenticatedDevice().get().getApnId())) {
+      RedisOperation.unchecked(() -> apnFallbackManager.cancel(account, account.getAuthenticatedDevice().get()));
+    }
+
+    return messagesManager.getMessagesForDevice(account.getNumber(),
+                                                account.getAuthenticatedDevice().get().getId());
+  }
+
+  @Timed
+  @DELETE
+  @Path("/{source}/{timestamp}")
+  public void removePendingMessage(@Auth Account account,
+                                   @PathParam("source") String source,
+                                   @PathParam("timestamp") long timestamp)
+  {
+    try {
+      WebSocketConnection.messageTime.update(System.currentTimeMillis() - timestamp);
+
+      Optional<OutgoingMessageEntity> message = messagesManager.delete(account.getNumber(),
+                                                                       account.getAuthenticatedDevice().get().getId(),
+                                                                       source, timestamp);
+
+      if (message.isPresent() && message.get().getType() != Envelope.Type.RECEIPT_VALUE) {
+        receiptSender.sendReceipt(account,
+                                  message.get().getSource(),
+                                  message.get().getTimestamp());
+      }
+    } catch (NotPushRegisteredException e) {
+      logger.info("User no longer push registered for delivery receipt: " + e.getMessage());
+    } catch (NoSuchUserException e) {
+      logger.warn("Sending delivery receipt", e);
+    }
+  }
+
+  @Timed
+  @DELETE
+  @Path("/uuid/{uuid}")
+  public void removePendingMessage(@Auth Account account, @PathParam("uuid") UUID uuid) {
+    try {
+      Optional<OutgoingMessageEntity> message = messagesManager.delete(account.getNumber(),
+                                                                       account.getAuthenticatedDevice().get().getId(),
+                                                                       uuid);
+
+      message.ifPresent(outgoingMessageEntity -> WebSocketConnection.messageTime.update(System.currentTimeMillis() - outgoingMessageEntity.getTimestamp()));
+
+      if (message.isPresent() && !Util.isEmpty(message.get().getSource()) && message.get().getType() != Envelope.Type.RECEIPT_VALUE) {
+        receiptSender.sendReceipt(account, message.get().getSource(), message.get().getTimestamp());
+      }
+    } catch (NoSuchUserException e) {
+      logger.warn("Sending delivery receipt", e);
+    } catch (NotPushRegisteredException e) {
+      logger.info("User no longer push registered for delivery receipt: " + e.getMessage());
+    }
+  }
+
+  private void sendMessage(Optional<Account> source,
+                           Account destinationAccount,
+                           Device destinationDevice,
+                           long timestamp,
+                           boolean online,
+                           IncomingMessage incomingMessage)
+      throws NoSuchUserException
+  {
+    try {
+      Optional<byte[]> messageBody    = getMessageBody(incomingMessage);
+      Optional<byte[]> messageContent = getMessageContent(incomingMessage);
+      Envelope.Builder messageBuilder = Envelope.newBuilder();
+
+      messageBuilder.setType(Envelope.Type.valueOf(incomingMessage.getType()))
+                    .setTimestamp(timestamp == 0 ? System.currentTimeMillis() : timestamp)
+                    .setServerTimestamp(System.currentTimeMillis());
+
+      if (source.isPresent()) {
+        messageBuilder.setSource(source.get().getNumber())
+                      .setSourceDevice((int)source.get().getAuthenticatedDevice().get().getId());
+      }
+
+      if (messageBody.isPresent()) {
+        messageBuilder.setLegacyMessage(ByteString.copyFrom(messageBody.get()));
+      }
+
+      if (messageContent.isPresent()) {
+        messageBuilder.setContent(ByteString.copyFrom(messageContent.get()));
+      }
+
+      pushSender.sendMessage(destinationAccount, destinationDevice, messageBuilder.build(), online);
+    } catch (NotPushRegisteredException e) {
+      if (destinationDevice.isMaster()) throw new NoSuchUserException(e);
+      else                              logger.debug("Not registered", e);
+    }
+  }
+
+  private void validateRegistrationIds(Account account, List<IncomingMessage> messages)
+      throws StaleDevicesException
+  {
+    List<Long> staleDevices = new LinkedList<>();
+
+    for (IncomingMessage message : messages) {
+      Optional<Device> device = account.getDevice(message.getDestinationDeviceId());
+
+      if (device.isPresent() &&
+          message.getDestinationRegistrationId() > 0 &&
+          message.getDestinationRegistrationId() != device.get().getRegistrationId())
+      {
+        staleDevices.add(device.get().getId());
+      }
+    }
+
+    if (!staleDevices.isEmpty()) {
+      throw new StaleDevicesException(staleDevices);
+    }
+  }
+
+  private void validateCompleteDeviceList(Account account,
+                                          List<IncomingMessage> messages,
+                                          boolean isSyncMessage)
+      throws MismatchedDevicesException
+  {
+    Set<Long> messageDeviceIds = new HashSet<>();
+    Set<Long> accountDeviceIds = new HashSet<>();
+
+    List<Long> missingDeviceIds = new LinkedList<>();
+    List<Long> extraDeviceIds   = new LinkedList<>();
+
+    for (IncomingMessage message : messages) {
+      messageDeviceIds.add(message.getDestinationDeviceId());
+    }
+
+    for (Device device : account.getDevices()) {
+      if (device.isActive() &&
+          !(isSyncMessage && device.getId() == account.getAuthenticatedDevice().get().getId()))
+      {
+        accountDeviceIds.add(device.getId());
+
+        if (!messageDeviceIds.contains(device.getId())) {
+          missingDeviceIds.add(device.getId());
+        }
+      }
+    }
+
+    for (IncomingMessage message : messages) {
+      if (!accountDeviceIds.contains(message.getDestinationDeviceId())) {
+        extraDeviceIds.add(message.getDestinationDeviceId());
+      }
+    }
+
+    if (!missingDeviceIds.isEmpty() || !extraDeviceIds.isEmpty()) {
+      throw new MismatchedDevicesException(missingDeviceIds, extraDeviceIds);
+    }
+  }
+
+  private Optional<byte[]> getMessageBody(IncomingMessage message) {
+    if (Util.isEmpty(message.getBody())) return Optional.empty();
+
+    try {
+      return Optional.of(Base64.decode(message.getBody()));
+    } catch (IOException ioe) {
+      logger.debug("Bad B64", ioe);
+      return Optional.empty();
+    }
+  }
+
+  private Optional<byte[]> getMessageContent(IncomingMessage message) {
+    if (Util.isEmpty(message.getContent())) return Optional.empty();
+
+    try {
+      return Optional.of(Base64.decode(message.getContent()));
+    } catch (IOException ioe) {
+      logger.debug("Bad B64", ioe);
+      return Optional.empty();
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/MismatchedDevicesException.java

@@ -0,0 +1,22 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import java.util.List;
+
+public class MismatchedDevicesException extends Exception {
+
+  private final List<Long> missingDevices;
+  private final List<Long> extraDevices;
+
+  public MismatchedDevicesException(List<Long> missingDevices, List<Long> extraDevices) {
+    this.missingDevices = missingDevices;
+    this.extraDevices   = extraDevices;
+  }
+
+  public List<Long> getMissingDevices() {
+    return missingDevices;
+  }
+
+  public List<Long> getExtraDevices() {
+    return extraDevices;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/NoSuchUserException.java

@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+import java.util.LinkedList;
+import java.util.List;
+
+public class NoSuchUserException extends Exception {
+
+  private List<String> missing;
+
+  public NoSuchUserException(String user) {
+    super(user);
+    missing = new LinkedList<>();
+    missing.add(user);
+  }
+
+  public NoSuchUserException(List<String> missing) {
+    this.missing = missing;
+  }
+
+  public NoSuchUserException(Exception e) {
+    super(e);
+  }
+
+  public List<String> getMissing() {
+    return missing;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/ProfileController.java

@@ -0,0 +1,146 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.amazonaws.auth.AWSCredentials;
+import com.amazonaws.auth.AWSCredentialsProvider;
+import com.amazonaws.auth.AWSStaticCredentialsProvider;
+import com.amazonaws.auth.BasicAWSCredentials;
+import com.amazonaws.services.s3.AmazonS3;
+import com.amazonaws.services.s3.AmazonS3Client;
+import com.codahale.metrics.annotation.Timed;
+import org.apache.commons.codec.binary.Base64;
+import org.hibernate.validator.constraints.Length;
+import org.hibernate.validator.valuehandling.UnwrapValidatedValue;
+import org.whispersystems.textsecuregcm.auth.OptionalAccess;
+import org.whispersystems.textsecuregcm.auth.Anonymous;
+import org.whispersystems.textsecuregcm.auth.UnidentifiedAccessChecksum;
+import org.whispersystems.textsecuregcm.configuration.ProfilesConfiguration;
+import org.whispersystems.textsecuregcm.entities.Profile;
+import org.whispersystems.textsecuregcm.entities.ProfileAvatarUploadAttributes;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.s3.PolicySigner;
+import org.whispersystems.textsecuregcm.s3.PostPolicyGenerator;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.util.Pair;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.security.SecureRandom;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import java.util.Optional;
+
+import io.dropwizard.auth.Auth;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+@Path("/v1/profile")
+public class ProfileController {
+
+  private final RateLimiters     rateLimiters;
+  private final AccountsManager  accountsManager;
+
+  private final PolicySigner        policySigner;
+  private final PostPolicyGenerator policyGenerator;
+
+  private final AmazonS3            s3client;
+  private final String              bucket;
+
+  public ProfileController(RateLimiters rateLimiters,
+                           AccountsManager accountsManager,
+                           ProfilesConfiguration profilesConfiguration)
+  {
+    AWSCredentials         credentials         = new BasicAWSCredentials(profilesConfiguration.getAccessKey(), profilesConfiguration.getAccessSecret());
+    AWSCredentialsProvider credentialsProvider = new AWSStaticCredentialsProvider(credentials);
+
+    this.rateLimiters       = rateLimiters;
+    this.accountsManager    = accountsManager;
+    this.bucket             = profilesConfiguration.getBucket();
+    this.s3client           = AmazonS3Client.builder()
+                                            .withCredentials(credentialsProvider)
+                                            .withRegion(profilesConfiguration.getRegion())
+                                            .build();
+
+    this.policyGenerator  = new PostPolicyGenerator(profilesConfiguration.getRegion(),
+                                                    profilesConfiguration.getBucket(),
+                                                    profilesConfiguration.getAccessKey());
+
+    this.policySigner     = new PolicySigner(profilesConfiguration.getAccessSecret(),
+                                             profilesConfiguration.getRegion());
+  }
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/{number}")
+  public Profile getProfile(@Auth                                     Optional<Account>   requestAccount,
+                            @HeaderParam(OptionalAccess.UNIDENTIFIED) Optional<Anonymous> accessKey,
+                            @PathParam("number")                      String number,
+                            @QueryParam("ca")                         boolean useCaCertificate)
+      throws RateLimitExceededException
+  {
+    if (!requestAccount.isPresent() && !accessKey.isPresent()) {
+      throw new WebApplicationException(Response.Status.UNAUTHORIZED);
+    }
+
+    if (requestAccount.isPresent()) {
+      rateLimiters.getProfileLimiter().validate(requestAccount.get().getNumber());
+    }
+
+    Optional<Account> accountProfile = accountsManager.get(number);
+    OptionalAccess.verify(requestAccount, accessKey, accountProfile);
+
+    //noinspection ConstantConditions,OptionalGetWithoutIsPresent
+    return new Profile(accountProfile.get().getProfileName(),
+                       accountProfile.get().getAvatar(),
+                       accountProfile.get().getIdentityKey(),
+                       accountProfile.get().isUnauthenticatedDeliverySupported() ? UnidentifiedAccessChecksum.generateFor(accountProfile.get().getUnidentifiedAccessKey()) : null,
+                       accountProfile.get().isUnrestrictedUnidentifiedAccess());
+  }
+
+  @Timed
+  @PUT
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/name/{name}")
+  public void setProfile(@Auth Account account, @PathParam("name") @UnwrapValidatedValue(true) @Length(min = 72,max= 72) Optional<String> name) {
+    account.setProfileName(name.orElse(null));
+    accountsManager.update(account);
+  }
+
+
+  @Timed
+  @GET
+  @Produces(MediaType.APPLICATION_JSON)
+  @Path("/form/avatar")
+  public ProfileAvatarUploadAttributes getAvatarUploadForm(@Auth Account account) {
+    String               previousAvatar = account.getAvatar();
+    ZonedDateTime        now            = ZonedDateTime.now(ZoneOffset.UTC);
+    String               objectName     = generateAvatarObjectName();
+    Pair<String, String> policy         = policyGenerator.createFor(now, objectName);
+    String               signature      = policySigner.getSignature(now, policy.second());
+
+    if (previousAvatar != null && previousAvatar.startsWith("profiles/")) {
+      s3client.deleteObject(bucket, previousAvatar);
+    }
+
+    account.setAvatar(objectName);
+    accountsManager.update(account);
+
+    return new ProfileAvatarUploadAttributes(objectName, policy.first(), "private", "AWS4-HMAC-SHA256",
+                                             now.format(PostPolicyGenerator.AWS_DATE_TIME), policy.second(), signature);
+  }
+
+  private String generateAvatarObjectName() {
+    byte[] object = new byte[16];
+    new SecureRandom().nextBytes(object);
+
+    return "profiles/" + Base64.encodeBase64URLSafeString(object);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/ProvisioningController.java

@@ -0,0 +1,55 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import com.codahale.metrics.annotation.Timed;
+import org.whispersystems.textsecuregcm.entities.ProvisioningMessage;
+import org.whispersystems.textsecuregcm.limits.RateLimiters;
+import org.whispersystems.textsecuregcm.push.PushSender;
+import org.whispersystems.textsecuregcm.push.WebsocketSender;
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.websocket.InvalidWebsocketAddressException;
+import org.whispersystems.textsecuregcm.websocket.ProvisioningAddress;
+
+import javax.validation.Valid;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+
+import io.dropwizard.auth.Auth;
+
+@Path("/v1/provisioning")
+public class ProvisioningController {
+
+  private final RateLimiters    rateLimiters;
+  private final WebsocketSender websocketSender;
+
+  public ProvisioningController(RateLimiters rateLimiters, PushSender pushSender) {
+    this.rateLimiters    = rateLimiters;
+    this.websocketSender = pushSender.getWebSocketSender();
+  }
+
+  @Timed
+  @Path("/{destination}")
+  @PUT
+  @Consumes(MediaType.APPLICATION_JSON)
+  @Produces(MediaType.APPLICATION_JSON)
+  public void sendProvisioningMessage(@Auth                     Account source,
+                                      @PathParam("destination") String destinationName,
+                                      @Valid                    ProvisioningMessage message)
+      throws RateLimitExceededException, InvalidWebsocketAddressException, IOException
+  {
+    rateLimiters.getMessagesLimiter().validate(source.getNumber());
+
+    if (!websocketSender.sendProvisioningMessage(new ProvisioningAddress(destinationName, 0),
+                                                 Base64.decode(message.getBody())))
+    {
+      throw new WebApplicationException(Response.Status.NOT_FOUND);
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/RateLimitExceededException.java

@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+public class RateLimitExceededException extends Exception {
+  public RateLimitExceededException(String number) {
+    super(number);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/StaleDevicesException.java

@@ -0,0 +1,16 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import java.util.List;
+
+
+public class StaleDevicesException extends Throwable {
+  private final List<Long> staleDevices;
+
+  public StaleDevicesException(List<Long> staleDevices) {
+    this.staleDevices = staleDevices;
+  }
+
+  public List<Long> getStaleDevices() {
+    return staleDevices;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/TransparentDataController.java

@@ -0,0 +1,42 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import org.whispersystems.textsecuregcm.storage.Account;
+import org.whispersystems.textsecuregcm.storage.AccountsManager;
+import org.whispersystems.textsecuregcm.storage.PublicAccount;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import java.util.Map;
+import java.util.Optional;
+
+@Path("/v1/transparency/")
+public class TransparentDataController {
+
+  private final AccountsManager     accountsManager;
+  private final Map<String, String> transparentDataIndex;
+
+  public TransparentDataController(AccountsManager accountsManager,
+                                   Map<String, String> transparentDataIndex)
+  {
+    this.accountsManager      = accountsManager;
+    this.transparentDataIndex = transparentDataIndex;
+  }
+
+  @GET
+  @Path("/account/{id}")
+  @Produces(MediaType.APPLICATION_JSON)
+  public Optional<PublicAccount> getAccount(@PathParam("id") String id) {
+    String index = transparentDataIndex.get(id);
+
+    if (index != null) {
+      return accountsManager.get(index).map(PublicAccount::new);
+    }
+
+    return Optional.empty();
+  }
+
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/ValidationException.java

@@ -0,0 +1,24 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.controllers;
+
+
+public class ValidationException extends Exception {
+  public ValidationException(String s) {
+    super(s);
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/controllers/VoiceVerificationController.java

@@ -0,0 +1,112 @@
+package org.whispersystems.textsecuregcm.controllers;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.Optional;
+import java.util.Set;
+
+@SuppressWarnings("OptionalUsedAsFieldOrParameterType")
+@Path("/v1/voice/")
+public class VoiceVerificationController {
+
+  private static final String PLAY_TWIML = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+      "<Response>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Pause length=\"1\"/>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Pause length=\"1\"/>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "    <Play>%s</Play>\n" +
+      "</Response>";
+
+
+  private final String      baseUrl;
+  private final Set<String> supportedLocales;
+
+  public VoiceVerificationController(String baseUrl, Set<String> supportedLocales) {
+    this.baseUrl          = baseUrl;
+    this.supportedLocales = supportedLocales;
+  }
+  
+  @POST
+  @Path("/description/{code}")
+  @Produces(MediaType.APPLICATION_XML)
+  public Response getDescription(@PathParam("code") String code, @QueryParam("l") String locale) {
+    code = code.replaceAll("[^0-9]", "");
+
+    if (code.length() != 6) {
+      return Response.status(400).build();
+    }
+
+    if (locale != null && supportedLocales.contains(locale)) {
+      return getLocalizedDescription(code, locale);
+    }
+
+    if (locale != null && locale.split("-").length >= 1 && supportedLocales.contains(locale.split("-")[0])) {
+      return getLocalizedDescription(code, locale.split("-")[0]);
+    }
+
+    return getLocalizedDescription(code, "en-US");
+  }
+
+  private Response getLocalizedDescription(String code, String locale) {
+    String path = constructUrlForLocale(baseUrl, locale);
+
+    return Response.ok()
+                   .entity(String.format(PLAY_TWIML,
+                                         path + "verification.mp3",
+                                         path + code.charAt(0) + "_middle.mp3",
+                                         path + code.charAt(1) + "_middle.mp3",
+                                         path + code.charAt(2) + "_middle.mp3",
+                                         path + code.charAt(3) + "_middle.mp3",
+                                         path + code.charAt(4) + "_middle.mp3",
+                                         path + code.charAt(5) + "_falling.mp3",
+                                         path + "verification.mp3",
+                                         path + code.charAt(0) + "_middle.mp3",
+                                         path + code.charAt(1) + "_middle.mp3",
+                                         path + code.charAt(2) + "_middle.mp3",
+                                         path + code.charAt(3) + "_middle.mp3",
+                                         path + code.charAt(4) + "_middle.mp3",
+                                         path + code.charAt(5) + "_falling.mp3",
+                                         path + "verification.mp3",
+                                         path + code.charAt(0) + "_middle.mp3",
+                                         path + code.charAt(1) + "_middle.mp3",
+                                         path + code.charAt(2) + "_middle.mp3",
+                                         path + code.charAt(3) + "_middle.mp3",
+                                         path + code.charAt(4) + "_middle.mp3",
+                                         path + code.charAt(5) + "_falling.mp3"))
+                   .build();
+  }
+
+  private String constructUrlForLocale(String baseUrl, String locale) {
+    if (!baseUrl.endsWith("/")) {
+      baseUrl += "/";
+    }
+
+    return baseUrl + locale + "/";
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/crypto/Curve.java

@@ -0,0 +1,98 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+import org.whispersystems.curve25519.Curve25519;
+import org.whispersystems.curve25519.Curve25519KeyPair;
+
+import java.security.InvalidKeyException;
+
+import static org.whispersystems.curve25519.Curve25519.BEST;
+
+public class Curve {
+
+  public  static final int DJB_TYPE   = 0x05;
+
+  public static ECKeyPair generateKeyPair() {
+    Curve25519KeyPair keyPair = Curve25519.getInstance(BEST).generateKeyPair();
+
+    return new ECKeyPair(new DjbECPublicKey(keyPair.getPublicKey()),
+                         new DjbECPrivateKey(keyPair.getPrivateKey()));
+  }
+
+  public static ECPublicKey decodePoint(byte[] bytes, int offset)
+      throws InvalidKeyException
+  {
+    if (bytes == null || bytes.length - offset < 1) {
+      throw new InvalidKeyException("No key type identifier");
+    }
+
+    int type = bytes[offset] & 0xFF;
+
+    switch (type) {
+      case Curve.DJB_TYPE:
+        if (bytes.length - offset < 33) {
+          throw new InvalidKeyException("Bad key length: " + bytes.length);
+        }
+
+        byte[] keyBytes = new byte[32];
+        System.arraycopy(bytes, offset+1, keyBytes, 0, keyBytes.length);
+        return new DjbECPublicKey(keyBytes);
+      default:
+        throw new InvalidKeyException("Bad key type: " + type);
+    }
+  }
+
+  public static ECPrivateKey decodePrivatePoint(byte[] bytes) {
+    return new DjbECPrivateKey(bytes);
+  }
+
+  public static byte[] calculateAgreement(ECPublicKey publicKey, ECPrivateKey privateKey)
+      throws InvalidKeyException
+  {
+    if (publicKey == null) {
+      throw new InvalidKeyException("public value is null");
+    }
+
+    if (privateKey == null) {
+      throw new InvalidKeyException("private value is null");
+    }
+
+    if (publicKey.getType() != privateKey.getType()) {
+      throw new InvalidKeyException("Public and private keys must be of the same type!");
+    }
+
+    if (publicKey.getType() == DJB_TYPE) {
+      return Curve25519.getInstance(BEST)
+                       .calculateAgreement(((DjbECPublicKey) publicKey).getPublicKey(),
+                                           ((DjbECPrivateKey) privateKey).getPrivateKey());
+    } else {
+      throw new InvalidKeyException("Unknown type: " + publicKey.getType());
+    }
+  }
+
+  public static byte[] calculateSignature(ECPrivateKey signingKey, byte[] message)
+      throws InvalidKeyException
+  {
+    if (signingKey == null || message == null) {
+      throw new InvalidKeyException("Values must not be null");
+    }
+
+    if (signingKey.getType() == DJB_TYPE) {
+      return Curve25519.getInstance(BEST)
+                       .calculateSignature(((DjbECPrivateKey) signingKey).getPrivateKey(), message);
+    } else {
+      throw new InvalidKeyException("Unknown type: " + signingKey.getType());
+    }
+  }
+
+  public static boolean verifySignature(ECPublicKey signingKey, byte[] message, byte[] signature)
+      throws InvalidKeyException
+  {
+    if (signingKey.getType() == DJB_TYPE) {
+      return Curve25519.getInstance(BEST)
+                       .verifySignature(((DjbECPublicKey) signingKey).getPublicKey(), message, signature);
+    } else {
+      throw new InvalidKeyException("Unknown type: " + signingKey.getType());
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/crypto/DjbECPrivateKey.java

@@ -0,0 +1,24 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+public class DjbECPrivateKey implements ECPrivateKey {
+
+  private final byte[] privateKey;
+
+  DjbECPrivateKey(byte[] privateKey) {
+    this.privateKey = privateKey;
+  }
+
+  @Override
+  public byte[] serialize() {
+    return privateKey;
+  }
+
+  @Override
+  public int getType() {
+    return Curve.DJB_TYPE;
+  }
+
+  public byte[] getPrivateKey() {
+    return privateKey;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/crypto/DjbECPublicKey.java

@@ -0,0 +1,49 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+import org.whispersystems.textsecuregcm.util.ByteUtil;
+
+import java.math.BigInteger;
+import java.util.Arrays;
+
+public class DjbECPublicKey implements ECPublicKey {
+
+  private final byte[] publicKey;
+
+  DjbECPublicKey(byte[] publicKey) {
+    this.publicKey = publicKey;
+  }
+
+  @Override
+  public byte[] serialize() {
+    byte[] type = {Curve.DJB_TYPE};
+    return ByteUtil.combine(type, publicKey);
+  }
+
+  @Override
+  public int getType() {
+    return Curve.DJB_TYPE;
+  }
+
+  @Override
+  public boolean equals(Object other) {
+    if (other == null)                      return false;
+    if (!(other instanceof DjbECPublicKey)) return false;
+
+    DjbECPublicKey that = (DjbECPublicKey)other;
+    return Arrays.equals(this.publicKey, that.publicKey);
+  }
+
+  @Override
+  public int hashCode() {
+    return Arrays.hashCode(publicKey);
+  }
+
+  @Override
+  public int compareTo(ECPublicKey another) {
+    return new BigInteger(publicKey).compareTo(new BigInteger(((DjbECPublicKey)another).publicKey));
+  }
+
+  public byte[] getPublicKey() {
+    return publicKey;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/crypto/ECKeyPair.java

@@ -0,0 +1,20 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+public class ECKeyPair {
+
+  private final ECPublicKey  publicKey;
+  private final ECPrivateKey privateKey;
+
+  ECKeyPair(ECPublicKey publicKey, ECPrivateKey privateKey) {
+    this.publicKey = publicKey;
+    this.privateKey = privateKey;
+  }
+
+  public ECPublicKey getPublicKey() {
+    return publicKey;
+  }
+
+  public ECPrivateKey getPrivateKey() {
+    return privateKey;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/crypto/ECPrivateKey.java

@@ -0,0 +1,7 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+public interface ECPrivateKey {
+  public byte[] serialize();
+  public int getType();
+}
+

service/src/main/java/org/whispersystems/textsecuregcm/crypto/ECPublicKey.java

@@ -0,0 +1,10 @@
+package org.whispersystems.textsecuregcm.crypto;
+
+public interface ECPublicKey extends Comparable<ECPublicKey> {
+
+  public static final int KEY_SIZE = 33;
+
+  public byte[] serialize();
+
+  public int getType();
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AccountAttributes.java

@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+import org.hibernate.validator.constraints.Length;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class AccountAttributes {
+
+  @JsonProperty
+  private String signalingKey;
+
+  @JsonProperty
+  private boolean fetchesMessages;
+
+  @JsonProperty
+  private int registrationId;
+
+  @JsonProperty
+  @Length(max = 204, message = "This field must be less than 50 characters")
+  private String name;
+
+  @JsonProperty
+  private boolean voice;
+
+  @JsonProperty
+  private boolean video;
+
+  @JsonProperty
+  private String pin;
+
+  @JsonProperty
+  private byte[] unidentifiedAccessKey;
+
+  @JsonProperty
+  private boolean unrestrictedUnidentifiedAccess;
+
+  public AccountAttributes() {}
+
+  @VisibleForTesting
+  public AccountAttributes(String signalingKey, boolean fetchesMessages, int registrationId, String pin) {
+    this(signalingKey, fetchesMessages, registrationId, null, false, false, pin);
+  }
+
+  @VisibleForTesting
+  public AccountAttributes(String signalingKey, boolean fetchesMessages, int registrationId, String name, boolean voice, boolean video, String pin) {
+    this.signalingKey    = signalingKey;
+    this.fetchesMessages = fetchesMessages;
+    this.registrationId  = registrationId;
+    this.name            = name;
+    this.voice           = voice;
+    this.video           = video;
+    this.pin             = pin;
+  }
+
+  public String getSignalingKey() {
+    return signalingKey;
+  }
+
+  public boolean getFetchesMessages() {
+    return fetchesMessages;
+  }
+
+  public int getRegistrationId() {
+    return registrationId;
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public boolean getVoice() {
+    return voice;
+  }
+
+  public boolean getVideo() {
+    return video;
+  }
+
+  public String getPin() {
+    return pin;
+  }
+
+  public byte[] getUnidentifiedAccessKey() {
+    return unidentifiedAccessKey;
+  }
+
+  public boolean isUnrestrictedUnidentifiedAccess() {
+    return unrestrictedUnidentifiedAccess;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AccountCount.java

@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class AccountCount {
+
+  @JsonProperty
+  private int count;
+
+  public AccountCount(int count) {
+    this.count = count;
+  }
+
+  public AccountCount() {}
+
+  public int getCount() {
+    return count;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AcknowledgeWebsocketMessage.java

@@ -0,0 +1,23 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class AcknowledgeWebsocketMessage extends IncomingWebsocketMessage {
+
+  @JsonProperty
+  private long id;
+
+  public AcknowledgeWebsocketMessage() {}
+
+  public AcknowledgeWebsocketMessage(long id) {
+    this.type = TYPE_ACKNOWLEDGE_MESSAGE;
+    this.id   = id;
+  }
+
+  public long getId() {
+    return id;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/ActiveUserTally.java

@@ -0,0 +1,57 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.Map;
+import java.util.HashMap;
+
+public class ActiveUserTally {
+  @JsonProperty
+  private String fromNumber;
+
+  @JsonProperty
+  private Map<String, long[]> platforms;
+
+  @JsonProperty
+  private Map<String, long[]> countries;
+
+  public ActiveUserTally() {}
+
+  public ActiveUserTally(String fromNumber, Map<String, long[]> platforms, Map<String, long[]> countries) {
+    this.fromNumber = fromNumber;
+    this.platforms  = platforms;
+    this.countries  = countries;
+  }
+
+  public String getFromNumber() {
+    return this.fromNumber;
+  }
+
+  public Map<String, long[]> getPlatforms() {
+    return this.platforms;
+  }
+
+  public Map<String, long[]> getCountries() {
+    return this.countries;
+  }
+
+  public void setFromNumber(String fromNumber) {
+    this.fromNumber = fromNumber;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/ApnRegistrationId.java

@@ -0,0 +1,38 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class ApnRegistrationId {
+
+  @JsonProperty
+  @NotEmpty
+  private String apnRegistrationId;
+
+  @JsonProperty
+  private String voipRegistrationId;
+
+  public String getApnRegistrationId() {
+    return apnRegistrationId;
+  }
+
+  public String getVoipRegistrationId() {
+    return voipRegistrationId;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AttachmentDescriptorV1.java

@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class AttachmentDescriptorV1 {
+
+  @JsonProperty
+  private long id;
+
+  @JsonProperty
+  private String idString;
+
+  @JsonProperty
+  private String location;
+
+  public AttachmentDescriptorV1(long id, String location) {
+    this.id       = id;
+    this.idString = String.valueOf(id);
+    this.location = location;
+  }
+
+  public AttachmentDescriptorV1() {}
+
+  public long getId() {
+    return id;
+  }
+
+  public String getLocation() {
+    return location;
+  }
+
+  public String getIdString() {
+    return idString;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AttachmentDescriptorV2.java

@@ -0,0 +1,88 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class AttachmentDescriptorV2 {
+
+  @JsonProperty
+  private String key;
+
+  @JsonProperty
+  private String credential;
+
+  @JsonProperty
+  private String acl;
+
+  @JsonProperty
+  private String algorithm;
+
+  @JsonProperty
+  private String date;
+
+  @JsonProperty
+  private String policy;
+
+  @JsonProperty
+  private String signature;
+
+  @JsonProperty
+  private long attachmentId;
+
+  @JsonProperty
+  private String attachmentIdString;
+
+  public AttachmentDescriptorV2() {}
+
+  public AttachmentDescriptorV2(long attachmentId,
+                                String key, String credential,
+                                String acl,  String algorithm,
+                                String date, String policy,
+                                String signature)
+  {
+    this.attachmentId       = attachmentId;
+    this.attachmentIdString = String.valueOf(attachmentId);
+    this.key                = key;
+    this.credential         = credential;
+    this.acl                = acl;
+    this.algorithm          = algorithm;
+    this.date               = date;
+    this.policy             = policy;
+    this.signature          = signature;
+  }
+
+  public String getKey() {
+    return key;
+  }
+
+  public String getCredential() {
+    return credential;
+  }
+
+  public String getAcl() {
+    return acl;
+  }
+
+  public String getAlgorithm() {
+    return algorithm;
+  }
+
+  public String getDate() {
+    return date;
+  }
+
+  public String getPolicy() {
+    return policy;
+  }
+
+  public String getSignature() {
+    return signature;
+  }
+
+  public long getAttachmentId() {
+    return attachmentId;
+  }
+
+  public String getAttachmentIdString() {
+    return attachmentIdString;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/AttachmentUri.java

@@ -0,0 +1,39 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+
+public class AttachmentUri {
+
+  @JsonProperty
+  private String location;
+
+  public AttachmentUri(URL uri) {
+    this.location = uri.toString();
+  }
+
+  public AttachmentUri() {}
+
+  public URL getLocation() throws MalformedURLException {
+    return URI.create(location).toURL();
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/ClientContact.java

@@ -0,0 +1,108 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import org.whispersystems.textsecuregcm.util.ByteArrayAdapter;
+
+import java.util.Arrays;
+
+@JsonInclude(JsonInclude.Include.NON_DEFAULT)
+public class ClientContact {
+
+  @JsonSerialize(using = ByteArrayAdapter.Serializing.class)
+  @JsonDeserialize(using = ByteArrayAdapter.Deserializing.class)
+  @JsonProperty
+  private byte[]  token;
+
+  @JsonProperty
+  private boolean voice;
+
+  @JsonProperty
+  private boolean video;
+
+  private String  relay;
+  private boolean inactive;
+
+  public ClientContact(byte[] token, String relay, boolean voice, boolean video) {
+    this.token = token;
+    this.relay = relay;
+    this.voice = voice;
+    this.video = video;
+  }
+
+  public ClientContact() {}
+
+  public byte[] getToken() {
+    return token;
+  }
+
+  public String getRelay() {
+    return relay;
+  }
+
+  public void setRelay(String relay) {
+    this.relay = relay;
+  }
+
+  public boolean isInactive() {
+    return inactive;
+  }
+
+  public void setInactive(boolean inactive) {
+    this.inactive = inactive;
+  }
+
+  public boolean isVoice() {
+    return voice;
+  }
+
+  public void setVoice(boolean voice) {
+    this.voice = voice;
+  }
+
+  public boolean isVideo() {
+    return video;
+  }
+
+  public void setVideo(boolean video) {
+    this.video = video;
+  }
+
+  @Override
+  public boolean equals(Object other) {
+    if (other == null) return false;
+    if (!(other instanceof ClientContact)) return false;
+
+    ClientContact that = (ClientContact)other;
+
+    return
+        Arrays.equals(this.token, that.token) &&
+        this.inactive == that.inactive &&
+        this.voice == that.voice &&
+        this.video == that.video &&
+        (this.relay == null ? (that.relay == null) : this.relay.equals(that.relay));
+  }
+
+  public int hashCode() {
+    return Arrays.hashCode(this.token);
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/ClientContactTokens.java

@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.constraints.NotNull;
+import java.util.List;
+
+public class ClientContactTokens {
+
+  @NotNull
+  @JsonProperty
+  private List<String> contacts;
+
+  public List<String> getContacts() {
+    return contacts;
+  }
+
+  public ClientContactTokens() {}
+
+  public ClientContactTokens(List<String> contacts) {
+    this.contacts = contacts;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/ClientContacts.java

@@ -0,0 +1,41 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.LinkedList;
+import java.util.List;
+
+public class ClientContacts {
+
+  @JsonProperty
+  private List<ClientContact> contacts;
+
+  public ClientContacts(List<ClientContact> contacts) {
+    if (contacts != null) this.contacts = contacts;
+    else                  this.contacts = new LinkedList<>();
+  }
+
+  public ClientContacts() {
+    this.contacts = new LinkedList<>();
+  }
+
+  public List<ClientContact> getContacts() {
+    return contacts;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/CryptoEncodingException.java

@@ -0,0 +1,13 @@
+package org.whispersystems.textsecuregcm.entities;
+
+public class CryptoEncodingException extends Exception {
+
+  public CryptoEncodingException(String s) {
+    super(s);
+  }
+
+  public CryptoEncodingException(Exception e) {
+    super(e);
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DeliveryCertificate.java

@@ -0,0 +1,50 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.google.common.annotations.VisibleForTesting;
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.ByteArrayAdapter;
+
+import java.io.IOException;
+
+public class DeliveryCertificate {
+
+  @JsonProperty
+  @JsonSerialize(using = ByteArraySerializer.class)
+  @JsonDeserialize(using = ByteArrayDeserializer.class)
+  private byte[] certificate;
+
+  public DeliveryCertificate(byte[] certificate) {
+    this.certificate = certificate;
+  }
+
+  public DeliveryCertificate() {}
+
+  @VisibleForTesting
+  public byte[] getCertificate() {
+    return certificate;
+  }
+
+  public static class ByteArraySerializer extends JsonSerializer<byte[]> {
+    @Override
+    public void serialize(byte[] bytes, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {
+      jsonGenerator.writeString(Base64.encodeBytes(bytes));
+    }
+  }
+
+  public static class ByteArrayDeserializer extends JsonDeserializer<byte[]> {
+    @Override
+    public byte[] deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException {
+      return Base64.decode(jsonParser.getValueAsString());
+    }
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DeviceInfo.java

@@ -0,0 +1,24 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class DeviceInfo {
+  @JsonProperty
+  private long id;
+
+  @JsonProperty
+  private String name;
+
+  @JsonProperty
+  private long lastSeen;
+
+  @JsonProperty
+  private long created;
+
+  public DeviceInfo(long id, String name, long lastSeen, long created) {
+    this.id       = id;
+    this.name     = name;
+    this.lastSeen = lastSeen;
+    this.created  = created;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DeviceInfoList.java

@@ -0,0 +1,15 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.List;
+
+public class DeviceInfoList {
+
+  @JsonProperty
+  private List<DeviceInfo> devices;
+
+  public DeviceInfoList(List<DeviceInfo> devices) {
+    this.devices = devices;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DeviceName.java

@@ -0,0 +1,19 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.Length;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class DeviceName {
+
+  @JsonProperty
+  @NotEmpty
+  @Length(max = 300, message = "This field must be less than 300 characters")
+  private String deviceName;
+
+  public DeviceName() {}
+
+  public String getDeviceName() {
+    return deviceName;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DeviceResponse.java

@@ -0,0 +1,21 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+public class DeviceResponse {
+
+  @JsonProperty
+  private long deviceId;
+
+  @VisibleForTesting
+  public DeviceResponse() {}
+
+  public DeviceResponse(long deviceId) {
+    this.deviceId = deviceId;
+  }
+
+  public long getDeviceId() {
+    return deviceId;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DirectoryFeedbackRequest.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2019 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.constraints.Size;
+import java.util.Optional;
+
+public class DirectoryFeedbackRequest {
+
+  @Size(max = 1024)
+  @JsonProperty
+  private Optional<String> reason;
+
+  public DirectoryFeedbackRequest() {
+  }
+
+  public DirectoryFeedbackRequest(Optional<String> reason) {
+    this.reason = reason;
+  }
+
+  public Optional<String> getReason() {
+    return reason;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DirectoryReconciliationRequest.java

@@ -0,0 +1,55 @@
+/**
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.List;
+
+public class DirectoryReconciliationRequest {
+
+  @JsonProperty
+  private String fromNumber;
+
+  @JsonProperty
+  private String toNumber;
+
+  @JsonProperty
+  private List<String> numbers;
+
+  public DirectoryReconciliationRequest() {
+  }
+
+  public DirectoryReconciliationRequest(String fromNumber, String toNumber, List<String> numbers) {
+    this.fromNumber = fromNumber;
+    this.toNumber   = toNumber;
+    this.numbers    = numbers;
+  }
+
+  public String getFromNumber() {
+    return fromNumber;
+  }
+
+  public String getToNumber() {
+    return toNumber;
+  }
+
+  public List<String> getNumbers() {
+    return numbers;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/DirectoryReconciliationResponse.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2018 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class DirectoryReconciliationResponse {
+
+  @JsonProperty
+  @NotEmpty
+  private Status status;
+
+  public DirectoryReconciliationResponse() {
+  }
+
+  public DirectoryReconciliationResponse(Status status) {
+    this.status = status;
+  }
+
+  public Status getStatus() {
+    return status;
+  }
+
+  public enum Status {
+    OK,
+    MISSING,
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/EncryptedOutgoingMessage.java

@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.textsecuregcm.entities.MessageProtos.Envelope;
+import org.whispersystems.textsecuregcm.util.Base64;
+import org.whispersystems.textsecuregcm.util.Util;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.Mac;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.spec.SecretKeySpec;
+import java.io.IOException;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+
+public class EncryptedOutgoingMessage {
+
+  private final Logger logger = LoggerFactory.getLogger(EncryptedOutgoingMessage.class);
+
+  private static final byte[] VERSION         = new byte[]{0x01};
+  private static final int    CIPHER_KEY_SIZE = 32;
+  private static final int    MAC_KEY_SIZE    = 20;
+  private static final int    MAC_SIZE        = 10;
+
+  private final byte[] serialized;
+
+  public EncryptedOutgoingMessage(Envelope outgoingMessage, String signalingKey)
+      throws CryptoEncodingException
+  {
+    byte[]        plaintext = outgoingMessage.toByteArray();
+    SecretKeySpec cipherKey = getCipherKey (signalingKey);
+    SecretKeySpec macKey    = getMacKey(signalingKey);
+
+    this.serialized         = getCiphertext(plaintext, cipherKey, macKey);
+  }
+
+  public byte[] toByteArray() {
+    return serialized;
+  }
+
+  private byte[] getCiphertext(byte[] plaintext, SecretKeySpec cipherKey, SecretKeySpec macKey)
+      throws CryptoEncodingException
+  {
+    try {
+      Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+      cipher.init(Cipher.ENCRYPT_MODE, cipherKey);
+
+      Mac hmac = Mac.getInstance("HmacSHA256");
+      hmac.init(macKey);
+
+      hmac.update(VERSION);
+
+      byte[] ivBytes = cipher.getIV();
+      hmac.update(ivBytes);
+
+      byte[] ciphertext   = cipher.doFinal(plaintext);
+      byte[] mac          = hmac.doFinal(ciphertext);
+      byte[] truncatedMac = new byte[MAC_SIZE];
+      System.arraycopy(mac, 0, truncatedMac, 0, truncatedMac.length);
+
+      return Util.combine(VERSION, ivBytes, ciphertext, truncatedMac);
+    } catch (NoSuchAlgorithmException | NoSuchPaddingException | IllegalBlockSizeException | BadPaddingException e) {
+      throw new AssertionError(e);
+    } catch (InvalidKeyException e) {
+      logger.warn("Invalid Key", e);
+      throw new CryptoEncodingException("Invalid key!");
+    }
+  }
+
+  private SecretKeySpec getCipherKey(String signalingKey) throws CryptoEncodingException {
+    try {
+      byte[] signalingKeyBytes = Base64.decode(signalingKey);
+      byte[] cipherKey         = new byte[CIPHER_KEY_SIZE];
+
+      if (signalingKeyBytes.length < CIPHER_KEY_SIZE)
+        throw new CryptoEncodingException("Signaling key too short!");
+
+      System.arraycopy(signalingKeyBytes, 0, cipherKey, 0, cipherKey.length);
+      return new SecretKeySpec(cipherKey, "AES");
+    } catch (IOException e) {
+      throw new CryptoEncodingException(e);
+    }
+  }
+
+  private SecretKeySpec getMacKey(String signalingKey) throws CryptoEncodingException {
+    try {
+      byte[] signalingKeyBytes = Base64.decode(signalingKey);
+      byte[] macKey            = new byte[MAC_KEY_SIZE];
+
+      if (signalingKeyBytes.length < CIPHER_KEY_SIZE + MAC_KEY_SIZE)
+        throw new CryptoEncodingException("Signaling key too short!");
+
+      System.arraycopy(signalingKeyBytes, CIPHER_KEY_SIZE, macKey, 0, macKey.length);
+
+      return new SecretKeySpec(macKey, "HmacSHA256");
+    } catch (IOException e) {
+      throw new CryptoEncodingException(e);
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/GcmRegistrationId.java

@@ -0,0 +1,33 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+public class GcmRegistrationId {
+
+  @JsonProperty
+  @NotEmpty
+  private String gcmRegistrationId;
+
+  public String getGcmRegistrationId() {
+    return gcmRegistrationId;
+  }
+
+}
+

service/src/main/java/org/whispersystems/textsecuregcm/entities/IncomingMessage.java

@@ -0,0 +1,75 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class IncomingMessage {
+
+  @JsonProperty
+  private int    type;
+
+  @JsonProperty
+  private String destination;
+
+  @JsonProperty
+  private long   destinationDeviceId = 1;
+
+  @JsonProperty
+  private int destinationRegistrationId;
+
+  @JsonProperty
+  private String body;
+
+  @JsonProperty
+  private String content;
+
+  @JsonProperty
+  private String relay;
+
+  @JsonProperty
+  private long   timestamp; // deprecated
+
+  public String getDestination() {
+    return destination;
+  }
+
+  public String getBody() {
+    return body;
+  }
+
+  public int getType() {
+    return type;
+  }
+
+  public String getRelay() {
+    return relay;
+  }
+
+  public long getDestinationDeviceId() {
+    return destinationDeviceId;
+  }
+
+  public int getDestinationRegistrationId() {
+    return destinationRegistrationId;
+  }
+
+  public String getContent() {
+    return content;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/IncomingMessageList.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
+import java.util.List;
+
+public class IncomingMessageList {
+
+  @JsonProperty
+  @NotNull
+  @Valid
+  private List<IncomingMessage> messages;
+
+  @JsonProperty
+  private long timestamp;
+
+  @JsonProperty
+  private boolean online;
+
+  public IncomingMessageList() {}
+
+  public List<IncomingMessage> getMessages() {
+    return messages;
+  }
+
+  public long getTimestamp() {
+    return timestamp;
+  }
+
+  public boolean isOnline() {
+    return online;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/IncomingWebsocketMessage.java

@@ -0,0 +1,25 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class IncomingWebsocketMessage {
+
+  public static final int TYPE_ACKNOWLEDGE_MESSAGE = 1;
+  public static final int TYPE_PING_MESSAGE        = 2;
+  public static final int TYPE_PONG_MESSAGE        = 3;
+
+  @JsonProperty
+  protected int type;
+
+  public IncomingWebsocketMessage() {}
+
+  public IncomingWebsocketMessage(int type) {
+    this.type = type;
+  }
+
+  public int getType() {
+    return type;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/MessageResponse.java

@@ -0,0 +1,66 @@
+/**
+ * Copyright (C) 2013 Open WhisperSystems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+
+public class MessageResponse {
+  private List<String> success;
+  private List<String> failure;
+  private Set<String>  missingDeviceIds;
+
+  public MessageResponse(List<String> success, List<String> failure) {
+    this.success          = success;
+    this.failure          = failure;
+    this.missingDeviceIds = new HashSet<>();
+  }
+
+  public MessageResponse(Set<String> missingDeviceIds) {
+    this.success          = new LinkedList<>();
+    this.failure          = new LinkedList<>(missingDeviceIds);
+    this.missingDeviceIds = missingDeviceIds;
+  }
+
+  public MessageResponse() {}
+
+  public List<String> getSuccess() {
+    return success;
+  }
+
+  public void setSuccess(List<String> success) {
+    this.success = success;
+  }
+
+  public List<String> getFailure() {
+    return failure;
+  }
+
+  public void setFailure(List<String> failure) {
+    this.failure = failure;
+  }
+
+  public Set<String> getNumbersMissingDevices() {
+    return missingDeviceIds;
+  }
+
+  public void setNumbersMissingDevices(Set<String> numbersMissingDevices) {
+    this.missingDeviceIds = numbersMissingDevices;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/MismatchedDevices.java

@@ -0,0 +1,24 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+import java.util.List;
+
+public class MismatchedDevices {
+
+  @JsonProperty
+  public List<Long> missingDevices;
+
+  @JsonProperty
+  public List<Long> extraDevices;
+
+  @VisibleForTesting
+  public MismatchedDevices() {}
+
+  public MismatchedDevices(List<Long> missingDevices, List<Long> extraDevices) {
+    this.missingDevices = missingDevices;
+    this.extraDevices   = extraDevices;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/OutgoingMessageEntity.java

@@ -0,0 +1,109 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.UUID;
+
+public class OutgoingMessageEntity {
+
+  @JsonIgnore
+  private long id;
+
+  @JsonIgnore
+  private boolean cached;
+
+  @JsonProperty
+  private UUID guid;
+
+  @JsonProperty
+  private int type;
+
+  @JsonProperty
+  private String relay;
+
+  @JsonProperty
+  private long timestamp;
+
+  @JsonProperty
+  private String source;
+
+  @JsonProperty
+  private int sourceDevice;
+
+  @JsonProperty
+  private byte[] message;
+
+  @JsonProperty
+  private byte[] content;
+
+  @JsonProperty
+  private long serverTimestamp;
+
+  public OutgoingMessageEntity() {}
+
+  public OutgoingMessageEntity(long id, boolean cached,
+                               UUID guid, int type, String relay, long timestamp,
+                               String source, int sourceDevice, byte[] message,
+                               byte[] content, long serverTimestamp)
+  {
+    this.id              = id;
+    this.cached          = cached;
+    this.guid            = guid;
+    this.type            = type;
+    this.relay           = relay;
+    this.timestamp       = timestamp;
+    this.source          = source;
+    this.sourceDevice    = sourceDevice;
+    this.message         = message;
+    this.content         = content;
+    this.serverTimestamp = serverTimestamp;
+  }
+
+  public UUID getGuid() {
+    return guid;
+  }
+
+  public int getType() {
+    return type;
+  }
+
+  public String getRelay() {
+    return relay;
+  }
+
+  public long getTimestamp() {
+    return timestamp;
+  }
+
+  public String getSource() {
+    return source;
+  }
+
+  public int getSourceDevice() {
+    return sourceDevice;
+  }
+
+  public byte[] getMessage() {
+    return message;
+  }
+
+  public byte[] getContent() {
+    return content;
+  }
+
+  @JsonIgnore
+  public long getId() {
+    return id;
+  }
+
+  @JsonIgnore
+  public boolean isCached() {
+    return cached;
+  }
+
+  public long getServerTimestamp() {
+    return serverTimestamp;
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/OutgoingMessageEntityList.java

@@ -0,0 +1,30 @@
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+import java.util.List;
+
+public class OutgoingMessageEntityList {
+
+  @JsonProperty
+  private List<OutgoingMessageEntity> messages;
+
+  @JsonProperty
+  private boolean more;
+
+  public OutgoingMessageEntityList() {}
+
+  public OutgoingMessageEntityList(List<OutgoingMessageEntity> messages, boolean more) {
+    this.messages = messages;
+    this.more     = more;
+  }
+
+  public List<OutgoingMessageEntity> getMessages() {
+    return messages;
+  }
+
+  public boolean hasMore() {
+    return more;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/PreKey.java

@@ -0,0 +1,80 @@
+package org.whispersystems.textsecuregcm.entities;
+
+/**
+ * Copyright (C) 2014 Open Whisper Systems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.hibernate.validator.constraints.NotEmpty;
+
+import javax.validation.constraints.NotNull;
+
+public class PreKey {
+
+  @JsonProperty
+  @NotNull
+  private long    keyId;
+
+  @JsonProperty
+  @NotEmpty
+  private String  publicKey;
+
+  public PreKey() {}
+
+  public PreKey(long keyId, String publicKey)
+  {
+    this.keyId     = keyId;
+    this.publicKey = publicKey;
+  }
+
+  public String getPublicKey() {
+    return publicKey;
+  }
+
+  public void setPublicKey(String publicKey) {
+    this.publicKey = publicKey;
+  }
+
+  public long getKeyId() {
+    return keyId;
+  }
+
+  public void setKeyId(long keyId) {
+    this.keyId = keyId;
+  }
+
+  @Override
+  public boolean equals(Object object) {
+    if (object == null || !(object instanceof PreKey)) return false;
+    PreKey that = (PreKey)object;
+
+    if (publicKey == null) {
+      return this.keyId == that.keyId && that.publicKey == null;
+    } else {
+      return this.keyId == that.keyId && this.publicKey.equals(that.publicKey);
+    }
+  }
+
+  @Override
+  public int hashCode() {
+    if (publicKey == null) {
+      return (int)this.keyId;
+    } else {
+      return ((int)this.keyId) ^ publicKey.hashCode();
+    }
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/PreKeyCount.java

@@ -0,0 +1,20 @@
+package org.whispersystems.textsecuregcm.entities;
+
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class PreKeyCount {
+
+  @JsonProperty
+  private int count;
+
+  public PreKeyCount(int count) {
+    this.count = count;
+  }
+
+  public PreKeyCount() {}
+
+  public int getCount() {
+    return count;
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/PreKeyResponse.java

@@ -0,0 +1,61 @@
+/**
+ * Copyright (C) 2014 Open Whisper Systems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+import java.util.List;
+
+public class PreKeyResponse {
+
+  @JsonProperty
+  private String identityKey;
+
+  @JsonProperty
+  private List<PreKeyResponseItem> devices;
+
+  public PreKeyResponse() {}
+
+  public PreKeyResponse(String identityKey, List<PreKeyResponseItem> devices) {
+    this.identityKey = identityKey;
+    this.devices     = devices;
+  }
+
+  @VisibleForTesting
+  public String getIdentityKey() {
+    return identityKey;
+  }
+
+  @VisibleForTesting
+  @JsonIgnore
+  public PreKeyResponseItem getDevice(int deviceId) {
+    for (PreKeyResponseItem device : devices) {
+      if (device.getDeviceId() == deviceId) return device;
+    }
+
+    return null;
+  }
+
+  @VisibleForTesting
+  @JsonIgnore
+  public int getDevicesCount() {
+    return devices.size();
+  }
+
+}

service/src/main/java/org/whispersystems/textsecuregcm/entities/PreKeyResponseItem.java

@@ -0,0 +1,64 @@
+/**
+ * Copyright (C) 2014 Open Whisper Systems
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.whispersystems.textsecuregcm.entities;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.google.common.annotations.VisibleForTesting;
+
+public class PreKeyResponseItem {
+
+  @JsonProperty
+  private long deviceId;
+
+  @JsonProperty
+  private int registrationId;
+
+  @JsonProperty
+  private SignedPreKey signedPreKey;
+
+  @JsonProperty
+  private PreKey preKey;
+
+  public PreKeyResponseItem() {}
+
+  public PreKeyResponseItem(long deviceId, int registrationId, SignedPreKey signedPreKey, PreKey preKey) {
+    this.deviceId       = deviceId;
+    this.registrationId = registrationId;
+    this.signedPreKey   = signedPreKey;
+    this.preKey         = preKey;
+  }
+
+  @VisibleForTesting
+  public SignedPreKey getSignedPreKey() {
+    return signedPreKey;
+  }
+
+  @VisibleForTesting
+  public PreKey getPreKey() {
+    return preKey;
+  }
+
+  @VisibleForTesting
+  public int getRegistrationId() {
+    return registrationId;
+  }
+
+  @VisibleForTesting
+  public long getDeviceId() {
+    return deviceId;
+  }
+}