Add Server-Side Download Queue (#21)

* test add queueing to file service

* further adjustments to download queueing

* add check for whether the request is still in the queue to CheckQueue

* forcefully release slot if download didn't finish in 15s

* actually cancel the delay task

* add metrics and refactor some of the request queue service

* refactor pathing

* reuse httpclient

* add queue request dto to requestfile, enqueue users immediately if a slot is available

* change startup to include all controllers

* update server pathing

* update pathing, again

* several adjustments to auth, banning, jwt server tokens, renaming, authorization

* update api I guess

* adjust automated banning of charaident and reg

* generate jwt on servers for internal authentication

* remove mvcextensions

Co-authored-by: rootdarkarchon <root.darkarchon@outlook.com>

MareSynchronosServer/MareSynchronosStaticFilesServer/Controllers/CacheController.cs

@@ -0,0 +1,42 @@
+using MareSynchronos.API;
+using MareSynchronosShared.Utils;
+using MareSynchronosStaticFilesServer.Services;
+using MareSynchronosStaticFilesServer.Utils;
+using Microsoft.AspNetCore.Mvc;
+
+namespace MareSynchronosStaticFilesServer.Controllers;
+
+[Route(MareFiles.Cache)]
+public class CacheController : ControllerBase
+{
+    private readonly RequestFileStreamResultFactory _requestFileStreamResultFactory;
+    private readonly CachedFileProvider _cachedFileProvider;
+    private readonly RequestQueueService _requestQueue;
+
+    public CacheController(ILogger<CacheController> logger, RequestFileStreamResultFactory requestFileStreamResultFactory,
+        CachedFileProvider cachedFileProvider, RequestQueueService requestQueue, ServerTokenGenerator generator) : base(logger, generator)
+    {
+        _requestFileStreamResultFactory = requestFileStreamResultFactory;
+        _cachedFileProvider = cachedFileProvider;
+        _requestQueue = requestQueue;
+    }
+
+    [HttpGet(MareFiles.Cache_Get)]
+    public async Task<IActionResult> GetFile(Guid requestId)
+    {
+        _logger.LogDebug($"GetFile:{MareUser}:{requestId}");
+
+        if (!_requestQueue.IsActiveProcessing(requestId, MareUser, out var request)) return BadRequest();
+
+        _requestQueue.ActivateRequest(requestId);
+
+        var fs = await _cachedFileProvider.GetAndDownloadFileStream(request.FileId, Authorization);
+        if (fs == null)
+        {
+            _requestQueue.FinishRequest(requestId);
+            return NotFound();
+        }
+
+        return _requestFileStreamResultFactory.Create(requestId, fs);
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Controllers/ControllerBase.cs

@@ -0,0 +1,19 @@
+using MareSynchronosShared.Utils;
+using Microsoft.AspNetCore.Mvc;
+
+namespace MareSynchronosStaticFilesServer.Controllers;
+
+public class ControllerBase : Controller
+{
+    protected ILogger _logger;
+    private readonly ServerTokenGenerator _generator;
+
+    public ControllerBase(ILogger logger, ServerTokenGenerator generator)
+    {
+        _logger = logger;
+        _generator = generator;
+    }
+
+    protected string MareUser => HttpContext.User.Claims.First(f => string.Equals(f.Type, MareClaimTypes.Uid, StringComparison.Ordinal)).Value;
+    protected string Authorization => "Bearer " + _generator.Token;
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Controllers/RequestController.cs

@@ -0,0 +1,54 @@
+using MareSynchronos.API;
+using MareSynchronosShared.Utils;
+using MareSynchronosStaticFilesServer.Services;
+using Microsoft.AspNetCore.Mvc;
+using System.Text.Json;
+
+namespace MareSynchronosStaticFilesServer.Controllers;
+
+[Route(MareFiles.Request)]
+public class RequestController : ControllerBase
+{
+    private readonly CachedFileProvider _cachedFileProvider;
+    private readonly RequestQueueService _requestQueue;
+
+    public RequestController(ILogger<RequestController> logger, CachedFileProvider cachedFileProvider, RequestQueueService requestQueue, 
+        ServerTokenGenerator generator) : base(logger, generator)
+    {
+        _cachedFileProvider = cachedFileProvider;
+        _requestQueue = requestQueue;
+    }
+
+    [HttpPost]
+    [Route(MareFiles.Request_Enqueue)]
+    public IActionResult PreRequestFiles([FromBody] List<string> files)
+    {
+        foreach (var file in files)
+        {
+            _cachedFileProvider.DownloadFileWhenRequired(file, Authorization);
+        }
+
+        return Ok();
+    }
+
+    [HttpGet]
+    [Route(MareFiles.Request_RequestFile)]
+    public async Task<IActionResult> RequestFile(string file)
+    {
+        Guid g = Guid.NewGuid();
+        _cachedFileProvider.DownloadFileWhenRequired(file, Authorization);
+        var queueStatus = await _requestQueue.EnqueueUser(new(g, MareUser, file));
+        return Ok(JsonSerializer.Serialize(new QueueRequestDto(g, queueStatus)));
+    }
+
+    [HttpGet]
+    [Route(MareFiles.Request_CheckQueue)]
+    public IActionResult CheckQueue(Guid requestId)
+    {
+        if (_requestQueue.IsActiveProcessing(requestId, MareUser, out _)) return Ok();
+
+        if (_requestQueue.StillEnqueued(requestId, MareUser, out int position)) return Conflict(position);
+
+        return BadRequest();
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Controllers/ServerFilesController.cs

@@ -0,0 +1,30 @@
+using MareSynchronos.API;
+using MareSynchronosShared.Utils;
+using MareSynchronosStaticFilesServer.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace MareSynchronosStaticFilesServer.Controllers;
+
+[Route(MareFiles.ServerFiles)]
+public class ServerFilesController : ControllerBase
+{
+    private readonly CachedFileProvider _cachedFileProvider;
+
+    public ServerFilesController(ILogger<ServerFilesController> logger, CachedFileProvider cachedFileProvider, ServerTokenGenerator generator) : base(logger, generator)
+    {
+        _cachedFileProvider = cachedFileProvider;
+    }
+
+    [HttpGet(MareFiles.ServerFiles_Get + "/{fileId}")]
+    [Authorize(Policy = "Internal")]
+    public async Task<IActionResult> GetFile(string fileId)
+    {
+        _logger.LogInformation($"GetFile:{MareUser}:{fileId}");
+
+        var fs = _cachedFileProvider.GetLocalFileStream(fileId);
+        if (fs == null) return NotFound();
+
+        return File(fs, "application/octet-stream");
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/FilesController.cs

@@ -1,29 +0,0 @@
-using MareSynchronosShared.Utils;
-using Microsoft.AspNetCore.Mvc;
-
-namespace MareSynchronosStaticFilesServer;
-
-[Route("/cache")]
-public class FilesController : Controller
-{
-    private readonly ILogger<FilesController> _logger;
-    private readonly CachedFileProvider _cachedFileProvider;
-
-    public FilesController(ILogger<FilesController> logger, CachedFileProvider cachedFileProvider)
-    {
-        _logger = logger;
-        _cachedFileProvider = cachedFileProvider;
-    }
-
-    [HttpGet("{fileId}")]
-    public async Task<IActionResult> GetFile(string fileId)
-    {
-        var authedUser = HttpContext.User.Claims.FirstOrDefault(f => string.Equals(f.Type, MareClaimTypes.Uid, StringComparison.Ordinal))?.Value ?? "Unknown";
-        _logger.LogInformation($"GetFile:{authedUser}:{fileId}");
-
-        var fs = await _cachedFileProvider.GetFileStream(fileId, Request.Headers["Authorization"]);
-        if (fs == null) return NotFound();
-
-        return File(fs, "application/octet-stream");
-    }
-}

MareSynchronosServer/MareSynchronosStaticFilesServer/MareSynchronosStaticFilesServer.csproj

@@ -30,6 +30,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <ProjectReference Include="..\..\MareAPI\MareSynchronosAPI\MareSynchronos.API.csproj" />
     <ProjectReference Include="..\MareSynchronosShared\MareSynchronosShared.csproj" />
   </ItemGroup>
 

MareSynchronosServer/MareSynchronosStaticFilesServer/Program.cs

@@ -1,6 +1,5 @@
 using MareSynchronosShared.Services;
 using MareSynchronosShared.Utils;
-using Microsoft.Extensions.Options;
 
 namespace MareSynchronosStaticFilesServer;
 

MareSynchronosServer/MareSynchronosStaticFilesServer/Services/CachedFileProvider.cs

@@ -1,9 +1,11 @@
 using MareSynchronosShared.Metrics;
 using MareSynchronosShared.Services;
-using Microsoft.Extensions.Options;
+using MareSynchronosStaticFilesServer.Utils;
 using System.Collections.Concurrent;
+using System.Net.Http.Headers;
+using MareSynchronos.API;
 
-namespace MareSynchronosStaticFilesServer;
+namespace MareSynchronosStaticFilesServer.Services;
 
 public class CachedFileProvider
 {
@@ -13,6 +15,7 @@ public class CachedFileProvider
     private readonly Uri _remoteCacheSourceUri;
     private readonly string _basePath;
     private readonly ConcurrentDictionary<string, Task> _currentTransfers = new(StringComparer.Ordinal);
+    private readonly HttpClient _httpClient;
     private bool IsMainServer => _remoteCacheSourceUri == null;
 
     public CachedFileProvider(IConfigurationService<StaticFilesServerConfiguration> configuration, ILogger<CachedFileProvider> logger, FileStatisticsService fileStatisticsService, MareMetrics metrics)
@@ -22,16 +25,18 @@ public class CachedFileProvider
         _metrics = metrics;
         _remoteCacheSourceUri = configuration.GetValueOrDefault<Uri>(nameof(StaticFilesServerConfiguration.RemoteCacheSourceUri), null);
         _basePath = configuration.GetValue<string>(nameof(StaticFilesServerConfiguration.CacheDirectory));
+        _httpClient = new HttpClient();
     }
 
     private async Task DownloadTask(string hash, string auth)
     {
         // download file from remote
-        var downloadUrl = new Uri(_remoteCacheSourceUri, hash);
+        var downloadUrl = MareFiles.ServerFilesGetFullPath(_remoteCacheSourceUri, hash);
         _logger.LogInformation("Did not find {hash}, downloading from {server}", hash, downloadUrl);
-        using var client = new HttpClient();
-        client.DefaultRequestHeaders.Add("Authorization", auth);
-        var response = await client.GetAsync(downloadUrl, HttpCompletionOption.ResponseHeadersRead).ConfigureAwait(false);
+
+        using var requestMessage = new HttpRequestMessage(HttpMethod.Get, downloadUrl);
+        requestMessage.Headers.Authorization = new AuthenticationHeaderValue(auth);
+        var response = await _httpClient.SendAsync(requestMessage).ConfigureAwait(false);
 
         try
         {
@@ -58,26 +63,40 @@ public class CachedFileProvider
         _metrics.IncGauge(MetricsAPI.GaugeFilesTotalSize, FilePathUtil.GetFileInfoForHash(_basePath, hash).Length);
     }
 
-    public async Task<FileStream?> GetFileStream(string hash, string auth)
+    public void DownloadFileWhenRequired(string hash, string auth)
     {
         var fi = FilePathUtil.GetFileInfoForHash(_basePath, hash);
-        if (fi == null && IsMainServer) return null;
+        if (fi == null && IsMainServer) return;
 
         if (fi == null && !_currentTransfers.ContainsKey(hash))
         {
-            _currentTransfers[hash] = DownloadTask(hash, auth).ContinueWith(r => _currentTransfers.Remove(hash, out _));
+            _currentTransfers[hash] = Task.Run(async () =>
+            {
+                await DownloadTask(hash, auth).ConfigureAwait(false);
+                _currentTransfers.Remove(hash, out _);
+            });
         }
+    }
 
-        if (_currentTransfers.TryGetValue(hash, out var downloadTask))
-        {
-            await downloadTask.ConfigureAwait(false);
-        }
-
-        fi = FilePathUtil.GetFileInfoForHash(_basePath, hash);
+    public FileStream? GetLocalFileStream(string hash)
+    {
+        var fi = FilePathUtil.GetFileInfoForHash(_basePath, hash);
         if (fi == null) return null;
 
         _fileStatisticsService.LogFile(hash, fi.Length);
 
         return new FileStream(fi.FullName, FileMode.Open, FileAccess.Read, FileShare.Inheritable | FileShare.Read);
     }
+
+    public async Task<FileStream?> GetAndDownloadFileStream(string hash, string auth)
+    {
+        DownloadFileWhenRequired(hash, auth);
+
+        if (_currentTransfers.TryGetValue(hash, out var downloadTask))
+        {
+            await downloadTask.ConfigureAwait(false);
+        }
+
+        return GetLocalFileStream(hash);
+    }
 }

MareSynchronosServer/MareSynchronosStaticFilesServer/Services/FileCleanupService.cs

@@ -3,9 +3,10 @@ using MareSynchronosShared.Data;
 using MareSynchronosShared.Metrics;
 using MareSynchronosShared.Models;
 using MareSynchronosShared.Services;
+using MareSynchronosStaticFilesServer.Utils;
 using Microsoft.EntityFrameworkCore;
 
-namespace MareSynchronosStaticFilesServer;
+namespace MareSynchronosStaticFilesServer.Services;
 
 public class FileCleanupService : IHostedService
 {
@@ -99,7 +100,7 @@ public class FileCleanupService : IHostedService
                 if (_isMainServer)
                 {
                     FileCache f = new() { Hash = oldestFile.Name.ToUpperInvariant() };
-                    dbContext.Entry(f).State = Microsoft.EntityFrameworkCore.EntityState.Deleted;
+                    dbContext.Entry(f).State = EntityState.Deleted;
                 }
             }
         }
@@ -113,8 +114,8 @@ public class FileCleanupService : IHostedService
     {
         try
         {
-            var unusedRetention = _configuration.GetValueOrDefault<int>(nameof(StaticFilesServerConfiguration.UnusedFileRetentionPeriodInDays), 14);
-            var forcedDeletionAfterHours = _configuration.GetValueOrDefault<int>(nameof(StaticFilesServerConfiguration.ForcedDeletionOfFilesAfterHours), -1);
+            var unusedRetention = _configuration.GetValueOrDefault(nameof(StaticFilesServerConfiguration.UnusedFileRetentionPeriodInDays), 14);
+            var forcedDeletionAfterHours = _configuration.GetValueOrDefault(nameof(StaticFilesServerConfiguration.ForcedDeletionOfFilesAfterHours), -1);
 
             _logger.LogInformation("Cleaning up files older than {filesOlderThanDays} days", unusedRetention);
             if (forcedDeletionAfterHours > 0)

MareSynchronosServer/MareSynchronosStaticFilesServer/Services/FileStatisticsService.cs

@@ -1,7 +1,7 @@
 using MareSynchronosShared.Metrics;
 using System.Collections.Concurrent;
 
-namespace MareSynchronosStaticFilesServer;
+namespace MareSynchronosStaticFilesServer.Services;
 
 public class FileStatisticsService : IHostedService
 {

MareSynchronosServer/MareSynchronosStaticFilesServer/Services/GrpcFileService.cs

@@ -3,10 +3,13 @@ using MareSynchronosShared.Data;
 using MareSynchronosShared.Metrics;
 using MareSynchronosShared.Protos;
 using MareSynchronosShared.Services;
+using MareSynchronosStaticFilesServer.Utils;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.EntityFrameworkCore;
 
-namespace MareSynchronosStaticFilesServer;
+namespace MareSynchronosStaticFilesServer.Services;
 
+[Authorize(Policy = "Internal")]
 public class GrpcFileService : FileService.FileServiceBase
 {
     private readonly string _basePath;
@@ -22,6 +25,7 @@ public class GrpcFileService : FileService.FileServiceBase
         _metricsClient = metricsClient;
     }
 
+    [Authorize(Policy = "Internal")]
     public override async Task<Empty> UploadFile(IAsyncStreamReader<UploadFileRequest> requestStream, ServerCallContext context)
     {
         _ = await requestStream.MoveNext().ConfigureAwait(false);
@@ -31,7 +35,6 @@ public class GrpcFileService : FileService.FileServiceBase
         var file = await _mareDbContext.Files.SingleOrDefaultAsync(f => f.Hash == uploadMsg.Hash && f.UploaderUID == uploadMsg.Uploader).ConfigureAwait(false);
         try
         {
-
             if (file != null)
             {
                 await fileWriter.WriteAsync(uploadMsg.FileData.ToArray()).ConfigureAwait(false);
@@ -71,6 +74,7 @@ public class GrpcFileService : FileService.FileServiceBase
         return new Empty();
     }
 
+    [Authorize(Policy = "Internal")]
     public override async Task<Empty> DeleteFiles(DeleteFilesRequest request, ServerCallContext context)
     {
         foreach (var hash in request.Hash)

MareSynchronosServer/MareSynchronosStaticFilesServer/Services/RequestQueueService.cs

@@ -0,0 +1,137 @@
+using MareSynchronos.API;
+using MareSynchronosShared.Metrics;
+using MareSynchronosShared.Services;
+using MareSynchronosStaticFilesServer.Utils;
+using System.Collections.Concurrent;
+
+namespace MareSynchronosStaticFilesServer.Services;
+
+public class RequestQueueService : IHostedService
+{
+    private CancellationTokenSource _queueCts = new();
+    private readonly UserQueueEntry[] _userQueueRequests;
+    private readonly ConcurrentQueue<UserRequest> _queue = new();
+    private readonly MareMetrics _metrics;
+    private readonly ILogger<RequestQueueService> _logger;
+    private readonly int _queueExpirationSeconds;
+    private SemaphoreSlim _queueSemaphore = new(1);
+    private SemaphoreSlim _queueProcessingSemaphore = new(1);
+
+    public RequestQueueService(MareMetrics metrics, IConfigurationService<StaticFilesServerConfiguration> configurationService, ILogger<RequestQueueService> logger)
+    {
+        _userQueueRequests = new UserQueueEntry[configurationService.GetValueOrDefault(nameof(StaticFilesServerConfiguration.DownloadQueueSize), 50)];
+        _queueExpirationSeconds = configurationService.GetValueOrDefault(nameof(StaticFilesServerConfiguration.DownloadTimeoutSeconds), 5);
+        _metrics = metrics;
+        _logger = logger;
+    }
+
+    public async Task<QueueStatus> EnqueueUser(UserRequest request)
+    {
+        _logger.LogDebug("Enqueueing req {guid} from {user} for {file}", request.RequestId, request.User, request.FileId);
+
+        if (_queueProcessingSemaphore.CurrentCount == 0)
+        {
+            _queue.Enqueue(request);
+            return QueueStatus.Waiting;
+        }
+
+        await _queueSemaphore.WaitAsync().ConfigureAwait(false);
+        QueueStatus status = QueueStatus.Waiting;
+        var idx = Array.FindIndex(_userQueueRequests, r => r == null);
+        if (idx == -1)
+        {
+            _queue.Enqueue(request);
+            status = QueueStatus.Waiting;
+        }
+        else
+        {
+            DequeueIntoSlot(request, idx);
+            status = QueueStatus.Ready;
+        }
+        _queueSemaphore.Release();
+
+        return status;
+    }
+
+    public bool StillEnqueued(Guid request, string user, out int queuePosition)
+    {
+        var result = _queue.FirstOrDefault(c => c.RequestId == request && string.Equals(c.User, user, StringComparison.Ordinal));
+        if (result != null)
+        {
+            queuePosition = Array.IndexOf(_queue.ToArray(), result);
+            return true;
+        }
+
+        queuePosition = -1;
+        return false;
+    }
+
+    public bool IsActiveProcessing(Guid request, string user, out UserRequest userRequest)
+    {
+        var userQueueRequest = _userQueueRequests.Where(u => u != null)
+            .FirstOrDefault(f => f.UserRequest.RequestId == request && string.Equals(f.UserRequest.User, user, StringComparison.Ordinal));
+        userRequest = userQueueRequest?.UserRequest ?? null;
+        return userQueueRequest != null && userRequest != null && userQueueRequest.ExpirationDate > DateTime.UtcNow;
+    }
+
+    public void FinishRequest(Guid request)
+    {
+        var req = _userQueueRequests.First(f => f.UserRequest.RequestId == request);
+        var idx = Array.IndexOf(_userQueueRequests, req);
+        _logger.LogDebug("Finishing Request {guid}, clearing slot {idx}", request, idx);
+        _userQueueRequests[idx] = null;
+    }
+
+    public void ActivateRequest(Guid request)
+    {
+        _logger.LogDebug("Activating request {guid}", request);
+        _userQueueRequests.First(f => f.UserRequest.RequestId == request).IsActive = true;
+    }
+
+    private async Task ProcessRequestQueue(CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            await _queueProcessingSemaphore.WaitAsync(ct).ConfigureAwait(false);
+            await _queueSemaphore.WaitAsync(ct).ConfigureAwait(false);
+            for (int i = 0; i < _userQueueRequests.Length; i++)
+            {
+                if (_userQueueRequests[i] != null && !_userQueueRequests[i].IsActive && _userQueueRequests[i].ExpirationDate < DateTime.UtcNow) _userQueueRequests[i] = null;
+
+                if (_userQueueRequests[i] == null)
+                {
+                    if (_queue.TryDequeue(out var request))
+                    {
+                        DequeueIntoSlot(request, i);
+                    }
+                }
+
+                if (!_queue.Any()) break;
+            }
+            _queueProcessingSemaphore.Release();
+            _queueSemaphore.Release();
+
+            _metrics.SetGaugeTo(MetricsAPI.GaugeDownloadQueue, _queue.Count);
+
+            await Task.Delay(250).ConfigureAwait(false);
+        }
+    }
+
+    private void DequeueIntoSlot(UserRequest userRequest, int slot)
+    {
+        _logger.LogDebug("Dequeueing {req} into {i}: {user} with {file}", userRequest.RequestId, slot, userRequest.User, userRequest.FileId);
+        _userQueueRequests[slot] = new(userRequest, DateTime.UtcNow.AddSeconds(_queueExpirationSeconds));
+    }
+
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        _ = Task.Run(() => ProcessRequestQueue(_queueCts.Token));
+        return Task.CompletedTask;
+    }
+
+    public Task StopAsync(CancellationToken cancellationToken)
+    {
+        _queueCts.Cancel();
+        return Task.CompletedTask;
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Startup.cs

@@ -5,6 +5,8 @@ using MareSynchronosShared.Metrics;
 using MareSynchronosShared.Protos;
 using MareSynchronosShared.Services;
 using MareSynchronosShared.Utils;
+using MareSynchronosStaticFilesServer.Services;
+using MareSynchronosStaticFilesServer.Utils;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
@@ -41,8 +43,6 @@ public class Startup
 
         var mareConfig = Configuration.GetRequiredSection("MareSynchronos");
 
-        services.AddControllers();
-
         services.AddSingleton(m => new MareMetrics(m.GetService<ILogger<MareMetrics>>(), new List<string>
         {
         }, new List<string>
@@ -52,10 +52,13 @@ public class Startup
             MetricsAPI.GaugeFilesUniquePastDay,
             MetricsAPI.GaugeFilesUniquePastDaySize,
             MetricsAPI.GaugeFilesUniquePastHour,
-            MetricsAPI.GaugeFilesUniquePastHourSize
+            MetricsAPI.GaugeFilesUniquePastHourSize,
+            MetricsAPI.GaugeCurrentDownloads,
+            MetricsAPI.GaugeDownloadQueue,
         }));
         services.AddSingleton<CachedFileProvider>();
         services.AddSingleton<FileStatisticsService>();
+        services.AddSingleton<RequestFileStreamResultFactory>();
 
         services.AddHostedService(m => m.GetService<FileStatisticsService>());
         services.AddHostedService<FileCleanupService>();
@@ -119,7 +122,11 @@ public class Startup
             o.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
         }).AddJwtBearer();
 
-        services.AddAuthorization(options => options.FallbackPolicy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build());
+        services.AddAuthorization(options =>
+        {
+            options.FallbackPolicy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();
+            options.AddPolicy("Internal", new AuthorizationPolicyBuilder().RequireClaim(MareClaimTypes.Internal, "true").Build());
+        });
 
         if (_isMain)
         {
@@ -148,9 +155,15 @@ public class Startup
                 p.GetRequiredService<GrpcClientFactory>(), "MainServer")
         );
 
+        services.AddSingleton<ServerTokenGenerator>();
+        services.AddSingleton<RequestQueueService>();
+        services.AddHostedService(p => p.GetService<RequestQueueService>());
+        services.AddControllers();
+
         services.AddHostedService(p => (MareConfigurationServiceClient<MareConfigurationAuthBase>)p.GetService<IConfigurationService<MareConfigurationAuthBase>>());
 
         services.AddHealthChecks();
+        services.AddControllers();
     }
 
     public void Configure(IApplicationBuilder app, IWebHostEnvironment env)

MareSynchronosServer/MareSynchronosStaticFilesServer/Utils/FilePathUtil.cs

@@ -1,8 +1,8 @@
-namespace MareSynchronosStaticFilesServer;
+namespace MareSynchronosStaticFilesServer.Utils;
 
 public static class FilePathUtil
 {
-    public static FileInfo? GetFileInfoForHash(string basePath, string hash)
+    public static FileInfo GetFileInfoForHash(string basePath, string hash)
     {
         FileInfo fi = new(Path.Combine(basePath, hash[0].ToString(), hash));
         if (!fi.Exists)

MareSynchronosServer/MareSynchronosStaticFilesServer/Utils/RequestFileStreamResult.cs

@@ -0,0 +1,59 @@
+using MareSynchronosShared.Metrics;
+using MareSynchronosStaticFilesServer.Services;
+using Microsoft.AspNetCore.Mvc;
+
+namespace MareSynchronosStaticFilesServer.Utils;
+
+public class RequestFileStreamResult : FileStreamResult
+{
+    private readonly Guid _requestId;
+    private readonly RequestQueueService _requestQueueService;
+    private readonly MareMetrics _mareMetrics;
+    private readonly CancellationTokenSource _releaseCts = new();
+    private bool _releasedSlot = false;
+
+    public RequestFileStreamResult(Guid requestId, int secondsUntilRelease, RequestQueueService requestQueueService,
+        MareMetrics mareMetrics, Stream fileStream, string contentType) : base(fileStream, contentType)
+    {
+        _requestId = requestId;
+        _requestQueueService = requestQueueService;
+        _mareMetrics = mareMetrics;
+        _mareMetrics.IncGauge(MetricsAPI.GaugeCurrentDownloads);
+
+        // forcefully release slot after secondsUntilRelease
+        Task.Run(async () =>
+        {
+            try
+            {
+                await Task.Delay(TimeSpan.FromSeconds(secondsUntilRelease), _releaseCts.Token).ConfigureAwait(false);
+                _requestQueueService.FinishRequest(_requestId);
+                _releasedSlot = true;
+            }
+            catch { }
+        });
+    }
+
+    public override void ExecuteResult(ActionContext context)
+    {
+        base.ExecuteResult(context);
+
+        _releaseCts.Cancel();
+
+        if (!_releasedSlot)
+            _requestQueueService.FinishRequest(_requestId);
+
+        _mareMetrics.DecGauge(MetricsAPI.GaugeCurrentDownloads);
+    }
+
+    public override async Task ExecuteResultAsync(ActionContext context)
+    {
+        await base.ExecuteResultAsync(context).ConfigureAwait(false);
+
+        _releaseCts.Cancel();
+
+        if (!_releasedSlot)
+            _requestQueueService.FinishRequest(_requestId);
+
+        _mareMetrics.DecGauge(MetricsAPI.GaugeCurrentDownloads);
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Utils/RequestFileStreamResultFactory.cs

@@ -0,0 +1,25 @@
+using MareSynchronosShared.Metrics;
+using MareSynchronosShared.Services;
+using MareSynchronosStaticFilesServer.Services;
+
+namespace MareSynchronosStaticFilesServer.Utils;
+
+public class RequestFileStreamResultFactory
+{
+    private readonly MareMetrics _metrics;
+    private readonly RequestQueueService _requestQueueService;
+    private readonly IConfigurationService<StaticFilesServerConfiguration> _configurationService;
+
+    public RequestFileStreamResultFactory(MareMetrics metrics, RequestQueueService requestQueueService, IConfigurationService<StaticFilesServerConfiguration> configurationService)
+    {
+        _metrics = metrics;
+        _requestQueueService = requestQueueService;
+        _configurationService = configurationService;
+    }
+
+    public RequestFileStreamResult Create(Guid requestId, FileStream fs)
+    {
+        return new RequestFileStreamResult(requestId, _configurationService.GetValueOrDefault(nameof(StaticFilesServerConfiguration.DownloadQueueReleaseSeconds), 15),
+            _requestQueueService, _metrics, fs, "application/octet-stream");
+    }
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Utils/UserQueueEntry.cs

@@ -0,0 +1,6 @@
+namespace MareSynchronosStaticFilesServer.Utils;
+
+public record UserQueueEntry(UserRequest UserRequest, DateTime ExpirationDate)
+{
+    public bool IsActive { get; set; } = false;
+}

MareSynchronosServer/MareSynchronosStaticFilesServer/Utils/UserRequest.cs

@@ -0,0 +1,3 @@
+namespace MareSynchronosStaticFilesServer.Utils;
+
+public record UserRequest(Guid RequestId, string User, string FileId);