[#5861] refresh the old collections in the UI import page on successful import submission

.github/SECURITY.md

@@ -1,128 +1,5 @@
 # Security
 
-**Keep in mind that PocketBase is a non-commercial open source project, maintained entirely on volunteer basis (there is no company or dedicated team behind it), and there are no bounties!**
+If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
 
-If you want to responsibly report a security issue you'll have to reach out as a human to **support at pocketbase.io**.
-
-This means:
-- no overconfident and arrogant tone
-- no threatening deadlines
-- no requirement for me to login in your security platform just to read the report
-- no inflated severity (we can discuss the CVSS score after confirming the issue)
-- no LLMs usage as part of your report description or followup communication
-
-Reports that don't follow the above will NOT be reviewed no matter of their validity _(you are of course free to publish whatever you want; see also [#7718](https://github.com/pocketbase/pocketbase/discussions/7718))_.
-
-**Or in other words - a simple _"Hey I think I found a security issue when I do X"_ is enough.**
-
-I try to be as responsive as possible and usually address security issues within couple days but if you didn't receive a reply from me for more than a week it is very likely that your email was flagged and in that case please open a GitHub issue or discussion just mentioning that you found a vulnerability and want to report it so that I can see the notification and will try to contact you for more details.
-
-In case the vulnerability is confirmed:
-
-- I'll start working on a local fix.
-- Once the fix is implemented locally, I'll publish a pre-announcement with a scheduled release date _(and when possible an approximate release time)_.
-- After the release, I'll publish a GitHub security advisory and CVE with remediation steps and **minimal** details regarding the found exploit _(you are free to publish PoC and more details in your own blog, gist, etc. but it is advised to wait at least a week after the release to allow enough time for people to patch their instances before making it more publicly known)_.
-
-### Below is a short list of previous reports that are NOT considered security issues:
-
-<details>
-<summary><strong>Stored XSS</strong></summary>
-
-This was discussed several times, both privately and [publicly](https://github.com/pocketbase/pocketbase/discussions/6694), but I remain on the opinion that it should be handled primarily on the client-side.
-
-Modern browsers recently introduced a basic [`Sanitizer` interface](https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer) that could help filtering HTML strings without external libraries.
-
-Having also a default [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) either as meta tag or response header is always a good idea to minimize the risk of XSS.
-</details>
-
-<details>
-<summary><strong>SQL injection in low level DB methods like <code>app.DeleteTable(dangerousName)</code></strong></summary>
-
-This is working correctly and it is not an issue but it is a common report most likely found by LLM or some other automated tools that may have stumbled on the [NB! code comments](https://pkg.go.dev/github.com/pocketbase/pocketbase@master/core#BaseApp.DeleteTable).
-
-Raw SQL statements, table and column names are not parameterized and they are vulnerable to SQL injection if used with untrusted input. The documentation as seen above already warns against it. In recent PocketBase releases, many of the arguments of these methods were also prefixed with `dangerous*` to make it even more clear that they should be used with caution.
-</details>
-
-<details>
-<summary><strong>Race conditions</strong></summary>
-
-To avoid DB locks PocketBase deliberately tries to minimize the use of DB transactions.
-This means that operations like record update don't wrap out of the box for example the `SELECT` and `UPDATE` SQL statements in a single transaction, and this can technically lead to a race condition if multiple users edit the same record.
-
-This is an accepted tradeoff and for the majority of cases it has no security implications.
-
-This also apply for the read and delete of MFA and OTP records but for those cases, since they operate in a security sensitive context, they have an extra short-lived duration that is configurable from the collection settings _(there are also system cron jobs that takes care for deleting forgotten/expired entries to prevent accumulation of invalid records)_.
-
-For the cases where transactions are really needed, users can utilize the [Batch Web API](https://pocketbase.io/docs/api-records/#batch-createupdateupsertdelete-records) or [create a transaction programmatically](https://pocketbase.io/docs/go-records/#transaction) _(with PocketBase v0.23+ it is also possible to wrap an entire hook chain in a single transaction)_.
-</details>
-
-<details>
-<summary><strong>List/Search side-channel attacks</strong></summary>
-
-Over the years we've implemented several extra checks to minimize the risk of List/Search side-channel attacks (see especially [v0.32.0](https://github.com/pocketbase/pocketbase/blob/master/CHANGELOG.md#v0320)) but users need to be aware that all client-side filtered fields are technically subject to timing attacks _(whether they are practical or not is a different topic)_.
-
-This is by design and it is accepted tradeoff between performance, security and usability.
-
-If you are concerned about timing attacks and have security sensitive collection data such as `secret`, `code`, `token`, etc. then the general recommendation is to mark their related fields as "Hidden" in order to disallow use in client-side filters.
-</details>
-
-<details>
-<summary><strong>Connecting to a vulnerable OAuth2 provider</strong></summary>
-
-Because PocketBase v0.23+ supports automatically uploading the OAuth2 avatar on user create _(need to be specified from the auth collection OAuth2 fields mapping)_ some security researchers raised a concern regarding a Blind SSRF but this implies that an attacker controls the OAuth2 vendor and this is a very serious assumption in the first place.
-
-The entire OAuth2 flow relies that the application server (PocketBase) trusts the configured OAuth2 vendor.
-If you suspect that an OAuth2 vendor is malicious and cannot be trusted then you MUST NOT use that OAuth2 vendor at all and you should report it.
-
-If someone is able to tamper with the OAuth2 responses then the entire OAuth2 flow can be thrown out of the window because they will be practically able to authenticate as any of your existing users and the eventual avatar URL probing request is the least of your problem.
-
-~Nonetheless, in future PocketBase releases there will be [extra `localhost` domain like checks](https://github.com/orgs/pocketbase/projects/2/views/1?pane=issue&itemId=159545722) when assigning the OAuth2 avatar URL to a `file` field that will further minimize the risk of internal network probing requests in case of a vulnerable OAuth2 provider.~ _Done._
-</details>
-
-<details>
-<summary><strong>Users enumeration</strong></summary>
-
-This is a common and usually valid report but there is no easy solution without confusing and degrading the users experience.
-
-Some endpoints, like the user create/register, can be used for usernames or emails enumeration based on various response heuristics - timing, specific error messages, etc.
-
-In many places where applicable we've tried to minimize the impact by using constant time checks, returning non-descriptive error messages, applying an internal rate limit for some operations, etc. but it is not bulletproof and if somebody wants to find out if a user is registered they will be able to do it one way or another.
-
-If you think that there is a place where we can improve the handling without hurting too much the user experience, feel free to open a regular public issue and it will be considered.
-</details>
-
-<details>
-<summary><strong>Attack-vectors relying on social engineering</strong></summary>
-
-Reports for attacks relying on various social engineering tactics _(e.g. tricking someone to click on a link)_ are valid concerns but usually out of the security scope of the project as there are a lot of cases where the APIs are deliberately designed for minimal friction.
-
-If you have concerns for such attack, feel free to open a regular public issue and we can eventually try to reconsider adding extra guards when feasible _(or at least properly document the existing behavior)_.
-</details>
-
-<details>
-<summary><strong><code>disintegration/imaging</code> CVE-2023-36308</strong></summary>
-
-Just for the past month, due to some corporate security scanners 5 different people raised concerns over [CVE-2023-36308](https://nvd.nist.gov/vuln/detail/CVE-2023-36308) but this is not really a vulnerability, especially not in PocketBase.
-
-[`disintegration/imaging`](https://github.com/disintegration/imaging) is a direct PocketBase dependency responsible for the thumbs generation.
-
-First, a panic (similar to exception in other languages) is NOT a security issue and Go programs usually have to be written defensively with that in mind. In PocketBase specifically all routes have auto panic-recover handling, no matter what the source of the panic is, so the worst case scenario would be an HTTP error response when attempting to access the thumb.
-
-Second, the related issue that the CVE describes is probably caused by a bug in an outdated `golang.org/x/image` dependency listed in the `go.mod` of that package but PocketBase uses a newer patched version of it that is expected to take precedence.
-
-Third, even if that issue is still available, with PocketBase it would have been triggerable ONLY if we supported TIFF thumbs generation but we don't. The supported thumbs formats at the moment are JPG, PNG, GIF (its first frame) and partially WebP (stored as PNG). All other images are served as it is, without any transformation.
-
-In the future I may consider eventually replacing the library because it is no longer actively maintained but as of now it is working correctly and as expected for our use case and you can safely flag the security warning as false-positive.
-</details>
-
-<details>
-<summary><strong>JSVM "sandboxing"</strong></summary>
-
-This is another very common report but **there is no such thing as JSVM "sandboxing" in PocketBase**.
-
-The JS `pb_hooks` (or JSVM for short) are NOT supposed to run untrusted or client provided JavaScript code _(the same way you are not supposed to run untrusted code in your Node.js server)_.
-
-Once interpreted the `pb_hooks` run as part of the same application process together with the rest of the Go code. There are no additional filesystem, network, memory, etc. restrictions. This means that it is OK for developers to be able to access environment variables, perform network calls to any URLs they want, invoke shell commands or even sleep/block the script execution.
-
-So if you are security researcher and not sure if something is a security fault in the JS hooks, ask yourself - "Can I do the same when using PocketBase as Go framework?" and if the answer is "Yes" then it is not a security issue with the JSVM.
-</details>
+All reports will be promptly addressed, and you'll be credited accordingly.

.github/workflows/release.yaml

@@ -7,28 +7,21 @@ on:
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
-    env:
-      flags: ""
     steps:
-      # re-enable auto-snapshot from goreleaser-action@v3
-      # (https://github.com/goreleaser/goreleaser-action-v4-auto-snapshot-example)
-      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: echo "flags=--snapshot" >> $GITHUB_ENV
-
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
-          node-version: '>=25.2.1'
+          node-version: 20.11.0
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v5
         with:
-          go-version: '>=1.27.1'
+          go-version: '>=1.22.8'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.
@@ -43,14 +36,19 @@ jobs:
       # - name: Generate jsvm types
       #   run: go run ./plugins/jsvm/internal/types/types.go
 
+      # The prebuilt golangci-lint doesn't support go 1.18+ yet
+      # https://github.com/golangci/golangci-lint/issues/2649
+      # - name: Run linter
+      #   uses: golangci/golangci-lint-action@v3
+
       - name: Run tests
         run: go test ./...
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v3
         with:
           distribution: goreleaser
-          version: '~> v2'
-          args: release --clean ${{ env.flags }}
+          version: latest
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -15,6 +15,4 @@ coverage.out
 # generated markdown previews
 README.html
 CHANGELOG.html
-CHANGELOG_16_22.html
-CHANGELOG_8_15.html
 LICENSE.html

.goreleaser.yaml

@@ -1,5 +1,3 @@
-version: 2
-
 project_name: pocketbase
 
 dist: .builds
@@ -9,6 +7,19 @@ before:
     - go mod tidy
 
 builds:
+  # used only for tests
+  - id: build_cgo
+    main: ./examples/base
+    binary: pocketbase
+    ldflags:
+      - -s -w -X github.com/pocketbase/pocketbase.Version={{ .Version }}
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+
   - id: build_noncgo
     main: ./examples/base
     binary: pocketbase
@@ -24,23 +35,13 @@ builds:
       - amd64
       - arm64
       - arm
-      - s390x
-      - ppc64le
     goarm:
       - 7
     ignore:
       - goos: windows
         goarch: arm
-      - goos: windows
-        goarch: s390x
-      - goos: windows
-        goarch: ppc64le
       - goos: darwin
         goarch: arm
-      - goos: darwin
-        goarch: s390x
-      - goos: darwin
-        goarch: ppc64le
 
 release:
   draft: true
@@ -57,7 +58,7 @@ checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  version_template: '{{ incpatch .Version }}-next'
+  name_template: '{{ incpatch .Version }}-next'
 
 changelog:
   sort: asc

CHANGELOG_8_15.md

@@ -326,7 +326,7 @@
 
 - Added "tags" support for all Record and Model related event hooks.
 
-    The "tags" allow registering event handlers that will be called only on matching table name(s) or collection id(s)/name(s).
+    The "tags" allow registering event handlers that will be called only on matching table name(s) or colleciton id(s)/name(s).
     For example:
     ```go
     app.OnRecordBeforeCreateRequest("articles").Add(func(e *core.RecordCreateEvent) error {
@@ -840,7 +840,7 @@ Please check the individual SDK package changelog and apply the necessary change
     </tr>
   </table>
 
-- All datetime strings are now returned in ISO8601 format - with _Z_ suffix and space as separator between the date and time part:
+- All datetime stings are now returned in ISO8601 format - with _Z_ suffix and space as separator between the date and time part:
   <table class="d-table" width="100%">
     <tr>
       <th>Old</th>

CONTRIBUTING.md

@@ -1,20 +1,17 @@
 # Contributing to PocketBase
 
-> [!IMPORTANT]
-> Due to recent LLM spam, PRs are temporary disabled and only existing collaborators can open a PR.
-> If you stumble on a problem that you want to fix, please consider instead opening an issue or discussion with link to your fork _(if not obvious - LLM contributions are not welcome)_.
-> This status may change in the future in case GitHub finally decide to do something about the constant spam, or when I find time to move the project somewhere else.
+Thanks for taking the time to improve PocketBase!
 
 This document describes how to prepare a PR for a change in the main repository.
 
 - [Prerequisites](#prerequisites)
 - [Making changes in the Go code](#making-changes-in-the-go-code)
-- [Making changes in the Superuser UI](#making-changes-in-the-admin-ui)
+- [Making changes in the Admin UI](#making-changes-in-the-admin-ui)
 
 ## Prerequisites
 
-- Go 1.27+ (for making changes in the Go code)
-- Node 24+ (for making changes in the Superuser UI)
+- Go 1.22+ (for making changes in the Go code)
+- Node 18+ (for making changes in the Admin UI)
 
 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
 
@@ -37,7 +34,7 @@ So, let's assume that you already done some changes in the PocketBase Go code an
 1. Navigate to `examples/base`
 2. Run `go run main.go serve`
 
-This will start a web server on `http://localhost:8090` with the embedded prebuilt Superuser UI from `ui/dist`. And that's it!
+This will start a web server on `http://localhost:8090` with the embedded prebuilt Admin UI from `ui/dist`. And that's it!
 
 **Before making a PR to the main repository, it is a good idea to:**
 
@@ -60,11 +57,11 @@ This will start a web server on `http://localhost:8090` with the embedded prebui
   make lint
   ```
 
-## Making changes in the Superuser UI
+## Making changes in the Admin UI
 
-PocketBase Superuser UI is a single-page application (SPA) built with Svelte and Vite.
+PocketBase Admin UI is a single-page application (SPA) built with Svelte and Vite.
 
-To start the Superuser UI:
+To start the Admin UI:
 
 1. Navigate to the `ui` project directory
 2. Run `npm install` to install the node dependencies
@@ -73,13 +70,13 @@ To start the Superuser UI:
    npm run dev
    ```
 
-You could open the browser and access the running Superuser UI at `http://localhost:5173`.
+You could open the browser and access the running Admin UI at `http://localhost:3000`.
 
-Since the Superuser UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
+Since the Admin UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
 
 > [!NOTE]
-> By default, the Superuser UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
+> By default, the Admin UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
 
-Every change you make in the Superuser UI should be automatically reflected in the browser at `http://localhost:5173` without reloading the page.
+Every change you make in the Admin UI should be automatically reflected in the browser at `http://localhost:3000` without reloading the page.
 
-Once you are done with your changes, you have to build the Superuser UI with `npm run build`, so that it can be embedded in the go package. And that's it - you can make your PR to the main PocketBase repository.
+Once you are done with your changes, you have to build the Admin UI with `npm run build`, so that it can be embedded in the go package. And that's it - you can make your PR to the main PocketBase repository.

README.md

@@ -1,6 +1,6 @@
 <p align="center">
     <a href="https://pocketbase.io" target="_blank" rel="noopener">
-        <img src="https://i.imgur.com/aCBbjKx.png" alt="PocketBase - open source backend in 1 file" />
+        <img src="https://i.imgur.com/5qimnm5.png" alt="PocketBase - open source backend in 1 file" />
     </a>
 </p>
 
@@ -10,7 +10,7 @@
     <a href="https://pkg.go.dev/github.com/pocketbase/pocketbase" target="_blank" rel="noopener"><img src="https://godoc.org/github.com/pocketbase/pocketbase?status.svg" alt="Go package documentation" /></a>
 </p>
 
-[PocketBase](https://pocketbase.io) is an open source Go backend that includes:
+[PocketBase](https://pocketbase.io) is an open source Go backend, consisting of:
 
 - embedded database (_SQLite_) with **realtime subscriptions**
 - built-in **files and users management**
@@ -25,13 +25,10 @@
 
 ## API SDK clients
 
-The easiest way to interact with the PocketBase Web APIs is to use one of the official SDK clients:
-
-- **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_Browser, Node.js, React Native_)
-- **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_Web, Mobile, Desktop, CLI_)
-
-You could also check the recommendations in https://pocketbase.io/docs/how-to-use/.
+The easiest way to interact with the API is to use one of the official SDK clients:
 
+- **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_browser and node_)
+- **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_web, mobile, desktop_)
 
 ## Overview
 
@@ -49,7 +46,7 @@ your own custom app specific business logic and still have a single portable exe
 
 Here is a minimal example:
 
-0. [Install Go 1.27+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.22+](https://go.dev/doc/install) (_if you haven't already_)
 
 1. Create a new project directory with the following `main.go` file inside it:
     ```go
@@ -57,21 +54,31 @@ Here is a minimal example:
 
     import (
         "log"
+        "net/http"
 
+        "github.com/labstack/echo/v5"
         "github.com/pocketbase/pocketbase"
+        "github.com/pocketbase/pocketbase/apis"
         "github.com/pocketbase/pocketbase/core"
     )
 
     func main() {
         app := pocketbase.New()
 
-        app.OnServe().BindFunc(func(se *core.ServeEvent) error {
-            // registers new "GET /hello" route
-            se.Router.GET("/hello", func(re *core.RequestEvent) error {
-                return re.String(200, "Hello world!")
+        app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
+            // add new "GET /hello" route to the app router (echo)
+            e.Router.AddRoute(echo.Route{
+                Method: http.MethodGet,
+                Path:   "/hello",
+                Handler: func(c echo.Context) error {
+                    return c.String(200, "Hello world!")
+                },
+                Middlewares: []echo.MiddlewareFunc{
+                    apis.ActivityLogger(app),
+                },
             })
 
-            return se.Next()
+            return nil
         })
 
         if err := app.Start(); err != nil {
@@ -86,43 +93,42 @@ Here is a minimal example:
 
 4. To build a statically linked executable, you can run `CGO_ENABLED=0 go build` and then start the created executable with `./myapp serve`.
 
+> [!NOTE]
+> PocketBase embeds SQLite, but doesn't require CGO.
+>
+> If CGO is enabled (aka. `CGO_ENABLED=1`), it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite).
+> Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
+
 _For more details please refer to [Extend with Go](https://pocketbase.io/docs/go-overview/)._
 
 ### Building and running the repo main.go example
 
 To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:
 
-0. [Install Go 1.27+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
 1. Clone/download the repo
 2. Navigate to `examples/base`
-3. Run `CGO_ENABLED=0 go build` to build a binary for your current environment
-   _(or to target other platforms use `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`; see https://go.dev/doc/install/source#environment)_
+3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
+   (_https://go.dev/doc/install/source#environment_)
 4. Start the created executable by running `./base serve`.
 
 Note that the supported build targets by the pure Go SQLite driver at the moment are:
 
-| GOOS    | GOARCH  |
-|---------|---------|
-| darwin  | amd64   |
-| darwin  | arm64   |
-| freebsd | 386     |
-| freebsd | amd64   |
-| freebsd | arm     |
-| freebsd | arm64   |
-| linux   | 386     |
-| linux   | amd64   |
-| linux   | arm     |
-| linux   | arm64   |
-| linux   | loong64 |
-| linux   | ppc64le |
-| linux   | riscv64 |
-| linux   | s390x   |
-| netbsd  | amd64   |
-| openbsd | amd64   |
-| openbsd | arm64   |
-| windows | 386     |
-| windows | amd64   |
-| windows | arm64   |
+```
+darwin  amd64
+darwin  arm64
+freebsd amd64
+freebsd arm64
+linux   386
+linux   amd64
+linux   arm
+linux   arm64
+linux   ppc64le
+linux   riscv64
+linux   s390x
+windows amd64
+windows arm64
+```
 
 ### Testing
 
@@ -139,7 +145,7 @@ Check also the [Testing guide](http://pocketbase.io/docs/testing) to learn how t
 
 If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
 
-You could find more details in the project [Security policy](https://github.com/pocketbase/pocketbase/security/policy).
+All reports will be promptly addressed, and you'll be credited accordingly.
 
 ## Contributing
 
@@ -151,13 +157,10 @@ You could help continuing its development by:
 - [Contribute to the source code](CONTRIBUTING.md)
 - [Suggest new features and report issues](https://github.com/pocketbase/pocketbase/issues)
 
-Please refrain creating PRs for _new features_ without previously discussing the implementation details.
+PRs for new OAuth2 providers, bug fixes, code optimizations and documentation improvements are more than welcome.
+
+But please refrain creating PRs for _new features_ without previously discussing the implementation details.
 PocketBase has a [roadmap](https://github.com/orgs/pocketbase/projects/2) and I try to work on issues in specific order and such PRs often come in out of nowhere and skew all initial planning with tedious back-and-forth communication.
 
 Don't get upset if I close your PR, even if it is well executed and tested. This doesn't mean that it will never be merged.
 Later we can always refer to it and/or take pieces of your implementation when the time comes to work on the issue (don't worry you'll be credited in the release notes).
-
-> [!IMPORTANT]
-> Due to recent LLM spam, PRs are temporary disabled and only existing collaborators can open a PR.
-> If you stumble on a problem that you want to fix, please consider instead opening an issue or discussion with link to your fork _(if not obvious - LLM contributions are not welcome)_.
-> This status may change in the future in case GitHub finally decide to do something about the constant spam, or when I find time to move the project somewhere else.

apis/admin.go

@@ -0,0 +1,353 @@
+package apis
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+// bindAdminApi registers the admin api endpoints and the corresponding handlers.
+func bindAdminApi(app core.App, rg *echo.Group) {
+	api := adminApi{app: app}
+
+	subGroup := rg.Group("/admins", ActivityLogger(app))
+	subGroup.POST("/auth-with-password", api.authWithPassword)
+	subGroup.POST("/request-password-reset", api.requestPasswordReset)
+	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
+	subGroup.POST("/auth-refresh", api.authRefresh, RequireAdminAuth())
+	subGroup.GET("", api.list, RequireAdminAuth())
+	subGroup.POST("", api.create, RequireAdminAuthOnlyIfAny(app))
+	subGroup.GET("/:id", api.view, RequireAdminAuth())
+	subGroup.PATCH("/:id", api.update, RequireAdminAuth())
+	subGroup.DELETE("/:id", api.delete, RequireAdminAuth())
+}
+
+type adminApi struct {
+	app core.App
+}
+
+func (api *adminApi) authResponse(c echo.Context, admin *models.Admin, finalizers ...func(token string) error) error {
+	token, tokenErr := tokens.NewAdminAuthToken(api.app, admin)
+	if tokenErr != nil {
+		return NewBadRequestError("Failed to create auth token.", tokenErr)
+	}
+
+	for _, f := range finalizers {
+		if err := f(token); err != nil {
+			return err
+		}
+	}
+
+	event := new(core.AdminAuthEvent)
+	event.HttpContext = c
+	event.Admin = admin
+	event.Token = token
+
+	return api.app.OnAdminAuthRequest().Trigger(event, func(e *core.AdminAuthEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		return e.HttpContext.JSON(200, map[string]any{
+			"token": e.Token,
+			"admin": e.Admin,
+		})
+	})
+}
+
+func (api *adminApi) authRefresh(c echo.Context) error {
+	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+	if admin == nil {
+		return NewNotFoundError("Missing auth admin context.", nil)
+	}
+
+	event := new(core.AdminAuthRefreshEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	return api.app.OnAdminBeforeAuthRefreshRequest().Trigger(event, func(e *core.AdminAuthRefreshEvent) error {
+		return api.app.OnAdminAfterAuthRefreshRequest().Trigger(event, func(e *core.AdminAuthRefreshEvent) error {
+			return api.authResponse(e.HttpContext, e.Admin)
+		})
+	})
+}
+
+func (api *adminApi) authWithPassword(c echo.Context) error {
+	form := forms.NewAdminLogin(api.app)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	event := new(core.AdminAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Password = form.Password
+	event.Identity = form.Identity
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.AdminAuthWithPasswordEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				return api.app.OnAdminAfterAuthWithPasswordRequest().Trigger(event, func(e *core.AdminAuthWithPasswordEvent) error {
+					return api.authResponse(e.HttpContext, e.Admin)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *adminApi) requestPasswordReset(c echo.Context) error {
+	form := forms.NewAdminPasswordResetRequest(api.app)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	if err := form.Validate(); err != nil {
+		return NewBadRequestError("An error occurred while validating the form.", err)
+	}
+
+	event := new(core.AdminRequestPasswordResetEvent)
+	event.HttpContext = c
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(Admin *models.Admin) error {
+			event.Admin = Admin
+
+			return api.app.OnAdminBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Admin); err != nil {
+						api.app.Logger().Error("Failed to send admin password reset request.", "error", err)
+					}
+				})
+
+				return api.app.OnAdminAfterRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	// eagerly write 204 response and skip submit errors
+	// as a measure against admins enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
+}
+
+func (api *adminApi) confirmPasswordReset(c echo.Context) error {
+	form := forms.NewAdminPasswordResetConfirm(api.app)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.AdminConfirmPasswordResetEvent)
+	event.HttpContext = c
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.AdminConfirmPasswordResetEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return api.app.OnAdminAfterConfirmPasswordResetRequest().Trigger(event, func(e *core.AdminConfirmPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *adminApi) list(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(
+		"id", "created", "updated", "name", "email",
+	)
+
+	admins := []*models.Admin{}
+
+	result, err := search.NewProvider(fieldResolver).
+		Query(api.app.Dao().AdminQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &admins)
+
+	if err != nil {
+		return NewBadRequestError("", err)
+	}
+
+	event := new(core.AdminsListEvent)
+	event.HttpContext = c
+	event.Admins = admins
+	event.Result = result
+
+	return api.app.OnAdminsListRequest().Trigger(event, func(e *core.AdminsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, e.Result)
+	})
+}
+
+func (api *adminApi) view(c echo.Context) error {
+	id := c.PathParam("id")
+	if id == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	admin, err := api.app.Dao().FindAdminById(id)
+	if err != nil || admin == nil {
+		return NewNotFoundError("", err)
+	}
+
+	event := new(core.AdminViewEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	return api.app.OnAdminViewRequest().Trigger(event, func(e *core.AdminViewEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, e.Admin)
+	})
+}
+
+func (api *adminApi) create(c echo.Context) error {
+	admin := &models.Admin{}
+
+	form := forms.NewAdminUpsert(api.app, admin)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.AdminCreateEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	// create the admin
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
+			return api.app.OnAdminBeforeCreateRequest().Trigger(event, func(e *core.AdminCreateEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to create admin.", err)
+				}
+
+				return api.app.OnAdminAfterCreateRequest().Trigger(event, func(e *core.AdminCreateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *adminApi) update(c echo.Context) error {
+	id := c.PathParam("id")
+	if id == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	admin, err := api.app.Dao().FindAdminById(id)
+	if err != nil || admin == nil {
+		return NewNotFoundError("", err)
+	}
+
+	form := forms.NewAdminUpsert(api.app, admin)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.AdminUpdateEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	// update the admin
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
+			return api.app.OnAdminBeforeUpdateRequest().Trigger(event, func(e *core.AdminUpdateEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to update admin.", err)
+				}
+
+				return api.app.OnAdminAfterUpdateRequest().Trigger(event, func(e *core.AdminUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *adminApi) delete(c echo.Context) error {
+	id := c.PathParam("id")
+	if id == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	admin, err := api.app.Dao().FindAdminById(id)
+	if err != nil || admin == nil {
+		return NewNotFoundError("", err)
+	}
+
+	event := new(core.AdminDeleteEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	return api.app.OnAdminBeforeDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
+		if err := api.app.Dao().DeleteAdmin(e.Admin); err != nil {
+			return NewBadRequestError("Failed to delete admin.", err)
+		}
+
+		return api.app.OnAdminAfterDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
+	})
+}

apis/admin_test.go

@@ -0,0 +1,925 @@
+package apis_test
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestAdminAuthWithPassword(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "empty data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"identity":{"code":"validation_required","message":"Cannot be blank."},"password":{"code":"validation_required","message":"Cannot be blank."}}`},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(`{`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:            "wrong email",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"missing@example.com","password":"1234567890"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:            "wrong password",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"test@example.com","password":"invalid"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:           "valid email/password (guest)",
+			Method:         http.MethodPost,
+			Url:            "/api/admins/auth-with-password",
+			Body:           strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"admin":{"id":"sywbhecnh46rhm0"`,
+				`"token":`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "valid email/password (already authorized)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-with-password",
+			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"admin":{"id":"sywbhecnh46rhm0"`,
+				`"token":`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterAuthWithPasswordRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-with-password",
+			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterAuthWithPasswordRequest().Add(func(e *core.AdminAuthWithPasswordEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminRequestPasswordReset(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "empty data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/request-password-reset",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/request-password-reset",
+			Body:            strings.NewReader(`{"email`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:           "missing admin",
+			Method:         http.MethodPost,
+			Url:            "/api/admins/request-password-reset",
+			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+		},
+		{
+			Name:           "existing admin",
+			Method:         http.MethodPost,
+			Url:            "/api/admins/request-password-reset",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnMailerBeforeAdminResetPasswordSend":     1,
+				"OnMailerAfterAdminResetPasswordSend":      1,
+				"OnAdminBeforeRequestPasswordResetRequest": 1,
+				"OnAdminAfterRequestPasswordResetRequest":  1,
+			},
+		},
+		{
+			Name:           "existing admin (after already sent)",
+			Method:         http.MethodPost,
+			Url:            "/api/admins/request-password-reset",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				// simulate recent password request
+				admin, err := app.Dao().FindAdminByEmail("test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				admin.LastResetSentAt = types.NowDateTime()
+				dao := daos.New(app.Dao().DB()) // new dao to ignore hooks
+				if err := dao.Save(admin); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminConfirmPasswordReset(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "empty data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/confirm-password-reset",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"password":{"code":"validation_required","message":"Cannot be blank."},"passwordConfirm":{"code":"validation_required","message":"Cannot be blank."},"token":{"code":"validation_required","message":"Cannot be blank."}}`},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/confirm-password-reset",
+			Body:            strings.NewReader(`{"password`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "expired token",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MTY0MDk5MTY2MX0.GLwCOsgWTTEKXTK-AyGW838de1OeZGIjfHH0FoRLqZg",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890"
+			}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"token":{"code":"validation_invalid_token","message":"Invalid or expired token."}}}`},
+		},
+		{
+			Name:   "valid token + invalid password",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"123456",
+				"passwordConfirm":"123456"
+			}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"password":{"code":"validation_length_out_of_range"`},
+		},
+		{
+			Name:   "valid token + valid password",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnAdminBeforeConfirmPasswordResetRequest": 1,
+				"OnAdminAfterConfirmPasswordResetRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterConfirmPasswordResetRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891"
+			}`),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterConfirmPasswordResetRequest().Add(func(e *core.AdminConfirmPasswordResetEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnAdminBeforeConfirmPasswordResetRequest": 1,
+				"OnAdminAfterConfirmPasswordResetRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminRefresh(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-refresh",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (expired token)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MDk5MTY2MX0.I7w8iktkleQvC7_UIRpD7rNzcU4OnF7i7SFIUu6lD_4",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (valid token)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"admin":{"id":"sywbhecnh46rhm0"`,
+				`"token":`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminAuthRequest":              1,
+				"OnAdminBeforeAuthRefreshRequest": 1,
+				"OnAdminAfterAuthRefreshRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterAuthRefreshRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterAuthRefreshRequest().Add(func(e *core.AdminAuthRefreshEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthRefreshRequest": 1,
+				"OnAdminAfterAuthRefreshRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			Url:             "/api/admins",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodGet,
+			Url:    "/api/admins",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin",
+			Method: http.MethodGet,
+			Url:    "/api/admins",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"sywbhecnh46rhm0"`,
+				`"id":"sbmbsdb40jyxf7h"`,
+				`"id":"9q2trqumvlyr3bd"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as admin + paging and sorting",
+			Method: http.MethodGet,
+			Url:    "/api/admins?page=2&perPage=1&sort=-created",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":2`,
+				`"perPage":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"sbmbsdb40jyxf7h"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as admin + invalid filter",
+			Method: http.MethodGet,
+			Url:    "/api/admins?filter=invalidfield~'test2'",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + valid filter",
+			Method: http.MethodGet,
+			Url:    "/api/admins?filter=email~'test3'",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"9q2trqumvlyr3bd"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminsListRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodGet,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + nonexisting admin id",
+			Method: http.MethodGet,
+			Url:    "/api/admins/nonexisting",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + existing admin id",
+			Method: http.MethodGet,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"sbmbsdb40jyxf7h"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminViewRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodDelete,
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + missing admin id",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/missing",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + existing admin id",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeDelete":        1,
+				"OnModelAfterDelete":         1,
+				"OnAdminBeforeDeleteRequest": 1,
+				"OnAdminAfterDeleteRequest":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin - try to delete the only remaining admin",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/sywbhecnh46rhm0",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				// delete all admins except the authorized one
+				adminModel := &models.Admin{}
+				_, err := app.Dao().DB().Delete(adminModel.TableName(), dbx.Not(dbx.HashExp{
+					"id": "sywbhecnh46rhm0",
+				})).Execute()
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeDeleteRequest": 1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterDeleteRequest error response",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterDeleteRequest().Add(func(e *core.AdminDeleteEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeDelete":        1,
+				"OnModelAfterDelete":         1,
+				"OnAdminBeforeDeleteRequest": 1,
+				"OnAdminAfterDeleteRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminCreate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized (while having at least 1 existing admin)",
+			Method:          http.MethodPost,
+			Url:             "/api/admins",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "unauthorized (while having 0 existing admins)",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body:   strings.NewReader(`{"email":"testnew@example.com","password":"1234567890","passwordConfirm":"1234567890","avatar":3}`),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				// delete all admins
+				_, err := app.Dao().DB().NewQuery("DELETE FROM {{_admins}}").Execute()
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"email":"testnew@example.com"`,
+				`"avatar":3`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeCreate":        1,
+				"OnModelAfterCreate":         1,
+				"OnAdminBeforeCreateRequest": 1,
+				"OnAdminAfterCreateRequest":  1,
+			},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + empty data",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body:   strings.NewReader(``),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."},"password":{"code":"validation_required","message":"Cannot be blank."}}`},
+		},
+		{
+			Name:   "authorized as admin + invalid data format",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body:   strings.NewReader(`{`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + invalid data",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body: strings.NewReader(`{
+				"email":"test@example.com",
+				"password":"1234",
+				"passwordConfirm":"4321",
+				"avatar":99
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"avatar":{"code":"validation_max_less_equal_than_required"`,
+				`"email":{"code":"validation_admin_email_exists"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
+			},
+		},
+		{
+			Name:   "authorized as admin + valid data",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890",
+				"avatar":3
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"email":"testnew@example.com"`,
+				`"avatar":3`,
+			},
+			NotExpectedContent: []string{
+				`"password"`,
+				`"passwordConfirm"`,
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeCreate":        1,
+				"OnModelAfterCreate":         1,
+				"OnAdminBeforeCreateRequest": 1,
+				"OnAdminAfterCreateRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterCreateRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890",
+				"avatar":3
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterCreateRequest().Add(func(e *core.AdminCreateEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeCreate":        1,
+				"OnModelAfterCreate":         1,
+				"OnAdminBeforeCreateRequest": 1,
+				"OnAdminAfterCreateRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAdminUpdate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPatch,
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + missing admin",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/missing",
+			Body:   strings.NewReader(``),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + empty data",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body:   strings.NewReader(``),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"sbmbsdb40jyxf7h"`,
+				`"email":"test2@example.com"`,
+				`"avatar":2`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":        1,
+				"OnModelAfterUpdate":         1,
+				"OnAdminBeforeUpdateRequest": 1,
+				"OnAdminAfterUpdateRequest":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin + invalid formatted data",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body:   strings.NewReader(`{`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + invalid data",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"test@example.com",
+				"password":"1234",
+				"passwordConfirm":"4321",
+				"avatar":99
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"avatar":{"code":"validation_max_less_equal_than_required"`,
+				`"email":{"code":"validation_admin_email_exists"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
+			},
+		},
+		{
+			Name:   "authorized as admin + valid data",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891",
+				"avatar":5
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"sbmbsdb40jyxf7h"`,
+				`"email":"testnew@example.com"`,
+				`"avatar":5`,
+			},
+			NotExpectedContent: []string{
+				`"password"`,
+				`"passwordConfirm"`,
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":        1,
+				"OnModelAfterUpdate":         1,
+				"OnAdminBeforeUpdateRequest": 1,
+				"OnAdminAfterUpdateRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterUpdateRequest error response",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891",
+				"avatar":5
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterUpdateRequest().Add(func(e *core.AdminUpdateEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":        1,
+				"OnModelAfterUpdate":         1,
+				"OnAdminBeforeUpdateRequest": 1,
+				"OnAdminAfterUpdateRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/api_error.go

@@ -0,0 +1,132 @@
+package apis
+
+import (
+	"net/http"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+)
+
+// ApiError defines the struct for a basic api error response.
+type ApiError struct {
+	Code    int            `json:"code"`
+	Message string         `json:"message"`
+	Data    map[string]any `json:"data"`
+
+	// stores unformatted error data (could be an internal error, text, etc.)
+	rawData any
+}
+
+// Error makes it compatible with the `error` interface.
+func (e *ApiError) Error() string {
+	return e.Message
+}
+
+// RawData returns the unformatted error data (could be an internal error, text, etc.)
+func (e *ApiError) RawData() any {
+	return e.rawData
+}
+
+// NewNotFoundError creates and returns 404 `ApiError`.
+func NewNotFoundError(message string, data any) *ApiError {
+	if message == "" {
+		message = "The requested resource wasn't found."
+	}
+
+	return NewApiError(http.StatusNotFound, message, data)
+}
+
+// NewBadRequestError creates and returns 400 `ApiError`.
+func NewBadRequestError(message string, data any) *ApiError {
+	if message == "" {
+		message = "Something went wrong while processing your request."
+	}
+
+	return NewApiError(http.StatusBadRequest, message, data)
+}
+
+// NewForbiddenError creates and returns 403 `ApiError`.
+func NewForbiddenError(message string, data any) *ApiError {
+	if message == "" {
+		message = "You are not allowed to perform this request."
+	}
+
+	return NewApiError(http.StatusForbidden, message, data)
+}
+
+// NewUnauthorizedError creates and returns 401 `ApiError`.
+func NewUnauthorizedError(message string, data any) *ApiError {
+	if message == "" {
+		message = "Missing or invalid authentication token."
+	}
+
+	return NewApiError(http.StatusUnauthorized, message, data)
+}
+
+// NewApiError creates and returns new normalized `ApiError` instance.
+func NewApiError(status int, message string, data any) *ApiError {
+	return &ApiError{
+		rawData: data,
+		Data:    safeErrorsData(data),
+		Code:    status,
+		Message: strings.TrimSpace(inflector.Sentenize(message)),
+	}
+}
+
+func safeErrorsData(data any) map[string]any {
+	switch v := data.(type) {
+	case validation.Errors:
+		return resolveSafeErrorsData[error](v)
+	case map[string]validation.Error:
+		return resolveSafeErrorsData[validation.Error](v)
+	case map[string]error:
+		return resolveSafeErrorsData[error](v)
+	case map[string]any:
+		return resolveSafeErrorsData[any](v)
+	default:
+		return map[string]any{} // not nil to ensure that is json serialized as object
+	}
+}
+
+func resolveSafeErrorsData[T any](data map[string]T) map[string]any {
+	result := map[string]any{}
+
+	for name, err := range data {
+		if isNestedError(err) {
+			result[name] = safeErrorsData(err)
+			continue
+		}
+		result[name] = resolveSafeErrorItem(err)
+	}
+
+	return result
+}
+
+func isNestedError(err any) bool {
+	switch err.(type) {
+	case validation.Errors, map[string]validation.Error, map[string]error, map[string]any:
+		return true
+	}
+
+	return false
+}
+
+// resolveSafeErrorItem extracts from each validation error its
+// public safe error code and message.
+func resolveSafeErrorItem(err any) map[string]string {
+	// default public safe error values
+	code := "validation_invalid_value"
+	msg := "Invalid value."
+
+	// only validation errors are public safe
+	if obj, ok := err.(validation.Error); ok {
+		code = obj.Code()
+		msg = inflector.Sentenize(obj.Error())
+	}
+
+	return map[string]string{
+		"code":    code,
+		"message": msg,
+	}
+}

apis/api_error_aliases.go

@@ -1,47 +0,0 @@
-package apis
-
-import "github.com/pocketbase/pocketbase/tools/router"
-
-// ApiError aliases to minimize the breaking changes with earlier versions
-// and for consistency with the JSVM binds.
-// -------------------------------------------------------------------
-
-// ToApiError wraps err into ApiError instance (if not already).
-func ToApiError(err error) *router.ApiError {
-	return router.ToApiError(err)
-}
-
-// NewApiError is an alias for [router.NewApiError].
-func NewApiError(status int, message string, errData any) *router.ApiError {
-	return router.NewApiError(status, message, errData)
-}
-
-// NewBadRequestError is an alias for [router.NewBadRequestError].
-func NewBadRequestError(message string, errData any) *router.ApiError {
-	return router.NewBadRequestError(message, errData)
-}
-
-// NewNotFoundError is an alias for [router.NewNotFoundError].
-func NewNotFoundError(message string, errData any) *router.ApiError {
-	return router.NewNotFoundError(message, errData)
-}
-
-// NewForbiddenError is an alias for [router.NewForbiddenError].
-func NewForbiddenError(message string, errData any) *router.ApiError {
-	return router.NewForbiddenError(message, errData)
-}
-
-// NewUnauthorizedError is an alias for [router.NewUnauthorizedError].
-func NewUnauthorizedError(message string, errData any) *router.ApiError {
-	return router.NewUnauthorizedError(message, errData)
-}
-
-// NewTooManyRequestsError is an alias for [router.NewTooManyRequestsError].
-func NewTooManyRequestsError(message string, errData any) *router.ApiError {
-	return router.NewTooManyRequestsError(message, errData)
-}
-
-// NewInternalServerError is an alias for [router.NewInternalServerError].
-func NewInternalServerError(message string, errData any) *router.ApiError {
-	return router.NewInternalServerError(message, errData)
-}

apis/api_error_test.go

@@ -0,0 +1,162 @@
+package apis_test
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/apis"
+)
+
+func TestNewApiErrorWithRawData(t *testing.T) {
+	t.Parallel()
+
+	e := apis.NewApiError(
+		300,
+		"message_test",
+		"rawData_test",
+	)
+
+	result, _ := json.Marshal(e)
+	expected := `{"code":300,"message":"Message_test.","data":{}}`
+
+	if string(result) != expected {
+		t.Errorf("Expected %v, got %v", expected, string(result))
+	}
+
+	if e.Error() != "Message_test." {
+		t.Errorf("Expected %q, got %q", "Message_test.", e.Error())
+	}
+
+	if e.RawData() != "rawData_test" {
+		t.Errorf("Expected rawData %v, got %v", "rawData_test", e.RawData())
+	}
+}
+
+func TestNewApiErrorWithValidationData(t *testing.T) {
+	t.Parallel()
+
+	e := apis.NewApiError(
+		300,
+		"message_test",
+		validation.Errors{
+			"err1": errors.New("test error"), // should be normalized
+			"err2": validation.ErrRequired,
+			"err3": validation.Errors{
+				"sub1": errors.New("test error"), // should be normalized
+				"sub2": validation.ErrRequired,
+				"sub3": validation.Errors{
+					"sub11": validation.ErrRequired,
+				},
+			},
+		},
+	)
+
+	result, _ := json.Marshal(e)
+	expected := `{"code":300,"message":"Message_test.","data":{"err1":{"code":"validation_invalid_value","message":"Invalid value."},"err2":{"code":"validation_required","message":"Cannot be blank."},"err3":{"sub1":{"code":"validation_invalid_value","message":"Invalid value."},"sub2":{"code":"validation_required","message":"Cannot be blank."},"sub3":{"sub11":{"code":"validation_required","message":"Cannot be blank."}}}}}`
+
+	if string(result) != expected {
+		t.Errorf("Expected \n%v, \ngot \n%v", expected, string(result))
+	}
+
+	if e.Error() != "Message_test." {
+		t.Errorf("Expected %q, got %q", "Message_test.", e.Error())
+	}
+
+	if e.RawData() == nil {
+		t.Error("Expected non-nil rawData")
+	}
+}
+
+func TestNewNotFoundError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"code":404,"message":"The requested resource wasn't found.","data":{}}`},
+		{"demo", "rawData_test", `{"code":404,"message":"Demo.","data":{}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":404,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
+	}
+
+	for i, scenario := range scenarios {
+		e := apis.NewNotFoundError(scenario.message, scenario.data)
+		result, _ := json.Marshal(e)
+
+		if string(result) != scenario.expected {
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
+		}
+	}
+}
+
+func TestNewBadRequestError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"code":400,"message":"Something went wrong while processing your request.","data":{}}`},
+		{"demo", "rawData_test", `{"code":400,"message":"Demo.","data":{}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":400,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
+	}
+
+	for i, scenario := range scenarios {
+		e := apis.NewBadRequestError(scenario.message, scenario.data)
+		result, _ := json.Marshal(e)
+
+		if string(result) != scenario.expected {
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
+		}
+	}
+}
+
+func TestNewForbiddenError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"code":403,"message":"You are not allowed to perform this request.","data":{}}`},
+		{"demo", "rawData_test", `{"code":403,"message":"Demo.","data":{}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":403,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
+	}
+
+	for i, scenario := range scenarios {
+		e := apis.NewForbiddenError(scenario.message, scenario.data)
+		result, _ := json.Marshal(e)
+
+		if string(result) != scenario.expected {
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
+		}
+	}
+}
+
+func TestNewUnauthorizedError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"code":401,"message":"Missing or invalid authentication token.","data":{}}`},
+		{"demo", "rawData_test", `{"code":401,"message":"Demo.","data":{}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":401,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
+	}
+
+	for i, scenario := range scenarios {
+		e := apis.NewUnauthorizedError(scenario.message, scenario.data)
+		result, _ := json.Marshal(e)
+
+		if string(result) != scenario.expected {
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
+		}
+	}
+}

apis/backup.go

@@ -6,37 +6,42 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
-	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )
 
 // bindBackupApi registers the file api endpoints and the corresponding handlers.
-func bindBackupApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	sub := rg.Group("/backups")
-	sub.GET("", backupsList).Bind(RequireSuperuserAuth())
-	sub.POST("", backupCreate).Bind(RequireSuperuserAuth())
-	sub.POST("/upload", backupUpload).Bind(BodyLimit(0), RequireSuperuserAuth())
-	sub.GET("/{key}", backupDownload) // relies on superuser file token
-	sub.DELETE("/{key}", backupDelete).Bind(RequireSuperuserAuth())
-	sub.POST("/{key}/restore", backupRestore).Bind(RequireSuperuserAuth())
+//
+// @todo add hooks once the app hooks api restructuring is finalized
+func bindBackupApi(app core.App, rg *echo.Group) {
+	api := backupApi{app: app}
+
+	subGroup := rg.Group("/backups", ActivityLogger(app))
+	subGroup.GET("", api.list, RequireAdminAuth())
+	subGroup.POST("", api.create, RequireAdminAuth())
+	subGroup.POST("/upload", api.upload, RequireAdminAuth())
+	subGroup.GET("/:key", api.download)
+	subGroup.DELETE("/:key", api.delete, RequireAdminAuth())
+	subGroup.POST("/:key/restore", api.restore, RequireAdminAuth())
 }
 
-type backupFileInfo struct {
-	Modified types.DateTime `json:"modified"`
-	Key      string         `json:"key"`
-	Size     int64          `json:"size"`
+type backupApi struct {
+	app core.App
 }
 
-func backupsList(e *core.RequestEvent) error {
+func (api *backupApi) list(c echo.Context) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
-	fsys, err := e.App.NewBackupsFilesystem()
+	fsys, err := api.app.NewBackupsFilesystem()
 	if err != nil {
-		return e.BadRequestError("Failed to load backups filesystem.", err)
+		return NewBadRequestError("Failed to load backups filesystem.", err)
 	}
 	defer fsys.Close()
 
@@ -44,117 +49,166 @@ func backupsList(e *core.RequestEvent) error {
 
 	backups, err := fsys.List("")
 	if err != nil {
-		return e.BadRequestError("Failed to retrieve backup items. Raw error: \n"+err.Error(), nil)
+		return NewBadRequestError("Failed to retrieve backup items. Raw error: \n"+err.Error(), nil)
 	}
 
-	result := make([]backupFileInfo, len(backups))
+	result := make([]models.BackupFileInfo, len(backups))
 
 	for i, obj := range backups {
 		modified, _ := types.ParseDateTime(obj.ModTime)
 
-		result[i] = backupFileInfo{
+		result[i] = models.BackupFileInfo{
 			Key:      obj.Key,
 			Size:     obj.Size,
 			Modified: modified,
 		}
 	}
 
-	return e.JSON(http.StatusOK, result)
+	return c.JSON(http.StatusOK, result)
 }
 
-func backupDownload(e *core.RequestEvent) error {
-	fileToken := e.Request.URL.Query().Get("token")
-
-	authRecord, err := e.App.FindAuthRecordByToken(fileToken, core.TokenTypeFile)
-	if err != nil || !authRecord.IsSuperuser() {
-		return e.ForbiddenError("Insufficient permissions to access the resource.", err)
+func (api *backupApi) create(c echo.Context) error {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
+		return NewBadRequestError("Try again later - another backup/restore process has already been started", nil)
 	}
 
-	allowedIPs := e.App.Settings().SuperuserIPs
-	if len(allowedIPs) > 0 && !isIPInList(allowedIPs, e.RealIP()) {
-		return e.ForbiddenError("Insufficient permissions to access the resource.", nil)
+	form := forms.NewBackupCreate(api.app)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	fsys, err := e.App.NewBackupsFilesystem()
+	return form.Submit(func(next forms.InterceptorNextFunc[string]) forms.InterceptorNextFunc[string] {
+		return func(name string) error {
+			if err := next(name); err != nil {
+				return NewBadRequestError("Failed to create backup.", err)
+			}
+
+			// we don't retrieve the generated backup file because it may not be
+			// available yet due to the eventually consistent nature of some S3 providers
+			return c.NoContent(http.StatusNoContent)
+		}
+	})
+}
+
+func (api *backupApi) upload(c echo.Context) error {
+	files, err := rest.FindUploadedFiles(c.Request(), "file")
 	if err != nil {
-		return e.InternalServerError("Failed to load backups filesystem.", err)
+		return NewBadRequestError("Missing or invalid uploaded file.", err)
+	}
+
+	form := forms.NewBackupUpload(api.app)
+	form.File = files[0]
+
+	return form.Submit(func(next forms.InterceptorNextFunc[*filesystem.File]) forms.InterceptorNextFunc[*filesystem.File] {
+		return func(file *filesystem.File) error {
+			if err := next(file); err != nil {
+				return NewBadRequestError("Failed to upload backup.", err)
+			}
+
+			// we don't retrieve the generated backup file because it may not be
+			// available yet due to the eventually consistent nature of some S3 providers
+			return c.NoContent(http.StatusNoContent)
+		}
+	})
+}
+
+func (api *backupApi) download(c echo.Context) error {
+	fileToken := c.QueryParam("token")
+
+	_, err := api.app.Dao().FindAdminByToken(
+		fileToken,
+		api.app.Settings().AdminFileToken.Secret,
+	)
+	if err != nil {
+		return NewForbiddenError("Insufficient permissions to access the resource.", err)
 	}
-	defer fsys.Close()
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
 	fsys.SetContext(ctx)
 
-	key := e.Request.PathValue("key")
+	key := c.PathParam("key")
+
+	br, err := fsys.GetFile(key)
+	if err != nil {
+		return NewBadRequestError("Failed to retrieve backup item. Raw error: \n"+err.Error(), nil)
+	}
+	defer br.Close()
 
 	return fsys.Serve(
-		e.Response,
-		e.Request,
+		c.Response(),
+		c.Request(),
 		key,
 		filepath.Base(key), // without the path prefix (if any)
 	)
 }
 
-func backupDelete(e *core.RequestEvent) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	fsys, err := e.App.NewBackupsFilesystem()
-	if err != nil {
-		return e.InternalServerError("Failed to load backups filesystem.", err)
-	}
-	defer fsys.Close()
-
-	fsys.SetContext(ctx)
-
-	key := e.Request.PathValue("key")
-
-	if key != "" && cast.ToString(e.App.Store().Get(core.StoreKeyActiveBackup)) == key {
-		return e.BadRequestError("The backup is currently being used and cannot be deleted.", nil)
+func (api *backupApi) restore(c echo.Context) error {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
+		return NewBadRequestError("Try again later - another backup/restore process has already been started.", nil)
 	}
 
-	if err := fsys.Delete(key); err != nil {
-		return e.BadRequestError("Invalid or already deleted backup file. Raw error: \n"+err.Error(), nil)
-	}
-
-	return e.NoContent(http.StatusNoContent)
-}
-
-func backupRestore(e *core.RequestEvent) error {
-	if e.App.Store().Has(core.StoreKeyActiveBackup) {
-		return e.BadRequestError("Try again later - another backup/restore process has already been started.", nil)
-	}
-
-	key := e.Request.PathValue("key")
+	key := c.PathParam("key")
 
 	existsCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
-	fsys, err := e.App.NewBackupsFilesystem()
+	fsys, err := api.app.NewBackupsFilesystem()
 	if err != nil {
-		return e.InternalServerError("Failed to load backups filesystem.", err)
+		return NewBadRequestError("Failed to load backups filesystem.", err)
 	}
 	defer fsys.Close()
 
 	fsys.SetContext(existsCtx)
 
 	if exists, err := fsys.Exists(key); !exists {
-		return e.BadRequestError("Missing or invalid backup file.", err)
+		return NewBadRequestError("Missing or invalid backup file.", err)
 	}
 
-	routine.FireAndForget(func() {
-		// give some optimistic time to write the response before restarting the app
-		time.Sleep(1 * time.Second)
-
-		// wait max 10 minutes to fetch the backup
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	go func() {
+		// wait max 15 minutes to fetch the backup
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
 		defer cancel()
 
-		if err := e.App.RestoreBackup(ctx, key); err != nil {
-			e.App.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
-		}
-	})
+		// give some optimistic time to write the response
+		time.Sleep(1 * time.Second)
 
-	return e.NoContent(http.StatusNoContent)
+		if err := api.app.RestoreBackup(ctx, key); err != nil {
+			api.app.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
+		}
+	}()
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (api *backupApi) delete(c echo.Context) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	key := c.PathParam("key")
+
+	if key != "" && cast.ToString(api.app.Store().Get(core.StoreKeyActiveBackup)) == key {
+		return NewBadRequestError("The backup is currently being used and cannot be deleted.", nil)
+	}
+
+	if err := fsys.Delete(key); err != nil {
+		return NewBadRequestError("Invalid or already deleted backup file. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
 }

apis/backup_create.go

@@ -1,78 +0,0 @@
-package apis
-
-import (
-	"context"
-	"net/http"
-	"regexp"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-func backupCreate(e *core.RequestEvent) error {
-	if e.App.Store().Has(core.StoreKeyActiveBackup) {
-		return e.BadRequestError("Try again later - another backup/restore process has already been started", nil)
-	}
-
-	form := new(backupCreateForm)
-	form.app = e.App
-
-	err := e.BindBody(form)
-	if err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
-	}
-
-	err = form.validate()
-	if err != nil {
-		return e.BadRequestError("An error occurred while validating the submitted data.", err)
-	}
-
-	err = e.App.CreateBackup(context.Background(), form.Name)
-	if err != nil {
-		return e.BadRequestError("Failed to create backup.", err)
-	}
-
-	// we don't retrieve the generated backup file because it may not be
-	// available yet due to the eventually consistent nature of some S3 providers
-	return e.NoContent(http.StatusNoContent)
-}
-
-// -------------------------------------------------------------------
-
-var backupNameRegex = regexp.MustCompile(`^[a-z0-9_-]+\.zip$`)
-
-type backupCreateForm struct {
-	app core.App
-
-	Name string `form:"name" json:"name"`
-}
-
-func (form *backupCreateForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(
-			&form.Name,
-			validation.Length(1, 150),
-			validation.Match(backupNameRegex),
-			validation.By(form.checkUniqueName),
-		),
-	)
-}
-
-func (form *backupCreateForm) checkUniqueName(value any) error {
-	v, _ := value.(string)
-	if v == "" {
-		return nil // nothing to check
-	}
-
-	fsys, err := form.app.NewBackupsFilesystem()
-	if err != nil {
-		return err
-	}
-	defer fsys.Close()
-
-	if exists, err := fsys.Exists(v); err != nil || exists {
-		return validation.NewError("validation_backup_name_exists", "The backup file name is invalid or already exists.")
-	}
-
-	return nil
-}

apis/backup_test.go

@@ -10,10 +10,10 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/pocketbase/pocketbase/apis"
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+	"gocloud.dev/blob"
 )
 
 func TestBackupsList(t *testing.T) {
@@ -23,51 +23,50 @@ func TestBackupsList(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodGet,
-			URL:    "/api/backups",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (empty list)",
+			Name:   "authorized as admin (empty list)",
 			Method: http.MethodGet,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[]`,
 			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`[]`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser",
+			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
@@ -78,7 +77,6 @@ func TestBackupsList(t *testing.T) {
 				`"test2.zip"`,
 				`"test3.zip"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 
@@ -94,53 +92,50 @@ func TestBackupsCreate(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			Url:    "/api/backups",
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (pending backup)",
+			Name:   "authorized as admin (pending backup)",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.Store().Set(core.StoreKeyActiveBackup, "")
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (autogenerated name)",
+			Name:   "authorized as admin (autogenerated name)",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
 				if err != nil {
 					t.Fatal(err)
@@ -156,20 +151,16 @@ func TestBackupsCreate(t *testing.T) {
 				}
 			},
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBackupCreate": 1,
-			},
 		},
 		{
-			Name:   "authorized as superuser (invalid name)",
+			Name:   "authorized as admin (invalid name)",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
+			Url:    "/api/backups",
 			Body:   strings.NewReader(`{"name":"!test.zip"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
 			ExpectedStatus: 400,
@@ -177,17 +168,16 @@ func TestBackupsCreate(t *testing.T) {
 				`"data":{`,
 				`"name":{"code":"validation_match_invalid"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (valid name)",
+			Name:   "authorized as admin (valid name)",
 			Method: http.MethodPost,
-			URL:    "/api/backups",
+			Url:    "/api/backups",
 			Body:   strings.NewReader(`{"name":"test.zip"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
 				if err != nil {
 					t.Fatal(err)
@@ -203,10 +193,6 @@ func TestBackupsCreate(t *testing.T) {
 				}
 			},
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBackupCreate": 1,
-			},
 		},
 	}
 
@@ -215,7 +201,7 @@ func TestBackupsCreate(t *testing.T) {
 	}
 }
 
-func TestBackupUpload(t *testing.T) {
+func TestBackupsUpload(t *testing.T) {
 	t.Parallel()
 
 	// create dummy form data bodies
@@ -257,58 +243,55 @@ func TestBackupUpload(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
+			Url:    "/api/backups/upload",
 			Body:   bodies[0].buffer,
-			Headers: map[string]string{
+			RequestHeaders: map[string]string{
 				"Content-Type": bodies[0].contentType,
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
+			Url:    "/api/backups/upload",
 			Body:   bodies[1].buffer,
-			Headers: map[string]string{
+			RequestHeaders: map[string]string{
 				"Content-Type":  bodies[1].contentType,
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (missing file)",
+			Name:   "authorized as admin (missing file)",
 			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/upload",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (existing backup name)",
+			Name:   "authorized as admin (existing backup name)",
 			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
+			Url:    "/api/backups/upload",
 			Body:   bodies[3].buffer,
-			Headers: map[string]string{
+			RequestHeaders: map[string]string{
 				"Content-Type":  bodies[3].contentType,
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				fsys, err := app.NewBackupsFilesystem()
 				if err != nil {
 					t.Fatal(err)
@@ -319,7 +302,7 @@ func TestBackupUpload(t *testing.T) {
 					t.Fatal(err)
 				}
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, _ := getBackupFiles(app)
 				if total := len(files); total != 1 {
 					t.Fatalf("Expected %d backup file, got %d", 1, total)
@@ -327,38 +310,23 @@ func TestBackupUpload(t *testing.T) {
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{"file":{`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (valid file)",
+			Name:   "authorized as admin (valid file)",
 			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
+			Url:    "/api/backups/upload",
 			Body:   bodies[4].buffer,
-			Headers: map[string]string{
+			RequestHeaders: map[string]string{
 				"Content-Type":  bodies[4].contentType,
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, _ := getBackupFiles(app)
 				if total := len(files); total != 1 {
 					t.Fatalf("Expected %d backup file, got %d", 1, total)
 				}
 			},
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "ensure that the default body limit is skipped",
-			Method: http.MethodPost,
-			URL:    "/api/backups/upload",
-			Body:   bytes.NewBuffer(make([]byte, apis.DefaultMaxBodySize+100)),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus:     400, // it doesn't matter as long as it is not 413
-			ExpectedContent:    []string{`"data":{`},
-			NotExpectedContent: []string{"entity too large"},
-			ExpectedEvents:     map[string]int{"*": 0},
 		},
 	}
 
@@ -374,211 +342,148 @@ func TestBackupsDownload(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "with record auth header",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "with superuser auth header",
+			Name:   "with admin auth header",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "with empty or invalid token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "with valid record auth token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "with valid record file token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "with valid superuser auth token",
+			Name:   "with valid admin auth token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "with expired superuser file token",
+			Name:   "with expired admin file token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.nqqtqpPhxU0045F4XP_ruAkzAidYBc5oPy9ErN3XBq0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImFkbWluIn0.g7Q_3UX6H--JWJ7yt1Hoe-1ugTX1KpbKzdt0zjGSe-E",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "with valid superuser file token but missing backup name",
+			Name:   "with valid admin file token but missing backup name",
 			Method: http.MethodGet,
-			URL:    "/api/backups/missing?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/missing?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			ExpectedStatus:  404,
+			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "with valid superuser file token",
+			Name:   "with valid admin file token",
 			Method: http.MethodGet,
-			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				"storage/",
-				"data.db",
-				"auxiliary.db",
+				`storage/`,
+				`data.db`,
+				`logs.db`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "with valid superuser file token and backup name with escaped char",
+			Name:   "with valid admin file token and backup name with escaped char",
 			Method: http.MethodGet,
-			URL:    "/api/backups/%40test4.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/%40test4.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				"storage/",
-				"data.db",
-				"auxiliary.db",
+				`storage/`,
+				`data.db`,
+				`logs.db`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:    "with valid superuser file token AND whitelisted IP",
-			Method:  http.MethodGet,
-			URL:     "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			Headers: map[string]string{"x-test-ip": "127.0.0.1"},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := createTestBackups(app); err != nil {
-					t.Fatal(err)
-				}
-
-				app.Settings().TrustedProxy = core.TrustedProxyConfig{
-					Headers: []string{"x-test-ip"},
-				}
-
-				app.Settings().SuperuserIPs = []string{"127.0.0.1"}
-
-				if err := app.Save(app.Settings()); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				"storage/",
-				"data.db",
-				"auxiliary.db",
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:    "with valid superuser file token BUT non-whitelisted IP",
-			Method:  http.MethodGet,
-			URL:     "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			Headers: map[string]string{"x-test-ip": "127.0.0.1"},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := createTestBackups(app); err != nil {
-					t.Fatal(err)
-				}
-
-				app.Settings().TrustedProxy = core.TrustedProxyConfig{
-					Headers: []string{"x-test-ip"},
-				}
-
-				app.Settings().SuperuserIPs = []string{"0.0.0.0"}
-
-				if err := app.Save(app.Settings()); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 	}
 
@@ -590,7 +495,7 @@ func TestBackupsDownload(t *testing.T) {
 func TestBackupsDelete(t *testing.T) {
 	t.Parallel()
 
-	noTestBackupFilesChanges := func(t testing.TB, app *tests.TestApp) {
+	noTestBackupFilesChanges := func(t *testing.T, app *tests.TestApp) {
 		files, err := getBackupFiles(app)
 		if err != nil {
 			t.Fatal(err)
@@ -606,65 +511,62 @@ func TestBackupsDelete(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/test1.zip",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/test1.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (missing file)",
+			Name:   "authorized as admin (missing file)",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/missing.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/missing.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (existing file with matching active backup)",
+			Name:   "authorized as admin (existing file with matching active backup)",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/test1.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
@@ -672,21 +574,20 @@ func TestBackupsDelete(t *testing.T) {
 				// mock active backup with the same name to delete
 				app.Store().Set(core.StoreKeyActiveBackup, "test1.zip")
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (existing file and no matching active backup)",
+			Name:   "authorized as admin (existing file and no matching active backup)",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/test1.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
@@ -694,7 +595,7 @@ func TestBackupsDelete(t *testing.T) {
 				// mock active backup with different name
 				app.Store().Set(core.StoreKeyActiveBackup, "new.zip")
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
 				if err != nil {
 					t.Fatal(err)
@@ -713,21 +614,20 @@ func TestBackupsDelete(t *testing.T) {
 				}
 			},
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (backup with escaped character)",
+			Name:   "authorized as admin (backup with escaped character)",
 			Method: http.MethodDelete,
-			URL:    "/api/backups/%40test4.zip",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/%40test4.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
 				if err != nil {
 					t.Fatal(err)
@@ -746,7 +646,6 @@ func TestBackupsDelete(t *testing.T) {
 				}
 			},
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 
@@ -762,56 +661,53 @@ func TestBackupsRestore(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodPost,
-			URL:    "/api/backups/test1.zip/restore",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/backups/test1.zip/restore",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/backups/test1.zip/restore",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/backups/test1.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (missing file)",
+			Name:   "authorized as admin (missing file)",
 			Method: http.MethodPost,
-			URL:    "/api/backups/missing.zip/restore",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/missing.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (active backup process)",
+			Name:   "authorized as admin (active backup process)",
 			Method: http.MethodPost,
-			URL:    "/api/backups/test1.zip/restore",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/backups/test1.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := createTestBackups(app); err != nil {
 					t.Fatal(err)
 				}
@@ -820,7 +716,6 @@ func TestBackupsRestore(t *testing.T) {
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 	}
 
@@ -863,7 +758,7 @@ func getBackupFiles(app core.App) ([]*blob.ListObject, error) {
 	return fsys.List("")
 }
 
-func ensureNoBackups(t testing.TB, app *tests.TestApp) {
+func ensureNoBackups(t *testing.T, app *tests.TestApp) {
 	files, err := getBackupFiles(app)
 	if err != nil {
 		t.Fatal(err)

apis/backup_upload.go

@@ -1,72 +0,0 @@
-package apis
-
-import (
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/core/validators"
-	"github.com/pocketbase/pocketbase/tools/filesystem"
-)
-
-func backupUpload(e *core.RequestEvent) error {
-	fsys, err := e.App.NewBackupsFilesystem()
-	if err != nil {
-		return err
-	}
-	defer fsys.Close()
-
-	form := new(backupUploadForm)
-	form.fsys = fsys
-	files, _ := e.FindUploadedFiles("file")
-	if len(files) > 0 {
-		form.File = files[0]
-	}
-
-	err = form.validate()
-	if err != nil {
-		return e.BadRequestError("An error occurred while validating the submitted data.", err)
-	}
-
-	err = fsys.UploadFile(form.File, form.File.OriginalName)
-	if err != nil {
-		return e.BadRequestError("Failed to upload backup.", err)
-	}
-
-	// we don't retrieve the generated backup file because it may not be
-	// available yet due to the eventually consistent nature of some S3 providers
-	return e.NoContent(http.StatusNoContent)
-}
-
-// -------------------------------------------------------------------
-
-type backupUploadForm struct {
-	fsys *filesystem.System
-
-	File *filesystem.File `json:"file"`
-}
-
-func (form *backupUploadForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(
-			&form.File,
-			validation.Required,
-			validation.By(validators.UploadedFileMimeType([]string{"application/zip"})),
-			validation.By(form.checkUniqueName),
-		),
-	)
-}
-
-func (form *backupUploadForm) checkUniqueName(value any) error {
-	v, _ := value.(*filesystem.File)
-	if v == nil {
-		return nil // nothing to check
-	}
-
-	// note: we use the original name because that is what we upload
-	if exists, err := form.fsys.Exists(v.OriginalName); err != nil || exists {
-		return validation.NewError("validation_backup_name_exists", "Backup file with the specified name already exists.")
-	}
-
-	return nil
-}

apis/base.go

@@ -1,180 +1,266 @@
+// Package apis implements the default PocketBase api services and middlewares.
 package apis
 
 import (
+	"database/sql"
 	"errors"
 	"fmt"
 	"io/fs"
+	"log/slog"
 	"net/http"
+	"net/url"
 	"path/filepath"
 	"strings"
+	"time"
 
+	"github.com/labstack/echo/v5"
+	"github.com/labstack/echo/v5/middleware"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/ui"
+	"github.com/spf13/cast"
 )
 
-// StaticWildcardParam is the name of Static handler wildcard parameter.
-const StaticWildcardParam = "path"
+const trailedAdminPath = "/_/"
 
-// NewRouter returns a new router instance loaded with the default app middlewares and routes.
-func NewRouter(app core.App) (*router.Router[*core.RequestEvent], error) {
-	pbRouter := router.NewRouter(func(w http.ResponseWriter, r *http.Request) (*core.RequestEvent, router.EventCleanupFunc) {
-		event := new(core.RequestEvent)
-		event.Response = w
-		event.Request = r
-		event.App = app
+// InitApi creates a configured echo instance with registered
+// system and app specific routes and middlewares.
+func InitApi(app core.App) (*echo.Echo, error) {
+	e := echo.New()
+	e.Debug = false
+	e.Binder = &rest.MultiBinder{}
+	e.JSONSerializer = &rest.Serializer{
+		FieldsParam: fieldsQueryParam,
+	}
 
-		return event, nil
+	// configure a custom router
+	e.ResetRouterCreator(func(ec *echo.Echo) echo.Router {
+		return echo.NewRouter(echo.RouterConfig{
+			UnescapePathParamValues: true,
+			AllowOverwritingRoute:   true,
+		})
 	})
 
-	// register default middlewares
-	pbRouter.Bind(activityLogger())
-	pbRouter.Bind(panicRecover())
-	pbRouter.Bind(rateLimit())
-	pbRouter.Bind(loadAuthToken())
-	pbRouter.Bind(superuserIPsWhitelist())
-	pbRouter.Bind(securityHeaders())
-	pbRouter.Bind(BodyLimit(DefaultMaxBodySize))
+	// default middlewares
+	e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{
+		Skipper: func(c echo.Context) bool {
+			// enable by default only for the API routes
+			return !strings.HasPrefix(c.Request().URL.Path, "/api/")
+		},
+	}))
+	e.Pre(LoadAuthContext(app))
+	e.Use(middleware.Recover())
+	e.Use(middleware.Secure())
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set(ContextExecStartKey, time.Now())
 
-	// API routes
-	apiGroup := pbRouter.Group("/api")
-	bindSettingsApi(app, apiGroup)
-	bindCollectionApi(app, apiGroup)
-	bindRecordCrudApi(app, apiGroup)
-	bindRecordAuthApi(app, apiGroup)
-	bindLogsApi(app, apiGroup)
-	bindBackupApi(app, apiGroup)
-	bindCronApi(app, apiGroup)
-	bindFileApi(app, apiGroup)
-	bindBatchApi(app, apiGroup)
-	bindRealtimeApi(app, apiGroup)
-	bindHealthApi(app, apiGroup)
-	bindSQLApi(app, apiGroup)
+			return next(c)
+		}
+	})
 
-	// UI routes
-	bindUIExtensions(app)
-
-	return pbRouter, nil
-}
-
-// WrapStdHandler wraps Go [http.Handler] into a PocketBase handler func.
-func WrapStdHandler(h http.Handler) func(*core.RequestEvent) error {
-	return func(e *core.RequestEvent) error {
-		h.ServeHTTP(e.Response, e.Request)
-		return nil
-	}
-}
-
-// WrapStdMiddleware wraps Go [func(http.Handler) http.Handle] into a PocketBase middleware func.
-func WrapStdMiddleware(m func(http.Handler) http.Handler) func(*core.RequestEvent) error {
-	return func(e *core.RequestEvent) (err error) {
-		m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			e.Response = w
-			e.Request = r
-			err = e.Next()
-		})).ServeHTTP(e.Response, e.Request)
-		return err
-	}
-}
-
-// MustSubFS returns an [fs.FS] corresponding to the subtree rooted at fsys's dir.
-//
-// This is similar to [fs.Sub] but panics on failure.
-func MustSubFS(fsys fs.FS, dir string) fs.FS {
-	dir = filepath.ToSlash(filepath.Clean(dir)) // ToSlash in case of Windows path
-
-	sub, err := fs.Sub(fsys, dir)
-	if err != nil {
-		panic(fmt.Errorf("failed to create sub FS: %w", err))
-	}
-
-	return sub
-}
-
-// Static is a handler function to serve static directory content from fsys.
-//
-// If a file resource is missing and indexFallback is true, the request
-// will be forwarded to the base index.html (useful for SPA with pretty urls).
-//
-// NB! Expects the route to have a "{path...}" wildcard parameter.
-//
-// Special redirects:
-//   - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
-//   - if "path" is a directory that has index.html, the index.html file is rendered,
-//     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is true
-//
-// Example:
-//
-//	fsys := os.DirFS("./pb_public")
-//	router.GET("/files/{path...}", apis.Static(fsys, false))
-func Static(fsys fs.FS, indexFallback bool) func(*core.RequestEvent) error {
-	if fsys == nil {
-		panic("Static: the provided fs.FS argument is nil")
-	}
-
-	return func(e *core.RequestEvent) error {
-		// disable the activity logger to avoid flooding with messages
-		//
-		// note: errors are still logged
-		if e.Get(requestEventKeySkipSuccessActivityLog) == nil {
-			e.Set(requestEventKeySkipSuccessActivityLog, true)
+	// custom error handler
+	e.HTTPErrorHandler = func(c echo.Context, err error) {
+		if err == nil {
+			return // no error
 		}
 
-		filename := e.Request.PathValue(StaticWildcardParam)
-		filename = filepath.ToSlash(filepath.Clean(strings.TrimPrefix(filename, "/")))
+		var apiErr *ApiError
 
-		// eagerly check for directory traversal
-		//
-		// note: this is just out of an abundance of caution because the fs.FS implementation could be non-std,
-		// but usually shouldn't be necessary since os.DirFS.Open is expected to fail if the filename starts with dots
-		if len(filename) > 2 && filename[0] == '.' && filename[1] == '.' && (filename[2] == '/' || filename[2] == '\\') {
-			if indexFallback && filename != router.IndexPage {
-				return e.FileFS(fsys, router.IndexPage)
+		if errors.As(err, &apiErr) {
+			// already an api error...
+		} else if v := new(echo.HTTPError); errors.As(err, &v) {
+			msg := fmt.Sprintf("%v", v.Message)
+			apiErr = NewApiError(v.Code, msg, v)
+		} else {
+			if errors.Is(err, sql.ErrNoRows) {
+				apiErr = NewNotFoundError("", err)
+			} else {
+				apiErr = NewBadRequestError("", err)
 			}
-			return router.ErrFileNotFound
 		}
 
-		fi, err := fs.Stat(fsys, filename)
-		if err != nil {
-			if indexFallback && filename != router.IndexPage {
-				return e.FileFS(fsys, router.IndexPage)
+		logRequest(app, c, apiErr)
+
+		if c.Response().Committed {
+			return // already committed
+		}
+
+		event := new(core.ApiErrorEvent)
+		event.HttpContext = c
+		event.Error = apiErr
+
+		// send error response
+		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
 			}
-			return router.ErrFileNotFound
-		}
 
-		if fi.IsDir() {
-			// redirect to a canonical dir url, aka. with trailing slash
-			if !strings.HasSuffix(e.Request.URL.Path, "/") {
-				return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(e.Request.URL.Path+"/"))
+			// @see https://github.com/labstack/echo/issues/608
+			if e.HttpContext.Request().Method == http.MethodHead {
+				return e.HttpContext.NoContent(apiErr.Code)
+			}
+
+			return e.HttpContext.JSON(apiErr.Code, apiErr)
+		})
+
+		if hookErr == nil {
+			if err := app.OnAfterApiError().Trigger(event); err != nil {
+				app.Logger().Debug("OnAfterApiError failure", slog.String("error", err.Error()))
 			}
 		} else {
-			urlPath := e.Request.URL.Path
-			if strings.HasSuffix(urlPath, "/") {
-				// redirect to a non-trailing slash file route
-				urlPath = strings.TrimRight(urlPath, "/")
-				if len(urlPath) > 0 {
-					return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(urlPath))
-				}
-			} else if stripped, ok := strings.CutSuffix(urlPath, router.IndexPage); ok {
-				// redirect without the index.html
-				return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(stripped))
-			}
+			app.Logger().Debug("OnBeforeApiError error (truly rare case, eg. client already disconnected)", slog.String("error", hookErr.Error()))
 		}
+	}
 
-		fileErr := e.FileFS(fsys, filename)
+	// admin ui routes
+	bindStaticAdminUI(app, e)
 
-		if fileErr != nil && indexFallback && filename != router.IndexPage && errors.Is(fileErr, router.ErrFileNotFound) {
-			return e.FileFS(fsys, router.IndexPage)
+	// default routes
+	api := e.Group("/api", eagerRequestInfoCache(app))
+	bindSettingsApi(app, api)
+	bindAdminApi(app, api)
+	bindCollectionApi(app, api)
+	bindRecordCrudApi(app, api)
+	bindRecordAuthApi(app, api)
+	bindFileApi(app, api)
+	bindRealtimeApi(app, api)
+	bindLogsApi(app, api)
+	bindHealthApi(app, api)
+	bindBackupApi(app, api)
+
+	// catch all any route
+	api.Any("/*", func(c echo.Context) error {
+		return echo.ErrNotFound
+	}, ActivityLogger(app))
+
+	return e, nil
+}
+
+// StaticDirectoryHandler is similar to `echo.StaticDirectoryHandler`
+// but without the directory redirect which conflicts with RemoveTrailingSlash middleware.
+//
+// If a file resource is missing and indexFallback is set, the request
+// will be forwarded to the base index.html (useful also for SPA).
+//
+// @see https://github.com/labstack/echo/issues/2211
+func StaticDirectoryHandler(fileSystem fs.FS, indexFallback bool) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		p := c.PathParam("*")
+
+		// escape url path
+		tmpPath, err := url.PathUnescape(p)
+		if err != nil {
+			return fmt.Errorf("failed to unescape path variable: %w", err)
+		}
+		p = tmpPath
+
+		// fs.FS.Open() already assumes that file names are relative to FS root path and considers name with prefix `/` as invalid
+		name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))
+
+		fileErr := c.FileFS(name, fileSystem)
+
+		if fileErr != nil && indexFallback && errors.Is(fileErr, echo.ErrNotFound) {
+			return c.FileFS("index.html", fileSystem)
 		}
 
 		return fileErr
 	}
 }
 
-// safeRedirectPath normalizes the path string by replacing all beginning slashes
-// (`\\`, `//`, `\/`) with a single forward slash to prevent open redirect attacks
-func safeRedirectPath(path string) string {
-	if len(path) > 1 && (path[0] == '\\' || path[0] == '/') && (path[1] == '\\' || path[1] == '/') {
-		path = "/" + strings.TrimLeft(path, `/\`)
+// bindStaticAdminUI registers the endpoints that serves the static admin UI.
+func bindStaticAdminUI(app core.App, e *echo.Echo) error {
+	// redirect to trailing slash to ensure that relative urls will still work properly
+	e.GET(
+		strings.TrimRight(trailedAdminPath, "/"),
+		func(c echo.Context) error {
+			return c.Redirect(http.StatusTemporaryRedirect, strings.TrimLeft(trailedAdminPath, "/"))
+		},
+	)
+
+	// serves static files from the /ui/dist directory
+	// (similar to echo.StaticFS but with gzip middleware enabled)
+	e.GET(
+		trailedAdminPath+"*",
+		echo.StaticDirectoryHandler(ui.DistDirFS, false),
+		installerRedirect(app),
+		uiCacheControl(),
+		middleware.Gzip(),
+	)
+
+	return nil
+}
+
+func uiCacheControl() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			// add default Cache-Control header for all Admin UI resources
+			// (ignoring the root admin path)
+			if c.Request().URL.Path != trailedAdminPath {
+				c.Response().Header().Set("Cache-Control", "max-age=1209600, stale-while-revalidate=86400")
+			}
+
+			return next(c)
+		}
 	}
-	return path
+}
+
+const hasAdminsCacheKey = "@hasAdmins"
+
+func updateHasAdminsCache(app core.App) error {
+	total, err := app.Dao().TotalAdmins()
+	if err != nil {
+		return err
+	}
+
+	app.Store().Set(hasAdminsCacheKey, total > 0)
+
+	return nil
+}
+
+// installerRedirect redirects the user to the installer admin UI page
+// when the application needs some preliminary configurations to be done.
+func installerRedirect(app core.App) echo.MiddlewareFunc {
+	// keep hasAdminsCacheKey value up-to-date
+	app.OnAdminAfterCreateRequest().Add(func(data *core.AdminCreateEvent) error {
+		return updateHasAdminsCache(app)
+	})
+
+	app.OnAdminAfterDeleteRequest().Add(func(data *core.AdminDeleteEvent) error {
+		return updateHasAdminsCache(app)
+	})
+
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			// skip redirect checks for non-root level index.html requests
+			path := c.Request().URL.Path
+			if path != trailedAdminPath && path != trailedAdminPath+"index.html" {
+				return next(c)
+			}
+
+			hasAdmins := cast.ToBool(app.Store().Get(hasAdminsCacheKey))
+
+			if !hasAdmins {
+				// update the cache to make sure that the admin wasn't created by another process
+				if err := updateHasAdminsCache(app); err != nil {
+					return err
+				}
+				hasAdmins = cast.ToBool(app.Store().Get(hasAdminsCacheKey))
+			}
+
+			_, hasInstallerParam := c.Request().URL.Query()["installer"]
+
+			if !hasAdmins && !hasInstallerParam {
+				// redirect to the installer page
+				return c.Redirect(http.StatusTemporaryRedirect, "?installer#")
+			}
+
+			if hasAdmins && hasInstallerParam {
+				// clear the installer param
+				return c.Redirect(http.StatusTemporaryRedirect, "?")
+			}
+
+			return next(c)
+		}
+	}
 }

apis/base_test.go

@@ -1,313 +1,422 @@
 package apis_test
 
 import (
+	"database/sql"
+	"errors"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/spf13/cast"
 )
 
-func TestWrapStdHandler(t *testing.T) {
+func Test404(t *testing.T) {
 	t.Parallel()
 
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	rec := httptest.NewRecorder()
-
-	e := new(core.RequestEvent)
-	e.App = app
-	e.Request = req
-	e.Response = rec
-
-	err := apis.WrapStdHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte("test"))
-	}))(e)
-	if err != nil {
-		t.Fatal(err)
+	scenarios := []tests.ApiScenario{
+		{
+			Method:          http.MethodGet,
+			Url:             "/api/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Method:          http.MethodPost,
+			Url:             "/api/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Method:          http.MethodPatch,
+			Url:             "/api/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Method:          http.MethodDelete,
+			Url:             "/api/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Method:         http.MethodHead,
+			Url:            "/api/missing",
+			ExpectedStatus: 404,
+		},
 	}
 
-	if body := rec.Body.String(); body != "test" {
-		t.Fatalf("Expected body %q, got %q", "test", body)
+	for _, scenario := range scenarios {
+		scenario.Test(t)
 	}
 }
 
-func TestWrapStdMiddleware(t *testing.T) {
+func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 	t.Parallel()
 
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	rec := httptest.NewRecorder()
-
-	e := new(core.RequestEvent)
-	e.App = app
-	e.Request = req
-	e.Response = rec
-
-	err := apis.WrapStdMiddleware(func(h http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.Write([]byte("test"))
-		})
-	})(e)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if body := rec.Body.String(); body != "test" {
-		t.Fatalf("Expected body %q, got %q", "test", body)
-	}
-}
-
-func TestStatic(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	dir := createTestDir(t)
-	defer os.RemoveAll(dir)
-
-	fsys := os.DirFS(filepath.Join(dir, "sub"))
-
-	type staticScenario struct {
-		path           string
-		indexFallback  bool
-		expectedStatus int
-		expectBody     string
-		expectError    bool
-	}
-
-	scenarios := []staticScenario{
+	scenarios := []tests.ApiScenario{
 		{
-			path:           "",
-			indexFallback:  false,
-			expectedStatus: 200,
-			expectBody:     "sub index.html",
-			expectError:    false,
-		},
-		{
-			path:           "missing/a/b/c",
-			indexFallback:  false,
-			expectedStatus: 404,
-			expectBody:     "",
-			expectError:    true,
-		},
-		{
-			path:           "missing/a/b/c",
-			indexFallback:  true,
-			expectedStatus: 200,
-			expectBody:     "sub index.html",
-			expectError:    false,
-		},
-		{
-			path:           "testroot", // parent directory file
-			indexFallback:  false,
-			expectedStatus: 404,
-			expectBody:     "",
-			expectError:    true,
-		},
-		{
-			path:           "test",
-			indexFallback:  false,
-			expectedStatus: 200,
-			expectBody:     "sub test",
-			expectError:    false,
-		},
-		{
-			path:           "sub2",
-			indexFallback:  false,
-			expectedStatus: 301,
-			expectBody:     "",
-			expectError:    false,
-		},
-		{
-			path:           "sub2/",
-			indexFallback:  false,
-			expectedStatus: 200,
-			expectBody:     "sub2 index.html",
-			expectError:    false,
-		},
-		{
-			path:           "sub2/test",
-			indexFallback:  false,
-			expectedStatus: 200,
-			expectBody:     "sub2 test",
-			expectError:    false,
-		},
-		{
-			path:           "sub2/test/",
-			indexFallback:  false,
-			expectedStatus: 301,
-			expectBody:     "",
-			expectError:    false,
-		},
-	}
-
-	// extra directory traversal checks
-	dtp := []string{
-		"/../",
-		"\\../",
-		"../",
-		"../../",
-		"..\\",
-		"..\\..\\",
-		"../..\\",
-		"..\\..//",
-		`%2e%2e%2f`,
-		`%2e%2e%2f%2e%2e%2f`,
-		`%2e%2e/`,
-		`%2e%2e/%2e%2e/`,
-		`..%2f`,
-		`..%2f..%2f`,
-		`%2e%2e%5c`,
-		`%2e%2e%5c%2e%2e%5c`,
-		`%2e%2e\`,
-		`%2e%2e\%2e%2e\`,
-		`..%5c`,
-		`..%5c..%5c`,
-		`%252e%252e%255c`,
-		`%252e%252e%255c%252e%252e%255c`,
-		`..%255c`,
-		`..%255c..%255c`,
-	}
-	for _, p := range dtp {
-		scenarios = append(scenarios,
-			staticScenario{
-				path:           p + "testroot",
-				indexFallback:  false,
-				expectedStatus: 404,
-				expectBody:     "",
-				expectError:    true,
+			Name:   "custom route",
+			Method: http.MethodGet,
+			Url:    "/custom",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
 			},
-			staticScenario{
-				path:           p + "testroot",
-				indexFallback:  true,
-				expectedStatus: 200,
-				expectBody:     "sub index.html",
-				expectError:    false,
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "custom route with url encoded parameter",
+			Method: http.MethodGet,
+			Url:    "/a%2Bb%2Bc",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/:param",
+					Handler: func(c echo.Context) error {
+						return c.String(200, c.PathParam("param"))
+					},
+				})
 			},
-		)
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"a+b+c"},
+		},
+		{
+			Name:   "route with HTTPError",
+			Method: http.MethodGet,
+			Url:    "/http-error",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/http-error",
+					Handler: func(c echo.Context) error {
+						return echo.ErrBadRequest
+					},
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`{"code":400,"message":"Bad Request.","data":{}}`},
+		},
+		{
+			Name:   "route with api error",
+			Method: http.MethodGet,
+			Url:    "/api-error",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/api-error",
+					Handler: func(c echo.Context) error {
+						return apis.NewApiError(500, "test message", errors.New("internal_test"))
+					},
+				})
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{`{"code":500,"message":"Test message.","data":{}}`},
+		},
+		{
+			Name:   "route with plain error",
+			Method: http.MethodGet,
+			Url:    "/plain-error",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/plain-error",
+					Handler: func(c echo.Context) error {
+						return errors.New("Test error")
+					},
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`{"code":400,"message":"Something went wrong while processing your request.","data":{}}`},
+		},
 	}
 
-	for i, s := range scenarios {
-		t.Run(fmt.Sprintf("%d_%s_%v", i, s.path, s.indexFallback), func(t *testing.T) {
-			req := httptest.NewRequest(http.MethodGet, "/"+s.path, nil)
-			req.SetPathValue(apis.StaticWildcardParam, s.path)
-
-			rec := httptest.NewRecorder()
-
-			e := new(core.RequestEvent)
-			e.App = app
-			e.Request = req
-			e.Response = rec
-
-			err := apis.Static(fsys, s.indexFallback)(e)
-
-			hasErr := err != nil
-			if hasErr != s.expectError {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			body := rec.Body.String()
-			if body != s.expectBody {
-				t.Fatalf("Expected body %q, got %q", s.expectBody, body)
-			}
-
-			if hasErr {
-				apiErr := router.ToApiError(err)
-				if apiErr.Status != s.expectedStatus {
-					t.Fatalf("Expected status code %d, got %d", s.expectedStatus, apiErr.Status)
-				}
-			}
-		})
+	for _, scenario := range scenarios {
+		scenario.Test(t)
 	}
 }
 
-func TestMustSubFS(t *testing.T) {
+func TestRemoveTrailingSlashMiddleware(t *testing.T) {
 	t.Parallel()
 
-	dir := createTestDir(t)
-	defer os.RemoveAll(dir)
-
-	// invalid path (no beginning and ending slashes)
-	if !hasPanicked(func() {
-		apis.MustSubFS(os.DirFS(dir), "/test/")
-	}) {
-		t.Fatalf("Expected to panic")
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "non /api/* route (exact match)",
+			Method: http.MethodGet,
+			Url:    "/custom",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "non /api/* route (with trailing slash)",
+			Method: http.MethodGet,
+			Url:    "/custom/",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "/api/* route (exact match)",
+			Method: http.MethodGet,
+			Url:    "/api/custom",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/api/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "/api/* route (with trailing slash)",
+			Method: http.MethodGet,
+			Url:    "/api/custom/",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/api/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
 	}
 
-	// valid path
-	if hasPanicked(func() {
-		apis.MustSubFS(os.DirFS(dir), "./////a/b/c") // checks if ToSlash was called
-	}) {
-		t.Fatalf("Didn't expect to panic")
-	}
-
-	// check sub content
-	sub := apis.MustSubFS(os.DirFS(dir), "sub")
-
-	_, err := sub.Open("test")
-	if err != nil {
-		t.Fatalf("Missing expected file sub/test")
+	for _, scenario := range scenarios {
+		scenario.Test(t)
 	}
 }
 
-// -------------------------------------------------------------------
+func TestMultiBinder(t *testing.T) {
+	t.Parallel()
 
-func hasPanicked(f func()) (didPanic bool) {
-	defer func() {
-		if r := recover(); r != nil {
-			didPanic = true
-		}
-	}()
-	f()
-	return
-}
+	rawJson := `{"name":"test123"}`
 
-// note: make sure to call os.RemoveAll(dir) after you are done
-// working with the created test dir.
-func createTestDir(t *testing.T) string {
-	dir, err := os.MkdirTemp(os.TempDir(), "test_dir")
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: rawJson,
+	})
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("root index.html"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "testroot"), []byte("root test"), 0644); err != nil {
-		t.Fatal(err)
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "non-api group route",
+			Method: "POST",
+			Url:    "/custom",
+			Body:   strings.NewReader(rawJson),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: "POST",
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+
+						if err := c.Bind(data); err != nil {
+							return err
+						}
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return c.NoContent(200)
+					},
+				})
+			},
+			ExpectedStatus: 200,
+		},
+		{
+			Name:   "api group route",
+			Method: "GET",
+			Url:    "/api/admins",
+			Body:   strings.NewReader(rawJson),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+					return func(c echo.Context) error {
+						// it is not important whether the route handler return an error since
+						// we just need to ensure that the eagerRequestInfoCache was registered
+						next(c)
+
+						// ensure that the body was read at least once
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+						c.Bind(data)
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return nil
+					}
+				})
+			},
+			ExpectedStatus: 200,
+		},
+		{
+			Name:   "custom route with @jsonPayload as multipart body",
+			Method: "POST",
+			Url:    "/custom",
+			Body:   formData,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: "POST",
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+
+						if err := c.Bind(data); err != nil {
+							return err
+						}
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return c.NoContent(200)
+					},
+				})
+			},
+			ExpectedStatus: 200,
+		},
 	}
 
-	if err := os.MkdirAll(filepath.Join(dir, "sub"), os.ModePerm); err != nil {
-		t.Fatal(err)
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestErrorHandler(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "apis.ApiError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return apis.NewApiError(418, "test", nil)
+				})
+			},
+			ExpectedStatus:  418,
+			ExpectedContent: []string{`"message":"Test."`},
+		},
+		{
+			Name:   "wrapped apis.ApiError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", apis.NewApiError(418, "test", nil))
+				})
+			},
+			ExpectedStatus:     418,
+			ExpectedContent:    []string{`"message":"Test."`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "echo.HTTPError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return echo.NewHTTPError(418, "test")
+				})
+			},
+			ExpectedStatus:  418,
+			ExpectedContent: []string{`"message":"Test."`},
+		},
+		{
+			Name:   "wrapped echo.HTTPError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", echo.NewHTTPError(418, "test"))
+				})
+			},
+			ExpectedStatus:     418,
+			ExpectedContent:    []string{`"message":"Test."`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "wrapped sql.ErrNoRows",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", sql.ErrNoRows)
+				})
+			},
+			ExpectedStatus:     404,
+			ExpectedContent:    []string{`"data":{}`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "custom error",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123")
+				})
+			},
+			ExpectedStatus:     400,
+			ExpectedContent:    []string{`"data":{}`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "sub/index.html"), []byte("sub index.html"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "sub/test"), []byte("sub test"), 0644); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := os.MkdirAll(filepath.Join(dir, "sub", "sub2"), os.ModePerm); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "sub/sub2/index.html"), []byte("sub2 index.html"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "sub/sub2/test"), []byte("sub2 test"), 0644); err != nil {
-		t.Fatal(err)
-	}
-
-	return dir
 }

apis/batch.go

@@ -1,550 +0,0 @@
-package apis
-
-import (
-	"bytes"
-	"encoding/json/v2"
-	"errors"
-	"io"
-	"mime/multipart"
-	"net/http"
-	"net/http/httptest"
-	"regexp"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/filesystem"
-	"github.com/pocketbase/pocketbase/tools/router"
-	"github.com/pocketbase/pocketbase/tools/routine"
-	"github.com/pocketbase/pocketbase/tools/types"
-	"github.com/spf13/cast"
-)
-
-func bindBatchApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	sub := rg.Group("/batch")
-	sub.POST("", batchTransaction).Unbind(DefaultBodyLimitMiddlewareId) // the body limit is inlined
-}
-
-type HandleFunc func(e *core.RequestEvent) error
-
-type BatchActionHandlerFunc func(app core.App, ir *core.InternalRequest, params map[string]string, next func(data any) error) HandleFunc
-
-// ValidBatchActions defines a map with the supported batch InternalRequest actions.
-//
-// Note: when adding new routes make sure that their middlewares are inlined!
-var ValidBatchActions = map[*regexp.Regexp]BatchActionHandlerFunc{
-	// "upsert" handler
-	regexp.MustCompile(`^PUT /api/collections/(?P<collection>[^\/\?]+)/records(?P<query>\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
-		var id string
-		if len(ir.Body) > 0 && ir.Body["id"] != "" {
-			id = cast.ToString(ir.Body["id"])
-		}
-		if id != "" {
-			_, err := app.FindRecordById(params["collection"], id)
-			if err == nil {
-				// update
-				// ---
-				params["id"] = id // required for the path value
-				ir.Method = "PATCH"
-				ir.URL = "/api/collections/" + params["collection"] + "/records/" + id + params["query"]
-				return recordUpdate(false, next)
-			}
-		}
-
-		// create
-		// ---
-		ir.Method = "POST"
-		ir.URL = "/api/collections/" + params["collection"] + "/records" + params["query"]
-		return recordCreate(false, next)
-	},
-	regexp.MustCompile(`^POST /api/collections/(?P<collection>[^\/\?]+)/records(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
-		return recordCreate(false, next)
-	},
-	regexp.MustCompile(`^PATCH /api/collections/(?P<collection>[^\/\?]+)/records/(?P<id>[^\/\?]+)(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
-		return recordUpdate(false, next)
-	},
-	regexp.MustCompile(`^DELETE /api/collections/(?P<collection>[^\/\?]+)/records/(?P<id>[^\/\?]+)(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
-		return recordDelete(false, next)
-	},
-}
-
-type BatchRequestResult struct {
-	Body   any `json:"body"`
-	Status int `json:"status"`
-}
-
-type batchRequestsForm struct {
-	Requests []*core.InternalRequest `form:"requests" json:"requests"`
-
-	max int
-}
-
-func (brs batchRequestsForm) validate() error {
-	return validation.ValidateStruct(&brs,
-		validation.Field(&brs.Requests, validation.Required, validation.Length(0, brs.max)),
-	)
-}
-
-// NB! When the request is submitted as multipart/form-data,
-// the regular fields data is expected to be submitted as serialized
-// json under the @jsonPayload field and file keys need to follow the
-// pattern "requests.N.fileField" or  requests[N].fileField.
-func batchTransaction(e *core.RequestEvent) error {
-	maxRequests := e.App.Settings().Batch.MaxRequests
-	if !e.App.Settings().Batch.Enabled || maxRequests <= 0 {
-		return e.ForbiddenError("Batch requests are not allowed.", nil)
-	}
-
-	txTimeout := time.Duration(e.App.Settings().Batch.Timeout) * time.Second
-	if txTimeout <= 0 {
-		txTimeout = 3 * time.Second // for now always limit
-	}
-
-	maxBodySize := e.App.Settings().Batch.MaxBodySize
-	if maxBodySize <= 0 {
-		maxBodySize = 128 << 20
-	}
-
-	err := applyBodyLimit(e, maxBodySize)
-	if err != nil {
-		return err
-	}
-
-	form := &batchRequestsForm{max: maxRequests}
-
-	// load base requests data
-	err = e.BindBody(form)
-	if err != nil {
-		return e.BadRequestError("Failed to read the submitted batch data.", err)
-	}
-
-	// load uploaded files into each request item
-	// note: expects the files to be under "requests.N.fileField" or "requests[N].fileField" format
-	// 		 (the other regular fields must be put under `@jsonPayload` as serialized json)
-	if strings.HasPrefix(e.Request.Header.Get("Content-Type"), "multipart/form-data") {
-		for i, ir := range form.Requests {
-			iStr := strconv.Itoa(i)
-
-			files, err := extractPrefixedFiles(e.Request, "requests."+iStr+".", "requests["+iStr+"].")
-			if err != nil {
-				return e.BadRequestError("Failed to read the submitted batch files data.", err)
-			}
-
-			for key, files := range files {
-				if ir.Body == nil {
-					ir.Body = map[string]any{}
-				}
-				ir.Body[key] = files
-			}
-		}
-	}
-
-	// validate batch request form
-	err = form.validate()
-	if err != nil {
-		return e.BadRequestError("Invalid batch request data.", err)
-	}
-
-	event := new(core.BatchRequestEvent)
-	event.RequestEvent = e
-	event.Batch = form.Requests
-
-	return e.App.OnBatchRequest().Trigger(event, func(e *core.BatchRequestEvent) error {
-		bp := batchProcessor{
-			app:         e.App,
-			baseEvent:   e.RequestEvent,
-			infoContext: core.RequestInfoContextBatch,
-		}
-
-		if err := bp.Process(e.Batch, txTimeout); err != nil {
-			return firstApiError(err, e.BadRequestError("Batch transaction failed.", err))
-		}
-
-		return e.JSON(http.StatusOK, bp.results)
-	})
-}
-
-type batchProcessor struct {
-	app         core.App
-	baseEvent   *core.RequestEvent
-	infoContext string
-	results     []*BatchRequestResult
-	failedIndex int
-	errCh       chan error
-	stopCh      chan struct{}
-}
-
-func (p *batchProcessor) Process(batch []*core.InternalRequest, timeout time.Duration) error {
-	p.results = make([]*BatchRequestResult, 0, len(batch))
-
-	if p.stopCh != nil {
-		close(p.stopCh)
-	}
-	p.stopCh = make(chan struct{}, 1)
-
-	if p.errCh != nil {
-		close(p.errCh)
-	}
-	p.errCh = make(chan error, 1)
-
-	return p.app.RunInTransaction(func(txApp core.App) error {
-		// used to interupts the recursive processing calls in case of a timeout or connection close
-		defer func() {
-			p.stopCh <- struct{}{}
-		}()
-
-		routine.FireAndForget(func() {
-			err := p.process(txApp, batch, 0)
-
-			if err != nil {
-				err = validation.Errors{
-					"requests": validation.Errors{
-						strconv.Itoa(p.failedIndex): &BatchResponseError{
-							code:    "batch_request_failed",
-							message: "Batch request failed.",
-							err:     router.ToApiError(err),
-						},
-					},
-				}
-			}
-
-			// note: to avoid copying and due to the process recursion the final results order is reversed
-			if err == nil {
-				slices.Reverse(p.results)
-			}
-
-			p.errCh <- err
-		})
-
-		select {
-		case responseErr := <-p.errCh:
-			return responseErr
-		case <-time.After(timeout):
-			// note: we don't return 408 Reques Timeout error because
-			// some browsers perform automatic retry behind the scenes
-			// which are hard to debug and unnecessary
-			return errors.New("batch transaction timeout")
-		case <-p.baseEvent.Request.Context().Done():
-			return errors.New("batch request interrupted")
-		}
-	})
-}
-
-func (p *batchProcessor) process(activeApp core.App, batch []*core.InternalRequest, i int) error {
-	select {
-	case <-p.stopCh:
-		return nil
-	default:
-		if len(batch) == 0 {
-			return nil
-		}
-
-		result, err := processInternalRequest(
-			activeApp,
-			p.baseEvent,
-			batch[0],
-			p.infoContext,
-			func(_ any) error {
-				if len(batch) == 1 {
-					return nil
-				}
-
-				err := p.process(activeApp, batch[1:], i+1)
-
-				// update the failed batch index (if not already)
-				if err != nil && p.failedIndex == 0 {
-					p.failedIndex = i + 1
-				}
-
-				return err
-			},
-		)
-
-		if err != nil {
-			return err
-		}
-
-		p.results = append(p.results, result)
-
-		return nil
-	}
-}
-
-func processInternalRequest(
-	activeApp core.App,
-	baseEvent *core.RequestEvent,
-	ir *core.InternalRequest,
-	infoContext string,
-	optNext func(data any) error,
-) (*BatchRequestResult, error) {
-	handle, params, ok := prepareInternalAction(activeApp, ir, optNext)
-	if !ok {
-		return nil, errors.New("unknown batch request action")
-	}
-
-	// construct a new http.Request
-	// ---------------------------------------------------------------
-	buf, mw, err := multipartDataFromInternalRequest(ir)
-	if err != nil {
-		return nil, err
-	}
-
-	r, err := http.NewRequest(strings.ToUpper(ir.Method), ir.URL, buf)
-	if err != nil {
-		return nil, err
-	}
-
-	// cleanup multipart temp files
-	defer func() {
-		if r.MultipartForm != nil {
-			if err := r.MultipartForm.RemoveAll(); err != nil {
-				activeApp.Logger().Warn("failed to cleanup temp batch files", "error", err)
-			}
-		}
-	}()
-
-	// load batch request path params
-	// ---
-	for k, v := range params {
-		r.SetPathValue(k, v)
-	}
-
-	// clone original request
-	// ---
-	r.RequestURI = r.URL.RequestURI()
-	r.Proto = baseEvent.Request.Proto
-	r.ProtoMajor = baseEvent.Request.ProtoMajor
-	r.ProtoMinor = baseEvent.Request.ProtoMinor
-	r.Host = baseEvent.Request.Host
-	r.RemoteAddr = baseEvent.Request.RemoteAddr
-	r.TLS = baseEvent.Request.TLS
-
-	if s := baseEvent.Request.TransferEncoding; s != nil {
-		s2 := make([]string, len(s))
-		copy(s2, s)
-		r.TransferEncoding = s2
-	}
-
-	if baseEvent.Request.Trailer != nil {
-		r.Trailer = baseEvent.Request.Trailer.Clone()
-	}
-
-	if baseEvent.Request.Header != nil {
-		r.Header = baseEvent.Request.Header.Clone()
-	}
-
-	// apply batch request specific headers
-	// ---
-	for k, v := range ir.Headers {
-		// individual Authorization header keys don't have affect
-		// because the auth state is populated from the base event
-		if strings.EqualFold(k, "authorization") {
-			continue
-		}
-
-		r.Header.Set(k, v)
-	}
-	r.Header.Set("Content-Type", mw.FormDataContentType())
-
-	// construct a new RequestEvent
-	// ---------------------------------------------------------------
-	event := &core.RequestEvent{}
-	event.App = activeApp
-	event.Auth = baseEvent.Auth
-	event.SetAll(baseEvent.GetAll())
-
-	// load RequestInfo context
-	if infoContext == "" {
-		infoContext = core.RequestInfoContextDefault
-	}
-	event.Set(core.RequestEventKeyInfoContext, infoContext)
-
-	// assign request
-	event.Request = r
-	event.Request.Body = &router.RereadableReadCloser{ReadCloser: r.Body} // enables multiple reads
-	defer event.Request.Body.Close()
-
-	// assign response
-	rec := httptest.NewRecorder()
-	event.Response = &router.ResponseWriter{ResponseWriter: rec} // enables status and write tracking
-
-	// execute
-	// ---------------------------------------------------------------
-	if err := handle(event); err != nil {
-		return nil, err
-	}
-
-	result := rec.Result()
-	defer result.Body.Close()
-
-	body, _ := types.ParseJSONRaw(rec.Body.Bytes())
-
-	return &BatchRequestResult{
-		Status: result.StatusCode,
-		Body:   body,
-	}, nil
-}
-
-func multipartDataFromInternalRequest(ir *core.InternalRequest) (*bytes.Buffer, *multipart.Writer, error) {
-	buf := &bytes.Buffer{}
-
-	mw := multipart.NewWriter(buf)
-
-	regularFields := map[string]any{}
-	fileFields := map[string][]*filesystem.File{}
-
-	// separate regular fields from files
-	// ---
-	for k, rawV := range ir.Body {
-		switch v := rawV.(type) {
-		case *filesystem.File:
-			fileFields[k] = append(fileFields[k], v)
-		case []*filesystem.File:
-			fileFields[k] = append(fileFields[k], v...)
-		default:
-			regularFields[k] = v
-		}
-	}
-
-	// submit regularFields as @jsonPayload
-	// ---
-	rawBody, err := json.Marshal(regularFields)
-	if err != nil {
-		return nil, nil, errors.Join(err, mw.Close())
-	}
-
-	jsonPayload, err := mw.CreateFormField("@jsonPayload")
-	if err != nil {
-		return nil, nil, errors.Join(err, mw.Close())
-	}
-	_, err = jsonPayload.Write(rawBody)
-	if err != nil {
-		return nil, nil, errors.Join(err, mw.Close())
-	}
-
-	// submit fileFields as multipart files
-	// ---
-	for key, files := range fileFields {
-		for _, file := range files {
-			part, err := mw.CreateFormFile(key, file.Name)
-			if err != nil {
-				return nil, nil, errors.Join(err, mw.Close())
-			}
-
-			fr, err := file.Reader.Open()
-			if err != nil {
-				return nil, nil, errors.Join(err, mw.Close())
-			}
-
-			_, err = io.Copy(part, fr)
-			if err != nil {
-				return nil, nil, errors.Join(err, fr.Close(), mw.Close())
-			}
-
-			err = fr.Close()
-			if err != nil {
-				return nil, nil, errors.Join(err, mw.Close())
-			}
-		}
-	}
-
-	return buf, mw, mw.Close()
-}
-
-func extractPrefixedFiles(request *http.Request, prefixes ...string) (map[string][]*filesystem.File, error) {
-	if request.MultipartForm == nil {
-		if err := request.ParseMultipartForm(router.DefaultMaxMemory); err != nil {
-			return nil, err
-		}
-	}
-
-	result := make(map[string][]*filesystem.File)
-
-	for k, fhs := range request.MultipartForm.File {
-		for _, p := range prefixes {
-			if strings.HasPrefix(k, p) {
-				resultKey := strings.TrimPrefix(k, p)
-
-				for _, fh := range fhs {
-					file, err := filesystem.NewFileFromMultipart(fh)
-					if err != nil {
-						return nil, err
-					}
-
-					result[resultKey] = append(result[resultKey], file)
-				}
-			}
-		}
-	}
-
-	return result, nil
-}
-
-func prepareInternalAction(activeApp core.App, ir *core.InternalRequest, optNext func(data any) error) (HandleFunc, map[string]string, bool) {
-	full := strings.ToUpper(ir.Method) + " " + ir.URL
-
-	for re, actionFactory := range ValidBatchActions {
-		params, ok := findNamedMatches(re, full)
-		if ok {
-			return actionFactory(activeApp, ir, params, optNext), params, true
-		}
-	}
-
-	return nil, nil, false
-}
-
-func findNamedMatches(re *regexp.Regexp, str string) (map[string]string, bool) {
-	match := re.FindStringSubmatch(str)
-	if match == nil {
-		return nil, false
-	}
-
-	result := map[string]string{}
-
-	names := re.SubexpNames()
-
-	for i, m := range match {
-		if names[i] != "" {
-			result[names[i]] = m
-		}
-	}
-
-	return result, true
-}
-
-// -------------------------------------------------------------------
-
-var (
-	_ router.SafeErrorItem     = (*BatchResponseError)(nil)
-	_ router.SafeErrorResolver = (*BatchResponseError)(nil)
-)
-
-type BatchResponseError struct {
-	err     *router.ApiError
-	code    string
-	message string
-}
-
-func (e *BatchResponseError) Error() string {
-	return e.message
-}
-
-func (e *BatchResponseError) Code() string {
-	return e.code
-}
-
-func (e *BatchResponseError) Resolve(errData map[string]any) any {
-	errData["response"] = e.err
-	return errData
-}
-
-func (e BatchResponseError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]any{
-		"message":  e.message,
-		"code":     e.code,
-		"response": e.err,
-	})
-}

apis/batch_test.go

@@ -1,755 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/router"
-)
-
-func TestBatchRequest(t *testing.T) {
-	t.Parallel()
-
-	formData, mp, err := tests.MockMultipartData(
-		map[string]string{
-			router.JSONPayloadKey: `{
-				"requests":[
-					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch1"}},
-					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch2"}},
-					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch3"}},
-					{"method":"PATCH", "url":"/api/collections/demo3/records/lcl9d87w22ml6jy", "body": {"files-": "test_FLurQTgrY8.txt"}}
-				]
-			}`,
-		},
-		"requests.0.files",
-		"requests.0.files",
-		"requests.0.files",
-		"requests[2].files",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "disabled batch requets",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().Batch.Enabled = false
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "max request limits reached",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"GET", "url":"/test1"},
-					{"method":"GET", "url":"/test2"},
-					{"method":"GET", "url":"/test3"}
-				]
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().Batch.Enabled = true
-				app.Settings().Batch.MaxRequests = 2
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"requests":{"code":"validation_length_too_long"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "trigger requests validations",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{},
-					{"method":"GET", "url":"/valid"},
-					{"method":"invalid", "url":"/valid"},
-					{"method":"POST", "url":"` + strings.Repeat("a", 2001) + `"}
-				]
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().Batch.Enabled = true
-				app.Settings().Batch.MaxRequests = 100
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"requests":{`,
-				`"0":{"method":{"code":"validation_required"`,
-				`"2":{"method":{"code":"validation_in_invalid"`,
-				`"3":{"url":{"code":"validation_length_too_long"`,
-			},
-			NotExpectedContent: []string{
-				`"1":`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "unknown batch request action",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"GET", "url":"/api/health"}
-				]
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"requests":{`,
-				`0":{"code":"batch_request_failed"`,
-				`"response":{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-			},
-		},
-		{
-			Name:   "base 2 successful and 1 failed (public collection)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-                    {"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}},
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": ""}}
-				]
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"response":{`,
-				`"2":{"code":"batch_request_failed"`,
-				`"response":{"data":{"title":{"code":"validation_required"`,
-			},
-			NotExpectedContent: []string{
-				`"0":`,
-				`"1":`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                        0,
-				"OnBatchRequest":           1,
-				"OnRecordCreateRequest":    3,
-				"OnModelCreate":            3,
-				"OnModelCreateExecute":     2,
-				"OnModelAfterCreateError":  3,
-				"OnModelValidate":          3,
-				"OnRecordCreate":           3,
-				"OnRecordCreateExecute":    2,
-				"OnRecordAfterCreateError": 3,
-				"OnRecordValidate":         3,
-				"OnRecordEnrich":           2,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if len(records) != 0 {
-					t.Fatalf("Expected no batch records to be persisted, got %d", len(records))
-				}
-			},
-		},
-		{
-			Name:   "base 4 successful (public collection)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}},
-					{"method":"PUT", "url":"/api/collections/demo2/records", "body": {"title": "batch3"}},
-					{"method":"PUT", "url":"/api/collections/demo2/records?fields=*,id:excerpt(4,true)", "body": {"id":"achvryl401bhse3","title": "batch4"}}
-				]
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"title":"batch1"`,
-				`"title":"batch2"`,
-				`"title":"batch3"`,
-				`"title":"batch4"`,
-				`"id":"achv..."`,
-				`"active":false`,
-				`"active":true`,
-				`"status":200`,
-				`"body":{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                0,
-				"OnBatchRequest":   1,
-				"OnModelValidate":  4,
-				"OnRecordValidate": 4,
-				"OnRecordEnrich":   4,
-
-				"OnRecordCreateRequest":      3,
-				"OnModelCreate":              3,
-				"OnModelCreateExecute":       3,
-				"OnModelAfterCreateSuccess":  3,
-				"OnRecordCreate":             3,
-				"OnRecordCreateExecute":      3,
-				"OnRecordAfterCreateSuccess": 3,
-
-				"OnRecordUpdateRequest":      1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if len(records) != 4 {
-					t.Fatalf("Expected %d batch records to be persisted, got %d", 3, len(records))
-				}
-			},
-		},
-		{
-			Name:   "mixed create/update/delete (non-superuser rule failure)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}},
-					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3"},
-					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}}
-				]
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"requests":{`,
-				`"2":{"code":"batch_request_failed"`,
-				`"response":{`,
-			},
-			NotExpectedContent: []string{
-				// only demo3 requires authentication
-				`"0":`,
-				`"1":`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                        0,
-				"OnBatchRequest":           1,
-				"OnModelCreate":            1,
-				"OnModelCreateExecute":     1,
-				"OnModelAfterCreateError":  1,
-				"OnModelDelete":            1,
-				"OnModelDeleteExecute":     1,
-				"OnModelAfterDeleteError":  1,
-				"OnModelValidate":          1,
-				"OnRecordCreateRequest":    1,
-				"OnRecordCreate":           1,
-				"OnRecordCreateExecute":    1,
-				"OnRecordAfterCreateError": 1,
-				"OnRecordDeleteRequest":    1,
-				"OnRecordDelete":           1,
-				"OnRecordDeleteExecute":    1,
-				"OnRecordAfterDeleteError": 1,
-				"OnRecordEnrich":           1,
-				"OnRecordValidate":         1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
-				if err == nil {
-					t.Fatal("Expected record to not be created")
-				}
-
-				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
-				if err == nil {
-					t.Fatal("Expected record to not be updated")
-				}
-
-				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
-				if err != nil {
-					t.Fatal("Expected record to not be deleted")
-				}
-			},
-		},
-		{
-			Name:   "mixed create/update/delete (superuser rule failure)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, clients
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3", "headers": {"Authorization": "ignored"}},
-					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}, "headers": {"Authorization": "ignored"}},
-					{"method":"POST", "url":"/api/collections/_superusers/records", "body": {"email":"test_batch@example.com","password":"1234567890"}}
-				]
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"requests":{`,
-				`"2":{"code":"batch_request_failed"`,
-				`403`,
-			},
-			NotExpectedContent: []string{
-				`"0":`,
-				`"1":`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                        0,
-				"OnBatchRequest":           1,
-				"OnModelUpdate":            1,
-				"OnModelUpdateExecute":     1,
-				"OnModelAfterUpdateError":  1,
-				"OnModelDelete":            1,
-				"OnModelDeleteExecute":     1,
-				"OnModelAfterDeleteError":  1,
-				"OnModelValidate":          1,
-				"OnRecordUpdateRequest":    1,
-				"OnRecordUpdate":           1,
-				"OnRecordUpdateExecute":    1,
-				"OnRecordAfterUpdateError": 1,
-				"OnRecordDeleteRequest":    1,
-				"OnRecordDelete":           1,
-				"OnRecordDeleteExecute":    1,
-				"OnRecordAfterDeleteError": 1,
-				"OnRecordEnrich":           1,
-				"OnRecordValidate":         1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
-				if err != nil {
-					t.Fatal("Expected record to not be deleted")
-				}
-
-				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
-				if err == nil {
-					t.Fatal("Expected record to not be updated")
-				}
-
-				_, err = app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test_batch@example.com")
-				if err == nil {
-					t.Fatal("Expected superuser to not be created")
-				}
-			},
-		},
-		{
-			Name:   "mixed create/update/delete (rules success)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, clients
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}, "headers": {"Authorization": "ignored"}},
-					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3", "headers": {"Authorization": "ignored"}},
-					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}, "headers": {"Authorization": "ignored"}}
-				]
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"title":"batch_create"`,
-				`"title":"batch_update"`,
-				`"status":200`,
-				`"status":204`,
-				`"body":{`,
-				`"body":null`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-				// ---
-				"OnModelCreate":             1,
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				"OnModelDelete":             1,
-				"OnModelDeleteExecute":      1,
-				"OnModelAfterDeleteSuccess": 1,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           2,
-				// ---
-				"OnRecordCreateRequest":      1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordDeleteRequest":      1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           2,
-				"OnRecordEnrich":             2,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
-				if err == nil {
-					t.Fatal("Expected record to be deleted")
-				}
-			},
-		},
-		{
-			Name:   "mixed create/update/delete (superuser auth)",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, _superusers
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}},
-					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3"},
-					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}}
-				]
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"title":"batch_create"`,
-				`"title":"batch_update"`,
-				`"status":200`,
-				`"status":204`,
-				`"body":{`,
-				`"body":null`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-				// ---
-				"OnModelCreate":             1,
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				"OnModelDelete":             1,
-				"OnModelDeleteExecute":      1,
-				"OnModelAfterDeleteSuccess": 1,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           2,
-				// ---
-				"OnRecordCreateRequest":      1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordDeleteRequest":      1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           2,
-				"OnRecordEnrich":             2,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
-				if err == nil {
-					t.Fatal("Expected record to be deleted")
-				}
-			},
-		},
-		{
-			Name:   "cascade delete/update",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, _superusers
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"DELETE", "url":"/api/collections/demo3/records/1tmknxy2868d869"},
-					{"method":"DELETE", "url":"/api/collections/demo3/records/mk5fmymtx4wsprk"}
-				]
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"status":204`,
-				`"body":null`,
-			},
-			NotExpectedContent: []string{
-				`"status":200`,
-				`"body":{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-				// ---
-				"OnModelDelete":             3, // 2 batch + 1 cascade delete
-				"OnModelDeleteExecute":      3,
-				"OnModelAfterDeleteSuccess": 3,
-				"OnModelUpdate":             5, // 5 cascade update
-				"OnModelUpdateExecute":      5,
-				"OnModelAfterUpdateSuccess": 5,
-				// ---
-				"OnRecordDeleteRequest":      2,
-				"OnRecordDelete":             3,
-				"OnRecordDeleteExecute":      3,
-				"OnRecordAfterDeleteSuccess": 3,
-				"OnRecordUpdate":             5,
-				"OnRecordUpdateExecute":      5,
-				"OnRecordAfterUpdateSuccess": 5,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				ids := []string{
-					"1tmknxy2868d869",
-					"mk5fmymtx4wsprk",
-					"qzaqccwrmva4o1n",
-				}
-
-				for _, id := range ids {
-					_, err := app.FindRecordById("demo2", id)
-					if err == nil {
-						t.Fatalf("Expected record %q to be deleted", id)
-					}
-				}
-			},
-		},
-		{
-			Name:   "transaction timeout",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
-					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}}
-				]
-			}`),
-			Headers: map[string]string{
-				// test@example.com, _superusers
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().Batch.Timeout = 1
-				app.OnRecordCreateRequest("demo2").BindFunc(func(e *core.RecordRequestEvent) error {
-					time.Sleep(600 * time.Millisecond) // < 1s so that the first request can succeed
-					return e.Next()
-				})
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{}`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                        0,
-				"OnBatchRequest":           1,
-				"OnRecordCreateRequest":    2,
-				"OnModelCreate":            1,
-				"OnModelCreateExecute":     1,
-				"OnModelAfterCreateError":  1,
-				"OnModelValidate":          1,
-				"OnRecordCreate":           1,
-				"OnRecordCreateExecute":    1,
-				"OnRecordAfterCreateError": 1,
-				"OnRecordEnrich":           1,
-				"OnRecordValidate":         1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if len(records) != 0 {
-					t.Fatalf("Expected %d batch records to be persisted, got %d", 0, len(records))
-				}
-			},
-		},
-		{
-			Name:   "multipart/form-data + file upload",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Body:   formData,
-			Headers: map[string]string{
-				// test@example.com, clients
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-				"Content-Type":  mp.FormDataContentType(),
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"title":"batch1"`,
-				`"title":"batch2"`,
-				`"title":"batch3"`,
-				`"id":"lcl9d87w22ml6jy"`,
-				`"files":["300_UhLKX91HVb.png"]`,
-				`"tmpfile_`,
-				`"status":200`,
-				`"body":{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-				// ---
-				"OnModelCreate":             3,
-				"OnModelCreateExecute":      3,
-				"OnModelAfterCreateSuccess": 3,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           4,
-				// ---
-				"OnRecordCreateRequest":      3,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordCreate":             3,
-				"OnRecordCreateExecute":      3,
-				"OnRecordAfterCreateSuccess": 3,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           4,
-				"OnRecordEnrich":             4,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				batch1, err := app.FindFirstRecordByFilter("demo3", `title="batch1"`)
-				if err != nil {
-					t.Fatalf("missing batch1: %v", err)
-				}
-				batch1Files := batch1.GetStringSlice("files")
-				if len(batch1Files) != 3 {
-					t.Fatalf("Expected %d batch1 file(s), got %d", 3, len(batch1Files))
-				}
-
-				batch2, err := app.FindFirstRecordByFilter("demo3", `title="batch2"`)
-				if err != nil {
-					t.Fatalf("missing batch2: %v", err)
-				}
-				batch2Files := batch2.GetStringSlice("files")
-				if len(batch2Files) != 0 {
-					t.Fatalf("Expected %d batch2 file(s), got %d", 0, len(batch2Files))
-				}
-
-				batch3, err := app.FindFirstRecordByFilter("demo3", `title="batch3"`)
-				if err != nil {
-					t.Fatalf("missing batch3: %v", err)
-				}
-				batch3Files := batch3.GetStringSlice("files")
-				if len(batch3Files) != 1 {
-					t.Fatalf("Expected %d batch3 file(s), got %d", 1, len(batch3Files))
-				}
-
-				batch4, err := app.FindRecordById("demo3", "lcl9d87w22ml6jy")
-				if err != nil {
-					t.Fatalf("missing batch4: %v", err)
-				}
-				batch4Files := batch4.GetStringSlice("files")
-				if len(batch4Files) != 1 {
-					t.Fatalf("Expected %d batch4 file(s), got %d", 1, len(batch4Files))
-				}
-			},
-		},
-		{
-			Name:   "create/update with expand query params",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, _superusers
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo5/records?expand=rel_one", "body": {"total": 9, "rel_one":"qzaqccwrmva4o1n"}},
-					{"method":"PATCH", "url":"/api/collections/demo5/records/qjeql998mtp1azp?expand=rel_many", "body": {"total": 10}}
-				]
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"body":{`,
-				`"id":"qjeql998mtp1azp"`,
-				`"id":"qzaqccwrmva4o1n"`,
-				`"id":"i9naidtvr6qsgb4"`,
-				`"expand":{"rel_one"`,
-				`"expand":{"rel_many"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":              0,
-				"OnBatchRequest": 1,
-				// ---
-				"OnModelCreate":             1,
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           2,
-				// ---
-				"OnRecordCreateRequest":      1,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           2,
-				"OnRecordEnrich":             5,
-			},
-		},
-		{
-			Name:   "check body limit middleware",
-			Method: http.MethodPost,
-			URL:    "/api/batch",
-			Headers: map[string]string{
-				// test@example.com, _superusers
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: strings.NewReader(`{
-				"requests": [
-					{"method":"POST", "url":"/api/collections/demo5/records?expand=rel_one", "body": {"total": 9, "rel_one":"qzaqccwrmva4o1n"}},
-					{"method":"PATCH", "url":"/api/collections/demo5/records/qjeql998mtp1azp?expand=rel_many", "body": {"total": 10}}
-				]
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().Batch.MaxBodySize = 10
-			},
-			ExpectedStatus:  413,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/collection.go

@@ -1,296 +1,210 @@
 package apis
 
 import (
-	"errors"
 	"net/http"
-	"slices"
-	"strings"
 
-	validation "github.com/pocketbase/ozzo-validation/v4"
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/auth"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/search"
-	"github.com/pocketbase/pocketbase/tools/security"
 )
 
 // bindCollectionApi registers the collection api endpoints and the corresponding handlers.
-func bindCollectionApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	subGroup := rg.Group("/collections").Bind(RequireSuperuserAuth())
-	subGroup.GET("", collectionsList)
-	subGroup.POST("", collectionCreate)
-	subGroup.GET("/{collection}", collectionView)
-	subGroup.PATCH("/{collection}", collectionUpdate)
-	subGroup.DELETE("/{collection}", collectionDelete)
-	subGroup.DELETE("/{collection}/truncate", collectionTruncate)
-	subGroup.PUT("/import", collectionsImport)
-	subGroup.GET("/meta/scaffolds", collectionScaffolds)
+func bindCollectionApi(app core.App, rg *echo.Group) {
+	api := collectionApi{app: app}
 
-	// @todo experimental
-	subGroup.GET("/meta/oauth2-providers", collectionListOAuth2Providers)
-	subGroup.POST("/meta/dry-run-view", collectionDryRunView)
+	subGroup := rg.Group("/collections", ActivityLogger(app), RequireAdminAuth())
+	subGroup.GET("", api.list)
+	subGroup.POST("", api.create)
+	subGroup.GET("/:collection", api.view)
+	subGroup.PATCH("/:collection", api.update)
+	subGroup.DELETE("/:collection", api.delete)
+	subGroup.PUT("/import", api.bulkImport)
 }
 
-func collectionsList(e *core.RequestEvent) error {
+type collectionApi struct {
+	app core.App
+}
+
+func (api *collectionApi) list(c echo.Context) error {
 	fieldResolver := search.NewSimpleFieldResolver(
 		"id", "created", "updated", "name", "system", "type",
 	)
 
-	collections := []*core.Collection{}
+	collections := []*models.Collection{}
 
 	result, err := search.NewProvider(fieldResolver).
-		Query(e.App.CollectionQuery()).
-		ParseAndExec(e.Request.URL.Query().Encode(), &collections)
+		Query(api.app.Dao().CollectionQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &collections)
 
 	if err != nil {
-		return e.BadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	event := new(core.CollectionsListRequestEvent)
-	event.RequestEvent = e
+	event := new(core.CollectionsListEvent)
+	event.HttpContext = c
 	event.Collections = collections
 	event.Result = result
 
-	return event.App.OnCollectionsListRequest().Trigger(event, func(e *core.CollectionsListRequestEvent) error {
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, e.Result)
-		})
-	})
-}
-
-func collectionView(e *core.RequestEvent) error {
-	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
-	if err != nil || collection == nil {
-		return e.NotFoundError("", err)
-	}
-
-	event := new(core.CollectionRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-
-	return e.App.OnCollectionViewRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, e.Collection)
-		})
-	})
-}
-
-func collectionCreate(e *core.RequestEvent) error {
-	// populate the minimal required factory collection data (if any)
-	factoryExtract := struct {
-		Type string `form:"type" json:"type"`
-		Name string `form:"name" json:"name"`
-	}{}
-	if err := e.BindBody(&factoryExtract); err != nil {
-		return e.BadRequestError("Failed to load the collection type data due to invalid formatting.", err)
-	}
-
-	// create scaffold
-	collection := core.NewCollection(factoryExtract.Type, factoryExtract.Name)
-
-	// merge the scaffold with the submitted request data
-	if err := e.BindBody(collection); err != nil {
-		return e.BadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := new(core.CollectionRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-
-	return e.App.OnCollectionCreateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
-		if err := e.App.Save(e.Collection); err != nil {
-			// validation failure
-			var validationErrors validation.Errors
-			if errors.As(err, &validationErrors) {
-				return e.BadRequestError("Failed to create collection.", validationErrors)
-			}
-
-			// other generic db error
-			return e.BadRequestError("Failed to create collection. Raw error: \n"+err.Error(), nil)
+	return api.app.OnCollectionsListRequest().Trigger(event, func(e *core.CollectionsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
 		}
 
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, e.Collection)
-		})
+		return e.HttpContext.JSON(http.StatusOK, e.Result)
 	})
 }
 
-func collectionUpdate(e *core.RequestEvent) error {
-	collection, err := e.App.FindCollectionByNameOrId(e.Request.PathValue("collection"))
+func (api *collectionApi) view(c echo.Context) error {
+	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
 	if err != nil || collection == nil {
-		return e.NotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	if err := e.BindBody(collection); err != nil {
-		return e.BadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := new(core.CollectionRequestEvent)
-	event.RequestEvent = e
+	event := new(core.CollectionViewEvent)
+	event.HttpContext = c
 	event.Collection = collection
 
-	return event.App.OnCollectionUpdateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
-		if err := e.App.Save(e.Collection); err != nil {
-			// validation failure
-			var validationErrors validation.Errors
-			if errors.As(err, &validationErrors) {
-				return e.BadRequestError("Failed to update collection.", validationErrors)
-			}
-
-			// other generic db error
-			return e.BadRequestError("Failed to update collection. Raw error: \n"+err.Error(), nil)
+	return api.app.OnCollectionViewRequest().Trigger(event, func(e *core.CollectionViewEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
 		}
 
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, e.Collection)
-		})
+		return e.HttpContext.JSON(http.StatusOK, e.Collection)
 	})
 }
 
-func collectionDelete(e *core.RequestEvent) error {
-	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
-	if err != nil || collection == nil {
-		return e.NotFoundError("", err)
+func (api *collectionApi) create(c echo.Context) error {
+	collection := &models.Collection{}
+
+	form := forms.NewCollectionUpsert(api.app, collection)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := new(core.CollectionRequestEvent)
-	event.RequestEvent = e
+	event := new(core.CollectionCreateEvent)
+	event.HttpContext = c
 	event.Collection = collection
 
-	return e.App.OnCollectionDeleteRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
-		if err := e.App.Delete(e.Collection); err != nil {
-			msg := "Failed to delete collection"
+	// create the collection
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
 
-			// check fo references
-			refs, _ := e.App.FindCollectionReferences(e.Collection, e.Collection.Id)
-			if len(refs) > 0 {
-				names := make([]string, 0, len(refs))
-				for ref := range refs {
-					names = append(names, ref.Name)
+			return api.app.OnCollectionBeforeCreateRequest().Trigger(event, func(e *core.CollectionCreateEvent) error {
+				if err := next(e.Collection); err != nil {
+					return NewBadRequestError("Failed to create the collection.", err)
 				}
-				msg += " probably due to existing reference in " + strings.Join(names, ", ")
+
+				return api.app.OnCollectionAfterCreateRequest().Trigger(event, func(e *core.CollectionCreateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				})
+			})
+		}
+	})
+}
+
+func (api *collectionApi) update(c echo.Context) error {
+	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
+	if err != nil || collection == nil {
+		return NewNotFoundError("", err)
+	}
+
+	form := forms.NewCollectionUpsert(api.app, collection)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.CollectionUpdateEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	// update the collection
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
+
+			return api.app.OnCollectionBeforeUpdateRequest().Trigger(event, func(e *core.CollectionUpdateEvent) error {
+				if err := next(e.Collection); err != nil {
+					return NewBadRequestError("Failed to update the collection.", err)
+				}
+
+				return api.app.OnCollectionAfterUpdateRequest().Trigger(event, func(e *core.CollectionUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				})
+			})
+		}
+	})
+}
+
+func (api *collectionApi) delete(c echo.Context) error {
+	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
+	if err != nil || collection == nil {
+		return NewNotFoundError("", err)
+	}
+
+	event := new(core.CollectionDeleteEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	return api.app.OnCollectionBeforeDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
+		if err := api.app.Dao().DeleteCollection(e.Collection); err != nil {
+			return NewBadRequestError("Failed to delete collection due to existing dependency.", err)
+		}
+
+		return api.app.OnCollectionAfterDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
 			}
 
-			return e.BadRequestError(msg, err)
-		}
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
+			return e.HttpContext.NoContent(http.StatusNoContent)
 		})
 	})
 }
 
-func collectionTruncate(e *core.RequestEvent) error {
-	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
-	if err != nil || collection == nil {
-		return e.NotFoundError("", err)
+func (api *collectionApi) bulkImport(c echo.Context) error {
+	form := forms.NewCollectionsImport(api.app)
+
+	// load request data
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	if collection.IsView() {
-		return e.BadRequestError("View collections cannot be truncated since they don't store their own records.", nil)
-	}
+	event := new(core.CollectionsImportEvent)
+	event.HttpContext = c
+	event.Collections = form.Collections
 
-	err = e.App.TruncateCollection(collection)
-	if err != nil {
-		return e.BadRequestError("Failed to truncate collection (most likely due to required cascade delete record references).", err)
-	}
+	// import collections
+	return form.Submit(func(next forms.InterceptorNextFunc[[]*models.Collection]) forms.InterceptorNextFunc[[]*models.Collection] {
+		return func(imports []*models.Collection) error {
+			event.Collections = imports
 
-	return e.NoContent(http.StatusNoContent)
-}
+			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+				if err := next(e.Collections); err != nil {
+					return NewBadRequestError("Failed to import the submitted collections.", err)
+				}
 
-func collectionScaffolds(e *core.RequestEvent) error {
-	randomId := security.RandomStringWithAlphabet(10, core.DefaultIdAlphabet) // could be used as part of the default indexes name
+				return api.app.OnCollectionsAfterImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
 
-	collections := map[string]*core.Collection{
-		core.CollectionTypeBase: core.NewBaseCollection("", randomId),
-		core.CollectionTypeAuth: core.NewAuthCollection("", randomId),
-		core.CollectionTypeView: core.NewViewCollection("", randomId),
-	}
-
-	for _, c := range collections {
-		c.Id = "" // clear random id
-	}
-
-	return e.JSON(http.StatusOK, collections)
-}
-
-type providerListItem struct {
-	order int
-
-	Name        string `json:"name"`
-	DisplayName string `json:"displayName"`
-	Logo        string `json:"logo"`
-}
-
-func collectionListOAuth2Providers(e *core.RequestEvent) error {
-	providers := make([]*providerListItem, 0, len(auth.Providers))
-
-	for name, factory := range auth.Providers {
-		p := factory()
-
-		providers = append(providers, &providerListItem{
-			order:       p.Order(),
-			Name:        name,
-			DisplayName: p.DisplayName(),
-			Logo:        p.Logo(),
-		})
-	}
-
-	slices.SortStableFunc(providers, func(a, b *providerListItem) int {
-		// sort by order
-		if a.order < b.order {
-			return -1
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
 		}
-		if a.order > b.order {
-			return 1
-		}
-
-		// fallback sort by name
-		if a.Name < b.Name {
-			return -1
-		}
-		if a.Name > b.Name {
-			return 1
-		}
-
-		return 0
 	})
-
-	return e.JSON(http.StatusOK, providers)
-}
-
-func collectionDryRunView(e *core.RequestEvent) error {
-	// extra precaution in case reused in custom route group
-	if !e.HasSuperuserAuth() {
-		return e.ForbiddenError("", nil)
-	}
-
-	form := dryRunViewForm{}
-
-	err := e.BindBody(&form)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-
-	err = form.validate()
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	result, err := e.App.DryRunView(form.Query, 10)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Invalid view query. Raw error: \n"+err.Error(), nil))
-	}
-
-	return e.JSON(http.StatusOK, result)
-}
-
-type dryRunViewForm struct {
-	Query string `form:"query" json:"query"`
-}
-
-func (form *dryRunViewForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Query, validation.Required, validation.Length(0, 5000)),
-	)
 }

apis/collection_import.go

@@ -1,62 +0,0 @@
-package apis
-
-import (
-	"errors"
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-func collectionsImport(e *core.RequestEvent) error {
-	form := new(collectionsImportForm)
-
-	err := e.BindBody(form)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-
-	err = form.validate()
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	event := new(core.CollectionsImportRequestEvent)
-	event.RequestEvent = e
-	event.CollectionsData = form.Collections
-	event.DeleteMissing = form.DeleteMissing
-
-	return event.App.OnCollectionsImportRequest().Trigger(event, func(e *core.CollectionsImportRequestEvent) error {
-		importErr := e.App.ImportCollections(e.CollectionsData, form.DeleteMissing)
-		if importErr == nil {
-			return execAfterSuccessTx(true, e.App, func() error {
-				return e.NoContent(http.StatusNoContent)
-			})
-		}
-
-		// validation failure
-		var validationErrors validation.Errors
-		if errors.As(importErr, &validationErrors) {
-			return e.BadRequestError("Failed to import collections.", validationErrors)
-		}
-
-		// generic/db failure
-		return e.BadRequestError("Failed to import collections.", validation.Errors{"collections": validation.NewError(
-			"validation_collections_import_failure",
-			"Failed to import the collections configuration. Raw error:\n"+importErr.Error(),
-		)})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type collectionsImportForm struct {
-	Collections   []map[string]any `form:"collections" json:"collections"`
-	DeleteMissing bool             `form:"deleteMissing" json:"deleteMissing"`
-}
-
-func (form *collectionsImportForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Collections, validation.Required),
-	)
-}

apis/collection_import_test.go

@@ -1,369 +0,0 @@
-package apis_test
-
-import (
-	"errors"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestCollectionsImport(t *testing.T) {
-	t.Parallel()
-
-	totalCollections := 16
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPut,
-			URL:             "/api/collections/import",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as regular user",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser + empty collections",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body:   strings.NewReader(`{"collections":[]}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"collections":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				collections := []*core.Collection{}
-				if err := app.CollectionQuery().All(&collections); err != nil {
-					t.Fatal(err)
-				}
-				expected := totalCollections
-				if len(collections) != expected {
-					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
-				}
-			},
-		},
-		{
-			Name:   "authorized as superuser + collections validator failure",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body: strings.NewReader(`{
-				"collections":[
-					{"name": "import1"},
-					{
-						"name": "import2",
-						"fields": [
-							{
-							  "id": "koih1lqx",
-							  "name": "expand",
-							  "type": "text"
-							}
-						]
-					}
-				]
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"collections":{"code":"validation_collections_import_failure"`,
-				`import2`,
-				`fields`,
-			},
-			NotExpectedContent: []string{"Raw error:"},
-			ExpectedEvents: map[string]int{
-				"*":                            0,
-				"OnCollectionsImportRequest":   1,
-				"OnCollectionCreate":           2,
-				"OnCollectionCreateExecute":    2,
-				"OnCollectionAfterCreateError": 2,
-				"OnModelCreate":                2,
-				"OnModelCreateExecute":         2,
-				"OnModelAfterCreateError":      2,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				collections := []*core.Collection{}
-				if err := app.CollectionQuery().All(&collections); err != nil {
-					t.Fatal(err)
-				}
-				expected := totalCollections
-				if len(collections) != expected {
-					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
-				}
-			},
-		},
-		{
-			Name:   "authorized as superuser + non-validator failure",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body: strings.NewReader(`{
-				"collections":[
-					{
-						"name": "import1",
-						"fields": [
-							{
-							  "id": "koih1lqx",
-							  "name": "test",
-							  "type": "text"
-							}
-						]
-					},
-					{
-						"name": "import2",
-						"fields": [
-							{
-							  "id": "koih1lqx",
-							  "name": "test",
-							  "type": "text"
-							}
-						],
-						"indexes": [
-							"create index idx_test on import2 (test)"
-						]
-					}
-				]
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"collections":{"code":"validation_collections_import_failure"`,
-				`Raw error:`,
-				`custom_error`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                            0,
-				"OnCollectionsImportRequest":   1,
-				"OnCollectionCreate":           1,
-				"OnCollectionAfterCreateError": 1,
-				"OnModelCreate":                1,
-				"OnModelAfterCreateError":      1,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnCollectionCreate().BindFunc(func(e *core.CollectionEvent) error {
-					return errors.New("custom_error")
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				collections := []*core.Collection{}
-				if err := app.CollectionQuery().All(&collections); err != nil {
-					t.Fatal(err)
-				}
-				expected := totalCollections
-				if len(collections) != expected {
-					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
-				}
-			},
-		},
-		{
-			Name:   "authorized as superuser + successful collections create",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body: strings.NewReader(`{
-				"collections":[
-					{
-						"name": "import1",
-						"fields": [
-							{
-							  "id": "koih1lqx",
-							  "name": "test",
-							  "type": "text"
-							}
-						]
-					},
-					{
-						"name": "import2",
-						"fields": [
-							{
-							  "id": "koih1lqx",
-							  "name": "test",
-							  "type": "text"
-							}
-						],
-						"indexes": [
-							"create index idx_test on import2 (test)"
-						]
-					},
-					{
-						"name": "auth_without_fields",
-						"type": "auth"
-					}
-				]
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                              0,
-				"OnCollectionsImportRequest":     1,
-				"OnCollectionCreate":             3,
-				"OnCollectionCreateExecute":      3,
-				"OnCollectionAfterCreateSuccess": 3,
-				"OnModelCreate":                  3,
-				"OnModelCreateExecute":           3,
-				"OnModelAfterCreateSuccess":      3,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				collections := []*core.Collection{}
-				if err := app.CollectionQuery().All(&collections); err != nil {
-					t.Fatal(err)
-				}
-
-				expected := totalCollections + 3
-				if len(collections) != expected {
-					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
-				}
-
-				indexes, err := app.TableIndexes("import2")
-				if err != nil || indexes["idx_test"] == "" {
-					t.Fatalf("Missing index %s (%v)", "idx_test", err)
-				}
-			},
-		},
-		{
-			Name:   "authorized as superuser + create/update/delete",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body: strings.NewReader(`{
-				"deleteMissing": true,
-				"collections":[
-					{"name": "test123"},
-					{
-						"id":"wsmn24bux7wo113",
-						"name":"demo1",
-						"fields":[
-							{
-								"id":"_2hlxbmp",
-								"name":"title",
-								"type":"text",
-								"required":true
-							}
-						],
-						"indexes": []
-					}
-				]
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnCollectionsImportRequest": 1,
-				// ---
-				"OnModelCreate":                  1,
-				"OnModelCreateExecute":           1,
-				"OnModelAfterCreateSuccess":      1,
-				"OnCollectionCreate":             1,
-				"OnCollectionCreateExecute":      1,
-				"OnCollectionAfterCreateSuccess": 1,
-				// ---
-				"OnModelUpdate":                  1,
-				"OnModelUpdateExecute":           1,
-				"OnModelAfterUpdateSuccess":      1,
-				"OnCollectionUpdate":             1,
-				"OnCollectionUpdateExecute":      1,
-				"OnCollectionAfterUpdateSuccess": 1,
-				// ---
-				"OnModelDelete":                  14,
-				"OnModelAfterDeleteSuccess":      14,
-				"OnModelDeleteExecute":           14,
-				"OnCollectionDelete":             9,
-				"OnCollectionDeleteExecute":      9,
-				"OnCollectionAfterDeleteSuccess": 9,
-				"OnRecordAfterDeleteSuccess":     5,
-				"OnRecordDelete":                 5,
-				"OnRecordDeleteExecute":          5,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				collections := []*core.Collection{}
-				if err := app.CollectionQuery().All(&collections); err != nil {
-					t.Fatal(err)
-				}
-
-				systemCollections := 0
-				for _, c := range collections {
-					if c.System {
-						systemCollections++
-					}
-				}
-
-				expected := systemCollections + 2
-				if len(collections) != expected {
-					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
-				}
-			},
-		},
-		{
-			Name:   "OnCollectionsImportRequest tx body write check",
-			Method: http.MethodPut,
-			URL:    "/api/collections/import",
-			Body: strings.NewReader(`{
-				"deleteMissing": true,
-				"collections":[
-					{"name": "test123"},
-					{
-						"id":"wsmn24bux7wo113",
-						"name":"demo1",
-						"fields":[
-							{
-								"id":"_2hlxbmp",
-								"name":"title",
-								"type":"text",
-								"required":true
-							}
-						],
-						"indexes": []
-					}
-				]
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnCollectionsImportRequest().BindFunc(func(e *core.CollectionsImportRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnCollectionsImportRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/cron.go

@@ -1,59 +0,0 @@
-package apis
-
-import (
-	"net/http"
-	"slices"
-	"strings"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/cron"
-	"github.com/pocketbase/pocketbase/tools/router"
-	"github.com/pocketbase/pocketbase/tools/routine"
-)
-
-// bindCronApi registers the crons api endpoint.
-func bindCronApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	subGroup := rg.Group("/crons").Bind(RequireSuperuserAuth())
-	subGroup.GET("", cronsList)
-	subGroup.POST("/{id}", cronRun)
-}
-
-func cronsList(e *core.RequestEvent) error {
-	jobs := e.App.Cron().Jobs()
-
-	slices.SortStableFunc(jobs, func(a, b *cron.Job) int {
-		if strings.HasPrefix(a.Id(), "__pb") {
-			return 1
-		}
-		if strings.HasPrefix(b.Id(), "__pb") {
-			return -1
-		}
-		return strings.Compare(a.Id(), b.Id())
-	})
-
-	return e.JSON(http.StatusOK, jobs)
-}
-
-func cronRun(e *core.RequestEvent) error {
-	cronId := e.Request.PathValue("id")
-
-	var foundJob *cron.Job
-
-	jobs := e.App.Cron().Jobs()
-	for _, j := range jobs {
-		if j.Id() == cronId {
-			foundJob = j
-			break
-		}
-	}
-
-	if foundJob == nil {
-		return e.NotFoundError("Missing or invalid cron job", nil)
-	}
-
-	routine.FireAndForget(func() {
-		foundJob.Run()
-	})
-
-	return e.NoContent(http.StatusNoContent)
-}

apis/cron_test.go

@@ -1,148 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/spf13/cast"
-)
-
-func TestCronsList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodGet,
-			URL:             "/api/crons",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as regular user",
-			Method: http.MethodGet,
-			URL:    "/api/crons",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser (empty list)",
-			Method: http.MethodGet,
-			URL:    "/api/crons",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Cron().RemoveAll()
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`[]`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser",
-			Method: http.MethodGet,
-			URL:    "/api/crons",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`{"id":"__pbLogsCleanup__","expression":"0 */6 * * *"}`,
-				`{"id":"__pbDBOptimize__","expression":"0 0 * * *"}`,
-				`{"id":"__pbMFACleanup__","expression":"0 * * * *"}`,
-				`{"id":"__pbOTPCleanup__","expression":"0 * * * *"}`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestCronsRun(t *testing.T) {
-	t.Parallel()
-
-	beforeTestFunc := func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-		app.Cron().Add("test", "* * * * *", func() {
-			app.Store().Set("testJobCalls", cast.ToInt(app.Store().Get("testJobCalls"))+1)
-		})
-		app.Cron().Stop()
-	}
-
-	expectedCalls := func(expected int) func(t testing.TB, app *tests.TestApp, res *http.Response) {
-		return func(t testing.TB, app *tests.TestApp, res *http.Response) {
-			time.Sleep(50 * time.Millisecond)
-
-			total := cast.ToInt(app.Store().Get("testJobCalls"))
-			if total != expected {
-				t.Fatalf("Expected total testJobCalls %d, got %d", expected, total)
-			}
-		}
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPost,
-			URL:             "/api/crons/test",
-			BeforeTestFunc:  beforeTestFunc,
-			AfterTestFunc:   expectedCalls(0),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as regular user",
-			Method: http.MethodPost,
-			URL:    "/api/crons/test",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc:  beforeTestFunc,
-			AfterTestFunc:   expectedCalls(0),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser (missing job)",
-			Method: http.MethodPost,
-			URL:    "/api/crons/missing",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc:  beforeTestFunc,
-			AfterTestFunc:   expectedCalls(0),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser (existing job)",
-			Method: http.MethodPost,
-			URL:    "/api/crons/test",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: beforeTestFunc,
-			AfterTestFunc:  expectedCalls(1),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/extensions.go

@@ -1,95 +0,0 @@
-package apis
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"os"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
-	"github.com/pocketbase/pocketbase/ui"
-)
-
-// bindUIExtensions binds the superuser UI extensions routes to the ServeEvent.Router.
-//
-// This method does nothing if the superuser UI is not bundled (aka. build with "no_ui" tag),
-func bindUIExtensions(app core.App) {
-	if ui.DistDirFS == nil {
-		return
-	}
-
-	app.OnServe().Bind(&hook.Handler[*core.ServeEvent]{
-		Priority: 9999, // execute as latest as possible
-		Func: func(se *core.ServeEvent) error {
-			uiGroup := se.Router.Group("/_").
-				BindFunc(func(e *core.RequestEvent) error {
-					if !e.App.IsDev() && e.Response.Header().Get("Cache-Control") == "" {
-						e.Response.Header().Set("Cache-Control", "max-age=1209600, stale-while-revalidate=86400")
-					}
-
-					if e.Response.Header().Get("Content-Security-Policy") == "" {
-						e.Response.Header().Set("Content-Security-Policy", defaultCSP)
-					}
-
-					return e.Next()
-				}).
-				Bind(Gzip())
-
-			// register static extension routes
-			for _, ext := range se.UIExtensions {
-				if ext.Name == "" || ext.FS == nil {
-					se.App.Logger().Debug("Invalid UI extension configuration", slog.Any("extension", ext))
-					continue
-				}
-
-				uiGroup.GET("/extensions/"+ext.Name+"/{path...}", Static(ext.FS, false))
-			}
-
-			// combine all extensions main.js in one file
-			//
-			// note: don't cache in memory to allow previewing changes without restart
-			uiGroup.GET("/extensions.js", func(re *core.RequestEvent) error {
-				buf := new(bytes.Buffer)
-
-				for _, ext := range se.UIExtensions {
-					err := copyExtensionMainjs(buf, ext)
-					if err != nil {
-						return re.InternalServerError("An error occurred while generating the main.js extension file", err)
-					}
-				}
-
-				return re.Stream(200, "text/javascript", buf)
-			}).Bind(SkipSuccessActivityLog())
-
-			return se.Next()
-		},
-	})
-}
-
-func copyExtensionMainjs(buf *bytes.Buffer, ext core.UIExtension) error {
-	f, err := ext.FS.Open("main.js")
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil // nothing to copy
-		}
-
-		return fmt.Errorf("[UI extension %q] main.js open error: %w", ext.Name, err)
-	}
-	defer f.Close()
-
-	// wrap in a self-executing function to avoid scope and concatenation issues
-	// (the await/async is for top-level await)
-	_, _ = buf.WriteString("await (async function(){")
-
-	_, err = io.Copy(buf, f)
-	if err != nil {
-		return fmt.Errorf("[UI extension %q] main.js copy error: %w", ext.Name, err)
-	}
-
-	_, _ = buf.WriteString("})();")
-
-	return nil
-}

apis/extensions_test.go

@@ -1,177 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"testing"
-	"testing/fstest"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/ui"
-)
-
-// note: don't run in parallel to avoid conflicts with the ui.DistDirFS nil test
-func TestUIExtensions_Mainjs(t *testing.T) {
-	successAfterTestFunc := func(t testing.TB, app *tests.TestApp, res *http.Response) {
-		expected := "text/javascript"
-		if ct := res.Header.Get("content-type"); ct != expected {
-			t.Fatalf("Expected response Content-Type %q, got %q", expected, ct)
-		}
-	}
-
-	oldDistDirFS := ui.DistDirFS
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "disabled UI",
-			Method: http.MethodGet,
-			URL:    "/_/extensions.js",
-			TestAppFactory: func(t testing.TB) *tests.TestApp {
-				app, err := tests.NewTestApp()
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// simulate no_ui tag (needs to be cleared before the router is initialized)
-				ui.DistDirFS = nil
-
-				return app
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				ui.DistDirFS = oldDistDirFS
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "no extensions",
-			Method:          http.MethodGet,
-			URL:             "/_/extensions.js",
-			AfterTestFunc:   successAfterTestFunc,
-			ExpectedStatus:  200,
-			ExpectedContent: []string{},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "with extensions",
-			Method: http.MethodGet,
-			URL:    "/_/extensions.js",
-			TestAppFactory: func(t testing.TB) *tests.TestApp {
-				app, err := tests.NewTestApp()
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				app.OnServe().BindFunc(func(e *core.ServeEvent) error {
-					e.UIExtensions = createTestExtensions()
-					return e.Next()
-				})
-
-				return app
-			},
-			AfterTestFunc:   successAfterTestFunc,
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"await (async function(){ext1_main})();await (async function(){ext3_main})();"},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-// note: don't run in parallel to avoid conflicts with the ui.DistDirFS nil test
-func TestUIExtensions_Files(t *testing.T) {
-	testAppFactory := func(t testing.TB) *tests.TestApp {
-		app, err := tests.NewTestApp()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		app.OnServe().BindFunc(func(e *core.ServeEvent) error {
-			e.UIExtensions = createTestExtensions()
-			return e.Next()
-		})
-
-		return app
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "no extensions",
-			Method:          http.MethodGet,
-			URL:             "/_/extensions/ext1/test.txt",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "with missing extension file",
-			Method:          http.MethodGet,
-			URL:             "/_/extensions/ext1/missing",
-			TestAppFactory:  testAppFactory,
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "with existing extension file (ext1)",
-			Method:          http.MethodGet,
-			URL:             "/_/extensions/ext1/test.txt",
-			TestAppFactory:  testAppFactory,
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"ext1_txt"},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "with existing extension file (extension name escape)",
-			Method:          http.MethodGet,
-			URL:             "/_/extensions/ext3%20with%20spaces/test.txt",
-			TestAppFactory:  testAppFactory,
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"ext3_txt"},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func createTestExtensions() []core.UIExtension {
-	return []core.UIExtension{
-		{
-			Name: "ext1",
-			FS: fstest.MapFS{
-				"main.js": &fstest.MapFile{
-					Data: []byte("ext1_main"),
-				},
-				"test.txt": &fstest.MapFile{
-					Data: []byte("ext1_txt"),
-				},
-			},
-		},
-		{
-			Name: "ext2",
-			FS: fstest.MapFS{
-				"test.txt": &fstest.MapFile{
-					Data: []byte("ext2_txt"),
-				},
-			},
-		},
-		{
-			Name: "ext3 with spaces",
-			FS: fstest.MapFS{
-				"main.js": &fstest.MapFile{
-					Data: []byte("ext3_main"),
-				},
-				"test.txt": &fstest.MapFile{
-					Data: []byte("ext3_txt"),
-				},
-			},
-		},
-	}
-}

apis/file.go

@@ -6,46 +6,44 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
-	"os"
 	"runtime"
+	"strings"
 	"time"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tokens"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
 	"golang.org/x/sync/semaphore"
 	"golang.org/x/sync/singleflight"
 )
 
-var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif", "image/webp"}
+var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif"}
 var defaultThumbSizes = []string{"100x100"}
 
 // bindFileApi registers the file api endpoints and the corresponding handlers.
-func bindFileApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	maxWorkers := cast.ToInt64(os.Getenv("PB_THUMBS_MAX_WORKERS"))
-	if maxWorkers <= 0 {
-		maxWorkers = int64(runtime.NumCPU() + 2) // the value is arbitrary chosen and may change in the future
-	}
-
-	maxWait := cast.ToInt64(os.Getenv("PB_THUMBS_MAX_WAIT"))
-	if maxWait <= 0 {
-		maxWait = 60
-	}
-
+func bindFileApi(app core.App, rg *echo.Group) {
 	api := fileApi{
+		app:             app,
+		thumbGenSem:     semaphore.NewWeighted(int64(runtime.NumCPU() + 2)), // the value is arbitrary chosen and may change in the future
 		thumbGenPending: new(singleflight.Group),
-		thumbGenSem:     semaphore.NewWeighted(maxWorkers),
-		thumbGenMaxWait: time.Duration(maxWait) * time.Second,
+		thumbGenMaxWait: 60 * time.Second,
 	}
 
-	sub := rg.Group("/files")
-	sub.POST("/token", api.fileToken).Bind(RequireAuth())
-	sub.GET("/{collection}/{recordId}/{filename}", api.download).Bind(collectionPathRateLimit("", "file"))
+	subGroup := rg.Group("/files", ActivityLogger(app))
+	subGroup.POST("/token", api.fileToken)
+	subGroup.HEAD("/:collection/:recordId/:filename", api.download, LoadCollectionContext(api.app))
+	subGroup.GET("/:collection/:recordId/:filename", api.download, LoadCollectionContext(api.app))
 }
 
 type fileApi struct {
+	app core.App
+
 	// thumbGenSem is a semaphore to prevent too much concurrent
 	// requests generating new thumbs at the same time.
 	thumbGenSem *semaphore.Weighted
@@ -59,78 +57,84 @@ type fileApi struct {
 	thumbGenMaxWait time.Duration
 }
 
-func (api *fileApi) fileToken(e *core.RequestEvent) error {
-	// extra check for just in case the handler is called in a different context
-	if e.Auth == nil {
-		return e.UnauthorizedError("Missing auth context.", nil)
+func (api *fileApi) fileToken(c echo.Context) error {
+	event := new(core.FileTokenEvent)
+	event.HttpContext = c
+
+	if admin, _ := c.Get(ContextAdminKey).(*models.Admin); admin != nil {
+		event.Model = admin
+		event.Token, _ = tokens.NewAdminFileToken(api.app, admin)
+	} else if record, _ := c.Get(ContextAuthRecordKey).(*models.Record); record != nil {
+		event.Model = record
+		event.Token, _ = tokens.NewRecordFileToken(api.app, record)
 	}
 
-	token, err := e.Auth.NewFileToken()
-	if err != nil {
-		return e.InternalServerError("Failed to generate file token", err)
-	}
+	return api.app.OnFileBeforeTokenRequest().Trigger(event, func(e *core.FileTokenEvent) error {
+		if e.Model == nil || e.Token == "" {
+			return NewBadRequestError("Failed to generate file token.", nil)
+		}
 
-	event := new(core.FileTokenRequestEvent)
-	event.RequestEvent = e
-	event.Token = token
-	event.Record = e.Auth
+		return api.app.OnFileAfterTokenRequest().Trigger(event, func(e *core.FileTokenEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
 
-	return e.App.OnFileTokenRequest().Trigger(event, func(e *core.FileTokenRequestEvent) error {
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, map[string]string{"token": e.Token})
+			return e.HttpContext.JSON(http.StatusOK, map[string]string{
+				"token": e.Token,
+			})
 		})
 	})
 }
 
-func (api *fileApi) download(e *core.RequestEvent) error {
-	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
-	if err != nil {
-		return e.NotFoundError("", nil)
+func (api *fileApi) download(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", nil)
 	}
 
-	recordId := e.Request.PathValue("recordId")
+	recordId := c.PathParam("recordId")
 	if recordId == "" {
-		return e.NotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
-	record, err := e.App.FindRecordById(collection, recordId)
+	record, err := api.app.Dao().FindRecordById(collection.Id, recordId)
 	if err != nil {
-		return e.NotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	filename := e.Request.PathValue("filename")
+	filename := c.PathParam("filename")
 
 	fileField := record.FindFileFieldByFile(filename)
 	if fileField == nil {
-		return e.NotFoundError("", nil)
+		return NewNotFoundError("", nil)
+	}
+
+	options, ok := fileField.Options.(*schema.FileOptions)
+	if !ok {
+		return NewBadRequestError("", errors.New("failed to load file options"))
 	}
 
 	// check whether the request is authorized to view the protected file
-	if fileField.Protected {
-		originalRequestInfo, err := e.RequestInfo()
-		if err != nil {
-			return e.InternalServerError("Failed to load request info", err)
-		}
+	if options.Protected {
+		token := c.QueryParam("token")
 
-		token := e.Request.URL.Query().Get("token")
-		authRecord, _ := e.App.FindAuthRecordByToken(token, core.TokenTypeFile)
+		adminOrAuthRecord, _ := api.findAdminOrAuthRecordByFileToken(token)
 
-		// reset the auth state if it is superuser and it is not whitelisted
-		// (not critical because file tokens are short-lived but checked nonetheless as an extra precaution)
-		if authRecord != nil && authRecord.IsSuperuser() {
-			allowedIPs := e.App.Settings().SuperuserIPs
-			if len(allowedIPs) > 0 && !isIPInList(allowedIPs, e.RealIP()) {
-				authRecord = nil
+		// create a copy of the cached request data and adjust it for the current auth model
+		requestInfo := *RequestInfo(c)
+		requestInfo.Context = models.RequestInfoContextProtectedFile
+		requestInfo.Admin = nil
+		requestInfo.AuthRecord = nil
+		if adminOrAuthRecord != nil {
+			if admin, _ := adminOrAuthRecord.(*models.Admin); admin != nil {
+				requestInfo.Admin = admin
+			} else if record, _ := adminOrAuthRecord.(*models.Record); record != nil {
+				requestInfo.AuthRecord = record
 			}
 		}
 
-		// create a shallow copy of the cached request data and adjust it to the current auth record (if any)
-		requestInfo := *originalRequestInfo
-		requestInfo.Context = core.RequestInfoContextProtectedFile
-		requestInfo.Auth = authRecord
-
-		if ok, _ := e.App.CanAccessRecord(record, &requestInfo, record.Collection().ViewRule); !ok {
-			return e.NotFoundError("", errors.New("insufficient permissions to access the file resource"))
+		if ok, _ := api.app.Dao().CanAccessRecord(record, &requestInfo, record.Collection().ViewRule); !ok {
+			return NewForbiddenError("Insufficient permissions to access the file resource.", nil)
 		}
 	}
 
@@ -138,93 +142,122 @@ func (api *fileApi) download(e *core.RequestEvent) error {
 
 	// fetch the original view file field related record
 	if collection.IsView() {
-		fileRecord, err := e.App.FindRecordByViewFile(collection.Id, fileField.Name, filename)
+		fileRecord, err := api.app.Dao().FindRecordByViewFile(collection.Id, fileField.Name, filename)
 		if err != nil {
-			return e.NotFoundError("", fmt.Errorf("failed to fetch view file field record: %w", err))
+			return NewNotFoundError("", fmt.Errorf("Failed to fetch view file field record: %w", err))
 		}
 		baseFilesPath = fileRecord.BaseFilesPath()
 	}
 
-	fsys, err := e.App.NewFilesystem()
+	fsys, err := api.app.NewFilesystem()
 	if err != nil {
-		return e.InternalServerError("Filesystem initialization failure.", err)
+		return NewBadRequestError("Filesystem initialization failure.", err)
 	}
 	defer fsys.Close()
 
 	originalPath := baseFilesPath + "/" + filename
-
-	event := new(core.FileDownloadRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-	event.FileField = fileField
-	event.ServedPath = originalPath
-	event.ServedName = filename
+	servedPath := originalPath
+	servedName := filename
 
 	// check for valid thumb size param
-	thumbSize := e.Request.URL.Query().Get("thumb")
-	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, fileField.Thumbs)) {
+	thumbSize := c.QueryParam("thumb")
+	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, options.Thumbs)) {
 		// extract the original file meta attributes and check it existence
 		oAttrs, oAttrsErr := fsys.Attributes(originalPath)
 		if oAttrsErr != nil {
-			return e.NotFoundError("", err)
+			return NewNotFoundError("", err)
 		}
 
 		// check if it is an image
 		if list.ExistInSlice(oAttrs.ContentType, imageContentTypes) {
 			// add thumb size as file suffix
-			event.ServedName = thumbSize + "_" + filename
-			event.ServedPath = baseFilesPath + "/thumbs_" + filename + "/" + event.ServedName
+			servedName = thumbSize + "_" + filename
+			servedPath = baseFilesPath + "/thumbs_" + filename + "/" + servedName
 
 			// create a new thumb if it doesn't exist
-			if exists, _ := fsys.Exists(event.ServedPath); !exists {
-				if err := api.createThumb(e, fsys, originalPath, event.ServedPath, thumbSize); err != nil {
-					e.App.Logger().Warn(
-						"Fallback to original - failed to create thumb "+event.ServedName,
+			if exists, _ := fsys.Exists(servedPath); !exists {
+				if err := api.createThumb(c, fsys, originalPath, servedPath, thumbSize); err != nil {
+					api.app.Logger().Warn(
+						"Fallback to original - failed to create thumb "+servedName,
 						slog.Any("error", err),
 						slog.String("original", originalPath),
-						slog.String("thumb", event.ServedPath),
+						slog.String("thumb", servedPath),
 					)
 
 					// fallback to the original
-					event.ThumbError = err
-					event.ServedName = filename
-					event.ServedPath = originalPath
+					servedName = filename
+					servedPath = originalPath
 				}
 			}
 		}
 	}
 
-	if thumbSize != "" && event.ThumbError == nil && event.ServedPath == originalPath {
-		event.ThumbError = fmt.Errorf("the thumb size %q or the original file format are not supported", thumbSize)
-	}
+	event := new(core.FileDownloadEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.FileField = fileField
+	event.ServedPath = servedPath
+	event.ServedName = servedName
 
 	// clickjacking shouldn't be a concern when serving uploaded files,
 	// so it safe to unset the global X-Frame-Options to allow files embedding
 	// (note: it is out of the hook to allow users to customize the behavior)
-	e.Response.Header().Del("X-Frame-Options")
+	c.Response().Header().Del("X-Frame-Options")
 
-	return e.App.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadRequestEvent) error {
-		err = execAfterSuccessTx(true, e.App, func() error {
-			return fsys.Serve(e.Response, e.Request, e.ServedPath, e.ServedName)
-		})
-		if err != nil {
-			return e.NotFoundError("", err)
+	return api.app.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		if err := fsys.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
+			return NewNotFoundError("", err)
 		}
 
 		return nil
 	})
 }
 
+func (api *fileApi) findAdminOrAuthRecordByFileToken(fileToken string) (models.Model, error) {
+	fileToken = strings.TrimSpace(fileToken)
+	if fileToken == "" {
+		return nil, errors.New("missing file token")
+	}
+
+	claims, _ := security.ParseUnverifiedJWT(strings.TrimSpace(fileToken))
+	tokenType := cast.ToString(claims["type"])
+
+	switch tokenType {
+	case tokens.TypeAdmin:
+		admin, err := api.app.Dao().FindAdminByToken(
+			fileToken,
+			api.app.Settings().AdminFileToken.Secret,
+		)
+		if err == nil && admin != nil {
+			return admin, nil
+		}
+	case tokens.TypeAuthRecord:
+		record, err := api.app.Dao().FindAuthRecordByToken(
+			fileToken,
+			api.app.Settings().RecordFileToken.Secret,
+		)
+		if err == nil && record != nil {
+			return record, nil
+		}
+	}
+
+	return nil, errors.New("missing or invalid file token")
+}
+
 func (api *fileApi) createThumb(
-	e *core.RequestEvent,
+	c echo.Context,
 	fsys *filesystem.System,
 	originalPath string,
 	thumbPath string,
 	thumbSize string,
 ) error {
 	ch := api.thumbGenPending.DoChan(thumbPath, func() (any, error) {
-		ctx, cancel := context.WithTimeout(e.Request.Context(), api.thumbGenMaxWait)
+		ctx, cancel := context.WithTimeout(c.Request().Context(), api.thumbGenMaxWait)
 		defer cancel()
 
 		if err := api.thumbGenSem.Acquire(ctx, 1); err != nil {

apis/file_test.go

@@ -10,8 +10,11 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
@@ -23,54 +26,23 @@ func TestFileToken(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPost,
-			URL:             "/api/files/token",
-			ExpectedStatus:  401,
+			Url:             "/api/files/token",
+			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "regular user",
-			Method: http.MethodPost,
-			URL:    "/api/files/token",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-			},
 			ExpectedEvents: map[string]int{
-				"*":                  0,
-				"OnFileTokenRequest": 1,
+				"OnFileBeforeTokenRequest": 1,
 			},
 		},
 		{
-			Name:   "superuser",
+			Name:   "unauthorized with model and token via hook",
 			Method: http.MethodPost,
-			URL:    "/api/files/token",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                  0,
-				"OnFileTokenRequest": 1,
-			},
-		},
-		{
-			Name:   "hook token overwrite",
-			Method: http.MethodPost,
-			URL:    "/api/files/token",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileTokenRequest().BindFunc(func(e *core.FileTokenRequestEvent) error {
+			Url:    "/api/files/token",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnFileBeforeTokenRequest().Add(func(e *core.FileTokenEvent) error {
+					record, _ := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+					e.Model = record
 					e.Token = "test"
-					return e.Next()
+					return nil
 				})
 			},
 			ExpectedStatus: 200,
@@ -78,8 +50,40 @@ func TestFileToken(t *testing.T) {
 				`"token":"test"`,
 			},
 			ExpectedEvents: map[string]int{
-				"*":                  0,
-				"OnFileTokenRequest": 1,
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
+			},
+		},
+		{
+			Name:   "auth record",
+			Method: http.MethodPost,
+			Url:    "/api/files/token",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
+			},
+		},
+		{
+			Name:   "admin",
+			Method: http.MethodPost,
+			Url:    "/api/files/token",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
 			},
 		},
 	}
@@ -148,379 +152,233 @@ func TestFileDownload(t *testing.T) {
 		{
 			Name:            "missing collection",
 			Method:          http.MethodGet,
-			URL:             "/api/files/missing/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			Url:             "/api/files/missing/4q1xlclmfloku33/300_1SEi6Q6U72.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:            "missing record",
 			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/missing/300_1SEi6Q6U72.png",
+			Url:             "/api/files/_pb_users_auth_/missing/300_1SEi6Q6U72.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:            "missing file",
 			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/missing.png",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/missing.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:            "existing image",
 			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testImg)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - missing thumb (should fallback to the original)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError == nil {
-						t.Fatal("Expected thumb error, got nil")
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - missing thumb (should fallback to the original)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testImg)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (crop center)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (crop center)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropCenter)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (crop top)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (crop top)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropTop)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (crop bottom)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (crop bottom)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropBottom)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (fit)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (fit)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbFit)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (zero width)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (zero width)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbZeroWidth)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing image - existing thumb (zero height)",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError != nil {
-						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing image - existing thumb (zero height)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbZeroHeight)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:   "existing non image file - thumb parameter should be ignored",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
-					if e.ThumbError == nil {
-						t.Fatal("Expected thumb error, got nil")
-					}
-					return e.Next()
-				})
-			},
+			Name:            "existing non image file - thumb parameter should be ignored",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testFile)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 
 		// protected file access checks
 		{
-			Name:            "protected file - superuser with expired file token",
+			Name:            "protected file - expired token",
 			Method:          http.MethodGet,
-			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.nqqtqpPhxU0045F4XP_ruAkzAidYBc5oPy9ErN3XBq0",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "protected file - superuser with valid file token",
-			Method:          http.MethodGet,
-			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			Url:             "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
 			ExpectedStatus:  200,
-			ExpectedContent: []string{"PNG"},
+			ExpectedContent: []string{string(testFile)},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
-			Name:    "protected file - superuser with non-whitelisted IP",
-			Method:  http.MethodGet,
-			URL:     "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			Headers: map[string]string{"x-test-ip": "127.0.0.1"},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().TrustedProxy = core.TrustedProxyConfig{
-					Headers: []string{"x-test-ip"},
-				}
-
-				app.Settings().SuperuserIPs = []string{"0.0.0.0"}
-
-				err := app.Save(app.Settings())
-				if err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  404,
+			Name:            "protected file - admin with expired file token",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImFkbWluIn0.g7Q_3UX6H--JWJ7yt1Hoe-1ugTX1KpbKzdt0zjGSe-E",
+			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:    "protected file - superuser with whitelisted IP",
-			Method:  http.MethodGet,
-			URL:     "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
-			Headers: map[string]string{"x-test-ip": "127.0.0.1"},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().TrustedProxy = core.TrustedProxyConfig{
-					Headers: []string{"x-test-ip"},
-				}
-
-				app.Settings().SuperuserIPs = []string{"127.0.0.1"}
-
-				if err := app.Save(app.Settings()); err != nil {
-					t.Fatal(err)
-				}
-			},
+			Name:            "protected file - admin with valid file token",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"PNG"},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
 			Name:            "protected file - guest without view access",
 			Method:          http.MethodGet,
-			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
-			ExpectedStatus:  404,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "protected file - guest with view access",
 			Method: http.MethodGet,
-			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
 				// mock public view access
-				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				c, err := dao.FindCollectionByNameOrId("demo1")
 				if err != nil {
 					t.Fatalf("Failed to fetch mock collection: %v", err)
 				}
 				c.ViewRule = types.Pointer("")
-				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+				if err := dao.SaveCollection(c); err != nil {
 					t.Fatalf("Failed to update mock collection: %v", err)
 				}
 			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"PNG"},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
 			Name:   "protected file - auth record without view access",
 			Method: http.MethodGet,
-			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
 				// mock restricted user view access
-				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				c, err := dao.FindCollectionByNameOrId("demo1")
 				if err != nil {
 					t.Fatalf("Failed to fetch mock collection: %v", err)
 				}
 				c.ViewRule = types.Pointer("@request.auth.verified = true")
-				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+				if err := dao.SaveCollection(c); err != nil {
 					t.Fatalf("Failed to update mock collection: %v", err)
 				}
 			},
-			ExpectedStatus:  404,
+			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "protected file - auth record with view access",
 			Method: http.MethodGet,
-			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
 				// mock user view access
-				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				c, err := dao.FindCollectionByNameOrId("demo1")
 				if err != nil {
 					t.Fatalf("Failed to fetch mock collection: %v", err)
 				}
 				c.ViewRule = types.Pointer("@request.auth.verified = false")
-				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+				if err := dao.SaveCollection(c); err != nil {
 					t.Fatalf("Failed to update mock collection: %v", err)
 				}
 			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"PNG"},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
 		{
 			Name:            "protected file in view (view's View API rule failure)",
 			Method:          http.MethodGet,
-			URL:             "/api/files/view1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
-			ExpectedStatus:  404,
+			Url:             "/api/files/view1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:            "protected file in view (view's View API rule success)",
 			Method:          http.MethodGet,
-			URL:             "/api/files/view1/84nmscqy84lsi1t/test_d61b33QdDU.txt?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			Url:             "/api/files/view1/84nmscqy84lsi1t/test_d61b33QdDU.txt?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"test"},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnFileDownloadRequest": 1,
 			},
 		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:file",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:file"},
-					{MaxRequests: 0, Label: "users:file"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:file",
-			Method: http.MethodGet,
-			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:file"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
 	}
 
 	for _, scenario := range scenarios {
@@ -552,23 +410,30 @@ func TestConcurrentThumbsGeneration(t *testing.T) {
 	defer fsys.Close()
 
 	// create a dummy file field collection
-	demo1, err := app.FindCollectionByNameOrId("demo1")
+	demo1, err := app.Dao().FindCollectionByNameOrId("demo1")
 	if err != nil {
 		t.Fatal(err)
 	}
-	fileField := demo1.Fields.GetByName("file_one").(*core.FileField)
-	fileField.Protected = false
-	fileField.MaxSelect = 1
-	fileField.MaxSize = 999999
-	// new thumbs
-	fileField.Thumbs = []string{"111x111", "111x222", "111x333"}
-	demo1.Fields.Add(fileField)
-	if err = app.Save(demo1); err != nil {
+	fileField := demo1.Schema.GetFieldByName("file_one")
+	fileField.Options = &schema.FileOptions{
+		Protected: false,
+		MaxSelect: 1,
+		MaxSize:   999999,
+		// new thumbs
+		Thumbs: []string{"111x111", "111x222", "111x333"},
+	}
+	demo1.Schema.AddField(fileField)
+	if err := app.Dao().SaveCollection(demo1); err != nil {
 		t.Fatal(err)
 	}
 
 	fileKey := "wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png"
 
+	e, err := apis.InitApi(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	urls := []string{
 		"/api/files/" + fileKey + "?thumb=111x111",
 		"/api/files/" + fileKey + "?thumb=111x111", // should still result in single thumb
@@ -581,6 +446,7 @@ func TestConcurrentThumbsGeneration(t *testing.T) {
 	wg.Add(len(urls))
 
 	for _, url := range urls {
+		url := url
 		go func() {
 			defer wg.Done()
 
@@ -588,11 +454,7 @@ func TestConcurrentThumbsGeneration(t *testing.T) {
 
 			req := httptest.NewRequest("GET", url, nil)
 
-			pbRouter, _ := apis.NewRouter(app)
-			mux, _ := pbRouter.BuildMux()
-			if mux != nil {
-				mux.ServeHTTP(recorder, req)
-			}
+			e.ServeHTTP(recorder, req)
 		}()
 	}
 

apis/health.go

@@ -2,53 +2,42 @@ package apis
 
 import (
 	"net/http"
-	"slices"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
 )
 
 // bindHealthApi registers the health api endpoint.
-func bindHealthApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+func bindHealthApi(app core.App, rg *echo.Group) {
+	api := healthApi{app: app}
+
 	subGroup := rg.Group("/health")
-	subGroup.GET("", healthCheck)
+	subGroup.HEAD("", api.healthCheck)
+	subGroup.GET("", api.healthCheck)
+}
+
+type healthApi struct {
+	app core.App
+}
+
+type healthCheckResponse struct {
+	Message string `json:"message"`
+	Code    int    `json:"code"`
+	Data    struct {
+		CanBackup bool `json:"canBackup"`
+	} `json:"data"`
 }
 
 // healthCheck returns a 200 OK response if the server is healthy.
-func healthCheck(e *core.RequestEvent) error {
-	resp := struct {
-		Message string         `json:"message"`
-		Code    int            `json:"code"`
-		Data    map[string]any `json:"data"`
-	}{
-		Code:    http.StatusOK,
-		Message: "API is healthy.",
+func (api *healthApi) healthCheck(c echo.Context) error {
+	if c.Request().Method == http.MethodHead {
+		return c.NoContent(http.StatusOK)
 	}
 
-	// @todo evaluate whether it is worth removing the extra info from the health endpoint
-	if e.HasSuperuserAuth() {
-		resp.Data = make(map[string]any, 3)
-		resp.Data["canBackup"] = !e.App.Store().Has(core.StoreKeyActiveBackup)
-		resp.Data["realIP"] = e.RealIP()
+	resp := new(healthCheckResponse)
+	resp.Code = http.StatusOK
+	resp.Message = "API is healthy."
+	resp.Data.CanBackup = !api.app.Store().Has(core.StoreKeyActiveBackup)
 
-		// loosely check if behind a reverse proxy
-		// (usually used in the dashboard to remind superusers in case deployed behind reverse-proxy)
-		possibleProxyHeader := ""
-		headersToCheck := append(
-			slices.Clone(e.App.Settings().TrustedProxy.Headers),
-			// common proxy headers
-			"CF-Connecting-IP", "Fly-Client-IP", "X-Forwarded-For",
-		)
-		for _, header := range headersToCheck {
-			if e.Request.Header.Get(header) != "" {
-				possibleProxyHeader = header
-				break
-			}
-		}
-		resp.Data["possibleProxyHeader"] = possibleProxyHeader
-	} else {
-		resp.Data = map[string]any{} // ensure that it is returned as object
-	}
-
-	return e.JSON(http.StatusOK, resp)
+	return c.JSON(http.StatusOK, resp)
 }

apis/health_test.go

@@ -12,56 +12,21 @@ func TestHealthAPI(t *testing.T) {
 
 	scenarios := []tests.ApiScenario{
 		{
-			Name:           "GET health status (guest)",
-			Method:         http.MethodGet, // automatically matches also HEAD as a side-effect of the Go std mux
-			URL:            "/api/health",
+			Name:           "HEAD health status",
+			Method:         http.MethodHead,
+			Url:            "/api/health",
 			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"code":200`,
-				`"data":{}`,
-			},
-			NotExpectedContent: []string{
-				"canBackup",
-				"realIP",
-				"possibleProxyHeader",
-			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "GET health status (regular user)",
-			Method: http.MethodGet,
-			URL:    "/api/health",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"code":200`,
-				`"data":{}`,
-			},
-			NotExpectedContent: []string{
-				"canBackup",
-				"realIP",
-				"possibleProxyHeader",
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "GET health status (superuser)",
-			Method: http.MethodGet,
-			URL:    "/api/health",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
+			Name:           "GET health status",
+			Method:         http.MethodGet,
+			Url:            "/api/health",
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"code":200`,
 				`"data":{`,
 				`"canBackup":true`,
-				`"realIP"`,
-				`"possibleProxyHeader"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 

apis/installer.go

@@ -1,102 +0,0 @@
-package apis
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/fatih/color"
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/osutils"
-	"github.com/pocketbase/pocketbase/ui"
-)
-
-// DefaultInstallerFunc is the default PocketBase installer function.
-//
-// It will attempt to open a link in the browser (with a short-lived auth
-// token for the systemSuperuser) to the installer UI so that users can
-// create their own custom superuser record.
-//
-// See https://github.com/pocketbase/pocketbase/discussions/5814.
-func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL string) error {
-	if ui.DistDirFS == nil {
-		color.Magenta("You can create your first superuser by running: %s superuser upsert EMAIL PASS", executablePath())
-		return nil
-	}
-
-	token, err := systemSuperuser.NewStaticAuthToken(30 * time.Minute)
-	if err != nil {
-		return err
-	}
-
-	// launch url (ignore errors and always print a help text as fallback)
-	url := fmt.Sprintf("%s/_/#/pbinstall/%s", strings.TrimRight(baseURL, "/"), token)
-	_ = osutils.LaunchURL(url)
-	color.Magenta("\n(!) Launch the URL below in the browser if it hasn't been open already to create your first superuser account:")
-	color.New(color.Bold).Add(color.FgCyan).Println(url)
-	color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", executablePath())
-
-	return nil
-}
-
-func loadInstaller(
-	app core.App,
-	baseURL string,
-	installerFunc func(app core.App, systemSuperuser *core.Record, baseURL string) error,
-) error {
-	if installerFunc == nil || !needInstallerSuperuser(app) {
-		return nil
-	}
-
-	superuser, err := findOrCreateInstallerSuperuser(app)
-	if err != nil {
-		return err
-	}
-
-	return installerFunc(app, superuser, baseURL)
-}
-
-func needInstallerSuperuser(app core.App) bool {
-	total, err := app.CountRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{
-		"email": core.DefaultInstallerEmail,
-	}))
-
-	return err == nil && total == 0
-}
-
-func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
-	col, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
-	if err != nil {
-		return nil, err
-	}
-
-	record, err := app.FindAuthRecordByEmail(col, core.DefaultInstallerEmail)
-	if err != nil {
-		if !errors.Is(err, sql.ErrNoRows) {
-			return nil, err
-		}
-
-		record = core.NewRecord(col)
-		record.SetEmail(core.DefaultInstallerEmail)
-		record.SetRandomPassword()
-
-		err = app.Save(record)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return record, nil
-}
-
-func executablePath() string {
-	if osutils.IsProbablyGoRun() {
-		return "go run ."
-	}
-
-	return os.Args[0]
-}

apis/logs.go

@@ -3,92 +3,79 @@ package apis
 import (
 	"net/http"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
 // bindLogsApi registers the request logs api endpoints.
-func bindLogsApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	sub := rg.Group("/logs").Bind(
-		RequireSuperuserAuth(),
-		SkipSuccessActivityLog(),
-	)
+func bindLogsApi(app core.App, rg *echo.Group) {
+	api := logsApi{app: app}
 
-	sub.GET("", logsList)
-	sub.DELETE("", logsTruncate)
-	sub.GET("/stats", logsStats)
-	sub.GET("/{id}", logsView)
+	subGroup := rg.Group("/logs", RequireAdminAuth())
+	subGroup.GET("", api.list)
+	subGroup.GET("/stats", api.stats)
+	subGroup.GET("/:id", api.view)
+}
+
+type logsApi struct {
+	app core.App
 }
 
 var logFilterFields = []string{
-	"id", "created", "level", "message", "data",
+	"rowid", "id", "created", "updated",
+	"level", "message", "data",
 	`^data\.[\w\.\:]*\w+$`,
 }
 
-func logsList(e *core.RequestEvent) error {
+func (api *logsApi) list(c echo.Context) error {
 	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	result, err := search.NewProvider(fieldResolver).
-		Query(e.App.AuxModelQuery(&core.Log{})).
-		ParseAndExec(e.Request.URL.Query().Encode(), &[]*core.Log{})
+		Query(api.app.LogsDao().LogQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &[]*models.Log{})
 
 	if err != nil {
-		return e.BadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	return e.JSON(http.StatusOK, result)
+	return c.JSON(http.StatusOK, result)
 }
 
-func logsStats(e *core.RequestEvent) error {
+func (api *logsApi) stats(c echo.Context) error {
 	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
-	filter := e.Request.URL.Query().Get(search.FilterQueryParam)
+	filter := c.QueryParam(search.FilterQueryParam)
 
 	var expr dbx.Expression
 	if filter != "" {
 		var err error
 		expr, err = search.FilterData(filter).BuildExpr(fieldResolver)
 		if err != nil {
-			return e.BadRequestError("Invalid filter format.", err)
+			return NewBadRequestError("Invalid filter format.", err)
 		}
 	}
 
-	stats, err := e.App.LogsStats(expr)
+	stats, err := api.app.LogsDao().LogsStats(expr)
 	if err != nil {
-		return e.BadRequestError("Failed to generate logs stats.", err)
+		return NewBadRequestError("Failed to generate logs stats.", err)
 	}
 
-	return e.JSON(http.StatusOK, stats)
+	return c.JSON(http.StatusOK, stats)
 }
 
-func logsView(e *core.RequestEvent) error {
-	id := e.Request.PathValue("id")
+func (api *logsApi) view(c echo.Context) error {
+	id := c.PathParam("id")
 	if id == "" {
-		return e.NotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
-	log, err := e.App.FindLogById(id)
+	log, err := api.app.LogsDao().FindLogById(id)
 	if err != nil || log == nil {
-		return e.NotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	return e.JSON(http.StatusOK, log)
-}
-
-func logsTruncate(e *core.RequestEvent) error {
-	// delete all rows directly (aka. no model hooks will be fired)
-	_, err := e.App.AuxNonconcurrentDB().Delete((&core.Log{}).TableName(), nil).Execute()
-	if err != nil {
-		return e.InternalServerError("Failed to truncate all logs.", err)
-	}
-
-	// try to free the unused disk space
-	err = e.App.AuxVacuum()
-	if err != nil {
-		e.App.Logger().Warn("Failed to VACUUM aux database", "error", err)
-	}
-
-	return e.NoContent(http.StatusNoContent)
+	return c.JSON(http.StatusOK, log)
 }

apis/logs_test.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/pocketbase/pocketbase/core"
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -15,31 +15,29 @@ func TestLogsList(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			URL:             "/api/logs",
+			Url:             "/api/logs",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			URL:    "/api/logs",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/logs",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser",
+			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			URL:    "/api/logs",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -52,17 +50,16 @@ func TestLogsList(t *testing.T) {
 				`"id":"873f2133-9f38-44fb-bf82-c8f53b310d91"`,
 				`"id":"f2133873-44fb-9f38-bf82-c918f53b310d"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser + filter",
+			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			URL:    "/api/logs?filter=data.status>200",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs?filter=data.status>200",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -74,7 +71,6 @@ func TestLogsList(t *testing.T) {
 				`"items":[{`,
 				`"id":"f2133873-44fb-9f38-bf82-c918f53b310d"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 
@@ -90,47 +86,44 @@ func TestLogView(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			URL:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			URL:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (nonexisting request log)",
+			Name:   "authorized as admin (nonexisting request log)",
 			Method: http.MethodGet,
-			URL:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (existing request log)",
+			Name:   "authorized as admin (existing request log)",
 			Method: http.MethodGet,
-			URL:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -138,7 +131,6 @@ func TestLogView(t *testing.T) {
 			ExpectedContent: []string{
 				`"id":"873f2133-9f38-44fb-bf82-c8f53b310d91"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 
@@ -154,54 +146,52 @@ func TestLogsStats(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			URL:             "/api/logs/stats",
+			Url:             "/api/logs/stats",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			URL:    "/api/logs/stats",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/logs/stats",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser",
+			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			URL:    "/api/logs/stats",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs/stats",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`[{"date":"2022-05-01 10:00:00.000Z","total":1},{"date":"2022-05-02 10:00:00.000Z","total":1}]`,
+				`[{"total":1,"date":"2022-05-01 10:00:00.000Z"},{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`,
 			},
 		},
 		{
-			Name:   "authorized as superuser + filter",
+			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			URL:    "/api/logs/stats?filter=data.status>200",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/logs/stats?filter=data.status>200",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`[{"date":"2022-05-02 10:00:00.000Z","total":1}]`,
+				`[{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`,
 			},
 		},
 	}
@@ -210,59 +200,3 @@ func TestLogsStats(t *testing.T) {
 		scenario.Test(t)
 	}
 }
-
-func TestLogsTruncate(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodDelete,
-			URL:             "/api/logs",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as regular user",
-			Method: http.MethodDelete,
-			URL:    "/api/logs",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser",
-			Method: http.MethodDelete,
-			URL:    "/api/logs",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubLogsData(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				var found []core.Log
-
-				if err := app.LogQuery().All(&found); err != nil {
-					t.Fatal(err)
-				}
-
-				if len(found) > 0 {
-					t.Fatalf("Expected all logs to be deleted, found: %v", found)
-				}
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/middlewares.go

@@ -1,376 +1,305 @@
 package apis
 
 import (
-	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/url"
-	"runtime"
-	"slices"
 	"strings"
 	"time"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tokens"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/router"
 	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
 )
 
-// Common request event store keys used by the middlewares and api handlers.
+// Common request context keys used by the middlewares and api handlers.
 const (
-	RequestEventKeyLogMeta = "pbLogMeta" // extra data to store with the request activity log
-
-	requestEventKeyExecStart              = "__execStart"                 // the value must be time.Time
-	requestEventKeySkipSuccessActivityLog = "__skipSuccessActivityLogger" // the value must be bool
-)
-
-const (
-	DefaultWWWRedirectMiddlewarePriority = -99999
-	DefaultWWWRedirectMiddlewareId       = "pbWWWRedirect"
-
-	DefaultActivityLoggerMiddlewarePriority   = DefaultRateLimitMiddlewarePriority - 40
-	DefaultActivityLoggerMiddlewareId         = "pbActivityLogger"
-	DefaultSkipSuccessActivityLogMiddlewareId = "pbSkipSuccessActivityLog"
-	DefaultEnableAuthIdActivityLog            = "pbEnableAuthIdActivityLog"
-
-	DefaultPanicRecoverMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 30
-	DefaultPanicRecoverMiddlewareId       = "pbPanicRecover"
-
-	DefaultLoadAuthTokenMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 20
-	DefaultLoadAuthTokenMiddlewareId       = "pbLoadAuthToken"
-
-	DefaultSuperuserIPsWhitelistMiddlewarePriority = DefaultLoadAuthTokenMiddlewarePriority + 5
-	DefaultSuperuserIPsWhitelistMiddlewareId       = "pbSuperuserIPsWhitelist"
-
-	DefaultSecurityHeadersMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 10
-	DefaultSecurityHeadersMiddlewareId       = "pbSecurityHeaders"
-
-	DefaultRequireGuestOnlyMiddlewareId                 = "pbRequireGuestOnly"
-	DefaultRequireAuthMiddlewareId                      = "pbRequireAuth"
-	DefaultRequireSuperuserAuthMiddlewareId             = "pbRequireSuperuserAuth"
-	DefaultRequireSuperuserOrOwnerAuthMiddlewareId      = "pbRequireSuperuserOrOwnerAuth"
-	DefaultRequireSameCollectionContextAuthMiddlewareId = "pbRequireSameCollectionContextAuth"
+	ContextAdminKey      string = "admin"
+	ContextAuthRecordKey string = "authRecord"
+	ContextCollectionKey string = "collection"
+	ContextExecStartKey  string = "execStart"
 )
 
 // RequireGuestOnly middleware requires a request to NOT have a valid
 // Authorization header.
 //
-// This middleware is the opposite of [apis.RequireAuth()].
-func RequireGuestOnly() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id: DefaultRequireGuestOnlyMiddlewareId,
-		Func: func(e *core.RequestEvent) error {
-			if e.Auth != nil {
-				return router.NewBadRequestError("The request can be accessed only by guests.", nil)
+// This middleware is the opposite of [apis.RequireAdminOrRecordAuth()].
+func RequireGuestOnly() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			err := NewBadRequestError("The request can be accessed only by guests.", nil)
+
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record != nil {
+				return err
 			}
 
-			return e.Next()
-		},
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			if admin != nil {
+				return err
+			}
+
+			return next(c)
+		}
 	}
 }
 
-// RequireAuth middleware requires a request to have a valid record Authorization header.
+// RequireRecordAuth middleware requires a request to have
+// a valid record auth Authorization header.
 //
 // The auth record could be from any collection.
-// You can further filter the allowed record auth collections by specifying their names.
+//
+// You can further filter the allowed record auth collections by
+// specifying their names.
 //
 // Example:
 //
-//	apis.RequireAuth()                      // any auth collection
-//	apis.RequireAuth("_superusers", "users") // only the listed auth collections
-func RequireAuth(optCollectionNames ...string) *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:   DefaultRequireAuthMiddlewareId,
-		Func: requireAuth(optCollectionNames...),
-	}
-}
+//	apis.RequireRecordAuth()
+//
+// Or:
+//
+//	apis.RequireRecordAuth("users", "supervisors")
+//
+// To restrict the auth record only to the loaded context collection,
+// use [apis.RequireSameContextRecordAuth()] instead.
+func RequireRecordAuth(optCollectionNames ...string) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires valid record authorization token to be set.", nil)
+			}
 
-func requireAuth(optCollectionNames ...string) func(*core.RequestEvent) error {
-	return func(e *core.RequestEvent) error {
-		if e.Auth == nil {
-			return e.UnauthorizedError("The request requires valid record authorization token.", nil)
+			// check record collection name
+			if len(optCollectionNames) > 0 && !list.ExistInSlice(record.Collection().Name, optCollectionNames) {
+				return NewForbiddenError("The authorized record model is not allowed to perform this action.", nil)
+			}
+
+			return next(c)
 		}
+	}
+}
 
-		// check record collection name
-		if len(optCollectionNames) > 0 && !slices.Contains(optCollectionNames, e.Auth.Collection().Name) {
-			return e.ForbiddenError("The authorized record is not allowed to perform this action.", nil)
+// RequireSameContextRecordAuth middleware requires a request to have
+// a valid record Authorization header.
+//
+// The auth record must be from the same collection already loaded in the context.
+func RequireSameContextRecordAuth() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires valid record authorization token to be set.", nil)
+			}
+
+			collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+			if collection == nil || record.Collection().Id != collection.Id {
+				return NewForbiddenError(fmt.Sprintf("The request requires auth record from %s collection.", record.Collection().Name), nil)
+			}
+
+			return next(c)
 		}
-
-		return e.Next()
 	}
 }
 
-// RequireSuperuserAuth middleware requires a request to have
-// a valid superuser Authorization header.
-func RequireSuperuserAuth() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:   DefaultRequireSuperuserAuthMiddlewareId,
-		Func: requireAuth(core.CollectionNameSuperusers),
+// RequireAdminAuth middleware requires a request to have
+// a valid admin Authorization header.
+func RequireAdminAuth() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			if admin == nil {
+				return NewUnauthorizedError("The request requires valid admin authorization token to be set.", nil)
+			}
+
+			return next(c)
+		}
 	}
 }
 
-// RequireSuperuserOrOwnerAuth middleware requires a request to have
-// a valid superuser or regular record owner Authorization header set.
-//
-// This middleware is similar to [apis.RequireAuth()] but
-// for the auth record token expects to have the same id as the path
-// parameter ownerIdPathParam (default to "id" if empty).
-func RequireSuperuserOrOwnerAuth(ownerIdPathParam string) *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id: DefaultRequireSuperuserOrOwnerAuthMiddlewareId,
-		Func: func(e *core.RequestEvent) error {
-			if e.Auth == nil {
-				return e.UnauthorizedError("The request requires superuser or record authorization token.", nil)
+// RequireAdminAuthOnlyIfAny middleware requires a request to have
+// a valid admin Authorization header ONLY if the application has
+// at least 1 existing Admin model.
+func RequireAdminAuthOnlyIfAny(app core.App) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			if admin != nil {
+				return next(c)
 			}
 
-			if e.Auth.IsSuperuser() {
-				return e.Next()
-			}
-
-			if ownerIdPathParam == "" {
-				ownerIdPathParam = "id"
-			}
-			ownerId := e.Request.PathValue(ownerIdPathParam)
-
-			// note: it is considered "safe" to compare only the record id
-			// since the auth record ids are treated as unique across all auth collections
-			if e.Auth.Id != ownerId {
-				return e.ForbiddenError("You are not allowed to perform this request.", nil)
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-// RequireSameCollectionContextAuth middleware requires a request to have
-// a valid record Authorization header and the auth record's collection to
-// match the one from the route path parameter (default to "collection" if collectionParam is empty).
-func RequireSameCollectionContextAuth(collectionPathParam string) *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id: DefaultRequireSameCollectionContextAuthMiddlewareId,
-		Func: func(e *core.RequestEvent) error {
-			if e.Auth == nil {
-				return e.UnauthorizedError("The request requires valid record authorization token.", nil)
-			}
-
-			if collectionPathParam == "" {
-				collectionPathParam = "collection"
-			}
-
-			collection, _ := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
-			if collection == nil || e.Auth.Collection().Id != collection.Id {
-				return e.ForbiddenError(fmt.Sprintf("The request requires auth record from %s collection.", e.Auth.Collection().Name), nil)
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-// loadAuthToken attempts to load the auth context based on the "Authorization: TOKEN" header value.
-//
-// This middleware does nothing in case of:
-//   - missing, invalid or expired token
-//   - e.Auth is already loaded by another middleware
-//
-// This middleware is registered by default for all routes.
-//
-// Note: We don't throw an error on invalid or expired token to allow
-// users to extend with their own custom handling in external middleware(s).
-func loadAuthToken() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultLoadAuthTokenMiddlewareId,
-		Priority: DefaultLoadAuthTokenMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			// already loaded by another middleware
-			if e.Auth != nil {
-				return e.Next()
-			}
-
-			token := getAuthTokenFromRequest(e)
-			if token == "" {
-				return e.Next()
-			}
-
-			record, err := e.App.FindAuthRecordByToken(token, core.TokenTypeAuth)
+			totalAdmins, err := app.Dao().TotalAdmins()
 			if err != nil {
-				e.App.Logger().Debug("loadAuthToken failure", "error", err)
-			} else if record != nil {
-				e.Auth = record
+				return NewBadRequestError("Failed to fetch admins info.", err)
 			}
 
-			return e.Next()
-		},
+			if totalAdmins == 0 {
+				return next(c)
+			}
+
+			return NewUnauthorizedError("The request requires valid admin authorization token to be set.", nil)
+		}
 	}
 }
 
-func getAuthTokenFromRequest(e *core.RequestEvent) string {
-	token := e.Request.Header.Get("Authorization")
-
-	// the "Bearer" schema prefix is not required by PocketBase and it is
-	// supported only for compatibility with the defaults of some HTTP clients
-	if len(token) > 7 && strings.EqualFold(token[:7], "Bearer ") {
-		return token[7:]
-	}
-
-	return token
-}
-
-// wwwRedirect performs www->non-www redirect(s) if the request host
-// matches with one of the values in redirectHosts.
+// RequireAdminOrRecordAuth middleware requires a request to have
+// a valid admin or record Authorization header set.
 //
-// This middleware is registered by default on Serve for all routes.
-func wwwRedirect(redirectHosts []string) *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultWWWRedirectMiddlewareId,
-		Priority: DefaultWWWRedirectMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			host := e.Request.Host
+// You can further filter the allowed auth record collections by providing their names.
+//
+// This middleware is the opposite of [apis.RequireGuestOnly()].
+func RequireAdminOrRecordAuth(optCollectionNames ...string) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
 
-			if strings.HasPrefix(host, "www.") && list.ExistInSlice(host, redirectHosts) {
-				// note: e.Request.URL.Scheme would be empty
-				schema := "http://"
-				if e.IsTLS() {
-					schema = "https://"
-				}
+			if admin == nil && record == nil {
+				return NewUnauthorizedError("The request requires admin or record authorization token to be set.", nil)
+			}
 
-				return e.Redirect(
-					http.StatusTemporaryRedirect,
-					(schema + host[4:] + e.Request.RequestURI),
+			if record != nil && len(optCollectionNames) > 0 && !list.ExistInSlice(record.Collection().Name, optCollectionNames) {
+				return NewForbiddenError("The authorized record model is not allowed to perform this action.", nil)
+			}
+
+			return next(c)
+		}
+	}
+}
+
+// RequireAdminOrOwnerAuth middleware requires a request to have
+// a valid admin or auth record owner Authorization header set.
+//
+// This middleware is similar to [apis.RequireAdminOrRecordAuth()] but
+// for the auth record token expects to have the same id as the path
+// parameter ownerIdParam (default to "id" if empty).
+func RequireAdminOrOwnerAuth(ownerIdParam string) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			if admin != nil {
+				return next(c)
+			}
+
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires admin or record authorization token to be set.", nil)
+			}
+
+			if ownerIdParam == "" {
+				ownerIdParam = "id"
+			}
+			ownerId := c.PathParam(ownerIdParam)
+
+			// note: it is "safe" to compare only the record id since the auth
+			// record ids are treated as unique across all auth collections
+			if record.Id != ownerId {
+				return NewForbiddenError("You are not allowed to perform this request.", nil)
+			}
+
+			return next(c)
+		}
+	}
+}
+
+// LoadAuthContext middleware reads the Authorization request header
+// and loads the token related record or admin instance into the
+// request's context.
+//
+// This middleware is expected to be already registered by default for all routes.
+func LoadAuthContext(app core.App) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			token := c.Request().Header.Get("Authorization")
+			if token == "" {
+				return next(c)
+			}
+
+			// the schema is not required and it is only for
+			// compatibility with the defaults of some HTTP clients
+			token = strings.TrimPrefix(token, "Bearer ")
+
+			claims, _ := security.ParseUnverifiedJWT(token)
+			tokenType := cast.ToString(claims["type"])
+
+			switch tokenType {
+			case tokens.TypeAdmin:
+				admin, err := app.Dao().FindAdminByToken(
+					token,
+					app.Settings().AdminAuthToken.Secret,
 				)
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-// panicRecover returns a default panic-recover handler.
-func panicRecover() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultPanicRecoverMiddlewareId,
-		Priority: DefaultPanicRecoverMiddlewarePriority,
-		Func: func(e *core.RequestEvent) (err error) {
-			// panic-recover
-			defer func() {
-				recoverResult := recover()
-				if recoverResult == nil {
-					return
+				if err == nil && admin != nil {
+					c.Set(ContextAdminKey, admin)
 				}
-
-				recoverErr, ok := recoverResult.(error)
-				if !ok {
-					recoverErr = fmt.Errorf("%v", recoverResult)
-				} else if errors.Is(recoverErr, http.ErrAbortHandler) {
-					// don't recover ErrAbortHandler so the response to the client can be aborted
-					panic(recoverResult)
-				}
-
-				stack := make([]byte, 2<<10) // 2 KB
-				length := runtime.Stack(stack, true)
-				err = e.InternalServerError("", fmt.Errorf("[PANIC RECOVER] %w %s", recoverErr, stack[:length]))
-			}()
-
-			err = e.Next()
-
-			return err
-		},
-	}
-}
-
-// securityHeaders middleware adds common security headers to the response.
-//
-// This middleware is registered by default for all routes.
-func securityHeaders() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultSecurityHeadersMiddlewareId,
-		Priority: DefaultSecurityHeadersMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			e.Response.Header().Set("X-XSS-Protection", "1; mode=block")
-			e.Response.Header().Set("X-Content-Type-Options", "nosniff")
-			e.Response.Header().Set("X-Frame-Options", "SAMEORIGIN")
-			e.Response.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
-
-			// @todo consider a default HSTS?
-			// (see also https://webkit.org/blog/8146/protecting-against-hsts-abuse/)
-
-			return e.Next()
-		},
-	}
-}
-
-// superuserIPsWhitelist middleware checks the current authenticated superuser IP
-// against the configured SuperuserIPs whitelist setting.
-//
-// This middleware is registered by default for all routes.
-func superuserIPsWhitelist() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultSuperuserIPsWhitelistMiddlewareId,
-		Priority: DefaultSuperuserIPsWhitelistMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			if e.HasSuperuserAuth() {
-				ips := e.App.Settings().SuperuserIPs
-
-				if len(ips) > 0 && !isIPInList(ips, e.RealIP()) {
-					return e.ForbiddenError("", errors.New("superuser IP is not whitelisted"))
+			case tokens.TypeAuthRecord:
+				record, err := app.Dao().FindAuthRecordByToken(
+					token,
+					app.Settings().RecordAuthToken.Secret,
+				)
+				if err == nil && record != nil {
+					c.Set(ContextAuthRecordKey, record)
 				}
 			}
 
-			return e.Next()
-		},
+			return next(c)
+		}
 	}
 }
 
-// SkipSuccessActivityLog is a helper middleware that instructs the global
-// activity logger to log only requests that have failed/returned an error.
-func SkipSuccessActivityLog() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id: DefaultSkipSuccessActivityLogMiddlewareId,
-		Func: func(e *core.RequestEvent) error {
-			e.Set(requestEventKeySkipSuccessActivityLog, true)
-			return e.Next()
-		},
+// LoadCollectionContext middleware finds the collection with related
+// path identifier and loads it into the request context.
+//
+// Set optCollectionTypes to further filter the found collection by its type.
+func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			if param := c.PathParam("collection"); param != "" {
+				collection, err := core.FindCachedCollectionByNameOrId(app, param)
+				if err != nil || collection == nil {
+					return NewNotFoundError("", err)
+				}
+
+				if len(optCollectionTypes) > 0 && !list.ExistInSlice(collection.Type, optCollectionTypes) {
+					return NewBadRequestError("Unsupported collection type.", nil)
+				}
+
+				c.Set(ContextCollectionKey, collection)
+			}
+
+			return next(c)
+		}
 	}
 }
 
-// activityLogger middleware takes care to save the request information
+// ActivityLogger middleware takes care to save the request information
 // into the logs database.
 //
-// This middleware is registered by default for all routes.
-//
 // The middleware does nothing if the app logs retention period is zero
 // (aka. app.Settings().Logs.MaxDays = 0).
-//
-// Users can attach the [apis.SkipSuccessActivityLog()] middleware if
-// you want to log only the failed requests.
-func activityLogger() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultActivityLoggerMiddlewareId,
-		Priority: DefaultActivityLoggerMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			e.Set(requestEventKeyExecStart, time.Now())
+func ActivityLogger(app core.App) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			if err := next(c); err != nil {
+				return err
+			}
 
-			err := e.Next()
+			logRequest(app, c, nil)
 
-			logRequest(e, err)
-
-			return err
-		},
+			return nil
+		}
 	}
 }
 
-func logRequest(event *core.RequestEvent, err error) {
+func logRequest(app core.App, c echo.Context, err *ApiError) {
 	// no logs retention
-	if event.App.Settings().Logs.MaxDays == 0 {
-		return
-	}
-
-	// the non-error route has explicitly disabled the activity logger
-	if err == nil && event.Get(requestEventKeySkipSuccessActivityLog) != nil {
+	if app.Settings().Logs.MaxDays == 0 {
 		return
 	}
 
@@ -378,45 +307,32 @@ func logRequest(event *core.RequestEvent, err error) {
 
 	attrs = append(attrs, slog.String("type", "request"))
 
-	started := cast.ToTime(event.Get(requestEventKeyExecStart))
+	started := cast.ToTime(c.Get(ContextExecStartKey))
 	if !started.IsZero() {
 		attrs = append(attrs, slog.Float64("execTime", float64(time.Since(started))/float64(time.Millisecond)))
 	}
 
-	if meta := event.Get(RequestEventKeyLogMeta); meta != nil {
-		attrs = append(attrs, slog.Any("meta", meta))
-	}
-
-	status := event.Status()
-	method := cutStr(strings.ToUpper(event.Request.Method), 50)
-	requestUri := cutStr(event.Request.URL.RequestURI(), 3000)
+	httpRequest := c.Request()
+	httpResponse := c.Response()
+	method := strings.ToUpper(httpRequest.Method)
+	status := httpResponse.Status
+	requestUri := httpRequest.URL.RequestURI()
 
 	// parse the request error
 	if err != nil {
-		apiErr, isPlainApiError := err.(*router.ApiError)
-		if isPlainApiError || errors.As(err, &apiErr) {
-			// the status header wasn't written yet
-			if status == 0 {
-				status = apiErr.Status
-			}
+		status = err.Code
+		attrs = append(
+			attrs,
+			slog.String("error", err.Message),
+			slog.Any("details", err.RawData()),
+		)
+	}
 
-			var errMsg string
-			if isPlainApiError {
-				errMsg = apiErr.Message
-			} else {
-				// wrapped ApiError -> add the full serialized version
-				// of the original error since it could contain more information
-				errMsg = err.Error()
-			}
-
-			attrs = append(
-				attrs,
-				slog.String("error", errMsg),
-				slog.Any("details", apiErr.RawData()),
-			)
-		} else {
-			attrs = append(attrs, slog.String("error", err.Error()))
-		}
+	requestAuth := models.RequestAuthGuest
+	if c.Get(ContextAuthRecordKey) != nil {
+		requestAuth = models.RequestAuthRecord
+	} else if c.Get(ContextAdminKey) != nil {
+		requestAuth = models.RequestAuthAdmin
 	}
 
 	attrs = append(
@@ -424,25 +340,17 @@ func logRequest(event *core.RequestEvent, err error) {
 		slog.String("url", requestUri),
 		slog.String("method", method),
 		slog.Int("status", status),
-		slog.String("referer", cutStr(event.Request.Referer(), 2000)),
-		slog.String("userAgent", cutStr(event.Request.UserAgent(), 2000)),
+		slog.String("auth", requestAuth),
+		slog.String("referer", httpRequest.Referer()),
+		slog.String("userAgent", httpRequest.UserAgent()),
 	)
 
-	if event.Auth != nil {
-		attrs = append(attrs, slog.String("auth", event.Auth.Collection().Name))
-
-		if event.App.Settings().Logs.LogAuthId {
-			attrs = append(attrs, slog.String("authId", event.Auth.Id))
-		}
-	} else {
-		attrs = append(attrs, slog.String("auth", ""))
-	}
-
-	if event.App.Settings().Logs.LogIP {
+	if app.Settings().Logs.LogIp {
+		ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
 		attrs = append(
 			attrs,
-			slog.String("userIP", event.RealIP()),
-			slog.String("remoteIP", event.RemoteIP()),
+			slog.String("userIp", realUserIp(httpRequest, ip)),
+			slog.String("remoteIp", ip),
 		)
 	}
 
@@ -450,23 +358,64 @@ func logRequest(event *core.RequestEvent, err error) {
 	routine.FireAndForget(func() {
 		message := method + " "
 
-		if escaped, unescapeErr := url.PathUnescape(requestUri); unescapeErr == nil {
+		if escaped, err := url.PathUnescape(requestUri); err == nil {
 			message += escaped
 		} else {
 			message += requestUri
 		}
 
 		if err != nil {
-			event.App.Logger().Error(message, attrs...)
+			app.Logger().Error(message, attrs...)
 		} else {
-			event.App.Logger().Info(message, attrs...)
+			app.Logger().Info(message, attrs...)
 		}
 	})
 }
 
-func cutStr(str string, max int) string {
-	if len(str) > max {
-		return str[:max] + "..."
+// Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
+//
+// The returned IP value shouldn't be trusted if not behind a trusted reverse proxy!
+func realUserIp(r *http.Request, fallbackIp string) string {
+	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
+		return ip
+	}
+
+	if ip := r.Header.Get("Fly-Client-IP"); ip != "" {
+		return ip
+	}
+
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
+
+	if ipsList := r.Header.Get("X-Forwarded-For"); ipsList != "" {
+		// extract the first non-empty leftmost-ish ip
+		ips := strings.Split(ipsList, ",")
+		for _, ip := range ips {
+			ip = strings.TrimSpace(ip)
+			if ip != "" {
+				return ip
+			}
+		}
+	}
+
+	return fallbackIp
+}
+
+// @todo consider removing as this may no longer be needed due to the custom rest.MultiBinder.
+//
+// eagerRequestInfoCache ensures that the request data is cached in the request
+// context to allow reading for example the json request body data more than once.
+func eagerRequestInfoCache(app core.App) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			switch c.Request().Method {
+			// currently we are eagerly caching only the requests with body
+			case "POST", "PUT", "PATCH", "DELETE":
+				RequestInfo(c)
+			}
+
+			return next(c)
+		}
 	}
-	return str
 }

apis/middlewares_body_limit.go

@@ -1,156 +0,0 @@
-package apis
-
-import (
-	"io"
-	"net/http"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
-	"github.com/pocketbase/pocketbase/tools/router"
-)
-
-var ErrRequestEntityTooLarge = router.NewApiError(http.StatusRequestEntityTooLarge, "Request entity too large", nil)
-
-const DefaultMaxBodySize int64 = 32 << 20 // @todo consider replacing with router.DefaultMaxMemory
-
-const (
-	DefaultBodyLimitMiddlewareId       = "pbBodyLimit"
-	DefaultBodyLimitMiddlewarePriority = DefaultRateLimitMiddlewarePriority + 10
-)
-
-// BodyLimit returns a middleware handler that changes the default request body size limit.
-//
-// If limitBytes <= 0, no limit is applied.
-//
-// Otherwise, if the request body size exceeds the configured limitBytes,
-// it sends 413 error response.
-func BodyLimit(limitBytes int64) *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultBodyLimitMiddlewareId,
-		Priority: DefaultBodyLimitMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			err := applyBodyLimit(e, limitBytes)
-			if err != nil {
-				return err
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-func dynamicCollectionBodyLimit(collectionPathParam string) *hook.Handler[*core.RequestEvent] {
-	if collectionPathParam == "" {
-		collectionPathParam = "collection"
-	}
-
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultBodyLimitMiddlewareId,
-		Priority: DefaultBodyLimitMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
-			if err != nil {
-				return e.NotFoundError("Missing or invalid collection context.", err)
-			}
-
-			limitBytes := DefaultMaxBodySize
-			if !collection.IsView() {
-				for _, f := range collection.Fields {
-					if calc, ok := f.(core.MaxBodySizeCalculator); ok {
-						limitBytes += calc.CalculateMaxBodySize()
-					}
-				}
-			}
-
-			err = applyBodyLimit(e, limitBytes)
-			if err != nil {
-				return err
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-func applyBodyLimit(e *core.RequestEvent, limitBytes int64) error {
-	// no limit
-	if limitBytes <= 0 {
-		return nil
-	}
-
-	// optimistically check the submitted request content length
-	if e.Request.ContentLength > limitBytes {
-		return ErrRequestEntityTooLarge
-	}
-
-	// replace the request body
-	e.Request.Body = newMaxBytesReader(e.Request.Body, limitBytes)
-
-	return nil
-}
-
-func newMaxBytesReader(body io.ReadCloser, limitBytes int64) *maxBytesReader {
-	return &maxBytesReader{
-		ReadCloser: body,
-		limit:      limitBytes,
-		remaining:  limitBytes,
-	}
-}
-
-// maxBytesReader is very similar to the http.MaxBytesReader but support
-// rereads and doesn't try to prematurely close the related response
-// to allow consequent middlewares to operate correctly.
-type maxBytesReader struct {
-	io.ReadCloser
-	limit     int64
-	remaining int64
-	stickyErr error
-}
-
-func (r *maxBytesReader) Read(b []byte) (int, error) {
-	if r.stickyErr != nil {
-		return 0, r.stickyErr
-	}
-
-	if len(b) == 0 {
-		return 0, nil
-	}
-
-	// if possible no need to read the entire chunk since
-	// remaining+1 is enough to determine whether it exceed the limit
-	if int64(len(b))-1 > r.remaining {
-		b = b[:r.remaining+1]
-	}
-
-	n, err := r.ReadCloser.Read(b)
-
-	if int64(n) <= r.remaining {
-		r.remaining -= int64(n)
-		r.stickyErr = err
-		return n, err
-	}
-
-	n = int(r.remaining)
-
-	r.remaining = 0
-	r.stickyErr = ErrRequestEntityTooLarge
-
-	return n, r.stickyErr
-}
-
-// explicit casts to ensure that the main struct methods will be invoked
-// (extra precautions in case of nested interface wrapping erasure)
-// ---
-
-func (r *maxBytesReader) Reread() {
-	rereader, ok := r.ReadCloser.(router.Rereader)
-	if ok {
-		rereader.Reread()
-		r.remaining = r.limit
-		r.stickyErr = nil
-	}
-}
-
-func (r *maxBytesReader) Close() error {
-	return r.ReadCloser.Close()
-}

apis/middlewares_body_limit_test.go

@@ -1,153 +0,0 @@
-package apis_test
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestBodyLimitMiddleware(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	pbRouter, err := apis.NewRouter(app)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	testHandler := func(e *core.RequestEvent) error {
-		// read the body multiple times to ensure that the limited
-		// reader guards and rereads are invoked
-		var result any
-		if err := e.BindBody(&result); err != nil {
-			return err
-		}
-
-		if err := e.BindBody(&result); err != nil {
-			return err
-		}
-
-		return e.JSON(200, result)
-	}
-
-	const customLimit = 20
-
-	pbRouter.POST("/a", testHandler) // default global BodyLimit check
-	pbRouter.POST("/b", testHandler).Bind(apis.BodyLimit(customLimit))
-	pbRouter.POST("/iof", func(e *core.RequestEvent) error {
-		// ensure that normal io methods still operate correctly
-		b, err := io.ReadAll(e.Request.Body)
-		if err != nil {
-			return err
-		}
-
-		return e.String(http.StatusOK, string(b))
-	}).Bind(apis.BodyLimit(customLimit))
-
-	mux, err := pbRouter.BuildMux()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	scenarios := []struct {
-		name              string
-		url               string
-		body              string
-		lazyContentLength bool
-		expectedStatus    int
-	}{
-		{
-			"(eager content-length check) with body = default limit",
-			"/a",
-			`"` + strings.Repeat("a", int(apis.DefaultMaxBodySize-2)) + `"`,
-			false,
-			http.StatusOK,
-		},
-		{
-			"(eager content-length check) with body > default limit",
-			"/a",
-			`"` + strings.Repeat("a", int(apis.DefaultMaxBodySize)) + `"`,
-			false,
-			http.StatusRequestEntityTooLarge,
-		},
-		{
-			"(lazy content-length check) with body = default limit",
-			"/a",
-			`"` + strings.Repeat("a", int(apis.DefaultMaxBodySize-2)) + `"`,
-			true,
-			http.StatusOK,
-		},
-		{
-			"(lazy content-length check) with body > default limit",
-			"/a",
-			`"` + strings.Repeat("a", int(apis.DefaultMaxBodySize)) + `"`,
-			true,
-			http.StatusRequestEntityTooLarge,
-		},
-		// ---
-		{
-			"(eager content-length check) with body = custom limit",
-			"/b",
-			`"` + strings.Repeat("a", customLimit-2) + `"`,
-			false,
-			http.StatusOK,
-		},
-		{
-			"(eager content-length check) with body > custom limit",
-			"/b",
-			`"` + strings.Repeat("a", customLimit) + `"`,
-			false,
-			http.StatusRequestEntityTooLarge,
-		},
-		{
-			"(lazy content-length check) with body = custom limit",
-			"/b",
-			`"` + strings.Repeat("a", customLimit-2) + `"`,
-			true,
-			http.StatusOK,
-		},
-		{
-			"(lazy content-length check) with body > custom limit",
-			"/b",
-			`"` + strings.Repeat("a", customLimit) + `"`,
-			true,
-			http.StatusRequestEntityTooLarge,
-		},
-		// ---
-		{
-			"io.ReadAll io.EOF exact limit check",
-			"/iof",
-			`"` + strings.Repeat("a", customLimit-2) + `"`,
-			true,
-			http.StatusOK,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			rec := httptest.NewRecorder()
-
-			req := httptest.NewRequest("POST", s.url, strings.NewReader(s.body))
-			req.Header.Set("Content-Type", "application/json")
-
-			if s.lazyContentLength {
-				req.ContentLength = -1
-			}
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-			defer result.Body.Close()
-
-			if result.StatusCode != s.expectedStatus {
-				t.Fatalf("Expected response status %d, got %d", s.expectedStatus, result.StatusCode)
-			}
-		})
-	}
-}

apis/middlewares_cors.go

@@ -1,327 +0,0 @@
-package apis
-
-// -------------------------------------------------------------------
-// This middleware is ported from echo/middleware to minimize the breaking
-// changes and differences in the API behavior from earlier PocketBase versions
-// (https://github.com/labstack/echo/blob/ec5b858dab6105ab4c3ed2627d1ebdfb6ae1ecb8/middleware/cors.go).
-//
-// I doubt that this would matter for most cases, but the only major difference
-// is that for non-supported routes this middleware doesn't return 405 and fallbacks
-// to the default catch-all PocketBase route (aka. returns 404) to avoid
-// the extra overhead of further hijacking and wrapping the Go default mux
-// (https://github.com/golang/go/issues/65648#issuecomment-1955328807).
-// -------------------------------------------------------------------
-
-import (
-	"log"
-	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
-)
-
-const (
-	DefaultCorsMiddlewareId       = "pbCors"
-	DefaultCorsMiddlewarePriority = DefaultActivityLoggerMiddlewarePriority - 1 // before the activity logger and rate limit so that OPTIONS preflight requests are not counted
-)
-
-// CORSConfig defines the config for CORS middleware.
-type CORSConfig struct {
-	// AllowOrigins determines the value of the Access-Control-Allow-Origin
-	// response header.  This header defines a list of origins that may access the
-	// resource.  The wildcard characters '*' and '?' are supported and are
-	// converted to regex fragments '.*' and '.' accordingly.
-	//
-	// Security: use extreme caution when handling the origin, and carefully
-	// validate any logic. Remember that attackers may register hostile domain names.
-	// See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
-	//
-	// Optional. Default value []string{"*"}.
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-	AllowOrigins []string
-
-	// AllowOriginFunc is a custom function to validate the origin. It takes the
-	// origin as an argument and returns true if allowed or false otherwise. If
-	// an error is returned, it is returned by the handler. If this option is
-	// set, AllowOrigins is ignored.
-	//
-	// Security: use extreme caution when handling the origin, and carefully
-	// validate any logic. Remember that attackers may register hostile domain names.
-	// See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
-	//
-	// Optional.
-	AllowOriginFunc func(origin string) (bool, error)
-
-	// AllowMethods determines the value of the Access-Control-Allow-Methods
-	// response header.  This header specified the list of methods allowed when
-	// accessing the resource.  This is used in response to a preflight request.
-	//
-	// Optional. Default value DefaultCORSConfig.AllowMethods.
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
-	AllowMethods []string
-
-	// AllowHeaders determines the value of the Access-Control-Allow-Headers
-	// response header.  This header is used in response to a preflight request to
-	// indicate which HTTP headers can be used when making the actual request.
-	//
-	// Optional. Default value []string{}.
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
-	AllowHeaders []string
-
-	// AllowCredentials determines the value of the
-	// Access-Control-Allow-Credentials response header.  This header indicates
-	// whether or not the response to the request can be exposed when the
-	// credentials mode (Request.credentials) is true. When used as part of a
-	// response to a preflight request, this indicates whether or not the actual
-	// request can be made using credentials.  See also
-	// [MDN: Access-Control-Allow-Credentials].
-	//
-	// Optional. Default value false, in which case the header is not set.
-	//
-	// Security: avoid using `AllowCredentials = true` with `AllowOrigins = *`.
-	// See "Exploiting CORS misconfigurations for Bitcoins and bounties",
-	// https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
-	AllowCredentials bool
-
-	// UnsafeWildcardOriginWithAllowCredentials UNSAFE/INSECURE: allows wildcard '*' origin to be used with AllowCredentials
-	// flag. In that case we consider any origin allowed and send it back to the client with `Access-Control-Allow-Origin` header.
-	//
-	// This is INSECURE and potentially leads to [cross-origin](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
-	// attacks. See: https://github.com/labstack/echo/issues/2400 for discussion on the subject.
-	//
-	// Optional. Default value is false.
-	UnsafeWildcardOriginWithAllowCredentials bool
-
-	// ExposeHeaders determines the value of Access-Control-Expose-Headers, which
-	// defines a list of headers that clients are allowed to access.
-	//
-	// Optional. Default value []string{}, in which case the header is not set.
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Header
-	ExposeHeaders []string
-
-	// MaxAge determines the value of the Access-Control-Max-Age response header.
-	// This header indicates how long (in seconds) the results of a preflight
-	// request can be cached.
-	// The header is set only if MaxAge != 0, negative value sends "0" which instructs browsers not to cache that response.
-	//
-	// Optional. Default value 0 - meaning header is not sent.
-	//
-	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
-	MaxAge int
-}
-
-// DefaultCORSConfig is the default CORS middleware config.
-var DefaultCORSConfig = CORSConfig{
-	AllowOrigins: []string{"*"},
-	AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
-}
-
-// CORS returns a CORS middleware.
-func CORS(config CORSConfig) *hook.Handler[*core.RequestEvent] {
-	// Defaults
-	if len(config.AllowOrigins) == 0 {
-		config.AllowOrigins = DefaultCORSConfig.AllowOrigins
-	}
-	if len(config.AllowMethods) == 0 {
-		config.AllowMethods = DefaultCORSConfig.AllowMethods
-	}
-
-	allowOriginPatterns := make([]*regexp.Regexp, 0, len(config.AllowOrigins))
-	for _, origin := range config.AllowOrigins {
-		if origin == "*" {
-			continue // "*" is handled differently and does not need regexp
-		}
-
-		pattern := regexp.QuoteMeta(origin)
-		pattern = strings.ReplaceAll(pattern, "\\*", ".*")
-		pattern = strings.ReplaceAll(pattern, "\\?", ".")
-		pattern = "^" + pattern + "$"
-
-		re, err := regexp.Compile(pattern)
-		if err != nil {
-			// This is to preserve previous behaviour - invalid patterns were just ignored.
-			// If we would turn this to panic, users with invalid patterns
-			// would have applications crashing in production due unrecovered panic.
-			log.Println("invalid AllowOrigins pattern", origin)
-			continue
-		}
-		allowOriginPatterns = append(allowOriginPatterns, re)
-	}
-
-	allowMethods := strings.Join(config.AllowMethods, ",")
-	allowHeaders := strings.Join(config.AllowHeaders, ",")
-	exposeHeaders := strings.Join(config.ExposeHeaders, ",")
-
-	maxAge := "0"
-	if config.MaxAge > 0 {
-		maxAge = strconv.Itoa(config.MaxAge)
-	}
-
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultCorsMiddlewareId,
-		Priority: DefaultCorsMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			req := e.Request
-			res := e.Response
-			origin := req.Header.Get("Origin")
-			allowOrigin := ""
-
-			res.Header().Add("Vary", "Origin")
-
-			// Preflight request is an OPTIONS request, using three HTTP request headers: Access-Control-Request-Method,
-			// Access-Control-Request-Headers, and the Origin header. See: https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
-			// For simplicity we just consider method type and later `Origin` header.
-			preflight := req.Method == http.MethodOptions
-
-			// No Origin provided. This is (probably) not request from actual browser - proceed executing middleware chain
-			if origin == "" {
-				if !preflight {
-					return e.Next()
-				}
-				return e.NoContent(http.StatusNoContent)
-			}
-
-			if config.AllowOriginFunc != nil {
-				allowed, err := config.AllowOriginFunc(origin)
-				if err != nil {
-					return err
-				}
-				if allowed {
-					allowOrigin = origin
-				}
-			} else {
-				// Check allowed origins
-				for _, o := range config.AllowOrigins {
-					if o == "*" && config.AllowCredentials && config.UnsafeWildcardOriginWithAllowCredentials {
-						allowOrigin = origin
-						break
-					}
-					if o == "*" || o == origin {
-						allowOrigin = o
-						break
-					}
-					if matchSubdomain(origin, o) {
-						allowOrigin = origin
-						break
-					}
-				}
-
-				checkPatterns := false
-				if allowOrigin == "" {
-					// to avoid regex cost by invalid (long) domains (253 is domain name max limit)
-					if len(origin) <= (253+3+5) && strings.Contains(origin, "://") {
-						checkPatterns = true
-					}
-				}
-				if checkPatterns {
-					for _, re := range allowOriginPatterns {
-						if match := re.MatchString(origin); match {
-							allowOrigin = origin
-							break
-						}
-					}
-				}
-			}
-
-			// Origin not allowed
-			if allowOrigin == "" {
-				if !preflight {
-					return e.Next()
-				}
-				return e.NoContent(http.StatusNoContent)
-			}
-
-			res.Header().Set("Access-Control-Allow-Origin", allowOrigin)
-			if config.AllowCredentials {
-				res.Header().Set("Access-Control-Allow-Credentials", "true")
-			}
-
-			// Simple request
-			if !preflight {
-				if exposeHeaders != "" {
-					res.Header().Set("Access-Control-Expose-Headers", exposeHeaders)
-				}
-				return e.Next()
-			}
-
-			// Preflight request
-			res.Header().Add("Vary", "Access-Control-Request-Method")
-			res.Header().Add("Vary", "Access-Control-Request-Headers")
-			res.Header().Set("Access-Control-Allow-Methods", allowMethods)
-
-			if allowHeaders != "" {
-				res.Header().Set("Access-Control-Allow-Headers", allowHeaders)
-			} else {
-				h := req.Header.Get("Access-Control-Request-Headers")
-				if h != "" {
-					res.Header().Set("Access-Control-Allow-Headers", h)
-				}
-			}
-			if config.MaxAge != 0 {
-				res.Header().Set("Access-Control-Max-Age", maxAge)
-			}
-
-			return e.NoContent(http.StatusNoContent)
-		},
-	}
-}
-
-func matchScheme(domain, pattern string) bool {
-	didx := strings.Index(domain, ":")
-	pidx := strings.Index(pattern, ":")
-	return didx != -1 && pidx != -1 && domain[:didx] == pattern[:pidx]
-}
-
-// matchSubdomain compares authority with wildcard
-func matchSubdomain(domain, pattern string) bool {
-	if !matchScheme(domain, pattern) {
-		return false
-	}
-
-	didx := strings.Index(domain, "://")
-	pidx := strings.Index(pattern, "://")
-	if didx == -1 || pidx == -1 {
-		return false
-	}
-	domAuth := domain[didx+3:]
-	// to avoid long loop by invalid long domain
-	if len(domAuth) > 253 {
-		return false
-	}
-	patAuth := pattern[pidx+3:]
-
-	domComp := strings.Split(domAuth, ".")
-	patComp := strings.Split(patAuth, ".")
-	for i := len(domComp)/2 - 1; i >= 0; i-- {
-		opp := len(domComp) - 1 - i
-		domComp[i], domComp[opp] = domComp[opp], domComp[i]
-	}
-	for i := len(patComp)/2 - 1; i >= 0; i-- {
-		opp := len(patComp) - 1 - i
-		patComp[i], patComp[opp] = patComp[opp], patComp[i]
-	}
-
-	for i, v := range domComp {
-		if len(patComp) <= i {
-			return false
-		}
-		p := patComp[i]
-		if p == "*" {
-			return true
-		}
-		if p != v {
-			return false
-		}
-	}
-
-	return false
-}

apis/middlewares_gzip.go

@@ -1,247 +0,0 @@
-package apis
-
-// -------------------------------------------------------------------
-// This middleware is ported from echo/middleware to minimize the breaking
-// changes and differences in the API behavior from earlier PocketBase versions
-// (https://github.com/labstack/echo/blob/ec5b858dab6105ab4c3ed2627d1ebdfb6ae1ecb8/middleware/compress.go).
-// -------------------------------------------------------------------
-
-import (
-	"bufio"
-	"bytes"
-	"compress/gzip"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"strings"
-	"sync"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
-	"github.com/pocketbase/pocketbase/tools/router"
-)
-
-const (
-	gzipScheme = "gzip"
-)
-
-const (
-	DefaultGzipMiddlewareId = "pbGzip"
-)
-
-// GzipConfig defines the config for Gzip middleware.
-type GzipConfig struct {
-	// Gzip compression level.
-	// Optional. Default value -1.
-	Level int
-
-	// Length threshold before gzip compression is applied.
-	// Optional. Default value 0.
-	//
-	// Most of the time you will not need to change the default. Compressing
-	// a short response might increase the transmitted data because of the
-	// gzip format overhead. Compressing the response will also consume CPU
-	// and time on the server and the client (for decompressing). Depending on
-	// your use case such a threshold might be useful.
-	//
-	// See also:
-	// https://webmasters.stackexchange.com/questions/31750/what-is-recommended-minimum-object-size-for-gzip-performance-benefits
-	MinLength int
-}
-
-// Gzip returns a middleware which compresses HTTP response using Gzip compression scheme.
-func Gzip() *hook.Handler[*core.RequestEvent] {
-	return GzipWithConfig(GzipConfig{})
-}
-
-// GzipWithConfig returns a middleware which compresses HTTP response using gzip compression scheme.
-func GzipWithConfig(config GzipConfig) *hook.Handler[*core.RequestEvent] {
-	if config.Level < -2 || config.Level > 9 { // these are consts: gzip.HuffmanOnly and gzip.BestCompression
-		panic(errors.New("invalid gzip level"))
-	}
-	if config.Level == 0 {
-		config.Level = -1
-	}
-	if config.MinLength < 0 {
-		config.MinLength = 0
-	}
-
-	pool := sync.Pool{
-		New: func() interface{} {
-			w, err := gzip.NewWriterLevel(io.Discard, config.Level)
-			if err != nil {
-				return err
-			}
-			return w
-		},
-	}
-
-	bpool := sync.Pool{
-		New: func() interface{} {
-			b := &bytes.Buffer{}
-			return b
-		},
-	}
-
-	return &hook.Handler[*core.RequestEvent]{
-		Id: DefaultGzipMiddlewareId,
-		Func: func(e *core.RequestEvent) error {
-			e.Response.Header().Add("Vary", "Accept-Encoding")
-			if strings.Contains(e.Request.Header.Get("Accept-Encoding"), gzipScheme) {
-				w, ok := pool.Get().(*gzip.Writer)
-				if !ok {
-					return e.InternalServerError("", errors.New("failed to get gzip.Writer"))
-				}
-
-				rw := e.Response
-				w.Reset(rw)
-
-				buf := bpool.Get().(*bytes.Buffer)
-				buf.Reset()
-
-				grw := &gzipResponseWriter{Writer: w, ResponseWriter: rw, minLength: config.MinLength, buffer: buf}
-				defer func() {
-					// There are different reasons for cases when we have not yet written response to the client and now need to do so.
-					// a) handler response had only response code and no response body (ala 404 or redirects etc). Response code need to be written now.
-					// b) body is shorter than our minimum length threshold and being buffered currently and needs to be written
-					if !grw.wroteBody {
-						if rw.Header().Get("Content-Encoding") == gzipScheme {
-							rw.Header().Del("Content-Encoding")
-						}
-						if grw.wroteHeader {
-							rw.WriteHeader(grw.code)
-						}
-						// We have to reset response to it's pristine state when
-						// nothing is written to body or error is returned.
-						// See issue echo#424, echo#407.
-						e.Response = rw
-						w.Reset(io.Discard)
-					} else if !grw.minLengthExceeded {
-						// Write uncompressed response
-						e.Response = rw
-						if grw.wroteHeader {
-							rw.WriteHeader(grw.code)
-						}
-						grw.buffer.WriteTo(rw)
-						w.Reset(io.Discard)
-					}
-					w.Close()
-					bpool.Put(buf)
-					pool.Put(w)
-				}()
-				e.Response = grw
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-type gzipResponseWriter struct {
-	http.ResponseWriter
-	io.Writer
-	buffer            *bytes.Buffer
-	minLength         int
-	code              int
-	wroteHeader       bool
-	wroteBody         bool
-	minLengthExceeded bool
-}
-
-func (w *gzipResponseWriter) WriteHeader(code int) {
-	w.Header().Del("Content-Length") // Issue echo#444
-
-	w.wroteHeader = true
-
-	// Delay writing of the header until we know if we'll actually compress the response
-	w.code = code
-}
-
-func (w *gzipResponseWriter) Write(b []byte) (int, error) {
-	if w.Header().Get("Content-Type") == "" {
-		w.Header().Set("Content-Type", http.DetectContentType(b))
-	}
-
-	w.wroteBody = true
-
-	if !w.minLengthExceeded {
-		n, err := w.buffer.Write(b)
-
-		if w.buffer.Len() >= w.minLength {
-			w.minLengthExceeded = true
-
-			// The minimum length is exceeded, add Content-Encoding header and write the header
-			w.Header().Set("Content-Encoding", gzipScheme)
-			if w.wroteHeader {
-				w.ResponseWriter.WriteHeader(w.code)
-			}
-
-			return w.Writer.Write(w.buffer.Bytes())
-		}
-
-		return n, err
-	}
-
-	return w.Writer.Write(b)
-}
-
-func (w *gzipResponseWriter) Flush() {
-	if !w.minLengthExceeded {
-		// Enforce compression because we will not know how much more data will come
-		w.minLengthExceeded = true
-		w.Header().Set("Content-Encoding", gzipScheme)
-		if w.wroteHeader {
-			w.ResponseWriter.WriteHeader(w.code)
-		}
-
-		_, _ = w.Writer.Write(w.buffer.Bytes())
-	}
-
-	_ = w.Writer.(*gzip.Writer).Flush()
-
-	_ = http.NewResponseController(w.ResponseWriter).Flush()
-}
-
-func (w *gzipResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	return http.NewResponseController(w.ResponseWriter).Hijack()
-}
-
-func (w *gzipResponseWriter) Push(target string, opts *http.PushOptions) error {
-	rw := w.ResponseWriter
-	for {
-		switch p := rw.(type) {
-		case http.Pusher:
-			return p.Push(target, opts)
-		case router.RWUnwrapper:
-			rw = p.Unwrap()
-		default:
-			return http.ErrNotSupported
-		}
-	}
-}
-
-// Note: Disable the implementation for now because in case the platform
-// supports the sendfile fast-path it won't run gzipResponseWriter.Write,
-// preventing compression on the fly.
-//
-// func (w *gzipResponseWriter) ReadFrom(r io.Reader) (n int64, err error) {
-// 	if w.wroteHeader {
-// 		w.ResponseWriter.WriteHeader(w.code)
-// 	}
-// 	rw := w.ResponseWriter
-// 	for {
-// 		switch rf := rw.(type) {
-// 		case io.ReaderFrom:
-// 			return rf.ReadFrom(r)
-// 		case router.RWUnwrapper:
-// 			rw = rf.Unwrap()
-// 		default:
-// 			return io.Copy(w.ResponseWriter, r)
-// 		}
-// 	}
-// }
-
-func (w *gzipResponseWriter) Unwrap() http.ResponseWriter {
-	return w.ResponseWriter
-}

apis/middlewares_rate_limit.go

@@ -1,375 +0,0 @@
-package apis
-
-import (
-	"errors"
-	"net/netip"
-	"sync"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
-	"github.com/pocketbase/pocketbase/tools/store"
-)
-
-const (
-	DefaultRateLimitMiddlewareId       = "pbRateLimit"
-	DefaultRateLimitMiddlewarePriority = -1000
-)
-
-const (
-	rateLimitersStoreKey       = "__pbRateLimiters__"
-	rateLimitersCronKey        = "__pbRateLimitersCleanup__"
-	rateLimitersSettingsHookId = "__pbRateLimitersSettingsHook__"
-)
-
-// rateLimit defines the global rate limit middleware.
-//
-// This middleware is registered by default for all routes.
-func rateLimit() *hook.Handler[*core.RequestEvent] {
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultRateLimitMiddlewareId,
-		Priority: DefaultRateLimitMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			if skipRateLimit(e) {
-				return e.Next()
-			}
-
-			rule, ok := e.App.Settings().RateLimits.FindRateLimitRule(
-				defaultRateLimitLabels(e),
-				defaultRateLimitAudience(e)...,
-			)
-			if ok {
-				err := checkRateLimit(e, rule.Label+rule.Audience, rule)
-				if err != nil {
-					return err
-				}
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-// collectionPathRateLimit defines a rate limit middleware for the internal collection handlers.
-func collectionPathRateLimit(collectionPathParam string, baseTags ...string) *hook.Handler[*core.RequestEvent] {
-	if collectionPathParam == "" {
-		collectionPathParam = "collection"
-	}
-
-	return &hook.Handler[*core.RequestEvent]{
-		Id:       DefaultRateLimitMiddlewareId,
-		Priority: DefaultRateLimitMiddlewarePriority,
-		Func: func(e *core.RequestEvent) error {
-			collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
-			if err != nil {
-				return e.NotFoundError("Missing or invalid collection context.", err)
-			}
-
-			if err := checkCollectionRateLimit(e, collection, baseTags...); err != nil {
-				return err
-			}
-
-			return e.Next()
-		},
-	}
-}
-
-// checkCollectionRateLimit checks whether the current request satisfy the
-// rate limit configuration for the specific collection.
-//
-// Each baseTags entry will be prefixed with the collection name and its wildcard variant.
-func checkCollectionRateLimit(e *core.RequestEvent, collection *core.Collection, baseTags ...string) error {
-	if skipRateLimit(e) {
-		return nil
-	}
-
-	labels := make([]string, 0, 2+len(baseTags)*2)
-
-	rtId := collection.Id + e.Request.Pattern
-
-	// add first the primary labels (aka. ["collectionName:action1", "collectionName:action2"])
-	for _, baseTag := range baseTags {
-		rtId += baseTag
-		labels = append(labels, collection.Name+":"+baseTag)
-	}
-
-	// add the wildcard labels (aka. [..., "*:action1","*:action2", "*"])
-	for _, baseTag := range baseTags {
-		labels = append(labels, "*:"+baseTag)
-	}
-	labels = append(labels, defaultRateLimitLabels(e)...)
-
-	rule, ok := e.App.Settings().RateLimits.FindRateLimitRule(labels, defaultRateLimitAudience(e)...)
-	if ok {
-		return checkRateLimit(e, rtId+rule.Audience, rule)
-	}
-
-	return nil
-}
-
-// isIPInList checks if the specified IP is in a list of other individual IPs or subnets.
-func isIPInList(ipsOrSubnets []string, ip string) bool {
-	if len(ipsOrSubnets) == 0 || ip == "" {
-		return false
-	}
-
-	// normalize
-	searchAddr, err := netip.ParseAddr(ip)
-	if err != nil {
-		return false
-	}
-
-	for _, item := range ipsOrSubnets {
-		// subnet?
-		prefix, err := netip.ParsePrefix(item)
-		if err == nil {
-			if prefix.Contains(searchAddr) {
-				return true
-			}
-			continue
-		}
-
-		// individual ip?
-		addr, err := netip.ParseAddr(item)
-		if err == nil {
-			if addr == searchAddr {
-				return true
-			}
-			continue
-		}
-	}
-
-	return false
-}
-
-// -------------------------------------------------------------------
-
-// @todo consider exporting as helper?
-func checkRateLimit(e *core.RequestEvent, rtId string, rule core.RateLimitRule) error {
-	switch rule.Audience {
-	case core.RateLimitRuleAudienceAll:
-		// valid for both guest and regular users
-	case core.RateLimitRuleAudienceGuest:
-		if e.Auth != nil {
-			return nil
-		}
-	case core.RateLimitRuleAudienceAuth:
-		if e.Auth == nil {
-			return nil
-		}
-	}
-
-	rateLimiters := e.App.Store().GetOrSet(rateLimitersStoreKey, func() any {
-		return initRateLimitersStore(e.App)
-	}).(*store.Store[string, *rateLimiter])
-	if rateLimiters == nil {
-		e.App.Logger().Warn("Failed to retrieve app rate limiters store")
-		return nil
-	}
-
-	rt := rateLimiters.GetOrSet(rtId, func() *rateLimiter {
-		return newRateLimiter(rule.MaxRequests, rule.Duration, 1800)
-	})
-	if rt == nil {
-		e.App.Logger().Warn("Failed to retrieve app rate limiter", "id", rtId)
-		return nil
-	}
-
-	key := e.RealIP()
-	if key == "" {
-		e.App.Logger().Warn("Empty rate limit client key")
-		return nil
-	}
-
-	if !rt.isAllowed(key) {
-		return e.TooManyRequestsError("", errors.New("triggered rate limit rule: "+rule.String()))
-	}
-
-	return nil
-}
-
-func skipRateLimit(e *core.RequestEvent) bool {
-	return !e.App.Settings().RateLimits.Enabled ||
-		e.HasSuperuserAuth() ||
-		isIPInList(e.App.Settings().RateLimits.ExcludedIPs, e.RealIP())
-}
-
-var defaultAuthAudience = []string{core.RateLimitRuleAudienceAll, core.RateLimitRuleAudienceAuth}
-var defaultGuestAudience = []string{core.RateLimitRuleAudienceAll, core.RateLimitRuleAudienceGuest}
-
-func defaultRateLimitAudience(e *core.RequestEvent) []string {
-	if e.Auth != nil {
-		return defaultAuthAudience
-	}
-
-	return defaultGuestAudience
-}
-
-func defaultRateLimitLabels(e *core.RequestEvent) []string {
-	return []string{e.Request.Method + " " + e.Request.URL.Path, e.Request.URL.Path}
-}
-
-func destroyRateLimitersStore(app core.App) {
-	app.OnSettingsReload().Unbind(rateLimitersSettingsHookId)
-	app.Cron().Remove(rateLimitersCronKey)
-	app.Store().Remove(rateLimitersStoreKey)
-}
-
-func initRateLimitersStore(app core.App) *store.Store[string, *rateLimiter] {
-	app.Cron().Add(rateLimitersCronKey, "2 * * * *", func() { // offset a little since too many cleanup tasks execute at 00
-		limitersStore, ok := app.Store().Get(rateLimitersStoreKey).(*store.Store[string, *rateLimiter])
-		if !ok {
-			return
-		}
-		limiters := limitersStore.GetAll()
-		for _, limiter := range limiters {
-			limiter.clean()
-		}
-	})
-
-	app.OnSettingsReload().Bind(&hook.Handler[*core.SettingsReloadEvent]{
-		Id: rateLimitersSettingsHookId,
-		Func: func(e *core.SettingsReloadEvent) error {
-			err := e.Next()
-			if err != nil {
-				return err
-			}
-
-			// reset
-			destroyRateLimitersStore(e.App)
-
-			return nil
-		},
-	})
-
-	return store.New[string, *rateLimiter](nil)
-}
-
-func newRateLimiter(maxAllowed int, intervalInSec int64, minDeleteIntervalInSec int64) *rateLimiter {
-	return &rateLimiter{
-		maxAllowed:        maxAllowed,
-		interval:          intervalInSec,
-		minDeleteInterval: minDeleteIntervalInSec,
-		clients:           map[string]*rateClient{},
-	}
-}
-
-type rateLimiter struct {
-	clients map[string]*rateClient
-
-	maxAllowed        int
-	interval          int64
-	minDeleteInterval int64
-	totalDeleted      int64
-
-	sync.RWMutex
-}
-
-//nolint:unused
-func (rt *rateLimiter) getClient(key string) (*rateClient, bool) {
-	rt.RLock()
-	client, ok := rt.clients[key]
-	rt.RUnlock()
-
-	return client, ok
-}
-
-func (rt *rateLimiter) isAllowed(key string) bool {
-	// lock only reads to minimize locks contention
-	rt.RLock()
-	client, ok := rt.clients[key]
-	rt.RUnlock()
-
-	if !ok {
-		rt.Lock()
-		// check again in case the client was added by another request
-		client, ok = rt.clients[key]
-		if !ok {
-			client = newRateClient(rt.maxAllowed, rt.interval)
-			rt.clients[key] = client
-		}
-		rt.Unlock()
-	}
-
-	return client.consume()
-}
-
-func (rt *rateLimiter) clean() {
-	rt.Lock()
-	defer rt.Unlock()
-
-	nowUnix := time.Now().Unix()
-
-	for k, client := range rt.clients {
-		if client.hasExpired(nowUnix, rt.minDeleteInterval) {
-			delete(rt.clients, k)
-			rt.totalDeleted++
-		}
-	}
-
-	// "shrink" the map if too may items were deleted
-	//
-	// @todo remove after https://github.com/golang/go/issues/20135
-	if rt.totalDeleted >= 300 {
-		shrunk := make(map[string]*rateClient, len(rt.clients))
-		for k, v := range rt.clients {
-			shrunk[k] = v
-		}
-		rt.clients = shrunk
-		rt.totalDeleted = 0
-	}
-}
-
-func newRateClient(maxAllowed int, intervalInSec int64) *rateClient {
-	return &rateClient{
-		maxAllowed: maxAllowed,
-		interval:   intervalInSec,
-	}
-}
-
-// @todo evaluate swiching to sliding window with approximation counter similar to Cloudflare.
-//
-// rateClient implements fixed window rate limit strategy.
-type rateClient struct {
-	// use plain Mutex instead of RWMutex since the operations are expected
-	// to be mostly writes (e.g. consume()) and it should perform better
-	sync.Mutex
-
-	maxAllowed int   // the max allowed tokens per interval
-	available  int   // the total available tokens
-	start      int64 // the start time of the current window
-	interval   int64 // in seconds
-}
-
-// hasExpired checks whether it has been at least minElapsed seconds after the last active window.
-// (usually used to perform periodic cleanup of staled instances).
-func (l *rateClient) hasExpired(relativeNow int64, minElapsed int64) bool {
-	l.Lock()
-	defer l.Unlock()
-
-	return relativeNow-(l.start+l.interval) > minElapsed
-}
-
-// consume decreases the current allowance with 1 (if not exhausted already).
-//
-// It returns false if the allowance has been already exhausted and the user
-// has to wait until it resets back to its maxAllowed value.
-func (l *rateClient) consume() bool {
-	l.Lock()
-	defer l.Unlock()
-
-	nowUnix := time.Now().Unix()
-
-	// reset
-	if nowUnix-l.start >= l.interval {
-		l.available = l.maxAllowed
-		l.start = nowUnix
-	}
-
-	if l.available > 0 {
-		l.available--
-		return true
-	}
-
-	return false
-}

apis/middlewares_rate_limit_test.go

@@ -1,326 +0,0 @@
-package apis_test
-
-import (
-	"fmt"
-	"net/http/httptest"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/hook"
-)
-
-func TestDefaultRateLimitMiddleware(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	app.Settings().RateLimits.Enabled = true
-	app.Settings().RateLimits.Rules = []core.RateLimitRule{
-		{
-			Label:       "/rate/",
-			MaxRequests: 2,
-			Duration:    1,
-		},
-		{
-			Label:       "/rate/b",
-			MaxRequests: 3,
-			Duration:    1,
-		},
-		{
-			Label:       "POST /rate/b",
-			MaxRequests: 1,
-			Duration:    1,
-		},
-		{
-			Label:       "/rate/guest",
-			MaxRequests: 1,
-			Duration:    1,
-			Audience:    core.RateLimitRuleAudienceGuest,
-		},
-		{
-			Label:       "/rate/auth",
-			MaxRequests: 1,
-			Duration:    1,
-			Audience:    core.RateLimitRuleAudienceAuth,
-		},
-	}
-
-	pbRouter, err := apis.NewRouter(app)
-	if err != nil {
-		t.Fatal(err)
-	}
-	pbRouter.GET("/norate", func(e *core.RequestEvent) error {
-		return e.String(200, "norate")
-	}).BindFunc(func(e *core.RequestEvent) error {
-		return e.Next()
-	})
-	pbRouter.GET("/rate/a", func(e *core.RequestEvent) error {
-		return e.String(200, "a")
-	})
-	pbRouter.GET("/rate/b", func(e *core.RequestEvent) error {
-		return e.String(200, "b")
-	})
-	pbRouter.GET("/rate/guest", func(e *core.RequestEvent) error {
-		return e.String(200, "guest")
-	})
-	pbRouter.GET("/rate/auth", func(e *core.RequestEvent) error {
-		return e.String(200, "auth")
-	})
-
-	mux, err := pbRouter.BuildMux()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	scenarios := []struct {
-		url            string
-		wait           float64 // ms
-		authenticated  bool
-		expectedStatus int
-	}{
-		{"/norate", 0, false, 200},
-		{"/norate", 0, false, 200},
-		{"/norate", 0, false, 200},
-		{"/norate", 0, false, 200},
-		{"/norate", 0, false, 200},
-
-		{"/rate/a", 0, false, 200},
-		{"/rate/a", 900, false, 200}, // (fixed window check) wait enough to ensure that it can't fit more than 2 requests in 1s
-		{"/rate/a", 900, false, 200},
-		{"/rate/a", 0, false, 200},
-		{"/rate/a", 0, false, 429},
-		{"/rate/a", 0, false, 429},
-		{"/rate/a", 1000, false, 200},
-		{"/rate/a", 0, false, 200},
-		{"/rate/a", 0, false, 429},
-
-		{"/rate/b", 0, false, 200},
-		{"/rate/b", 0, false, 200},
-		{"/rate/b", 0, false, 200},
-		{"/rate/b", 0, false, 429},
-		{"/rate/b", 1000, false, 200},
-		{"/rate/b", 0, false, 200},
-		{"/rate/b", 0, false, 200},
-		{"/rate/b", 0, false, 429},
-
-		// "auth" with guest (should fallback to the /rate/ rule)
-		{"/rate/auth", 0, false, 200},
-		{"/rate/auth", 0, false, 200},
-		{"/rate/auth", 0, false, 429},
-		{"/rate/auth", 0, false, 429},
-
-		// "auth" rule with regular user (should match the /rate/auth rule)
-		{"/rate/auth", 0, true, 200},
-		{"/rate/auth", 0, true, 429},
-		{"/rate/auth", 0, true, 429},
-
-		// "guest" with guest (should match the /rate/guest rule)
-		{"/rate/guest", 0, false, 200},
-		{"/rate/guest", 0, false, 429},
-		{"/rate/guest", 0, false, 429},
-
-		// "guest" rule with regular user (should fallback to the /rate/ rule)
-		{"/rate/guest", 1000, true, 200},
-		{"/rate/guest", 0, true, 200},
-		{"/rate/guest", 0, true, 429},
-		{"/rate/guest", 0, true, 429},
-	}
-
-	synctest.Test(t, func(t *testing.T) {
-		for i, s := range scenarios {
-			prefix := fmt.Sprintf("[%s:%d] ", s.url, i+1)
-
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", s.url, nil)
-
-			if s.authenticated {
-				auth, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf(prefix+"%v", err)
-				}
-
-				token, err := auth.NewAuthToken()
-				if err != nil {
-					t.Fatalf(prefix+"%v", err)
-				}
-
-				req.Header.Add("Authorization", token)
-			}
-
-			if s.wait > 0 {
-				synctest.Sleep(time.Duration(s.wait) * time.Millisecond)
-			}
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			if result.StatusCode != s.expectedStatus {
-				t.Fatalf(prefix+"Expected response status %d, got %d", s.expectedStatus, result.StatusCode)
-			}
-		}
-	})
-}
-
-func TestDefaultRateLimitMiddlewareSkipChecks(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	app.Settings().RateLimits.Enabled = true
-	app.Settings().RateLimits.Rules = []core.RateLimitRule{
-		{
-			Label:       "/rate",
-			MaxRequests: 1,
-			Duration:    5,
-		},
-	}
-
-	pbRouter, err := apis.NewRouter(app)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// just for the exclude tests - load the user IP from a query param
-	pbRouter.Bind(&hook.Handler[*core.RequestEvent]{
-		Priority: apis.DefaultRateLimitMiddlewarePriority - 1,
-		Func: func(e *core.RequestEvent) error {
-			testIp := e.Request.URL.Query().Get("testIP")
-			if testIp != "" {
-				e.Request.Header.Set("x-test-ip", testIp)
-			}
-
-			return e.Next()
-		},
-	})
-
-	pbRouter.GET("/rate", func(e *core.RequestEvent) error {
-		return e.String(200, "test")
-	})
-
-	mux, err := pbRouter.BuildMux()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	checkStatusCodes := func(t *testing.T, got []int, expected []int) {
-		if len(expected) != len(got) {
-			t.Fatalf("Expected status codes %v, got %v", expected, got)
-		}
-
-		for i, item := range expected {
-			if got[i] != item {
-				t.Fatalf("Expected %d status code to be %d, got %d:\n%v", i, item, got[i], got)
-			}
-		}
-	}
-
-	t.Run("base check", func(t *testing.T) {
-		app.Settings().RateLimits.Enabled = true
-
-		statusCodes := []int{}
-		for range 3 {
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", "/rate", nil)
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			statusCodes = append(statusCodes, result.StatusCode)
-		}
-
-		checkStatusCodes(t, statusCodes, []int{200, 429, 429})
-	})
-
-	t.Run("disabled rate limiter", func(t *testing.T) {
-		app.Settings().RateLimits.Enabled = false
-
-		statusCodes := []int{}
-		for range 3 {
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", "/rate", nil)
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			statusCodes = append(statusCodes, result.StatusCode)
-		}
-
-		checkStatusCodes(t, statusCodes, []int{200, 200, 200})
-	})
-
-	t.Run("authenticated as superuser", func(t *testing.T) {
-		app.Settings().RateLimits.Enabled = true
-
-		superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		token, err := superuser.NewAuthToken()
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		statusCodes := []int{}
-		for range 3 {
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", "/rate", nil)
-			req.Header.Add("Authorization", token)
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			statusCodes = append(statusCodes, result.StatusCode)
-		}
-
-		checkStatusCodes(t, statusCodes, []int{200, 200, 200})
-	})
-
-	t.Run("excludedIPs (different)", func(t *testing.T) {
-		app.Settings().RateLimits.Enabled = true
-		app.Settings().RateLimits.ExcludedIPs = []string{"10.0.0.0"}
-		app.Settings().TrustedProxy.Headers = []string{"x-test-ip"}
-
-		statusCodes := []int{}
-		for range 3 {
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", "/rate", nil)
-			req.Header.Set("x-test-ip", "127.0.0.1")
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			statusCodes = append(statusCodes, result.StatusCode)
-		}
-
-		checkStatusCodes(t, statusCodes, []int{200, 429, 429})
-	})
-
-	t.Run("excludedIPs (match)", func(t *testing.T) {
-		app.Settings().RateLimits.Enabled = true
-		app.Settings().RateLimits.ExcludedIPs = []string{"127.0.0.1"}
-		app.Settings().TrustedProxy.Headers = []string{"x-test-ip"}
-
-		statusCodes := []int{}
-		for range 3 {
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequest("GET", "/rate", nil)
-			req.Header.Set("x-test-ip", "127.0.0.1")
-
-			mux.ServeHTTP(rec, req)
-
-			result := rec.Result()
-
-			statusCodes = append(statusCodes, result.StatusCode)
-		}
-
-		checkStatusCodes(t, statusCodes, []int{200, 200, 200})
-	})
-}

apis/record_auth.go

@@ -1,79 +1,765 @@
 package apis
 
 import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"sort"
+	"time"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
 )
 
 // bindRecordAuthApi registers the auth record api endpoints and
 // the corresponding handlers.
-func bindRecordAuthApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+func bindRecordAuthApi(app core.App, rg *echo.Group) {
+	api := recordAuthApi{app: app}
+
 	// global oauth2 subscription redirect handler
-	rg.GET("/oauth2-redirect", oauth2SubscriptionRedirect).Bind(
-		SkipSuccessActivityLog(), // skip success log as it could contain sensitive information in the url
-	)
-	// add again as POST in case of response_mode=form_post
-	rg.POST("/oauth2-redirect", oauth2SubscriptionRedirect).Bind(
-		SkipSuccessActivityLog(), // skip success log as it could contain sensitive information in the url
-	)
+	rg.GET("/oauth2-redirect", api.oauth2SubscriptionRedirect)
+	rg.POST("/oauth2-redirect", api.oauth2SubscriptionRedirect) // needed in case of response_mode=form_post
 
-	sub := rg.Group("/collections/{collection}")
-
-	sub.GET("/auth-methods", recordAuthMethods).Bind(
-		collectionPathRateLimit("", "listAuthMethods"),
+	// common collection record related routes
+	subGroup := rg.Group(
+		"/collections/:collection",
+		ActivityLogger(app),
+		LoadCollectionContext(app, models.CollectionTypeAuth),
 	)
-
-	sub.POST("/auth-refresh", recordAuthRefresh).Bind(
-		collectionPathRateLimit("", "authRefresh"),
-		RequireSameCollectionContextAuth(""),
-	)
-
-	sub.POST("/auth-with-password", recordAuthWithPassword).Bind(
-		collectionPathRateLimit("", "authWithPassword", "auth"),
-	)
-
-	sub.POST("/auth-with-oauth2", recordAuthWithOAuth2).Bind(
-		collectionPathRateLimit("", "authWithOAuth2", "auth"),
-	)
-
-	sub.POST("/request-otp", recordRequestOTP).Bind(
-		collectionPathRateLimit("", "requestOTP"),
-	)
-	sub.POST("/auth-with-otp", recordAuthWithOTP).Bind(
-		collectionPathRateLimit("", "authWithOTP", "auth"),
-	)
-
-	sub.POST("/request-password-reset", recordRequestPasswordReset).Bind(
-		collectionPathRateLimit("", "requestPasswordReset"),
-	)
-	sub.POST("/confirm-password-reset", recordConfirmPasswordReset).Bind(
-		collectionPathRateLimit("", "confirmPasswordReset"),
-	)
-
-	sub.POST("/request-verification", recordRequestVerification).Bind(
-		collectionPathRateLimit("", "requestVerification"),
-	)
-	sub.POST("/confirm-verification", recordConfirmVerification).Bind(
-		collectionPathRateLimit("", "confirmVerification"),
-	)
-
-	sub.POST("/request-email-change", recordRequestEmailChange).Bind(
-		collectionPathRateLimit("", "requestEmailChange"),
-		RequireSameCollectionContextAuth(""),
-	)
-	sub.POST("/confirm-email-change", recordConfirmEmailChange).Bind(
-		collectionPathRateLimit("", "confirmEmailChange"),
-	)
-
-	sub.POST("/impersonate/{id}", recordAuthImpersonate).Bind(RequireSuperuserAuth())
+	subGroup.GET("/auth-methods", api.authMethods)
+	subGroup.POST("/auth-refresh", api.authRefresh, RequireSameContextRecordAuth())
+	subGroup.POST("/auth-with-oauth2", api.authWithOAuth2)
+	subGroup.POST("/auth-with-password", api.authWithPassword)
+	subGroup.POST("/request-password-reset", api.requestPasswordReset)
+	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
+	subGroup.POST("/request-verification", api.requestVerification)
+	subGroup.POST("/confirm-verification", api.confirmVerification)
+	subGroup.POST("/request-email-change", api.requestEmailChange, RequireSameContextRecordAuth())
+	subGroup.POST("/confirm-email-change", api.confirmEmailChange)
+	subGroup.GET("/records/:id/external-auths", api.listExternalAuths, RequireAdminOrOwnerAuth("id"))
+	subGroup.DELETE("/records/:id/external-auths/:provider", api.unlinkExternalAuth, RequireAdminOrOwnerAuth("id"))
 }
 
-func findAuthCollection(e *core.RequestEvent) (*core.Collection, error) {
-	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+type recordAuthApi struct {
+	app core.App
+}
 
-	if err != nil || !collection.IsAuth() {
-		return nil, e.NotFoundError("Missing or invalid auth collection context.", err)
+func (api *recordAuthApi) authRefresh(c echo.Context) error {
+	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if record == nil {
+		return NewNotFoundError("Missing auth record context.", nil)
 	}
 
-	return collection, nil
+	event := new(core.RecordAuthRefreshEvent)
+	event.HttpContext = c
+	event.Collection = record.Collection()
+	event.Record = record
+
+	return api.app.OnRecordBeforeAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshEvent) error {
+		return api.app.OnRecordAfterAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshEvent) error {
+			return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+		})
+	})
+}
+
+type providerInfo struct {
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+	State       string `json:"state"`
+	AuthUrl     string `json:"authUrl"`
+	// technically could be omitted if the provider doesn't support PKCE,
+	// but to avoid breaking existing typed clients we'll return them as empty string
+	CodeVerifier        string `json:"codeVerifier"`
+	CodeChallenge       string `json:"codeChallenge"`
+	CodeChallengeMethod string `json:"codeChallengeMethod"`
+}
+
+func (api *recordAuthApi) authMethods(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	authOptions := collection.AuthOptions()
+
+	result := struct {
+		AuthProviders    []providerInfo `json:"authProviders"`
+		UsernamePassword bool           `json:"usernamePassword"`
+		EmailPassword    bool           `json:"emailPassword"`
+		OnlyVerified     bool           `json:"onlyVerified"`
+	}{
+		UsernamePassword: authOptions.AllowUsernameAuth,
+		EmailPassword:    authOptions.AllowEmailAuth,
+		OnlyVerified:     authOptions.OnlyVerified,
+		AuthProviders:    []providerInfo{},
+	}
+
+	if !authOptions.AllowOAuth2Auth {
+		return c.JSON(http.StatusOK, result)
+	}
+
+	nameConfigMap := api.app.Settings().NamedAuthProviderConfigs()
+	for name, config := range nameConfigMap {
+		if !config.Enabled {
+			continue
+		}
+
+		provider, err := auth.NewProviderByName(name)
+		if err != nil {
+			api.app.Logger().Debug("Missing or invalid provider name", slog.String("name", name))
+			continue // skip provider
+		}
+
+		if err := config.SetupProvider(provider); err != nil {
+			api.app.Logger().Debug(
+				"Failed to setup provider",
+				slog.String("name", name),
+				slog.String("error", err.Error()),
+			)
+			continue // skip provider
+		}
+
+		info := providerInfo{
+			Name:        name,
+			DisplayName: provider.DisplayName(),
+			State:       security.RandomString(30),
+		}
+
+		if info.DisplayName == "" {
+			info.DisplayName = name
+		}
+
+		urlOpts := []oauth2.AuthCodeOption{}
+
+		// custom providers url options
+		switch name {
+		case auth.NameApple:
+			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
+			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "form_post"))
+		}
+
+		if provider.PKCE() {
+			info.CodeVerifier = security.RandomString(43)
+			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
+			info.CodeChallengeMethod = "S256"
+			urlOpts = append(urlOpts,
+				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
+				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
+			)
+		}
+
+		info.AuthUrl = provider.BuildAuthUrl(
+			info.State,
+			urlOpts...,
+		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
+
+		result.AuthProviders = append(result.AuthProviders, info)
+	}
+
+	// sort providers
+	sort.SliceStable(result.AuthProviders, func(i, j int) bool {
+		return result.AuthProviders[i].Name < result.AuthProviders[j].Name
+	})
+
+	return c.JSON(http.StatusOK, result)
+}
+
+func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	if !collection.AuthOptions().AllowOAuth2Auth {
+		return NewBadRequestError("The collection is not configured to allow OAuth2 authentication.", nil)
+	}
+
+	var fallbackAuthRecord *models.Record
+
+	loggedAuthRecord, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if loggedAuthRecord != nil && loggedAuthRecord.Collection().Id == collection.Id {
+		fallbackAuthRecord = loggedAuthRecord
+	}
+
+	form := forms.NewRecordOAuth2Login(api.app, collection, fallbackAuthRecord)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordAuthWithOAuth2Event)
+	event.HttpContext = c
+	event.Collection = collection
+	event.ProviderName = form.Provider
+
+	form.SetBeforeNewRecordCreateFunc(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
+		return createForm.DrySubmit(func(txDao *daos.Dao) error {
+			event.IsNewRecord = true
+
+			// clone the current request data and assign the form create data as its body data
+			requestInfo := *RequestInfo(c)
+			requestInfo.Context = models.RequestInfoContextOAuth2
+			requestInfo.Data = form.CreateData
+
+			createRuleFunc := func(q *dbx.SelectQuery) error {
+				admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+				if admin != nil {
+					return nil // either admin or the rule is empty
+				}
+
+				if collection.CreateRule == nil {
+					return errors.New("Only admins can create new accounts with OAuth2")
+				}
+
+				if *collection.CreateRule != "" {
+					resolver := resolvers.NewRecordFieldResolver(txDao, collection, &requestInfo, true)
+					expr, err := search.FilterData(*collection.CreateRule).BuildExpr(resolver)
+					if err != nil {
+						return err
+					}
+					resolver.UpdateQuery(q)
+					q.AndWhere(expr)
+				}
+
+				return nil
+			}
+
+			if _, err := txDao.FindRecordById(collection.Id, createForm.Id, createRuleFunc); err != nil {
+				return fmt.Errorf("Failed create rule constraint: %w", err)
+			}
+
+			return nil
+		})
+	})
+
+	_, _, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData]) forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData] {
+		return func(data *forms.RecordOAuth2LoginData) error {
+			event.Record = data.Record
+			event.OAuth2User = data.OAuth2User
+			event.ProviderClient = data.ProviderClient
+			event.IsNewRecord = data.Record == nil
+
+			return api.app.OnRecordBeforeAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+				data.Record = e.Record
+				data.OAuth2User = e.OAuth2User
+
+				if err := next(data); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				e.Record = data.Record
+				e.OAuth2User = data.OAuth2User
+
+				meta := struct {
+					*auth.AuthUser
+					IsNew bool `json:"isNew"`
+				}{
+					AuthUser: e.OAuth2User,
+					IsNew:    event.IsNewRecord,
+				}
+
+				return api.app.OnRecordAfterAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+					// clear the lastLoginAlertSentAt field so that we can enforce password auth notifications
+					if !e.Record.LastLoginAlertSentAt().IsZero() {
+						e.Record.Set(schema.FieldNameLastLoginAlertSentAt, "")
+						if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+							api.app.Logger().Warn("Failed to reset lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+						}
+					}
+
+					return RecordAuthResponse(api.app, e.HttpContext, e.Record, meta)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) authWithPassword(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordPasswordLogin(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Password = form.Password
+	event.Identity = form.Identity
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				// @todo remove after the refactoring
+				if collection.AuthOptions().AllowOAuth2Auth && e.Record.Email() != "" {
+					externalAuths, err := api.app.Dao().FindAllExternalAuthsByRecord(e.Record)
+					if err != nil {
+						return NewBadRequestError("Failed to authenticate.", err)
+					}
+					if len(externalAuths) > 0 {
+						lastLoginAlert := e.Record.LastLoginAlertSentAt().Time()
+
+						// send an email alert if the password auth is after OAuth2 auth (lastLoginAlert will be empty)
+						// or if it has been ~7 days since the last alert
+						if lastLoginAlert.IsZero() || time.Now().UTC().Sub(lastLoginAlert).Hours() > 168 {
+							providerNames := make([]string, len(externalAuths))
+							for i, ea := range externalAuths {
+								var name string
+								if provider, err := auth.NewProviderByName(ea.Provider); err == nil {
+									name = provider.DisplayName()
+								}
+								if name == "" {
+									name = ea.Provider
+								}
+								providerNames[i] = name
+							}
+
+							if err := mails.SendRecordPasswordLoginAlert(api.app, e.Record, providerNames...); err != nil {
+								return NewBadRequestError("Failed to authenticate.", err)
+							}
+
+							e.Record.SetLastLoginAlertSentAt(types.NowDateTime())
+							if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+								api.app.Logger().Warn("Failed to update lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+							}
+						}
+					}
+				}
+
+				return api.app.OnRecordAfterAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
+					return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	authOptions := collection.AuthOptions()
+	if !authOptions.AllowUsernameAuth && !authOptions.AllowEmailAuth {
+		return NewBadRequestError("The collection is not configured to allow password authentication.", nil)
+	}
+
+	form := forms.NewRecordPasswordResetRequest(api.app, collection)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	if err := form.Validate(); err != nil {
+		return NewBadRequestError("An error occurred while validating the form.", err)
+	}
+
+	event := new(core.RecordRequestPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send password reset email",
+							slog.String("error", err.Error()),
+						)
+					}
+				})
+
+				return api.app.OnRecordAfterRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	// eagerly write 204 response and skip submit errors
+	// as a measure against emails enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
+}
+
+func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordPasswordResetConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestVerification(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordVerificationRequest(api.app, collection)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	if err := form.Validate(); err != nil {
+		return NewBadRequestError("An error occurred while validating the form.", err)
+	}
+
+	event := new(core.RecordRequestVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send verification email",
+							slog.String("error", err.Error()),
+						)
+					}
+				})
+
+				return api.app.OnRecordAfterRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	// eagerly write 204 response and skip submit errors
+	// as a measure against users enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
+}
+
+func (api *recordAuthApi) confirmVerification(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordVerificationConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("An error occurred while submitting the form.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if record == nil {
+		return NewUnauthorizedError("The request requires valid auth record.", nil)
+	}
+
+	form := forms.NewRecordEmailChangeRequest(api.app, record)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	event := new(core.RecordRequestEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			return api.app.OnRecordBeforeRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to request email change.", err)
+				}
+
+				return api.app.OnRecordAfterRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+}
+
+func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordEmailChangeConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to confirm email change.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) listExternalAuths(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	id := c.PathParam("id")
+	if id == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	record, err := api.app.Dao().FindRecordById(collection.Id, id)
+	if err != nil || record == nil {
+		return NewNotFoundError("", err)
+	}
+
+	externalAuths, err := api.app.Dao().FindAllExternalAuthsByRecord(record)
+	if err != nil {
+		return NewBadRequestError("Failed to fetch the external auths for the specified auth record.", err)
+	}
+
+	event := new(core.RecordListExternalAuthsEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuths = externalAuths
+
+	return api.app.OnRecordListExternalAuthsRequest().Trigger(event, func(e *core.RecordListExternalAuthsEvent) error {
+		return e.HttpContext.JSON(http.StatusOK, e.ExternalAuths)
+	})
+}
+
+func (api *recordAuthApi) unlinkExternalAuth(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	id := c.PathParam("id")
+	provider := c.PathParam("provider")
+	if id == "" || provider == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	record, err := api.app.Dao().FindRecordById(collection.Id, id)
+	if err != nil || record == nil {
+		return NewNotFoundError("", err)
+	}
+
+	externalAuth, err := api.app.Dao().FindExternalAuthByRecordAndProvider(record, provider)
+	if err != nil {
+		return NewNotFoundError("Missing external auth provider relation.", err)
+	}
+
+	event := new(core.RecordUnlinkExternalAuthEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuth = externalAuth
+
+	return api.app.OnRecordBeforeUnlinkExternalAuthRequest().Trigger(event, func(e *core.RecordUnlinkExternalAuthEvent) error {
+		if err := api.app.Dao().DeleteExternalAuth(externalAuth); err != nil {
+			return NewBadRequestError("Cannot unlink the external auth provider.", err)
+		}
+
+		return api.app.OnRecordAfterUnlinkExternalAuthRequest().Trigger(event, func(e *core.RecordUnlinkExternalAuthEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+const (
+	oauth2SubscriptionTopic   string = "@oauth2"
+	oauth2RedirectFailurePath string = "../_/#/auth/oauth2-redirect-failure"
+	oauth2RedirectSuccessPath string = "../_/#/auth/oauth2-redirect-success"
+)
+
+type oauth2RedirectData struct {
+	State string `form:"state" query:"state" json:"state"`
+	Code  string `form:"code" query:"code" json:"code"`
+	Error string `form:"error" query:"error" json:"error,omitempty"`
+}
+
+func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
+	redirectStatusCode := http.StatusTemporaryRedirect
+	if c.Request().Method != http.MethodGet {
+		redirectStatusCode = http.StatusSeeOther
+	}
+
+	data := oauth2RedirectData{}
+	if err := c.Bind(&data); err != nil {
+		api.app.Logger().Debug("Failed to read OAuth2 redirect data", "error", err)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	if data.State == "" {
+		api.app.Logger().Debug("Missing OAuth2 state parameter")
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	client, err := api.app.SubscriptionsBroker().ClientById(data.State)
+	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
+		api.app.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", data.State)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+	defer client.Unsubscribe(oauth2SubscriptionTopic)
+
+	encodedData, err := json.Marshal(data)
+	if err != nil {
+		api.app.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	msg := subscriptions.Message{
+		Name: oauth2SubscriptionTopic,
+		Data: encodedData,
+	}
+
+	client.Send(msg)
+
+	if data.Error != "" || data.Code == "" {
+		api.app.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	return c.Redirect(redirectStatusCode, oauth2RedirectSuccessPath)
 }

apis/record_auth_email_change_confirm.go

@@ -1,122 +0,0 @@
-package apis
-
-import (
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/security"
-)
-
-func recordConfirmEmailChange(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if collection.Name == core.CollectionNameSuperusers {
-		return e.BadRequestError("All superusers can change their emails directly.", nil)
-	}
-
-	form := newEmailChangeConfirmForm(e.App, collection)
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	authRecord, newEmail, err := form.parseToken()
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Invalid or expired token.", err))
-	}
-
-	event := new(core.RecordConfirmEmailChangeRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = authRecord
-	event.NewEmail = newEmail
-
-	return e.App.OnRecordConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeRequestEvent) error {
-		e.Record.SetEmail(e.NewEmail)
-		e.Record.SetVerified(true)
-
-		if err := e.App.Save(e.Record); err != nil {
-			return firstApiError(err, e.BadRequestError("Failed to confirm email change.", err))
-		}
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-func newEmailChangeConfirmForm(app core.App, collection *core.Collection) *EmailChangeConfirmForm {
-	return &EmailChangeConfirmForm{
-		app:        app,
-		collection: collection,
-	}
-}
-
-type EmailChangeConfirmForm struct {
-	app        core.App
-	collection *core.Collection
-
-	Token    string `form:"token" json:"token"`
-	Password string `form:"password" json:"password"`
-}
-
-func (form *EmailChangeConfirmForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
-		validation.Field(&form.Password, validation.Required, validation.Length(1, 100), validation.By(form.checkPassword)),
-	)
-}
-
-func (form *EmailChangeConfirmForm) checkToken(value any) error {
-	_, _, err := form.parseToken()
-	return err
-}
-
-func (form *EmailChangeConfirmForm) checkPassword(value any) error {
-	v, _ := value.(string)
-	if v == "" {
-		return nil // nothing to check
-	}
-
-	authRecord, _, _ := form.parseToken()
-	if authRecord == nil || !authRecord.ValidatePassword(v) {
-		return validation.NewError("validation_invalid_password", "Missing or invalid auth record password.")
-	}
-
-	return nil
-}
-
-func (form *EmailChangeConfirmForm) parseToken() (*core.Record, string, error) {
-	// check token payload
-	claims, _ := security.ParseUnverifiedJWT(form.Token)
-	newEmail, _ := claims[core.TokenClaimNewEmail].(string)
-	if newEmail == "" {
-		return nil, "", validation.NewError("validation_invalid_token_payload", "Invalid token payload - newEmail must be set.")
-	}
-
-	// verify that the token is not expired and its signature is valid
-	authRecord, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeEmailChange)
-	if err != nil {
-		return nil, "", validation.NewError("validation_invalid_token", "Invalid or expired token.")
-	}
-
-	if authRecord.Collection().Id != form.collection.Id {
-		return nil, "", validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
-	}
-
-	// check if there are other users with the new email
-	_, err = form.app.FindAuthRecordByEmail(form.collection, newEmail)
-	if err == nil {
-		return nil, "", validation.NewError("validation_invalid_token_email", "The new email address is invalid.")
-	}
-
-	return authRecord, newEmail, nil
-}

apis/record_auth_email_change_confirm_test.go

@@ -1,250 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordConfirmEmailChange(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/confirm-email-change",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "empty data",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/confirm-email-change",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"token":{"code":"validation_required"`,
-				`"password":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid data",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/confirm-email-change",
-			Body:            strings.NewReader(`{"token`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "expired token and correct password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoxNjQwOTkxNjYxfQ.dff842MO0mgRTHY8dktp0dqG9-7LGQOgRuiAbQpYBls",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{`,
-				`"code":"validation_invalid_token"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-email change token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{`,
-				`"code":"validation_invalid_token_payload"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid token and incorrect password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567891"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"password":{`,
-				`"code":"validation_invalid_password"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid token and correct password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                 0,
-				"OnRecordConfirmEmailChangeRequest": 1,
-				"OnModelUpdate":                     1,
-				"OnModelUpdateExecute":              1,
-				"OnModelAfterUpdateSuccess":         1,
-				"OnModelValidate":                   1,
-				"OnRecordUpdate":                    1,
-				"OnRecordUpdateExecute":             1,
-				"OnRecordAfterUpdateSuccess":        1,
-				"OnRecordValidate":                  1,
-				// unverified->verified external auths removal
-				"OnModelDelete":              2,
-				"OnModelDeleteExecute":       2,
-				"OnModelAfterDeleteSuccess":  2,
-				"OnRecordDelete":             2,
-				"OnRecordDeleteExecute":      2,
-				"OnRecordAfterDeleteSuccess": 2,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if user.Verified() {
-					t.Fatalf("Expected the user to be unverified before the confirmation")
-				}
-
-				// ensure that there is at least one pre-existing OAuth2 link
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) == 0 {
-					t.Fatal("Expected at least one external auths")
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "change@example.com")
-				if err != nil {
-					t.Fatalf("Expected to find user with email %q, got error: %v", "change@example.com", err)
-				}
-
-				if !user.Verified() {
-					t.Fatalf("Expected the user to be verified after the confirmation")
-				}
-
-				// ensure that all pre-existing OAuth2 links are cleared
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) > 0 {
-					t.Fatalf("Expected all external auths to be cleared, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid token in different auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_token_collection_mismatch"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "OnRecordConfirmEmailChangeRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordConfirmEmailChangeRequest().BindFunc(func(e *core.RecordConfirmEmailChangeRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordConfirmEmailChangeRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:confirmEmailChange",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:confirmEmailChange"},
-					{MaxRequests: 0, Label: "users:confirmEmailChange"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:confirmEmailChange",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-email-change",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:confirmEmailChange"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_email_change_request.go

@@ -1,92 +0,0 @@
-package apis
-
-import (
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/mails"
-)
-
-func recordRequestEmailChange(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if collection.Name == core.CollectionNameSuperusers {
-		return e.BadRequestError("All superusers can change their emails directly.", nil)
-	}
-
-	record := e.Auth
-	if record == nil {
-		return e.UnauthorizedError("The request requires valid auth record.", nil)
-	}
-
-	form := newEmailChangeRequestForm(e.App, record)
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	event := new(core.RecordRequestEmailChangeRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-	event.NewEmail = form.NewEmail
-
-	return e.App.OnRecordRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeRequestEvent) error {
-		if err := mails.SendRecordChangeEmail(e.App, e.Record, e.NewEmail); err != nil {
-			return firstApiError(err, e.BadRequestError("Failed to request email change.", err))
-		}
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-func newEmailChangeRequestForm(app core.App, record *core.Record) *emailChangeRequestForm {
-	return &emailChangeRequestForm{
-		app:    app,
-		record: record,
-	}
-}
-
-type emailChangeRequestForm struct {
-	app    core.App
-	record *core.Record
-
-	NewEmail string `form:"newEmail" json:"newEmail"`
-}
-
-func (form *emailChangeRequestForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.NewEmail,
-			validation.Required,
-			validation.Length(1, 255),
-			is.EmailFormat,
-			validation.NotIn(form.record.Email()),
-			validation.By(form.checkUniqueEmail),
-		),
-	)
-}
-
-func (form *emailChangeRequestForm) checkUniqueEmail(value any) error {
-	v, _ := value.(string)
-	if v == "" {
-		return nil
-	}
-
-	found, _ := form.app.FindAuthRecordByEmail(form.record.Collection(), v)
-	if found != nil && found.Id != form.record.Id {
-		return validation.NewError("validation_invalid_new_email", "Invalid new email address.")
-	}
-
-	return nil
-}

apis/record_auth_email_change_request_test.go

@@ -1,195 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordRequestEmailChange(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-email-change",
-			Body:            strings.NewReader(`{"newEmail":"change@example.com"}`),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/request-email-change",
-			Body:            strings.NewReader(`{"newEmail":"change@example.com"}`),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "record authentication but from different auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superuser authentication",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "invalid data",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "empty data",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"newEmail":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid data (existing email)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"test2@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"newEmail":{"code":"validation_invalid_new_email"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid data (new email)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                 0,
-				"OnRecordRequestEmailChangeRequest": 1,
-				"OnMailerSend":                      1,
-				"OnMailerRecordEmailChangeSend":     1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-email-change") {
-					t.Fatalf("Expected email change email, got\n%v", app.TestMailer.LastMessage().HTML)
-				}
-			},
-		},
-		{
-			Name:   "OnRecordRequestEmailChangeRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordRequestEmailChangeRequest().BindFunc(func(e *core.RecordRequestEmailChangeRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordRequestEmailChangeRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:requestEmailChange",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:requestEmailChange"},
-					{MaxRequests: 0, Label: "users:requestEmailChange"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:requestEmailChange",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:requestEmailChange"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_impersonate.go

@@ -1,54 +0,0 @@
-package apis
-
-import (
-	"time"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// note: for now allow superusers but it may change in the future to allow access
-// also to users with "Manage API" rule access depending on the use cases that will arise
-func recordAuthImpersonate(e *core.RequestEvent) error {
-	if !e.HasSuperuserAuth() {
-		return e.ForbiddenError("", nil)
-	}
-
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	record, err := e.App.FindRecordById(collection, e.Request.PathValue("id"))
-	if err != nil {
-		return e.NotFoundError("", err)
-	}
-
-	form := &impersonateForm{}
-	if err = e.BindBody(form); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
-	}
-	if err = form.validate(); err != nil {
-		return e.BadRequestError("An error occurred while validating the submitted data.", err)
-	}
-
-	token, err := record.NewStaticAuthToken(time.Duration(form.Duration) * time.Second)
-	if err != nil {
-		return e.InternalServerError("Failed to generate static auth token", err)
-	}
-
-	return recordAuthResponse(e, record, token, "", nil)
-}
-
-// -------------------------------------------------------------------
-
-type impersonateForm struct {
-	// Duration is the optional custom token duration in seconds.
-	Duration int64 `form:"duration" json:"duration"`
-}
-
-func (form *impersonateForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Duration, validation.Min(0)),
-	)
-}

apis/record_auth_impersonate_test.go

@@ -1,109 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordAuthImpersonate(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/impersonate/4q1xlclmfloku33",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as different user",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as the same user",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-				`"id":"4q1xlclmfloku33"`,
-				`"record":{`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields should remain hidden even though we are authenticated as superuser
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordAuthRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-		{
-			Name:   "authorized as superuser with custom invalid duration",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body:           strings.NewReader(`{"duration":-1}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"duration":{`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "authorized as superuser with custom valid duration",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body:           strings.NewReader(`{"duration":100}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-				`"id":"4q1xlclmfloku33"`,
-				`"record":{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordAuthRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_methods.go

@@ -1,179 +0,0 @@
-package apis
-
-import (
-	"log/slog"
-	"net/http"
-	"slices"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/auth"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"golang.org/x/oauth2"
-)
-
-type otpResponse struct {
-	Enabled  bool  `json:"enabled"`
-	Duration int64 `json:"duration"` // in seconds
-}
-
-type mfaResponse struct {
-	Enabled  bool  `json:"enabled"`
-	Duration int64 `json:"duration"` // in seconds
-}
-
-type passwordResponse struct {
-	IdentityFields []string `json:"identityFields"`
-	Enabled        bool     `json:"enabled"`
-}
-
-type oauth2Response struct {
-	Providers []providerInfo `json:"providers"`
-	Enabled   bool           `json:"enabled"`
-}
-
-type providerInfo struct {
-	Name        string `json:"name"`
-	DisplayName string `json:"displayName"`
-	Logo        string `json:"logo"`
-	State       string `json:"state"`
-	AuthURL     string `json:"authURL"`
-
-	// @todo
-	// deprecated: use AuthURL instead
-	// AuthUrl will be removed after dropping v0.22 support
-	AuthUrl string `json:"authUrl"`
-
-	// technically could be omitted if the provider doesn't support PKCE,
-	// but to avoid breaking existing typed clients we'll return them as empty string
-	CodeVerifier        string `json:"codeVerifier"`
-	CodeChallenge       string `json:"codeChallenge"`
-	CodeChallengeMethod string `json:"codeChallengeMethod"`
-}
-
-type authMethodsResponse struct {
-	Password passwordResponse `json:"password"`
-	OAuth2   oauth2Response   `json:"oauth2"`
-	MFA      mfaResponse      `json:"mfa"`
-	OTP      otpResponse      `json:"otp"`
-
-	// legacy fields
-	// @todo remove after dropping v0.22 support
-	AuthProviders    []providerInfo `json:"authProviders"`
-	UsernamePassword bool           `json:"usernamePassword"`
-	EmailPassword    bool           `json:"emailPassword"`
-}
-
-func (amr *authMethodsResponse) fillLegacyFields() {
-	amr.EmailPassword = amr.Password.Enabled && slices.Contains(amr.Password.IdentityFields, "email")
-
-	amr.UsernamePassword = amr.Password.Enabled && slices.Contains(amr.Password.IdentityFields, "username")
-
-	if amr.OAuth2.Enabled {
-		// clone without the logo
-		legacyProviders := make([]providerInfo, len(amr.OAuth2.Providers))
-		for i, p := range amr.OAuth2.Providers {
-			legacyProviders[i] = p
-			legacyProviders[i].Logo = ""
-		}
-
-		amr.AuthProviders = legacyProviders
-	}
-}
-
-func recordAuthMethods(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	result := authMethodsResponse{
-		Password: passwordResponse{
-			IdentityFields: make([]string, 0, len(collection.PasswordAuth.IdentityFields)),
-		},
-		OAuth2: oauth2Response{
-			Providers: make([]providerInfo, 0, len(collection.OAuth2.Providers)),
-		},
-		OTP: otpResponse{
-			Enabled: collection.OTP.Enabled,
-		},
-		MFA: mfaResponse{
-			Enabled: collection.MFA.Enabled,
-		},
-	}
-
-	if collection.PasswordAuth.Enabled {
-		result.Password.Enabled = true
-		result.Password.IdentityFields = collection.PasswordAuth.IdentityFields
-	}
-
-	if collection.OTP.Enabled {
-		result.OTP.Duration = collection.OTP.Duration
-	}
-
-	if collection.MFA.Enabled {
-		result.MFA.Duration = collection.MFA.Duration
-	}
-
-	if !collection.OAuth2.Enabled {
-		result.fillLegacyFields()
-
-		return e.JSON(http.StatusOK, result)
-	}
-
-	result.OAuth2.Enabled = true
-
-	for _, config := range collection.OAuth2.Providers {
-		provider, err := config.InitProvider()
-		if err != nil {
-			e.App.Logger().Debug(
-				"Failed to setup OAuth2 provider",
-				slog.String("name", config.Name),
-				slog.String("error", err.Error()),
-			)
-			continue // skip provider
-		}
-
-		info := providerInfo{
-			Name:        config.Name,
-			DisplayName: provider.DisplayName(),
-			Logo:        provider.Logo(),
-			State:       security.RandomString(30),
-		}
-
-		if info.DisplayName == "" {
-			info.DisplayName = config.Name
-		}
-
-		urlOpts := []oauth2.AuthCodeOption{}
-
-		// custom providers url options
-		switch config.Name {
-		case auth.NameApple:
-			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
-			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "form_post"))
-		}
-
-		if provider.PKCE() {
-			info.CodeVerifier = security.RandomString(43)
-			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
-			info.CodeChallengeMethod = "S256"
-			urlOpts = append(urlOpts,
-				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
-				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
-			)
-		}
-
-		info.AuthURL = provider.BuildAuthURL(
-			info.State,
-			urlOpts...,
-		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
-
-		info.AuthUrl = info.AuthURL
-
-		result.OAuth2.Providers = append(result.OAuth2.Providers, info)
-	}
-
-	result.fillLegacyFields()
-
-	return e.JSON(http.StatusOK, result)
-}

apis/record_auth_methods_test.go

@@ -1,108 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordAuthMethodsList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "missing collection",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/missing/auth-methods",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "non auth collection",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/demo1/auth-methods",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "auth collection with none auth methods allowed",
-			Method:         http.MethodGet,
-			URL:            "/api/collections/nologin/auth-methods",
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"password":{"identityFields":[],"enabled":false}`,
-				`"oauth2":{"providers":[],"enabled":false}`,
-				`"mfa":{"enabled":false,"duration":0}`,
-				`"otp":{"enabled":false,"duration":0}`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:           "auth collection with all auth methods allowed",
-			Method:         http.MethodGet,
-			URL:            "/api/collections/users/auth-methods",
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"password":{"identityFields":["email","username"],"enabled":true}`,
-				`"mfa":{"enabled":true,"duration":1800}`,
-				`"otp":{"enabled":true,"duration":300}`,
-				`"oauth2":{`,
-				`"providers":[{`,
-				`"name":"google"`,
-				`"name":"gitlab"`,
-				`"logo":"<svg`,
-				`"logo":""`, // for the legacy fields
-				`"state":`,
-				`"displayName":`,
-				`"codeVerifier":`,
-				`"codeChallenge":`,
-				`"codeChallengeMethod":`,
-				`"authURL":`,
-				`redirect_uri="`, // ensures that the redirect_uri is the last url param
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - nologin:listAuthMethods",
-			Method: http.MethodGet,
-			URL:    "/api/collections/nologin/auth-methods",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:listAuthMethods"},
-					{MaxRequests: 0, Label: "nologin:listAuthMethods"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:listAuthMethods",
-			Method: http.MethodGet,
-			URL:    "/api/collections/nologin/auth-methods",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:listAuthMethods"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_otp_request.go

@@ -1,127 +0,0 @@
-package apis
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/mails"
-	"github.com/pocketbase/pocketbase/tools/routine"
-	"github.com/pocketbase/pocketbase/tools/security"
-)
-
-func recordRequestOTP(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if !collection.OTP.Enabled {
-		return e.ForbiddenError("The collection is not configured to allow OTP authentication.", nil)
-	}
-
-	form := &createOTPForm{}
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
-
-	// ignore not found errors to allow custom record find implementations
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return e.InternalServerError("", err)
-	}
-
-	event := new(core.RecordCreateOTPRequestEvent)
-	event.RequestEvent = e
-	event.Password = security.RandomStringWithAlphabet(collection.OTP.Length, "1234567890")
-	event.Collection = collection
-	event.Record = record
-
-	originalApp := e.App
-
-	return e.App.OnRecordRequestOTPRequest().Trigger(event, func(e *core.RecordCreateOTPRequestEvent) error {
-		if e.Record == nil {
-			// write a dummy 200 response as a very rudimentary emails enumeration "protection"
-			e.JSON(http.StatusOK, map[string]string{
-				"otpId": core.GenerateDefaultRandomId(),
-			})
-
-			return fmt.Errorf("missing or invalid %s OTP auth record with email %s", collection.Name, form.Email)
-		}
-
-		var otp *core.OTP
-
-		// limit the new OTP creations for a single user
-		if !e.App.IsDev() {
-			otps, err := e.App.FindAllOTPsByRecord(e.Record)
-			if err != nil {
-				return firstApiError(err, e.InternalServerError("Failed to fetch previous record OTPs.", err))
-			}
-
-			totalRecent := 0
-			for _, existingOTP := range otps {
-				if !existingOTP.HasExpired(collection.OTP.DurationTime()) {
-					totalRecent++
-				}
-				// use the last issued one
-				if totalRecent > 9 {
-					otp = otps[0] // otps are DESC sorted
-					e.App.Logger().Warn(
-						"Too many OTP requests - reusing the last issued",
-						"email", form.Email,
-						"recordId", e.Record.Id,
-						"otpId", existingOTP.Id,
-					)
-					break
-				}
-			}
-		}
-
-		if otp == nil {
-			// create new OTP
-			// ---
-			otp = core.NewOTP(e.App)
-			otp.SetCollectionRef(e.Record.Collection().Id)
-			otp.SetRecordRef(e.Record.Id)
-			otp.SetPassword(e.Password)
-			err = e.App.Save(otp)
-			if err != nil {
-				return err
-			}
-
-			// send OTP email
-			// (in the background as a very basic timing attacks and emails enumeration protection)
-			// ---
-			routine.FireAndForget(func() {
-				err = mails.SendRecordOTP(originalApp, e.Record, otp.Id, e.Password)
-				if err != nil {
-					originalApp.Logger().Error("Failed to send OTP email", "error", errors.Join(err, originalApp.Delete(otp)))
-				}
-			})
-		}
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, map[string]string{"otpId": otp.Id})
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type createOTPForm struct {
-	Email string `form:"email" json:"email"`
-}
-
-func (form createOTPForm) validate() error {
-	return validation.ValidateStruct(&form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
-	)
-}

apis/record_auth_otp_request_test.go

@@ -1,316 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-func TestRecordRequestOTP(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/request-otp",
-			Body:            strings.NewReader(`{"email":"test@example.com"}`),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "auth collection with disabled otp",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				usersCol, err := app.FindCollectionByNameOrId("users")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				usersCol.OTP.Enabled = false
-
-				if err := app.Save(usersCol); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "empty body",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-otp",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid body",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-otp",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "invalid request data",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-otp",
-			Body:           strings.NewReader(`{"email":"invalid"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"email":{"code":"validation_is_email`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:           "missing auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-otp",
-			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"otpId":"`, // some fake random generated string
-			},
-			ExpectedEvents: map[string]int{
-				"*":                         0,
-				"OnRecordRequestOTPRequest": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:   "existing auth record (with < 9 non-expired)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:  100 * time.Millisecond,
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// insert 8 non-expired and 2 expired
-				for i := 0; i < 10; i++ {
-					otp := core.NewOTP(app)
-					otp.Id = "otp_" + strconv.Itoa(i)
-					otp.SetCollectionRef(user.Collection().Id)
-					otp.SetRecordRef(user.Id)
-					otp.SetPassword("123456")
-					if i >= 8 {
-						expiredDate := types.NowDateTime().AddDate(-3, 0, 0)
-						otp.SetRaw("created", expiredDate)
-						otp.SetRaw("updated", expiredDate)
-					}
-					if err := app.SaveNoValidate(otp); err != nil {
-						t.Fatal(err)
-					}
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"otpId":"`,
-			},
-			NotExpectedContent: []string{
-				`"otpId":"otp_`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordRequestOTPRequest":  1,
-				"OnMailerSend":               1,
-				"OnMailerRecordOTPSend":      1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            2, // + 1 for the OTP update after the email send
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           2,
-				// OTP update
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 1 {
-					t.Fatalf("Expected 1 email, got %d", app.TestMailer.TotalSend())
-				}
-
-				// ensure that sentTo is set
-				otps, err := app.FindRecordsByFilter(core.CollectionNameOTPs, "sentTo='test@example.com'", "", 0, 0)
-				if err != nil || len(otps) != 1 {
-					t.Fatalf("Expected to find 1 OTP with sentTo %q, found %d", "test@example.com", len(otps))
-				}
-			},
-		},
-		{
-			Name:   "existing auth record with intercepted email (with < 9 non-expired)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:  100 * time.Millisecond,
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				// prevent email sent
-				app.OnMailerRecordOTPSend("users").BindFunc(func(e *core.MailerRecordEvent) error {
-					return nil
-				})
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"otpId":"`,
-			},
-			NotExpectedContent: []string{
-				`"otpId":"otp_`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordRequestOTPRequest":  1,
-				"OnMailerRecordOTPSend":      1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected 0 emails, got %d", app.TestMailer.TotalSend())
-				}
-
-				// ensure that there is no OTP with user email as sentTo
-				otps, err := app.FindRecordsByFilter(core.CollectionNameOTPs, "sentTo='test@example.com'", "", 0, 0)
-				if err != nil || len(otps) != 0 {
-					t.Fatalf("Expected to find 0 OTPs with sentTo %q, found %d", "test@example.com", len(otps))
-				}
-			},
-		},
-		{
-			Name:   "existing auth record (with > 9 non-expired)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:  100 * time.Millisecond,
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// insert 10 non-expired
-				for i := 0; i < 10; i++ {
-					otp := core.NewOTP(app)
-					otp.Id = "otp_" + strconv.Itoa(i)
-					otp.SetCollectionRef(user.Collection().Id)
-					otp.SetRecordRef(user.Id)
-					otp.SetPassword("123456")
-					if err := app.SaveNoValidate(otp); err != nil {
-						t.Fatal(err)
-					}
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"otpId":"otp_9"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                         0,
-				"OnRecordRequestOTPRequest": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected 0 sent emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:   "OnRecordRequestOTPRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:  100 * time.Millisecond,
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordRequestOTPRequest().BindFunc(func(e *core.RecordCreateOTPRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordRequestOTPRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:requestOTP",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:requestOTP"},
-					{MaxRequests: 0, Label: "users:requestOTP"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:requestOTP",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-otp",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:requestOTP"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_password_reset_confirm.go

@@ -1,104 +0,0 @@
-package apis
-
-import (
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/core/validators"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/spf13/cast"
-)
-
-func recordConfirmPasswordReset(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	form := new(recordConfirmPasswordResetForm)
-	form.app = e.App
-	form.collection = collection
-	if err = e.BindBody(form); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	authRecord, err := e.App.FindAuthRecordByToken(form.Token, core.TokenTypePasswordReset)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Invalid or expired password reset token.", err))
-	}
-
-	event := new(core.RecordConfirmPasswordResetRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = authRecord
-
-	return e.App.OnRecordConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetRequestEvent) error {
-		authRecord.SetPassword(form.Password)
-
-		if !authRecord.Verified() {
-			payload, err := security.ParseUnverifiedJWT(form.Token)
-			if err == nil && authRecord.Email() == cast.ToString(payload[core.TokenClaimEmail]) {
-				// mark as verified if the email hasn't changed
-				authRecord.SetVerified(true)
-			}
-		}
-
-		err = e.App.Save(authRecord)
-		if err != nil {
-			return firstApiError(err, e.BadRequestError("Failed to set new password.", err))
-		}
-
-		e.App.Store().Remove(getPasswordResetResendKey(authRecord))
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type recordConfirmPasswordResetForm struct {
-	app        core.App
-	collection *core.Collection
-
-	Token           string `form:"token" json:"token"`
-	Password        string `form:"password" json:"password"`
-	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
-}
-
-func (form *recordConfirmPasswordResetForm) validate() error {
-	min := 1
-	passField, ok := form.collection.Fields.GetByName(core.FieldNamePassword).(*core.PasswordField)
-	if ok && passField != nil && passField.Min > 0 {
-		min = passField.Min
-	}
-
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
-		validation.Field(&form.Password, validation.Required, validation.Length(min, 255)), // the FieldPassword validator will check further the specicic length constraints
-		validation.Field(&form.PasswordConfirm, validation.Required, validation.By(validators.Equal(form.Password))),
-	)
-}
-
-func (form *recordConfirmPasswordResetForm) checkToken(value any) error {
-	v, _ := value.(string)
-	if v == "" {
-		return nil
-	}
-
-	record, err := form.app.FindAuthRecordByToken(v, core.TokenTypePasswordReset)
-	if err != nil || record == nil {
-		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
-	}
-
-	if record.Collection().Id != form.collection.Id {
-		return validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
-	}
-
-	return nil
-}

apis/record_auth_password_reset_confirm_test.go

@@ -1,394 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordConfirmPasswordReset(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "empty data",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/confirm-password-reset",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"password":{"code":"validation_required"`,
-				`"passwordConfirm":{"code":"validation_required"`,
-				`"token":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid data format",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/confirm-password-reset",
-			Body:            strings.NewReader(`{"password`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "expired token and invalid password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.5Tm6_6amQqOlX3urAnXlEdmxwG5qQJfiTg6U0hHR1hk",
-				"password":"1234567",
-				"passwordConfirm":"7654321"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_invalid_token"`,
-				`"password":{"code":"validation_length_out_of_range"`,
-				`"passwordConfirm":{"code":"validation_values_mismatch"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-password reset token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_invalid_token"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "non auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/demo1/confirm-password-reset?expand=rel,missing",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "different auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/confirm-password-reset?expand=rel,missing",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{"token":{"code":"validation_token_collection_mismatch"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid token and data (unverified user)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                   0,
-				"OnRecordConfirmPasswordResetRequest": 1,
-				"OnModelUpdate":                       1,
-				"OnModelUpdateExecute":                1,
-				"OnModelAfterUpdateSuccess":           1,
-				"OnRecordUpdate":                      1,
-				"OnRecordUpdateExecute":               1,
-				"OnRecordAfterUpdateSuccess":          1,
-				"OnModelValidate":                     1,
-				"OnRecordValidate":                    1,
-				// ---
-				"OnModelDelete":              2, // pre-existing OAuth2 links
-				"OnModelDeleteExecute":       2,
-				"OnModelAfterDeleteSuccess":  2,
-				"OnRecordDelete":             2,
-				"OnRecordDeleteExecute":      2,
-				"OnRecordAfterDeleteSuccess": 2,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to be unverified")
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindAuthRecordByToken(
-					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-					core.TokenTypePasswordReset,
-				)
-				if err == nil {
-					t.Fatal("Expected the password reset token to be invalidated")
-				}
-
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				if !user.Verified() {
-					t.Fatal("Expected the user to be marked as verified")
-				}
-
-				if !user.ValidatePassword("1234567!") {
-					t.Fatal("Password wasn't changed")
-				}
-
-				// ensure that all pre-existing OAuth2 links are cleared
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) > 0 {
-					t.Fatalf("Expected all external auths to be cleared, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid token and data (unverified user with different email from the one in the token)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                   0,
-				"OnRecordConfirmPasswordResetRequest": 1,
-				"OnModelUpdate":                       1,
-				"OnModelUpdateExecute":                1,
-				"OnModelAfterUpdateSuccess":           1,
-				"OnModelValidate":                     1,
-				"OnRecordUpdate":                      1,
-				"OnRecordUpdateExecute":               1,
-				"OnRecordAfterUpdateSuccess":          1,
-				"OnRecordValidate":                    1,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to be unverified")
-				}
-
-				oldTokenKey := user.TokenKey()
-
-				// manually change the email to check whether the verified state will be updated
-				user.SetEmail("test_update@example.com")
-				if err = app.Save(user); err != nil {
-					t.Fatalf("Failed to update user test email: %v", err)
-				}
-
-				// resave with the old token key since the email change above
-				// would change it and will make the password token invalid
-				user.SetTokenKey(oldTokenKey)
-				if err = app.Save(user); err != nil {
-					t.Fatalf("Failed to restore original user tokenKey: %v", err)
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindAuthRecordByToken(
-					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-					core.TokenTypePasswordReset,
-				)
-				if err == nil {
-					t.Fatalf("Expected the password reset token to be invalidated")
-				}
-
-				user, err := app.FindAuthRecordByEmail("users", "test_update@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to remain unverified")
-				}
-
-				if !user.ValidatePassword("1234567!") {
-					t.Fatal("Password wasn't changed")
-				}
-
-				// ensure that all pre-existing OAuth2 were NOT deleted
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) != 2 {
-					t.Fatalf("Expected 2 external auths, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid token and data (verified user)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                   0,
-				"OnRecordConfirmPasswordResetRequest": 1,
-				"OnModelUpdate":                       1,
-				"OnModelUpdateExecute":                1,
-				"OnModelAfterUpdateSuccess":           1,
-				"OnModelValidate":                     1,
-				"OnRecordUpdate":                      1,
-				"OnRecordUpdateExecute":               1,
-				"OnRecordAfterUpdateSuccess":          1,
-				"OnRecordValidate":                    1,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				oldTokenKey := user.TokenKey()
-
-				// ensure that the user is already verified
-				user.SetVerified(true)
-				if err := app.Save(user); err != nil {
-					t.Fatalf("Failed to update user verified state")
-				}
-
-				// resave with the old token key since the verified change above
-				// would refresh it and will make the password token invalid
-				user.SetTokenKey(oldTokenKey)
-				if err = app.Save(user); err != nil {
-					t.Fatalf("Failed to restore original user tokenKey: %v", err)
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				_, err := app.FindAuthRecordByToken(
-					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-					core.TokenTypePasswordReset,
-				)
-				if err == nil {
-					t.Fatal("Expected the password reset token to be invalidated")
-				}
-
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatalf("Failed to fetch confirm password user: %v", err)
-				}
-
-				if !user.Verified() {
-					t.Fatal("Expected the user to remain verified")
-				}
-
-				if !user.ValidatePassword("1234567!") {
-					t.Fatal("Password wasn't changed")
-				}
-			},
-		},
-		{
-			Name:   "OnRecordConfirmPasswordResetRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordConfirmPasswordResetRequest().BindFunc(func(e *core.RecordConfirmPasswordResetRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordConfirmPasswordResetRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:confirmPasswordReset",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:confirmPasswordReset"},
-					{MaxRequests: 0, Label: "users:confirmPasswordReset"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:confirmPasswordReset",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-password-reset",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
-				"password":"1234567!",
-				"passwordConfirm":"1234567!"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:confirmPasswordReset"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_password_reset_request.go

@@ -1,88 +0,0 @@
-package apis
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/mails"
-	"github.com/pocketbase/pocketbase/tools/routine"
-)
-
-func recordRequestPasswordReset(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if !collection.PasswordAuth.Enabled {
-		return e.BadRequestError("The collection is not configured to allow password authentication.", nil)
-	}
-
-	form := new(recordRequestPasswordResetForm)
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
-	if err != nil {
-		// eagerly write 204 response as a very basic measure against emails enumeration
-		e.NoContent(http.StatusNoContent)
-		return fmt.Errorf("failed to fetch %s record with email %s: %w", collection.Name, form.Email, err)
-	}
-
-	resendKey := getPasswordResetResendKey(record)
-	if e.App.Store().Has(resendKey) {
-		// eagerly write 204 response as a very basic measure against emails enumeration
-		e.NoContent(http.StatusNoContent)
-		return errors.New("try again later - you've already requested a password reset email")
-	}
-
-	event := new(core.RecordRequestPasswordResetRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-
-	return e.App.OnRecordRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetRequestEvent) error {
-		// run in background because we don't need to show the result to the client
-		app := e.App
-		routine.FireAndForget(func() {
-			if err := mails.SendRecordPasswordReset(app, e.Record); err != nil {
-				app.Logger().Error("Failed to send password reset email", "error", err)
-				return
-			}
-
-			app.Store().Set(resendKey, struct{}{})
-			time.AfterFunc(2*time.Minute, func() {
-				app.Store().Remove(resendKey)
-			})
-		})
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type recordRequestPasswordResetForm struct {
-	Email string `form:"email" json:"email"`
-}
-
-func (form *recordRequestPasswordResetForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
-	)
-}
-
-func getPasswordResetResendKey(record *core.Record) string {
-	return "@limitPasswordResetEmail_" + record.Collection().Id + record.Id
-}

apis/record_auth_password_reset_request_test.go

@@ -1,169 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordRequestPasswordReset(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/request-password-reset",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "empty data",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-password-reset",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid data",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-password-reset",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "existing auth record in a collection with disabled password login",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/nologin/request-password-reset",
-			Body:            strings.NewReader(`{"email":"test@example.com"}`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "missing auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:           "existing auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                   0,
-				"OnRecordRequestPasswordResetRequest": 1,
-				"OnMailerSend":                        1,
-				"OnMailerRecordPasswordResetSend":     1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-password-reset") {
-					t.Fatalf("Expected password reset email, got\n%v", app.TestMailer.LastMessage().HTML)
-				}
-			},
-		},
-		{
-			Name:           "existing auth record (after already sent)",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				// simulate recent verification sent
-				authRecord, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				resendKey := "@limitPasswordResetEmail_" + authRecord.Collection().Id + authRecord.Id
-				app.Store().Set(resendKey, struct{}{})
-			},
-		},
-		{
-			Name:   "OnRecordRequestPasswordResetRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-password-reset",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordRequestPasswordResetRequest().BindFunc(func(e *core.RecordRequestPasswordResetRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordRequestPasswordResetRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:requestPasswordReset",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-password-reset",
-			Body:   strings.NewReader(`{"email":"missing@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:requestPasswordReset"},
-					{MaxRequests: 0, Label: "users:requestPasswordReset"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:requestPasswordReset",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-password-reset",
-			Body:   strings.NewReader(`{"email":"missing@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:requestPasswordReset"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_refresh.go

@@ -1,35 +0,0 @@
-package apis
-
-import (
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/spf13/cast"
-)
-
-func recordAuthRefresh(e *core.RequestEvent) error {
-	record := e.Auth
-	if record == nil {
-		return e.NotFoundError("Missing auth record context.", nil)
-	}
-
-	event := new(core.RecordAuthRefreshRequestEvent)
-	event.RequestEvent = e
-	event.Collection = record.Collection()
-	event.Record = record
-
-	return e.App.OnRecordAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshRequestEvent) error {
-		token := getAuthTokenFromRequest(e.RequestEvent)
-
-		// skip token renewal if the token's payload doesn't explicitly allow it (e.g. impersonate tokens)
-		claims, _ := security.ParseUnverifiedJWT(token) //
-		if v, ok := claims[core.TokenClaimRefreshable]; ok && cast.ToBool(v) {
-			var tokenErr error
-			token, tokenErr = e.Record.NewAuthToken()
-			if tokenErr != nil {
-				return e.InternalServerError("Failed to refresh auth token.", tokenErr)
-			}
-		}
-
-		return recordAuthResponse(e.RequestEvent, e.Record, token, "", nil)
-	})
-}

apis/record_auth_refresh_test.go

@@ -1,216 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordAuthRefresh(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/auth-refresh",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superuser trying to refresh the auth of another auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "auth record + not an auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/demo1/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "auth record + different auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-refresh?expand=rel,missing",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "auth record + same auth collection as the token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh?expand=rel,missing",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"record":`,
-				`"id":"4q1xlclmfloku33"`,
-				`"emailVisibility":false`,
-				`"email":"test@example.com"`, // the owner can always view their email address
-				`"expand":`,
-				`"rel":`,
-				`"id":"llvuca81nly1qls"`,
-			},
-			NotExpectedContent: []string{
-				`"missing":`,
-				// should return a different token
-				"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthRefreshRequest": 1,
-				"OnRecordAuthRequest":        1,
-				"OnRecordEnrich":             2,
-			},
-		},
-		{
-			Name:   "auth record + same auth collection as the token but static/unrefreshable",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				// should return the same token
-				`"token":"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak"`,
-				`"record":`,
-				`"id":"4q1xlclmfloku33"`,
-				`"emailVisibility":false`,
-				`"email":"test@example.com"`, // the owner can always view their email address
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthRefreshRequest": 1,
-				"OnRecordAuthRequest":        1,
-				"OnRecordEnrich":             1,
-			},
-		},
-		{
-			Name:   "unverified auth record in onlyVerified collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im8xeTBkZDBzcGQ3ODZtZCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.Zi0yXE-CNmnbTdVaQEzYZVuECqRdn3LgEM6pmB3XWBE",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthRefreshRequest": 1,
-			},
-		},
-		{
-			Name:   "verified auth record in onlyVerified collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"record":`,
-				`"id":"gk390qegs4y47wn"`,
-				`"verified":true`,
-				`"email":"test@example.com"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthRefreshRequest": 1,
-				"OnRecordAuthRequest":        1,
-				"OnRecordEnrich":             1,
-			},
-		},
-		{
-			Name:   "OnRecordAuthRefreshRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordAuthRefreshRequest().BindFunc(func(e *core.RecordAuthRefreshRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordAuthRefreshRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:authRefresh",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:authRefresh"},
-					{MaxRequests: 0, Label: "users:authRefresh"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:authRefresh",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-refresh",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:authRefresh"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_verification_confirm.go

@@ -1,109 +0,0 @@
-package apis
-
-import (
-	"net/http"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/spf13/cast"
-)
-
-func recordConfirmVerification(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if collection.Name == core.CollectionNameSuperusers {
-		return e.BadRequestError("All superusers are verified by default.", nil)
-	}
-
-	form := new(recordConfirmVerificationForm)
-	form.app = e.App
-	form.collection = collection
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	record, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeVerification)
-	if err != nil {
-		return e.BadRequestError("Invalid or expired verification token.", err)
-	}
-
-	wasVerified := record.Verified()
-
-	event := new(core.RecordConfirmVerificationRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-
-	return e.App.OnRecordConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationRequestEvent) error {
-		if !wasVerified {
-			e.Record.SetVerified(true)
-
-			// similar to the OTP auth, we enforce an extra password reset
-			// guard as this way is less prone to pre-hijacking attacks
-			// in case the password auth is eventually enabled later
-			if !e.Record.Collection().PasswordAuth.Enabled {
-				e.Record.SetRandomPassword()
-			}
-
-			if err := e.App.Save(e.Record); err != nil {
-				return firstApiError(err, e.BadRequestError("An error occurred while saving the verified state.", err))
-			}
-		}
-
-		e.App.Store().Remove(getVerificationResendKey(e.Record))
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type recordConfirmVerificationForm struct {
-	app        core.App
-	collection *core.Collection
-
-	Token string `form:"token" json:"token"`
-}
-
-func (form *recordConfirmVerificationForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
-	)
-}
-
-func (form *recordConfirmVerificationForm) checkToken(value any) error {
-	v, _ := value.(string)
-	if v == "" {
-		return nil // nothing to check
-	}
-
-	claims, _ := security.ParseUnverifiedJWT(v)
-	email := cast.ToString(claims["email"])
-	if email == "" {
-		return validation.NewError("validation_invalid_token_claims", "Missing email token claim.")
-	}
-
-	record, err := form.app.FindAuthRecordByToken(v, core.TokenTypeVerification)
-	if err != nil || record == nil {
-		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
-	}
-
-	if record.Collection().Id != form.collection.Id {
-		return validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
-	}
-
-	if record.Email() != email {
-		return validation.NewError("validation_token_email_mismatch", "The record email doesn't match with the requested token claims.")
-	}
-
-	return nil
-}

apis/record_auth_verification_confirm_test.go

@@ -1,340 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordConfirmVerification(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "empty data",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/confirm-verification",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid data format",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/confirm-verification",
-			Body:            strings.NewReader(`{"password`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "expired token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.qqelNNL2Udl6K_TJ282sNHYCpASgA6SIuSVKGfBHMZU"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_invalid_token"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-verification token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{"code":"validation_invalid_token"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "non auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/demo1/confirm-verification?expand=rel,missing",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
-			}`),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "different auth collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/confirm-verification?expand=rel,missing",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{"token":{"code":"validation_token_collection_mismatch"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid token",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordConfirmVerificationRequest": 1,
-				"OnModelUpdate":                      1,
-				"OnModelValidate":                    1,
-				"OnModelUpdateExecute":               1,
-				"OnModelAfterUpdateSuccess":          1,
-				"OnRecordUpdate":                     1,
-				"OnRecordValidate":                   1,
-				"OnRecordUpdateExecute":              1,
-				"OnRecordAfterUpdateSuccess":         1,
-				// unverified->verified external auths removal
-				"OnModelDelete":              2,
-				"OnModelDeleteExecute":       2,
-				"OnModelAfterDeleteSuccess":  2,
-				"OnRecordDelete":             2,
-				"OnRecordDeleteExecute":      2,
-				"OnRecordAfterDeleteSuccess": 2,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to be unverified before the confirmation")
-				}
-
-				// ensure that there is at least one pre-existing OAuth2 link
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) == 0 {
-					t.Fatal("Expected at least one external auths")
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if !user.Verified() {
-					t.Fatalf("Expected the user to be verified after the confirmation")
-				}
-
-				// ensure that all pre-existing OAuth2 links are cleared
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) > 0 {
-					t.Fatalf("Expected all external auths to be cleared, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid token (disabled password auth)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordConfirmVerificationRequest": 1,
-				"OnModelUpdate":                      1,
-				"OnModelValidate":                    1,
-				"OnModelUpdateExecute":               1,
-				"OnModelAfterUpdateSuccess":          1,
-				"OnRecordUpdate":                     1,
-				"OnRecordValidate":                   1,
-				"OnRecordUpdateExecute":              1,
-				"OnRecordAfterUpdateSuccess":         1,
-				// unverified->verified external auths removal
-				"OnModelDelete":              2,
-				"OnModelDeleteExecute":       2,
-				"OnModelAfterDeleteSuccess":  2,
-				"OnRecordDelete":             2,
-				"OnRecordDeleteExecute":      2,
-				"OnRecordAfterDeleteSuccess": 2,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				user.Collection().PasswordAuth.Enabled = false
-				if err = app.Save(user.Collection()); err != nil {
-					t.Fatal(err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to be unverified before the confirmation")
-				}
-
-				if !user.ValidatePassword("1234567890") {
-					t.Fatal("Expected password to be valid")
-				}
-
-				// ensure that there is at least one pre-existing OAuth2 link
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) == 0 {
-					t.Fatal("Expected at least one external auths")
-				}
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if !user.Verified() {
-					t.Fatalf("Expected the user to be verified after the confirmation")
-				}
-
-				if user.ValidatePassword("1234567890") {
-					t.Fatal("Expected the user password to be reset")
-				}
-
-				// ensure that all pre-existing OAuth2 links are cleared
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) > 0 {
-					t.Fatalf("Expected all external auths to be cleared, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid token (already verified)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdDJAZXhhbXBsZS5jb20ifQ.QQmM3odNFVk6u4J4-5H8IBM3dfk9YCD7mPW-8PhBAI8"
-			}`),
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordConfirmVerificationRequest": 1,
-			},
-		},
-		{
-			Name:   "valid verification token from a collection without allowed login",
-			Method: http.MethodPost,
-			URL:    "/api/collections/nologin/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
-			}`),
-			ExpectedStatus:  204,
-			ExpectedContent: []string{},
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordConfirmVerificationRequest": 1,
-				"OnModelUpdate":                      1,
-				"OnModelValidate":                    1,
-				"OnModelUpdateExecute":               1,
-				"OnModelAfterUpdateSuccess":          1,
-				"OnRecordUpdate":                     1,
-				"OnRecordValidate":                   1,
-				"OnRecordUpdateExecute":              1,
-				"OnRecordAfterUpdateSuccess":         1,
-			},
-		},
-		{
-			Name:   "OnRecordConfirmVerificationRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordConfirmVerificationRequest().BindFunc(func(e *core.RecordConfirmVerificationRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordConfirmVerificationRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - nologin:confirmVerification",
-			Method: http.MethodPost,
-			URL:    "/api/collections/nologin/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:confirmVerification"},
-					{MaxRequests: 0, Label: "nologin:confirmVerification"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:confirmVerification",
-			Method: http.MethodPost,
-			URL:    "/api/collections/nologin/confirm-verification",
-			Body: strings.NewReader(`{
-				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:confirmVerification"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_verification_request.go

@@ -1,91 +0,0 @@
-package apis
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/mails"
-	"github.com/pocketbase/pocketbase/tools/routine"
-)
-
-func recordRequestVerification(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if collection.Name == core.CollectionNameSuperusers {
-		return e.BadRequestError("All superusers are verified by default.", nil)
-	}
-
-	form := new(recordRequestVerificationForm)
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
-	if err != nil {
-		// eagerly write 204 response as a very basic measure against emails enumeration
-		e.NoContent(http.StatusNoContent)
-		return fmt.Errorf("failed to fetch %s record with email %s: %w", collection.Name, form.Email, err)
-	}
-
-	resendKey := getVerificationResendKey(record)
-	if !record.Verified() && e.App.Store().Has(resendKey) {
-		// eagerly write 204 response as a very basic measure against emails enumeration
-		e.NoContent(http.StatusNoContent)
-		return errors.New("try again later - you've already requested a verification email")
-	}
-
-	event := new(core.RecordRequestVerificationRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-
-	return e.App.OnRecordRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationRequestEvent) error {
-		if e.Record.Verified() {
-			return e.NoContent(http.StatusNoContent)
-		}
-
-		// run in background because we don't need to show the result to the client
-		app := e.App
-		routine.FireAndForget(func() {
-			if err := mails.SendRecordVerification(app, e.Record); err != nil {
-				app.Logger().Error("Failed to send verification email", "error", err)
-			}
-
-			app.Store().Set(resendKey, struct{}{})
-			time.AfterFunc(2*time.Minute, func() {
-				app.Store().Remove(resendKey)
-			})
-		})
-
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.NoContent(http.StatusNoContent)
-		})
-	})
-}
-
-// -------------------------------------------------------------------
-
-type recordRequestVerificationForm struct {
-	Email string `form:"email" json:"email"`
-}
-
-func (form *recordRequestVerificationForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
-	)
-}
-
-func getVerificationResendKey(record *core.Record) string {
-	return "@limitVerificationEmail_" + record.Collection().Id + record.Id
-}

apis/record_auth_verification_request_test.go

@@ -1,186 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordRequestVerification(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/request-verification",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "empty data",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-verification",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid data",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/request-verification",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "missing auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-verification",
-			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:           "already verified auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordRequestVerificationRequest": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:           "existing auth record",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                                  0,
-				"OnRecordRequestVerificationRequest": 1,
-				"OnMailerSend":                       1,
-				"OnMailerRecordVerificationSend":     1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-verification") {
-					t.Fatalf("Expected verification email, got\n%v", app.TestMailer.LastMessage().HTML)
-				}
-			},
-		},
-		{
-			Name:           "existing auth record (after already sent)",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*": 0,
-				// terminated before firing the event
-				// "OnRecordRequestVerificationRequest": 1,
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				// simulate recent verification sent
-				authRecord, err := app.FindFirstRecordByData("users", "email", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				resendKey := "@limitVerificationEmail_" + authRecord.Collection().Id + authRecord.Id
-				app.Store().Set(resendKey, struct{}{})
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 0 {
-					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
-				}
-			},
-		},
-		{
-			Name:   "OnRecordRequestVerificationRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-verification",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordRequestVerificationRequest().BindFunc(func(e *core.RecordRequestVerificationRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordRequestVerificationRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:requestVerification",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-verification",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:requestVerification"},
-					{MaxRequests: 0, Label: "users:requestVerification"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:requestVerification",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/request-verification",
-			Body:   strings.NewReader(`{"email":"test@example.com"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:requestVerification"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_with_oauth2.go

@@ -1,510 +0,0 @@
-package apis
-
-import (
-	"bytes"
-	"context"
-	"database/sql"
-	"encoding/json/v2"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"maps"
-	"net"
-	"net/http"
-	"path"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/pocketbase/dbx"
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/auth"
-	"github.com/pocketbase/pocketbase/tools/dbutils"
-	"github.com/pocketbase/pocketbase/tools/filesystem"
-	"github.com/pocketbase/pocketbase/tools/inflector"
-	"golang.org/x/oauth2"
-)
-
-func recordAuthWithOAuth2(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if !collection.OAuth2.Enabled {
-		return e.ForbiddenError("The collection is not configured to allow OAuth2 authentication.", nil)
-	}
-
-	var fallbackAuthRecord *core.Record
-	if e.Auth != nil && e.Auth.Collection().Id == collection.Id {
-		fallbackAuthRecord = e.Auth
-	}
-
-	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOAuth2)
-
-	form := new(recordOAuth2LoginForm)
-	form.collection = collection
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-
-	if form.RedirectUrl != "" && form.RedirectURL == "" {
-		e.App.Logger().Warn("[recordAuthWithOAuth2] redirectUrl body param is deprecated and will be removed in the future. Please replace it with redirectURL.")
-		form.RedirectURL = form.RedirectUrl
-	}
-
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-
-	// exchange token for OAuth2 user info and locate existing ExternalAuth rel
-	// ---------------------------------------------------------------
-
-	// load provider configuration
-	providerConfig, ok := collection.OAuth2.GetProviderConfig(form.Provider)
-	if !ok {
-		return e.InternalServerError("Missing or invalid provider config.", nil)
-	}
-
-	provider, err := providerConfig.InitProvider()
-	if err != nil {
-		return firstApiError(err, e.InternalServerError("Failed to init provider "+form.Provider, err))
-	}
-
-	ctx, cancel := context.WithTimeout(e.Request.Context(), 30*time.Second)
-	defer cancel()
-
-	provider.SetContext(ctx)
-	provider.SetRedirectURL(form.RedirectURL)
-
-	var opts []oauth2.AuthCodeOption
-
-	if provider.PKCE() {
-		opts = append(opts, oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier))
-	}
-
-	// fetch token
-	token, err := provider.FetchToken(form.Code, opts...)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Failed to fetch OAuth2 token.", err))
-	}
-
-	// fetch external auth user
-	authUser, err := provider.FetchAuthUser(token)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Failed to fetch OAuth2 user.", err))
-	}
-
-	// Apple currently returns the user's name only as part of the first redirect data response
-	// so we try to assign the [apis.oauth2SubscriptionRedirect] forwarded name.
-	if form.Provider == auth.NameApple && authUser.Name == "" {
-		nameKey := oauth2RedirectAppleNameStoreKeyPrefix + form.Code
-		name, ok := e.App.Store().Get(nameKey).(string)
-		if ok {
-			e.App.Store().Remove(nameKey)
-			authUser.Name = name
-		} else {
-			e.App.Logger().Debug("Missing or already removed Apple user's name")
-		}
-	}
-
-	var authRecord *core.Record
-
-	// check for existing relation with the auth collection
-	externalAuthRel, err := e.App.FindFirstExternalAuthByExpr(dbx.HashExp{
-		"collectionRef": form.collection.Id,
-		"provider":      form.Provider,
-		"providerId":    authUser.Id,
-	})
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return e.InternalServerError("Failed OAuth2 relation check.", err)
-	}
-
-	switch {
-	case err == nil && externalAuthRel != nil:
-		authRecord, err = e.App.FindRecordById(form.collection, externalAuthRel.RecordRef())
-		if err != nil {
-			return err
-		}
-	case fallbackAuthRecord != nil && fallbackAuthRecord.Collection().Id == form.collection.Id:
-		// fallback to the logged auth record (if any)
-		authRecord = fallbackAuthRecord
-	case authUser.Email != "":
-		// look for an existing auth record by the external auth record's email
-		authRecord, err = e.App.FindAuthRecordByEmail(form.collection.Id, authUser.Email)
-		if err != nil && !errors.Is(err, sql.ErrNoRows) {
-			return e.InternalServerError("Failed OAuth2 auth record check.", err)
-		}
-	}
-
-	// ---------------------------------------------------------------
-
-	event := new(core.RecordAuthWithOAuth2RequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.ProviderName = form.Provider
-	event.ProviderClient = provider
-	event.OAuth2User = authUser
-	event.CreateData = form.CreateData
-	event.Record = authRecord
-	event.IsNewRecord = authRecord == nil
-
-	return e.App.OnRecordAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2RequestEvent) error {
-		if err := oauth2Submit(e, externalAuthRel); err != nil {
-			return firstApiError(err, e.BadRequestError("Failed to authenticate.", err))
-		}
-
-		// @todo revert back to struct after removing the custom auth.AuthUser marshalization
-		meta := map[string]any{}
-		rawOAuth2User, err := json.Marshal(e.OAuth2User)
-		if err != nil {
-			return err
-		}
-		err = json.Unmarshal(rawOAuth2User, &meta)
-		if err != nil {
-			return err
-		}
-		meta["isNew"] = e.IsNewRecord
-
-		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOAuth2, meta)
-	})
-}
-
-// -------------------------------------------------------------------
-
-type recordOAuth2LoginForm struct {
-	collection *core.Collection
-
-	// Additional data that will be used for creating a new auth record
-	// if an existing OAuth2 account doesn't exist.
-	CreateData map[string]any `form:"createData" json:"createData"`
-
-	// The name of the OAuth2 client provider (eg. "google")
-	Provider string `form:"provider" json:"provider"`
-
-	// The authorization code returned from the initial request.
-	Code string `form:"code" json:"code"`
-
-	// The optional PKCE code verifier as part of the code_challenge sent with the initial request.
-	CodeVerifier string `form:"codeVerifier" json:"codeVerifier"`
-
-	// The redirect url sent with the initial request.
-	RedirectURL string `form:"redirectURL" json:"redirectURL"`
-
-	// @todo
-	// deprecated: use RedirectURL instead
-	// RedirectUrl will be removed after dropping v0.22 support
-	RedirectUrl string `form:"redirectUrl" json:"redirectUrl"`
-}
-
-func (form *recordOAuth2LoginForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Provider, validation.Required, validation.Length(0, 100), validation.By(form.checkProviderName)),
-		validation.Field(&form.Code, validation.Required),
-	)
-}
-
-func (form *recordOAuth2LoginForm) checkProviderName(value any) error {
-	name, _ := value.(string)
-
-	_, ok := form.collection.OAuth2.GetProviderConfig(name)
-	if !ok {
-		return validation.NewError("validation_invalid_provider", "Provider with name {{.name}} is missing or is not enabled.").
-			SetParams(map[string]any{"name": name})
-	}
-
-	return nil
-}
-
-// @todo evaluate if it is still worth keeping as this exists only for backward-compatibility with pre v0.23 versions
-func oldCanAssignUsername(txApp core.App, collection *core.Collection, username string) bool {
-	field := collection.Fields.GetByName(collection.OAuth2.MappedFields.Username)
-	if field == nil {
-		return false
-	}
-
-	// ensure that the value matches the pattern of the username field (if text)
-	if txtField, ok := field.(*core.TextField); ok && txtField.ValidatePlainValue(username) != nil {
-		return false
-	}
-
-	// ensure that username is unique
-	index, hasUniqueue := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, field.GetName())
-	if hasUniqueue {
-		// it is not required because collection fields are already sanitized
-		// but normalize as an extra precaution in case of a custom validator
-		colName := inflector.Columnify(field.GetName())
-
-		var expr dbx.Expression
-		if strings.EqualFold(index.Columns[0].Collate, "nocase") {
-			// case-insensitive search
-			expr = dbx.NewExp("[["+colName+"]] = {:username} COLLATE NOCASE", dbx.Params{"username": username})
-		} else {
-			expr = dbx.HashExp{colName: username}
-		}
-
-		var exists int
-		_ = txApp.RecordQuery(collection).Select("(1)").AndWhere(expr).Limit(1).Row(&exists)
-		if exists > 0 {
-			return false
-		}
-	}
-
-	return true
-}
-
-func oauth2Submit(e *core.RecordAuthWithOAuth2RequestEvent, optExternalAuth *core.ExternalAuth) error {
-	return e.App.RunInTransaction(func(txApp core.App) error {
-		if e.Record == nil {
-			// extra check to prevent creating a superuser record via
-			// OAuth2 in case the method is used by another action
-			if e.Collection.Name == core.CollectionNameSuperusers {
-				return errors.New("superusers are not allowed to sign-up with OAuth2")
-			}
-
-			payload := maps.Clone(e.CreateData)
-			if payload == nil {
-				payload = map[string]any{}
-			}
-
-			// assign the OAuth2 user email only if the user hasn't submitted one
-			// (ignore empty/invalid values for consistency with the OAuth2->existing user update flow)
-			if v, _ := payload[core.FieldNameEmail].(string); v == "" {
-				payload[core.FieldNameEmail] = e.OAuth2User.Email
-			}
-
-			// map known fields (unless the field was explicitly submitted as part of CreateData)
-			if _, ok := payload[e.Collection.OAuth2.MappedFields.Id]; !ok && e.Collection.OAuth2.MappedFields.Id != "" {
-				payload[e.Collection.OAuth2.MappedFields.Id] = e.OAuth2User.Id
-			}
-			if _, ok := payload[e.Collection.OAuth2.MappedFields.Name]; !ok && e.Collection.OAuth2.MappedFields.Name != "" {
-				payload[e.Collection.OAuth2.MappedFields.Name] = e.OAuth2User.Name
-			}
-			if _, ok := payload[e.Collection.OAuth2.MappedFields.Username]; !ok &&
-				// no explicit username payload value and existing OAuth2 mapping
-				e.Collection.OAuth2.MappedFields.Username != "" &&
-				// extra checks for backward compatibility with earlier versions
-				oldCanAssignUsername(txApp, e.Collection, e.OAuth2User.Username) {
-				payload[e.Collection.OAuth2.MappedFields.Username] = e.OAuth2User.Username
-			}
-			if _, ok := payload[e.Collection.OAuth2.MappedFields.AvatarURL]; !ok &&
-				// no explicit avatar payload value and existing OAuth2 mapping
-				e.Collection.OAuth2.MappedFields.AvatarURL != "" &&
-				// non-empty OAuth2 avatar url
-				e.OAuth2User.AvatarURL != "" {
-				mappedField := e.Collection.Fields.GetByName(e.Collection.OAuth2.MappedFields.AvatarURL)
-				if mappedField != nil && mappedField.Type() == core.FieldTypeFile {
-					// download the avatar if the mapped field is a file
-					avatarFile, err := func() (*filesystem.File, error) {
-						ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-						defer cancel()
-
-						// the extra checks are not required because the OAuth2 APIs are trusted vendor
-						// but are here to minimize the impact in case the provider is vulnerable
-						return safeFileFromURL(ctx, e.OAuth2User.AvatarURL)
-					}()
-					if err != nil {
-						txApp.Logger().Warn("Failed to retrieve OAuth2 avatar", slog.String("error", err.Error()))
-					} else {
-						payload[e.Collection.OAuth2.MappedFields.AvatarURL] = avatarFile
-					}
-				} else {
-					// otherwise - assign the url string
-					payload[e.Collection.OAuth2.MappedFields.AvatarURL] = e.OAuth2User.AvatarURL
-				}
-			}
-
-			createdRecord, err := sendOAuth2RecordCreateRequest(txApp, e, payload)
-			if err != nil {
-				return err
-			}
-
-			e.Record = createdRecord
-
-			if e.Record.Email() == e.OAuth2User.Email && !e.Record.Verified() {
-				// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
-				e.Record.SetVerified(true)
-				if err := txApp.Save(e.Record); err != nil {
-					return err
-				}
-			}
-		} else {
-			var needUpdate bool
-
-			isLoggedAuthRecord := e.Auth != nil &&
-				e.Auth.Id == e.Record.Id &&
-				e.Auth.Collection().Id == e.Record.Collection().Id
-
-			// prevent pre-hijacking with password auth
-			//
-			// reset the unverified user password in case the record was precreated by a malicious actor
-			if !isLoggedAuthRecord && !e.Record.Verified() {
-				needUpdate = true
-				e.Record.SetRandomPassword()
-			}
-
-			// prevent pre-hijacking with different OAuth2 provider
-			//
-			// delete all other previous OAuth2 record links for the cases
-			// when the user was precreated by malicious OAuth2 auth with custom payload data
-			//
-			// while this would be also done automatically on unverified -> verified upgrade,
-			// doing it manually here ensures that a single unverified record could have
-			// max 1 OAuth2 link to prevent further abuse when mixed with other auth flows
-			if !e.Record.Verified() {
-				err := txApp.DeleteAllExternalAuthsByRecord(e.Record)
-				if err != nil {
-					return err
-				}
-				optExternalAuth = nil // clear to allow recreate below
-			}
-
-			// update the existing auth record empty email if the data.OAuth2User has one
-			// (this is in case previously the auth record was created
-			// with an OAuth2 provider that didn't return an email address)
-			if e.Record.Email() == "" && e.OAuth2User.Email != "" {
-				needUpdate = true
-				e.Record.SetEmail(e.OAuth2User.Email)
-			}
-
-			// update the existing auth record verified state
-			// (only if the auth record doesn't have an email or the auth record email match with the one in data.OAuth2User)
-			if !e.Record.Verified() && (e.Record.Email() == "" || e.Record.Email() == e.OAuth2User.Email) {
-				needUpdate = true
-				e.Record.SetVerified(true)
-			}
-
-			if needUpdate {
-				if err := txApp.Save(e.Record); err != nil {
-					return err
-				}
-			}
-		}
-
-		// create ExternalAuth relation if missing
-		if optExternalAuth == nil {
-			optExternalAuth = core.NewExternalAuth(txApp)
-			optExternalAuth.SetCollectionRef(e.Record.Collection().Id)
-			optExternalAuth.SetRecordRef(e.Record.Id)
-			optExternalAuth.SetProvider(e.ProviderName)
-			optExternalAuth.SetProviderId(e.OAuth2User.Id)
-
-			if err := txApp.Save(optExternalAuth); err != nil {
-				return fmt.Errorf("failed to save linked rel: %w", err)
-			}
-		}
-
-		return nil
-	})
-}
-
-func sendOAuth2RecordCreateRequest(txApp core.App, e *core.RecordAuthWithOAuth2RequestEvent, payload map[string]any) (*core.Record, error) {
-	ir := &core.InternalRequest{
-		Method: http.MethodPost,
-		URL:    "/api/collections/" + e.Collection.Name + "/records",
-		Body:   payload,
-	}
-
-	var createdRecord *core.Record
-	response, err := processInternalRequest(txApp, e.RequestEvent, ir, core.RequestInfoContextOAuth2, func(data any) error {
-		createdRecord, _ = data.(*core.Record)
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	if response.Status != http.StatusOK || createdRecord == nil {
-		return nil, errors.New("failed to create OAuth2 auth record")
-	}
-
-	return createdRecord, nil
-}
-
-// -------------------------------------------------------------------
-
-// safeHTTPClient initializes a custom http.Client with extra host checks
-// to prevent internal network probing requests
-// (aka. disallow loopback, private, multicast, etc. requests).
-//
-// NB! The host checks are not perfect and there are probably edge cases that are not covered,
-// so if you plan using with untrusted user URL, consider performing additional whitelist checks.
-//
-// @todo Evaluate with the refactoring if worth exporting(+tests) and moving under the security package.
-func safeHTTPClient() *http.Client {
-	dialer := &net.Dialer{
-		// the same options as in http.DefaultTransport.DialContext
-		Timeout:   30 * time.Second,
-		KeepAlive: 30 * time.Second,
-
-		// check the address right after estrablishing the connection to prevent dns rebinding
-		Control: func(network, address string, c syscall.RawConn) error {
-			host, _, err := net.SplitHostPort(address)
-			if err != nil {
-				return err
-			}
-
-			ip := net.ParseIP(host)
-
-			if ip == nil ||
-				ip.IsLoopback() ||
-				ip.IsUnspecified() ||
-				ip.IsPrivate() ||
-				ip.IsLinkLocalUnicast() ||
-				ip.IsLinkLocalMulticast() ||
-				ip.IsMulticast() {
-				return fmt.Errorf("address %q is invalid or resolve to disallowed IP", address)
-			}
-
-			return nil
-		},
-	}
-
-	return &http.Client{
-		Timeout: 180 * time.Second, // can be still cancelled with the request context
-		Transport: &http.Transport{
-			DialContext: dialer.DialContext,
-			// the same options as in http.DefaultTransport
-			ForceAttemptHTTP2:     true,
-			MaxIdleConns:          100,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-		},
-	}
-}
-
-// safeFileFromURL downloads the file from the specified url (using safeHTTPClient)
-// and creates a new filesystem.File value from its content (limited to DefaultMaxBodySize).
-//
-// @todo Evaluate with the refactoring if worth exporting/replacing filesystem.NewFileFromURL (or redefine as NewUnsafeFileFromURL).
-func safeFileFromURL(ctx context.Context, url string) (*filesystem.File, error) {
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	client := safeHTTPClient()
-
-	res, err := client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer res.Body.Close()
-
-	if res.StatusCode < 200 || res.StatusCode > 399 {
-		return nil, fmt.Errorf("failed to download url %s (%d)", url, res.StatusCode)
-	}
-
-	body := io.LimitReader(res.Body, DefaultMaxBodySize)
-
-	var buf bytes.Buffer
-	if _, err = io.Copy(&buf, body); err != nil {
-		return nil, err
-	}
-
-	return filesystem.NewFileFromBytes(buf.Bytes(), path.Base(url))
-}

apis/record_auth_with_oauth2_redirect.go

@@ -1,180 +0,0 @@
-package apis
-
-import (
-	"encoding/json/v2"
-	"errors"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/subscriptions"
-	"github.com/pocketbase/pocketbase/ui"
-)
-
-const (
-	oauth2SubscriptionTopic               string = "@oauth2"
-	oauth2RedirectFailurePath             string = "../_/#/auth/oauth2-redirect-failure"
-	oauth2RedirectSuccessPath             string = "../_/#/auth/oauth2-redirect-success"
-	oauth2RedirectAppleNameStoreKeyPrefix string = "@redirect_name_"
-)
-
-type oauth2RedirectData struct {
-	State string `form:"state" json:"state"`
-	Code  string `form:"code" json:"code"`
-	Error string `form:"error" json:"error,omitempty"`
-
-	// returned by Apple only
-	AppleUser string `form:"user" json:"-"`
-}
-
-func oauth2SubscriptionRedirect(e *core.RequestEvent) error {
-	data := oauth2RedirectData{}
-
-	if e.Request.Method == http.MethodPost {
-		if err := e.BindBody(&data); err != nil {
-			e.App.Logger().Debug("Failed to read OAuth2 redirect data", "error", err)
-			return failureRedirect(e)
-		}
-	} else {
-		query := e.Request.URL.Query()
-		data.State = query.Get("state")
-		data.Code = query.Get("code")
-		data.Error = query.Get("error")
-	}
-
-	if data.State == "" {
-		e.App.Logger().Debug("Missing OAuth2 state parameter")
-		return failureRedirect(e)
-	}
-
-	client, err := e.App.SubscriptionsBroker().ClientById(data.State)
-	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
-		e.App.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", data.State)
-		return failureRedirect(e)
-	}
-	defer client.Unsubscribe(oauth2SubscriptionTopic)
-
-	// additional check to minimize the risk of XSRF attack vectors
-	//
-	// note: custom registered clients (aka. those without IP in the store)
-	// are excluded from the check for backward compatibility
-	clientIP, _ := client.Get(RealtimeClientIPKey).(string)
-	if clientIP != "" && clientIP != e.RealIP() {
-		e.App.Logger().Debug("The client IP that completed the authentication is different from the one that initialized the OAuth2 realtime connection")
-		return failureRedirect(e)
-	}
-
-	// temporary store the Apple user's name so that it can be later retrieved with the authWithOAuth2 call
-	// (see https://github.com/pocketbase/pocketbase/issues/7090)
-	if data.AppleUser != "" && data.Error == "" && data.Code != "" {
-		nameErr := parseAndStoreAppleRedirectName(
-			e.App,
-			oauth2RedirectAppleNameStoreKeyPrefix+data.Code,
-			data.AppleUser,
-		)
-		if nameErr != nil {
-			// non-critical error
-			e.App.Logger().Debug("Failed to parse and load Apple Redirect name data", "error", nameErr)
-		}
-	}
-
-	encodedData, err := json.Marshal(data)
-	if err != nil {
-		e.App.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
-		return failureRedirect(e)
-	}
-
-	msg := subscriptions.Message{
-		Name: oauth2SubscriptionTopic,
-		Data: encodedData,
-	}
-
-	client.Send(msg)
-
-	if data.Error != "" || data.Code == "" {
-		e.App.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
-		return failureRedirect(e)
-	}
-
-	return successRedirect(e)
-}
-
-func redirectStatusCode(e *core.RequestEvent) int {
-	if e.Request.Method != http.MethodGet {
-		return http.StatusSeeOther
-	}
-
-	return http.StatusTemporaryRedirect
-}
-
-func failureRedirect(e *core.RequestEvent) error {
-	// fallback if UI is not bundled
-	if ui.DistDirFS == nil {
-		return e.String(http.StatusOK, "Failed to authenticate. You can close this window and go back to the app to try again.")
-	}
-
-	return e.Redirect(redirectStatusCode(e), oauth2RedirectFailurePath)
-}
-
-func successRedirect(e *core.RequestEvent) error {
-	// fallback if UI is not bundled
-	if ui.DistDirFS == nil {
-		return e.HTML(http.StatusOK, "Auth completed. You can close this window and go back to the app.")
-	}
-
-	return e.Redirect(redirectStatusCode(e), oauth2RedirectSuccessPath)
-}
-
-// parseAndStoreAppleRedirectName extracts the first and last name
-// from serializedNameData and temporary store them in the app.Store.
-//
-// This is hacky workaround to forward safely and seamlessly the Apple
-// redirect user's name back to the OAuth2 auth handler.
-//
-// Note that currently Apple is the only provider that behaves like this and
-// for now it is unnecessary to check whether the redirect is coming from Apple or not.
-//
-// Ideally this shouldn't be needed and will be removed in the future
-// once Apple adds a dedicated userinfo endpoint.
-func parseAndStoreAppleRedirectName(app core.App, nameKey string, serializedNameData string) error {
-	if serializedNameData == "" {
-		return nil
-	}
-
-	// just in case to prevent storing large strings in memory
-	if len(nameKey) > 1000 {
-		return errors.New("nameKey is too large")
-	}
-
-	// https://developer.apple.com/documentation/signinwithapple/incorporating-sign-in-with-apple-into-other-platforms#Handle-the-response
-	extracted := struct {
-		Name struct {
-			FirstName string `json:"firstName"`
-			LastName  string `json:"lastName"`
-		} `json:"name"`
-	}{}
-	if err := json.Unmarshal([]byte(serializedNameData), &extracted); err != nil {
-		return err
-	}
-
-	fullName := extracted.Name.FirstName + " " + extracted.Name.LastName
-
-	// truncate just in case to prevent storing large strings in memory
-	if len(fullName) > 150 {
-		fullName = fullName[:150]
-	}
-
-	fullName = strings.TrimSpace(fullName)
-	if fullName == "" {
-		return nil
-	}
-
-	// store (and remove)
-	app.Store().Set(nameKey, fullName)
-	time.AfterFunc(1*time.Minute, func() {
-		app.Store().Remove(nameKey)
-	})
-
-	return nil
-}

apis/record_auth_with_oauth2_redirect_test.go

@@ -1,366 +0,0 @@
-package apis_test
-
-import (
-	"context"
-	"net/http"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/subscriptions"
-)
-
-func TestRecordAuthWithOAuth2Redirect(t *testing.T) {
-	t.Parallel()
-
-	clientStubs := make([]map[string]subscriptions.Client, 0, 11)
-
-	for i := 0; i < 11; i++ {
-		c1 := subscriptions.NewDefaultClient()
-
-		c2 := subscriptions.NewDefaultClient()
-		c2.Subscribe("@oauth2")
-
-		c3 := subscriptions.NewDefaultClient()
-		c3.Subscribe("test1", "@oauth2")
-
-		c4 := subscriptions.NewDefaultClient()
-		c4.Subscribe("test1", "test2")
-
-		c5 := subscriptions.NewDefaultClient()
-		c5.Subscribe("@oauth2")
-		c5.Discard()
-
-		clientStubs = append(clientStubs, map[string]subscriptions.Client{
-			"c1": c1,
-			"c2": c2,
-			"c3": c3,
-			"c4": c4,
-			"c5": c5,
-		})
-	}
-
-	checkFailureRedirect := func(t testing.TB, app *tests.TestApp, res *http.Response) {
-		loc := res.Header.Get("Location")
-		if !strings.Contains(loc, "/oauth2-redirect-failure") {
-			t.Fatalf("Expected failure redirect, got %q", loc)
-		}
-	}
-
-	checkSuccessRedirect := func(t testing.TB, app *tests.TestApp, res *http.Response) {
-		loc := res.Header.Get("Location")
-		if !strings.Contains(loc, "/oauth2-redirect-success") {
-			t.Fatalf("Expected success redirect, got %q", loc)
-		}
-	}
-
-	// note: don't exit because it is usually called as part of a separate goroutine
-	checkClientMessages := func(t testing.TB, clientId string, msg subscriptions.Message, expectedMessages map[string][]string) {
-		if len(expectedMessages[clientId]) == 0 {
-			t.Errorf("Unexpected client %q message, got %q:\n%q", clientId, msg.Name, msg.Data)
-			return
-		}
-
-		if msg.Name != "@oauth2" {
-			t.Errorf("Expected @oauth2 msg.Name, got %q", msg.Name)
-			return
-		}
-
-		for _, txt := range expectedMessages[clientId] {
-			if !strings.Contains(string(msg.Data), txt) {
-				t.Errorf("Failed to find %q in \n%s", txt, msg.Data)
-				return
-			}
-		}
-	}
-
-	beforeTestFunc := func(
-		clients map[string]subscriptions.Client,
-		expectedMessages map[string][]string,
-	) func(testing.TB, *tests.TestApp, *core.ServeEvent) {
-		return func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-			for _, client := range clients {
-				app.SubscriptionsBroker().Register(client)
-			}
-
-			ctx, cancelFunc := context.WithTimeout(context.Background(), 100*time.Millisecond)
-
-			// add to the app store so that it can be cancelled manually after test completion
-			app.Store().Set("cancelFunc", cancelFunc)
-
-			go func() {
-				defer cancelFunc()
-
-				for {
-					select {
-					case msg, ok := <-clients["c1"].Channel():
-						if ok {
-							checkClientMessages(t, "c1", msg, expectedMessages)
-						} else {
-							t.Errorf("Unexpected c1 closed channel")
-						}
-					case msg, ok := <-clients["c2"].Channel():
-						if ok {
-							checkClientMessages(t, "c2", msg, expectedMessages)
-						} else {
-							t.Errorf("Unexpected c2 closed channel")
-						}
-					case msg, ok := <-clients["c3"].Channel():
-						if ok {
-							checkClientMessages(t, "c3", msg, expectedMessages)
-						} else {
-							t.Errorf("Unexpected c3 closed channel")
-						}
-					case msg, ok := <-clients["c4"].Channel():
-						if ok {
-							checkClientMessages(t, "c4", msg, expectedMessages)
-						} else {
-							t.Errorf("Unexpected c4 closed channel")
-						}
-					case _, ok := <-clients["c5"].Channel():
-						if ok {
-							t.Errorf("Expected c5 channel to be closed")
-						}
-					case <-ctx.Done():
-						for _, c := range clients {
-							c.Discard()
-						}
-						return
-					}
-				}
-			}()
-		}
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "no state query param",
-			Method:         http.MethodGet,
-			URL:            "/api/oauth2-redirect?code=123",
-			BeforeTestFunc: beforeTestFunc(clientStubs[0], nil),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-			},
-		},
-		{
-			Name:           "invalid or missing client",
-			Method:         http.MethodGet,
-			URL:            "/api/oauth2-redirect?code=123&state=missing",
-			BeforeTestFunc: beforeTestFunc(clientStubs[1], nil),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-			},
-		},
-		{
-			Name:   "no code query param",
-			Method: http.MethodGet,
-			URL:    "/api/oauth2-redirect?state=" + clientStubs[2]["c3"].Id(),
-			BeforeTestFunc: beforeTestFunc(clientStubs[2], map[string][]string{
-				"c3": {`"state":"` + clientStubs[2]["c3"].Id(), `"code":""`},
-			}),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-
-				if clientStubs[2]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-			},
-		},
-		{
-			Name:   "error query param",
-			Method: http.MethodGet,
-			URL:    "/api/oauth2-redirect?error=example&code=123&state=" + clientStubs[3]["c3"].Id(),
-			BeforeTestFunc: beforeTestFunc(clientStubs[3], map[string][]string{
-				"c3": {`"state":"` + clientStubs[3]["c3"].Id(), `"code":"123"`, `"error":"example"`},
-			}),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-
-				if clientStubs[3]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-			},
-		},
-		{
-			Name:           "discarded client with @oauth2 subscription",
-			Method:         http.MethodGet,
-			URL:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c5"].Id(),
-			BeforeTestFunc: beforeTestFunc(clientStubs[4], nil),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-			},
-		},
-		{
-			Name:           "client without @oauth2 subscription",
-			Method:         http.MethodGet,
-			URL:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c4"].Id(),
-			BeforeTestFunc: beforeTestFunc(clientStubs[5], nil),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-			},
-		},
-		{
-			Name:   "client with @oauth2 subscription",
-			Method: http.MethodGet,
-			URL:    "/api/oauth2-redirect?code=123&state=" + clientStubs[6]["c3"].Id(),
-			BeforeTestFunc: beforeTestFunc(clientStubs[6], map[string][]string{
-				"c3": {`"state":"` + clientStubs[6]["c3"].Id(), `"code":"123"`},
-			}),
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkSuccessRedirect(t, app, res)
-
-				if clientStubs[6]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-			},
-		},
-		{
-			Name:   "(POST) client with @oauth2 subscription",
-			Method: http.MethodPost,
-			URL:    "/api/oauth2-redirect",
-			Body:   strings.NewReader("code=123&state=" + clientStubs[7]["c3"].Id()),
-			Headers: map[string]string{
-				"content-type": "application/x-www-form-urlencoded",
-			},
-			BeforeTestFunc: beforeTestFunc(clientStubs[7], map[string][]string{
-				"c3": {`"state":"` + clientStubs[7]["c3"].Id(), `"code":"123"`},
-			}),
-			ExpectedStatus: http.StatusSeeOther,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkSuccessRedirect(t, app, res)
-
-				if clientStubs[7]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-			},
-		},
-		{
-			Name:   "(POST) Apple user's name json (nameKey error)",
-			Method: http.MethodPost,
-			URL:    "/api/oauth2-redirect",
-			Body: strings.NewReader(url.Values{
-				"code":  []string{strings.Repeat("a", 986)},
-				"state": []string{clientStubs[8]["c3"].Id()},
-				"user": []string{
-					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
-				},
-			}.Encode()),
-			Headers: map[string]string{
-				"content-type": "application/x-www-form-urlencoded",
-			},
-			BeforeTestFunc: beforeTestFunc(clientStubs[8], map[string][]string{
-				"c3": {`"state":"` + clientStubs[8]["c3"].Id(), `"code":"` + strings.Repeat("a", 986) + `"`},
-			}),
-			ExpectedStatus: http.StatusSeeOther,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkSuccessRedirect(t, app, res)
-
-				if clientStubs[8]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-
-				if storedName := app.Store().Get("@redirect_name_" + strings.Repeat("a", 986)); storedName != nil {
-					t.Fatalf("Didn't expect stored name, got %q", storedName)
-				}
-			},
-		},
-		{
-			Name:   "(POST) Apple user's name json",
-			Method: http.MethodPost,
-			URL:    "/api/oauth2-redirect",
-			Body: strings.NewReader(url.Values{
-				"code":  []string{strings.Repeat("a", 985)},
-				"state": []string{clientStubs[9]["c3"].Id()},
-				"user": []string{
-					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
-				},
-			}.Encode()),
-			Headers: map[string]string{
-				"content-type": "application/x-www-form-urlencoded",
-			},
-			BeforeTestFunc: beforeTestFunc(clientStubs[9], map[string][]string{
-				"c3": {`"state":"` + clientStubs[9]["c3"].Id(), `"code":"` + strings.Repeat("a", 985) + `"`},
-			}),
-			ExpectedStatus: http.StatusSeeOther,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkSuccessRedirect(t, app, res)
-
-				if clientStubs[9]["c3"].HasSubscription("@oauth2") {
-					t.Fatalf("Expected oauth2 subscription to be removed")
-				}
-
-				storedName, _ := app.Store().Get("@redirect_name_" + strings.Repeat("a", 985)).(string)
-				expectedName := "aaa " + strings.Repeat("b", 146)
-				if storedName != expectedName {
-					t.Fatalf("Expected stored name\n%q\ngot\n%q", expectedName, storedName)
-				}
-			},
-		},
-		{
-			Name:    "client with different IP",
-			Method:  http.MethodGet,
-			URL:     "/api/oauth2-redirect?code=123&state=" + clientStubs[10]["c3"].Id(),
-			Headers: map[string]string{"x-test-ip": "127.0.0.2"},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().TrustedProxy.Headers = []string{"x-test-ip"}
-
-				clientStubs[10]["c3"].Set(apis.RealtimeClientIPKey, "127.0.0.1")
-
-				beforeTestFunc(clientStubs[10], map[string][]string{
-					"c3": {`"state":"` + clientStubs[10]["c3"].Id(), `"code":"123"`},
-				})(t, app, e)
-			},
-			ExpectedStatus: http.StatusTemporaryRedirect,
-			ExpectedEvents: map[string]int{"*": 0},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				app.Store().Get("cancelFunc").(context.CancelFunc)()
-
-				checkFailureRedirect(t, app, res)
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_auth_with_otp.go

@@ -1,116 +0,0 @@
-package apis
-
-import (
-	"errors"
-	"fmt"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-func recordAuthWithOTP(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if !collection.OTP.Enabled {
-		return e.ForbiddenError("The collection is not configured to allow OTP authentication.", nil)
-	}
-
-	form := &authWithOTPForm{}
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOTP)
-
-	event := new(core.RecordAuthWithOTPRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-
-	// extra validations
-	// (note: returns a generic 400 as a very basic OTPs enumeration protection)
-	// ---
-	event.OTP, err = e.App.FindOTPById(form.OTPId)
-	if err != nil {
-		return e.BadRequestError("Invalid or expired OTP", err)
-	}
-
-	if event.OTP.CollectionRef() != collection.Id {
-		return e.BadRequestError("Invalid or expired OTP", errors.New("the OTP is for a different collection"))
-	}
-
-	if event.OTP.HasExpired(collection.OTP.DurationTime()) {
-		return e.BadRequestError("Invalid or expired OTP", errors.New("the OTP is expired"))
-	}
-
-	event.Record, err = e.App.FindRecordById(event.OTP.CollectionRef(), event.OTP.RecordRef())
-	if err != nil {
-		return e.BadRequestError("Invalid or expired OTP", fmt.Errorf("missing auth record: %w", err))
-	}
-
-	// since otps are usually simple digit numbers, enforce an extra rate limit rule as basic enumeration protection
-	err = checkRateLimit(e, "@pb_otp_"+event.Record.Id, core.RateLimitRule{MaxRequests: 5, Duration: 180})
-	if err != nil {
-		return e.TooManyRequestsError("Too many attempts, please try again later with a new OTP.", nil)
-	}
-
-	if !event.OTP.ValidatePassword(form.Password) {
-		return e.BadRequestError("Invalid or expired OTP", errors.New("incorrect password"))
-	}
-	// ---
-
-	return e.App.OnRecordAuthWithOTPRequest().Trigger(event, func(e *core.RecordAuthWithOTPRequestEvent) error {
-		otpId := e.OTP.Id
-		otpSentTo := e.OTP.SentTo()
-
-		// eagerly delete the OTP to avoid unnecessary double delete model hook calls
-		// triggered by the password change below
-		err := e.App.Delete(e.OTP)
-		if err != nil {
-			e.App.Logger().Error("Failed to delete used OTP", "error", err, "otpId", e.OTP.Id)
-		}
-
-		// update the user email verified state in case the OTP originate from an email address matching the current record one
-		//
-		// note: don't wait for success auth response (it could fail because of MFA) and because we already validated the OTP above
-		if !e.Record.Verified() && otpSentTo != "" && e.Record.Email() == otpSentTo {
-			e.Record.SetVerified(true)
-
-			// this is technically not required but we enforce password
-			// reset on verified upgrades in case the OTP is used on its own
-			// since this makes it less error prone to pre-hijacking attacks
-			if !e.Record.Collection().MFA.Enabled {
-				e.Record.SetRandomPassword()
-			}
-
-			if err := e.App.Save(e.Record); err != nil {
-				e.App.Logger().Error("Failed to update record verified state after successful OTP validation",
-					"error", err,
-					"otpId", otpId,
-					"recordId", e.Record.Id,
-				)
-			}
-		}
-
-		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOTP, nil)
-	})
-}
-
-// -------------------------------------------------------------------
-
-type authWithOTPForm struct {
-	OTPId    string `form:"otpId" json:"otpId"`
-	Password string `form:"password" json:"password"`
-}
-
-func (form *authWithOTPForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.OTPId, validation.Required, validation.Length(1, 255)),
-		validation.Field(&form.Password, validation.Required, validation.Length(1, 71)),
-	)
-}

apis/record_auth_with_otp_test.go

@@ -1,644 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-func TestRecordAuthWithOTP(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "not an auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/auth-with-otp",
-			Body:            strings.NewReader(`{"otpId":"test","password":"123456"}`),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "auth collection with disabled otp",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body:   strings.NewReader(`{"otpId":"test","password":"123456"}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				usersCol, err := app.FindCollectionByNameOrId("users")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				usersCol.OTP.Enabled = false
-
-				if err := app.Save(usersCol); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid body",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/users/auth-with-otp",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "empty body",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/users/auth-with-otp",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"otpId":{"code":"validation_required"`,
-				`"password":{"code":"validation_required"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "invalid request data",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 256) + `",
-				"password":"` + strings.Repeat("a", 72) + `"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"otpId":{"code":"validation_length_out_of_range"`,
-				`"password":{"code":"validation_length_out_of_range"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "missing otp",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"missing",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "otp for different collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				client, err := app.FindAuthRecordByEmail("clients", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(client.Collection().Id)
-				otp.SetRecordRef(client.Id)
-				otp.SetPassword("123456")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "otp with wrong password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("1234567890")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "expired otp with valid password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				expiredDate := types.NowDateTime().AddDate(-3, 0, 0)
-				otp.SetRaw("created", expiredDate)
-				otp.SetRaw("updated", expiredDate)
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid otp with valid password (enabled MFA)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"mfaId":"`},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthWithOTPRequest": 1,
-				"OnRecordAuthRequest":        1,
-				// ---
-				"OnModelValidate":           1,
-				"OnModelCreate":             1, // mfa record
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				"OnModelDelete":             1, // otp delete
-				"OnModelDeleteExecute":      1,
-				"OnModelAfterDeleteSuccess": 1,
-				// ---
-				"OnRecordValidate":           1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-		{
-			Name:   "valid otp with valid password and empty sentTo (disabled MFA)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// ensure that the user is unverified
-				user.SetVerified(false)
-				if err = app.Save(user); err != nil {
-					t.Fatal(err)
-				}
-
-				// disable MFA
-				user.Collection().MFA.Enabled = false
-				if err = app.Save(user.Collection()); err != nil {
-					t.Fatal(err)
-				}
-
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-
-				// test at least once that the correct request info context is properly loaded
-				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
-					info, err := e.RequestInfo()
-					if err != nil {
-						t.Fatal(err)
-					}
-
-					if info.Context != core.RequestInfoContextOTP {
-						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextOTP, info.Context)
-					}
-
-					return e.Next()
-				})
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-				`"record":{`,
-				`"email":"test@example.com"`,
-			},
-			NotExpectedContent: []string{
-				`"meta":`,
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthWithOTPRequest": 1,
-				"OnRecordAuthRequest":        1,
-				"OnRecordEnrich":             1,
-				// ---
-				"OnModelValidate":           1,
-				"OnModelCreate":             1, // authOrigin
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				"OnModelDelete":             1, // otp delete
-				"OnModelDeleteExecute":      1,
-				"OnModelAfterDeleteSuccess": 1,
-				// ---
-				"OnRecordValidate":           1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if user.Verified() {
-					t.Fatal("Expected the user to remain unverified because sentTo != email")
-				}
-
-				// ensure that all pre-existing OAuth2 were NOT deleted
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) != 2 {
-					t.Fatalf("Expected 2 external auths, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "valid otp with valid password and nonempty sentTo=email (disabled MFA)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// ensure that the user is unverified
-				user.SetVerified(false)
-				if err = app.Save(user); err != nil {
-					t.Fatal(err)
-				}
-
-				// disable MFA
-				user.Collection().MFA.Enabled = false
-				if err = app.Save(user.Collection()); err != nil {
-					t.Fatal(err)
-				}
-
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				otp.SetSentTo(user.Email())
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-
-				// verify that there are at least one pre-existing OAuth2 link
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) == 0 {
-					t.Fatal("Expected at least one external auth")
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":"`,
-				`"record":{`,
-				`"email":"test@example.com"`,
-			},
-			NotExpectedContent: []string{
-				`"meta":`,
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordAuthWithOTPRequest": 1,
-				"OnRecordAuthRequest":        1,
-				"OnRecordEnrich":             1,
-				// ---
-				"OnModelValidate": 2, // +1 because of the verified user update
-				// authOrigin create
-				"OnModelCreate":             1,
-				"OnModelCreateExecute":      1,
-				"OnModelAfterCreateSuccess": 1,
-				// record OTP + 2 ExternalAuths delete
-				"OnModelDelete":             3,
-				"OnModelDeleteExecute":      3,
-				"OnModelAfterDeleteSuccess": 3,
-				// user verified update
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				// ---
-				"OnRecordValidate":           2,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordDelete":             3,
-				"OnRecordDeleteExecute":      3,
-				"OnRecordAfterDeleteSuccess": 3,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if !user.Verified() {
-					t.Fatal("Expected the user to be marked as verified")
-				}
-
-				// ensure that all pre-existing OTPs are cleared
-				otps, err := app.FindAllOTPsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(otps) > 0 {
-					t.Fatalf("Expected all OTPs to be cleared, found %d", len(otps))
-				}
-
-				// ensure that all pre-existing OAuth2 links are cleared
-				externalAuths, err := app.FindAllExternalAuthsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if len(externalAuths) > 0 {
-					t.Fatalf("Expected all external auths to be cleared, found %d", len(externalAuths))
-				}
-			},
-		},
-		{
-			Name:   "OnRecordAuthWithOTPRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + strings.Repeat("a", 15) + `",
-				"password":"123456"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// disable MFA
-				user.Collection().MFA.Enabled = false
-				if err = app.Save(user.Collection()); err != nil {
-					t.Fatal(err)
-				}
-
-				otp := core.NewOTP(app)
-				otp.Id = strings.Repeat("a", 15)
-				otp.SetCollectionRef(user.Collection().Id)
-				otp.SetRecordRef(user.Id)
-				otp.SetPassword("123456")
-				if err := app.Save(otp); err != nil {
-					t.Fatal(err)
-				}
-
-				app.OnRecordAuthWithOTPRequest().BindFunc(func(e *core.RecordAuthWithOTPRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordAuthWithOTPRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:authWithOTP",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:authWithOTP"},
-					{MaxRequests: 100, Label: "users:auth"},
-					{MaxRequests: 0, Label: "users:authWithOTP"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:authWithOTP",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:auth"},
-					{MaxRequests: 0, Label: "*:authWithOTP"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - users:auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:authWithOTP"},
-					{MaxRequests: 0, Label: "users:auth"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:auth"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordAuthWithOTPManualRateLimiterCheck(t *testing.T) {
-	t.Parallel()
-
-	var storeCache map[string]any
-
-	otpAId := strings.Repeat("a", 15)
-	otpBId := strings.Repeat("b", 15)
-
-	scenarios := []struct {
-		otpId          string
-		password       string
-		expectedStatus int
-	}{
-		{otpAId, "12345", 400},
-		{otpAId, "12345", 400},
-		{otpBId, "12345", 400},
-		{otpBId, "12345", 400},
-		{otpBId, "12345", 400},
-		{otpAId, "12345", 429},
-		{otpAId, "123456", 429}, // reject even if it is correct
-		{otpAId, "123456", 429},
-		{otpBId, "123456", 429},
-	}
-
-	for _, s := range scenarios {
-		(&tests.ApiScenario{
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-otp",
-			Body: strings.NewReader(`{
-				"otpId":"` + s.otpId + `",
-				"password":"` + s.password + `"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				for k, v := range storeCache {
-					app.Store().Set(k, v)
-				}
-
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				user.Collection().MFA.Enabled = false
-				if err := app.Save(user.Collection()); err != nil {
-					t.Fatal(err)
-				}
-
-				for _, id := range []string{otpAId, otpBId} {
-					otp := core.NewOTP(app)
-					otp.Id = id
-					otp.SetCollectionRef(user.Collection().Id)
-					otp.SetRecordRef(user.Id)
-					otp.SetPassword("123456")
-					if err := app.Save(otp); err != nil {
-						t.Fatal(err)
-					}
-				}
-			},
-			ExpectedStatus:  s.expectedStatus,
-			ExpectedContent: []string{`"`}, // it doesn't matter anything non-empty
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				storeCache = app.Store().GetAll()
-			},
-		}).Test(t)
-	}
-}

apis/record_auth_with_password.go

@@ -1,164 +0,0 @@
-package apis
-
-import (
-	"database/sql"
-	"errors"
-	"slices"
-	"strings"
-
-	"github.com/pocketbase/dbx"
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/dbutils"
-	"github.com/pocketbase/pocketbase/tools/list"
-)
-
-func recordAuthWithPassword(e *core.RequestEvent) error {
-	collection, err := findAuthCollection(e)
-	if err != nil {
-		return err
-	}
-
-	if !collection.PasswordAuth.Enabled {
-		return e.ForbiddenError("The collection is not configured to allow password authentication.", nil)
-	}
-
-	form := &authWithPasswordForm{}
-	if err = e.BindBody(form); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-	if err = form.validate(collection); err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextPasswordAuth)
-
-	var foundRecord *core.Record
-	var foundErr error
-
-	if form.IdentityField != "" {
-		foundRecord, foundErr = findRecordByIdentityField(e.App, collection, form.IdentityField, form.Identity)
-	} else {
-		identityFields := collection.PasswordAuth.IdentityFields
-
-		// @todo consider removing with the stable release or moving it in the collection save
-		//
-		// prioritize email lookup to minimize breaking changes with earlier versions
-		if len(identityFields) > 1 && identityFields[0] != core.FieldNameEmail {
-			identityFields = slices.Clone(identityFields)
-			slices.SortStableFunc(identityFields, func(a, b string) int {
-				if a == "email" {
-					return -1
-				}
-				if b == "email" {
-					return 1
-				}
-				return 0
-			})
-		}
-
-		for _, name := range identityFields {
-			if name == core.FieldNameEmail && is.EmailFormat.Validate(form.Identity) != nil {
-				continue // no need to query the database if we know that the submitted value is not an email
-			}
-
-			foundRecord, foundErr = findRecordByIdentityField(e.App, collection, name, form.Identity)
-			if foundErr == nil {
-				break
-			}
-		}
-	}
-
-	// ignore not found errors to allow custom record find implementations
-	if foundErr != nil && !errors.Is(foundErr, sql.ErrNoRows) {
-		return e.InternalServerError("", foundErr)
-	}
-
-	event := new(core.RecordAuthWithPasswordRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = foundRecord
-	event.Identity = form.Identity
-	event.Password = form.Password
-	event.IdentityField = form.IdentityField
-
-	return e.App.OnRecordAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordRequestEvent) error {
-		if e.Record == nil || !e.Record.ValidatePassword(e.Password) {
-			// dummy password check to minimize enumeration side-channel attacks
-			if e.Record == nil {
-				dummyPasswordCheck(e.App, e.Collection)
-			}
-
-			return e.BadRequestError("Failed to authenticate.", errors.New("invalid login credentials"))
-		}
-
-		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodPassword, nil)
-	})
-}
-
-// -------------------------------------------------------------------
-
-type authWithPasswordForm struct {
-	Identity string `form:"identity" json:"identity"`
-	Password string `form:"password" json:"password"`
-
-	// IdentityField specifies the field to use to search for the identity
-	// (leave it empty for "auto" detection).
-	IdentityField string `form:"identityField" json:"identityField"`
-}
-
-func (form *authWithPasswordForm) validate(collection *core.Collection) error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Identity, validation.Required, validation.Length(1, 255)),
-		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
-		validation.Field(
-			&form.IdentityField,
-			validation.Length(1, 255),
-			validation.In(list.ToInterfaceSlice(collection.PasswordAuth.IdentityFields)...),
-		),
-	)
-}
-
-// dummy password check to minimize side-channel attacks
-// (performed with the collection configured field cost)
-func dummyPasswordCheck(app core.App, collection *core.Collection) {
-	record := &core.Record{}
-
-	// find any random existing record
-	err := app.RecordQuery(collection).Limit(1).One(record)
-	if err != nil {
-		return
-	}
-
-	// the value and result doesn't matter, we just need a constant-time check
-	_ = record.ValidatePassword("")
-}
-
-func findRecordByIdentityField(app core.App, collection *core.Collection, field string, value any) (*core.Record, error) {
-	if !slices.Contains(collection.PasswordAuth.IdentityFields, field) {
-		return nil, errors.New("invalid identity field " + field)
-	}
-
-	index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, field)
-	if !ok {
-		return nil, errors.New("missing " + field + " unique index constraint")
-	}
-
-	var expr dbx.Expression
-	if strings.EqualFold(index.Columns[0].Collate, "nocase") {
-		// case-insensitive search
-		expr = dbx.NewExp("[["+field+"]] = {:identity} COLLATE NOCASE", dbx.Params{"identity": value})
-	} else {
-		expr = dbx.HashExp{field: value}
-	}
-
-	record := &core.Record{}
-
-	err := app.RecordQuery(collection).AndWhere(expr).Limit(1).One(record)
-	if err != nil {
-		return nil, err
-	}
-
-	return record, nil
-}

apis/record_auth_with_password_test.go

@@ -1,764 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/dbutils"
-)
-
-func TestRecordAuthWithPassword(t *testing.T) {
-	t.Parallel()
-
-	updateIdentityIndex := func(collectionIdOrName string, fieldCollateMap map[string]string) func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-		return func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-			collection, err := app.FindCollectionByNameOrId("clients")
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			for column, collate := range fieldCollateMap {
-				index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, column)
-				if !ok {
-					t.Fatalf("Missing unique identityField index for column %q", column)
-				}
-
-				index.Columns[0].Collate = collate
-
-				collection.RemoveIndex(index.IndexName)
-				collection.Indexes = append(collection.Indexes, index.Build())
-			}
-
-			err = app.Save(collection)
-			if err != nil {
-				t.Fatalf("Failed to update identityField index: %v", err)
-			}
-		}
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "disabled password auth",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/nologin/auth-with-password",
-			Body:            strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "non-auth collection",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/demo1/auth-with-password",
-			Body:            strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:            "invalid body format",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/clients/auth-with-password",
-			Body:            strings.NewReader(`{"identity`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:           "empty body params",
-			Method:         http.MethodPost,
-			URL:            "/api/collections/clients/auth-with-password",
-			Body:           strings.NewReader(`{"identity":"","password":""}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"identity":{`,
-				`"password":{`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "OnRecordAuthWithPasswordRequest tx body write check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnRecordAuthWithPasswordRequest().BindFunc(func(e *core.RecordAuthWithPasswordRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnRecordAuthWithPasswordRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
-		{
-			Name:   "valid identity field and invalid password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"invalid"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{}`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-			},
-		},
-		{
-			Name:   "valid identity field (email) and valid password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				// test at least once that the correct request info context is properly loaded
-				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
-					info, err := e.RequestInfo()
-					if err != nil {
-						t.Fatal(err)
-					}
-
-					if info.Context != core.RequestInfoContextPasswordAuth {
-						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextPasswordAuth, info.Context)
-					}
-
-					return e.Next()
-				})
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "valid identity field (username) and valid password",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"clients57772",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"clients57772"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			// https://github.com/pocketbase/pocketbase/issues/7256
-			Name:   "valid non-email identity field with a value that is a properly formatted email",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"username_as_email@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				record, err := app.FindAuthRecordByEmail("clients", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				record.Set("username", "username_as_email@example.com")
-
-				err = app.SaveNoValidate(record)
-				if err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"username_as_email@example.com"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "unknown explicit identityField",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identityField": "created",
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"identityField":{"code":"validation_in_invalid"`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "valid identity field and valid password with mismatched explicit identityField",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identityField": "username",
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-			},
-		},
-		{
-			Name:   "valid identity field and valid password with matched explicit identityField",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identityField": "username",
-				"identity":"clients57772",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"clients57772"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "valid identity (unverified) and valid password in onlyVerified collection",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test2@example.com",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-			},
-		},
-		{
-			Name:   "already authenticated record",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"gk390qegs4y47wn"`,
-				`"email":"test@example.com"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "with mfa first auth check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			ExpectedStatus: 401,
-			ExpectedContent: []string{
-				`"mfaId":"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				// mfa create
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				mfas, err := app.FindAllMFAsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if v := len(mfas); v != 1 {
-					t.Fatalf("Expected 1 mfa record to be created, got %d", v)
-				}
-			},
-		},
-		{
-			Name:   "with mfa second auth check",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			Body: strings.NewReader(`{
-				"mfaId": "` + strings.Repeat("a", 15) + `",
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				// insert a dummy mfa record
-				mfa := core.NewMFA(app)
-				mfa.Id = strings.Repeat("a", 15)
-				mfa.SetCollectionRef(user.Collection().Id)
-				mfa.SetRecordRef(user.Id)
-				mfa.SetMethod("test")
-				if err := app.Save(mfa); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                0, // disabled auth email alerts
-				"OnMailerRecordAuthAlertSend": 0,
-				// mfa delete
-				"OnModelDelete":              1,
-				"OnModelDeleteExecute":       1,
-				"OnModelAfterDeleteSuccess":  1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-		{
-			Name:   "with enabled mfa but unsatisfied mfa rule (aka. skip the mfa check)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"test@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				users, err := app.FindCollectionByNameOrId("users")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				users.MFA.Enabled = true
-				users.MFA.Rule = "1=2"
-
-				if err := app.Save(users); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                0, // disabled auth email alerts
-				"OnMailerRecordAuthAlertSend": 0,
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				mfas, err := app.FindAllMFAsByRecord(user)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if v := len(mfas); v != 0 {
-					t.Fatalf("Expected no mfa records to be created, got %d", v)
-				}
-			},
-		},
-
-		// case sensitivity checks
-		// -----------------------------------------------------------
-		{
-			Name:   "with explicit identityField (case-sensitive)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identityField": "username",
-				"identity":"Clients57772",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc:  updateIdentityIndex("clients", map[string]string{"username": ""}),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-			},
-		},
-		{
-			Name:   "with explicit identityField (case-insensitive)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identityField": "username",
-				"identity":"Clients57772",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"clients57772"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "without explicit identityField and non-email field (case-insensitive)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"Clients57772",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"clients57772"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-		{
-			Name:   "without explicit identityField and email field (case-insensitive)",
-			Method: http.MethodPost,
-			URL:    "/api/collections/clients/auth-with-password",
-			Body: strings.NewReader(`{
-				"identity":"tESt@example.com",
-				"password":"1234567890"
-			}`),
-			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"email": "nocase"}),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"email":"test@example.com"`,
-				`"username":"clients57772"`,
-				`"token":`,
-			},
-			NotExpectedContent: []string{
-				// hidden fields
-				`"tokenKey"`,
-				`"password"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnRecordAuthWithPasswordRequest": 1,
-				"OnRecordAuthRequest":             1,
-				"OnRecordEnrich":                  1,
-				// authOrigin track
-				"OnModelCreate":               1,
-				"OnModelCreateExecute":        1,
-				"OnModelAfterCreateSuccess":   1,
-				"OnModelValidate":             1,
-				"OnRecordCreate":              1,
-				"OnRecordCreateExecute":       1,
-				"OnRecordAfterCreateSuccess":  1,
-				"OnRecordValidate":            1,
-				"OnMailerSend":                1,
-				"OnMailerRecordAuthAlertSend": 1,
-			},
-		},
-
-		// rate limit checks
-		// -----------------------------------------------------------
-		{
-			Name:   "RateLimit rule - users:authWithPassword",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:authWithPassword"},
-					{MaxRequests: 100, Label: "users:auth"},
-					{MaxRequests: 0, Label: "users:authWithPassword"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:authWithPassword",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:auth"},
-					{MaxRequests: 0, Label: "*:authWithPassword"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - users:auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 100, Label: "*:authWithPassword"},
-					{MaxRequests: 0, Label: "users:auth"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "RateLimit rule - *:auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/users/auth-with-password",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.Settings().RateLimits.Enabled = true
-				app.Settings().RateLimits.Rules = []core.RateLimitRule{
-					{MaxRequests: 100, Label: "abc"},
-					{MaxRequests: 0, Label: "*:auth"},
-				}
-			},
-			ExpectedStatus:  429,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_crud_auth_origin_test.go

@@ -1,314 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordCrudAuthOriginList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "guest",
-			Method:         http.MethodGet,
-			URL:            "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-		{
-			Name:   "regular auth with authOrigins",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":1`,
-				`"totalPages":1`,
-				`"id":"9r2j0m74260ur8i"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-				"OnRecordEnrich":       1,
-			},
-		},
-		{
-			Name:   "regular auth without authOrigins",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudAuthOriginView(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`"id":"9r2j0m74260ur8i"`},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordViewRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudAuthOriginDelete(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodDelete,
-			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordDeleteRequest":      1,
-				"OnModelDelete":              1,
-				"OnModelDeleteExecute":       1,
-				"OnModelAfterDeleteSuccess":  1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudAuthOriginCreate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"recordRef":     "4q1xlclmfloku33",
-			"collectionRef": "_pb_users_auth_",
-			"fingerprint":   "abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"fingerprint":"abc"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordCreateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudAuthOriginUpdate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"fingerprint":"abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPatch,
-			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"id":"9r2j0m74260ur8i"`,
-				`"fingerprint":"abc"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_crud_external_auth_test.go

@@ -1,316 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordCrudExternalAuthList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "guest",
-			Method:         http.MethodGet,
-			URL:            "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-		{
-			Name:   "regular auth with externalAuths",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":1`,
-				`"totalPages":1`,
-				`"id":"f1z5b3843pzc964"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-				"OnRecordEnrich":       1,
-			},
-		},
-		{
-			Name:   "regular auth without externalAuths",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			Headers: map[string]string{
-				// users, test2@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudExternalAuthView(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`"id":"dlmflokuq1xl342"`},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordViewRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudExternalAuthDelete(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodDelete,
-			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordDeleteRequest":      1,
-				"OnModelDelete":              1,
-				"OnModelDeleteExecute":       1,
-				"OnModelAfterDeleteSuccess":  1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudExternalAuthCreate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"recordRef":     "4q1xlclmfloku33",
-			"collectionRef": "_pb_users_auth_",
-			"provider":      "github",
-			"providerId":    "abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"recordRef":"4q1xlclmfloku33"`,
-				`"providerId":"abc"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordCreateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudExternalAuthUpdate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"providerId": "abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPatch,
-			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"id":"dlmflokuq1xl342"`,
-				`"providerId":"abc"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_crud_mfa_test.go

@@ -1,405 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordCrudMFAList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-		{
-			Name:   "regular auth with mfas",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":1`,
-				`"totalPages":1`,
-				`"id":"user1_0"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-				"OnRecordEnrich":       1,
-			},
-		},
-		{
-			Name:   "regular auth without mfas",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudMFAView(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`"id":"user1_0"`},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordViewRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudMFADelete(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordDeleteRequest":      1,
-				"OnModelDelete":              1,
-				"OnModelDeleteExecute":       1,
-				"OnModelAfterDeleteSuccess":  1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudMFACreate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"recordRef":     "4q1xlclmfloku33",
-			"collectionRef": "_pb_users_auth_",
-			"method":        "abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			Body:   body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedContent: []string{
-				`"recordRef":"4q1xlclmfloku33"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordCreateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudMFAUpdate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"method":"abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Body:   body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubMFARecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedContent: []string{
-				`"id":"user1_0"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_crud_otp_test.go

@@ -1,405 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordCrudOTPList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-		{
-			Name:   "regular auth with otps",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":1`,
-				`"totalPages":1`,
-				`"id":"user1_0"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-				"OnRecordEnrich":       1,
-			},
-		},
-		{
-			Name:   "regular auth without otps",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":0`,
-				`"totalPages":0`,
-				`"items":[]`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudOTPView(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`"id":"user1_0"`},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordViewRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudOTPDelete(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-owner auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// clients, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordDeleteRequest":      1,
-				"OnModelDelete":              1,
-				"OnModelDeleteExecute":       1,
-				"OnModelAfterDeleteSuccess":  1,
-				"OnRecordDelete":             1,
-				"OnRecordDeleteExecute":      1,
-				"OnRecordAfterDeleteSuccess": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudOTPCreate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"recordRef":     "4q1xlclmfloku33",
-			"collectionRef": "_pb_users_auth_",
-			"password":      "abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			Body:   body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedContent: []string{
-				`"recordRef":"4q1xlclmfloku33"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordCreateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudOTPUpdate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"password":"abc"
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "guest",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Body:   body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "owner regular auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				if err := tests.StubOTPRecords(app); err != nil {
-					t.Fatal(err)
-				}
-			},
-			ExpectedContent: []string{
-				`"id":"user1_0"`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_crud_superuser_test.go

@@ -1,336 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestRecordCrudSuperuserList(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-superusers auth",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalPages":1`,
-				`"totalItems":4`,
-				`"items":[{`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                    0,
-				"OnRecordsListRequest": 1,
-				"OnRecordEnrich":       4,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudSuperuserView(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodGet,
-			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-superusers auth",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodGet,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"sywbhecnh46rhm0"`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                   0,
-				"OnRecordViewRequest": 1,
-				"OnRecordEnrich":      1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudSuperuserDelete(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodDelete,
-			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-superusers auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordDeleteRequest":      1,
-				"OnModelDelete":              4, // + 3 AuthOrigins
-				"OnModelDeleteExecute":       4,
-				"OnModelAfterDeleteSuccess":  4,
-				"OnRecordDelete":             4,
-				"OnRecordDeleteExecute":      4,
-				"OnRecordAfterDeleteSuccess": 4,
-			},
-		},
-		{
-			Name:   "delete the last superuser",
-			Method: http.MethodDelete,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				// delete all other superusers
-				superusers, err := app.FindAllRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{"id": "sywbhecnh46rhm0"}))
-				if err != nil {
-					t.Fatal(err)
-				}
-				for _, superuser := range superusers {
-					if err = app.Delete(superuser); err != nil {
-						t.Fatal(err)
-					}
-				}
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                        0,
-				"OnRecordDeleteRequest":    1,
-				"OnModelDelete":            1,
-				"OnModelAfterDeleteError":  1,
-				"OnRecordDelete":           1,
-				"OnRecordAfterDeleteError": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudSuperuserCreate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"email":           "test_new@example.com",
-			"password":        "1234567890",
-			"passwordConfirm": "1234567890",
-			"verified":        false
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPost,
-			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPost,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"collectionName":"_superusers"`,
-				`"email":"test_new@example.com"`,
-				`"verified":true`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordCreateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelCreate":              1,
-				"OnModelCreateExecute":       1,
-				"OnModelAfterCreateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordCreate":             1,
-				"OnRecordCreateExecute":      1,
-				"OnRecordAfterCreateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestRecordCrudSuperuserUpdate(t *testing.T) {
-	t.Parallel()
-
-	body := func() *strings.Reader {
-		return strings.NewReader(`{
-			"email":    "test_new@example.com",
-			"verified": true
-		}`)
-	}
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPatch,
-			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "non-superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Headers: map[string]string{
-				// users, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
-			},
-			Body:            body(),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superusers auth",
-			Method: http.MethodPatch,
-			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
-			Headers: map[string]string{
-				// _superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			Body: body(),
-			ExpectedContent: []string{
-				`"collectionName":"_superusers"`,
-				`"id":"sywbhecnh46rhm0"`,
-				`"email":"test_new@example.com"`,
-				`"verified":true`,
-			},
-			ExpectedStatus: 200,
-			ExpectedEvents: map[string]int{
-				"*":                          0,
-				"OnRecordUpdateRequest":      1,
-				"OnRecordEnrich":             1,
-				"OnModelUpdate":              1,
-				"OnModelUpdateExecute":       1,
-				"OnModelAfterUpdateSuccess":  1,
-				"OnModelValidate":            1,
-				"OnRecordUpdate":             1,
-				"OnRecordUpdateExecute":      1,
-				"OnRecordAfterUpdateSuccess": 1,
-				"OnRecordValidate":           1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

apis/record_helpers.go

@@ -1,472 +1,249 @@
 package apis
 
 import (
-	"database/sql"
-	"errors"
 	"fmt"
+	"log"
+	"log/slog"
 	"net/http"
 	"strings"
-	"time"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/mails"
-	"github.com/pocketbase/pocketbase/tools/router"
-	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-const (
-	expandQueryParam = "expand"
-	fieldsQueryParam = "fields"
-)
+const ContextRequestInfoKey = "requestInfo"
 
-var ErrMFA = errors.New("mfa required")
+const expandQueryParam = "expand"
+const fieldsQueryParam = "fields"
 
-// RecordAuthResponse writes standardized json record auth response
-// into the specified request context.
-//
-// The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
-// that it is used primarily as an auth identifier during MFA and for login alerts.
-//
-// Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
-// (can be also adjusted additionally via the OnRecordAuthRequest hook).
-func RecordAuthResponse(e *core.RequestEvent, authRecord *core.Record, authMethod string, meta any) error {
-	token, tokenErr := authRecord.NewAuthToken()
-	if tokenErr != nil {
-		return e.InternalServerError("Failed to create auth token.", tokenErr)
-	}
-
-	return recordAuthResponse(e, authRecord, token, authMethod, meta)
+// Deprecated: Use RequestInfo instead.
+func RequestData(c echo.Context) *models.RequestInfo {
+	log.Println("RequestData(c) is deprecated and will be removed in the future! You can replace it with RequestInfo(c).")
+	return RequestInfo(c)
 }
 
-func recordAuthResponse(e *core.RequestEvent, authRecord *core.Record, token string, authMethod string, meta any) error {
-	if authRecord.IsSuperuser() {
-		allowedIPs := e.App.Settings().SuperuserIPs
-		if len(allowedIPs) > 0 && !isIPInList(allowedIPs, e.RealIP()) {
-			return e.ForbiddenError("", errors.New("superuser IP is not whitelisted"))
+// RequestInfo exports cached common request data fields
+// (query, body, logged auth state, etc.) from the provided context.
+func RequestInfo(c echo.Context) *models.RequestInfo {
+	// return cached to avoid copying the body multiple times
+	if v := c.Get(ContextRequestInfoKey); v != nil {
+		if data, ok := v.(*models.RequestInfo); ok {
+			// refresh auth state
+			data.AuthRecord, _ = c.Get(ContextAuthRecordKey).(*models.Record)
+			data.Admin, _ = c.Get(ContextAdminKey).(*models.Admin)
+			return data
 		}
 	}
 
-	originalRequestInfo, err := e.RequestInfo()
-	if err != nil {
-		return err
+	result := &models.RequestInfo{
+		Context: models.RequestInfoContextDefault,
+		Method:  c.Request().Method,
+		Query:   map[string]any{},
+		Data:    map[string]any{},
+		Headers: map[string]any{},
 	}
 
-	ok, err := e.App.CanAccessRecord(authRecord, originalRequestInfo, authRecord.Collection().AuthRule)
-	if !ok {
-		return firstApiError(err, e.ForbiddenError("The request doesn't satisfy the collection requirements to authenticate.", err))
+	// extract the first value of all headers and normalizes the keys
+	// ("X-Token" is converted to "x_token")
+	for k, v := range c.Request().Header {
+		if len(v) > 0 {
+			result.Headers[inflector.Snakecase(k)] = v[0]
+		}
 	}
 
-	event := new(core.RecordAuthRequestEvent)
-	event.RequestEvent = e
+	result.AuthRecord, _ = c.Get(ContextAuthRecordKey).(*models.Record)
+	result.Admin, _ = c.Get(ContextAdminKey).(*models.Admin)
+	echo.BindQueryParams(c, &result.Query)
+	rest.BindBody(c, &result.Data)
+
+	c.Set(ContextRequestInfoKey, result)
+
+	return result
+}
+
+// RecordAuthResponse writes standardised json record auth response
+// into the specified request context.
+func RecordAuthResponse(
+	app core.App,
+	c echo.Context,
+	authRecord *models.Record,
+	meta any,
+	finalizers ...func(token string) error,
+) error {
+	if !authRecord.Verified() && authRecord.Collection().AuthOptions().OnlyVerified {
+		return NewForbiddenError("Please verify your account first.", nil)
+	}
+
+	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
+	if tokenErr != nil {
+		return NewBadRequestError("Failed to create auth token.", tokenErr)
+	}
+
+	event := new(core.RecordAuthEvent)
+	event.HttpContext = c
 	event.Collection = authRecord.Collection()
 	event.Record = authRecord
 	event.Token = token
 	event.Meta = meta
-	event.AuthMethod = authMethod
 
-	return e.App.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthRequestEvent) error {
-		if e.Written() {
+	return app.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthEvent) error {
+		if e.HttpContext.Response().Committed {
 			return nil
 		}
 
-		// MFA
-		// ---
-		mfaId, err := checkMFA(e.RequestEvent, e.Record, e.AuthMethod)
-		if err != nil {
-			return err
-		}
+		// allow always returning the email address of the authenticated account
+		e.Record.IgnoreEmailVisibility(true)
 
-		// require additional authentication
-		if mfaId != "" {
-			// eagerly write the mfa response and return an err so that
-			// external middlewars are aware that the auth response requires an extra step
-			e.JSON(http.StatusUnauthorized, map[string]string{
-				"mfaId": mfaId,
-			})
-			return ErrMFA
-		}
-		// ---
-
-		// create a shallow copy of the cached request data and adjust it to the current auth record
-		requestInfo := *originalRequestInfo
-		requestInfo.Auth = e.Record
-
-		err = triggerRecordEnrichHooks(e.App, &requestInfo, []*core.Record{e.Record}, func() error {
-			if e.Record.IsSuperuser() {
-				e.Record.Unhide(e.Record.Collection().Fields.FieldNames()...)
-			}
-
-			// allow always returning the email address of the authenticated model
-			e.Record.IgnoreEmailVisibility(true)
-
-			// expand record relations
-			expands := strings.Split(e.Request.URL.Query().Get(expandQueryParam), ",")
-			if len(expands) > 0 {
-				failed := e.App.ExpandRecord(e.Record, expands, expandFetch(e.App, &requestInfo))
-				if len(failed) > 0 {
-					e.App.Logger().Warn("[recordAuthResponse] Failed to expand relations", "error", failed)
-				}
-			}
-
-			return nil
-		})
-		if err != nil {
-			return err
-		}
-
-		if e.AuthMethod != "" && authRecord.Collection().AuthAlert.Enabled {
-			if err = authAlert(e.RequestEvent, e.Record); err != nil {
-				e.App.Logger().Warn("[recordAuthResponse] Failed to send login alert", "error", err)
+		// expand record relations
+		expands := strings.Split(c.QueryParam(expandQueryParam), ",")
+		if len(expands) > 0 {
+			// create a copy of the cached request data and adjust it to the current auth record
+			requestInfo := *RequestInfo(e.HttpContext)
+			requestInfo.Admin = nil
+			requestInfo.AuthRecord = e.Record
+			failed := app.Dao().ExpandRecord(
+				e.Record,
+				expands,
+				expandFetch(app.Dao(), &requestInfo),
+			)
+			if len(failed) > 0 {
+				app.Logger().Debug("[RecordAuthResponse] Failed to expand relations", slog.Any("errors", failed))
 			}
 		}
 
-		result := struct {
-			Meta   any          `json:"meta,omitempty"`
-			Record *core.Record `json:"record"`
-			Token  string       `json:"token"`
-		}{
-			Token:  e.Token,
-			Record: e.Record,
+		result := map[string]any{
+			"token":  e.Token,
+			"record": e.Record,
 		}
 
 		if e.Meta != nil {
-			result.Meta = e.Meta
+			result["meta"] = e.Meta
 		}
 
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, result)
-		})
-	})
-}
-
-// wantsMFA checks whether to enable MFA for the specified auth record based on its MFA rule
-// (note: returns true even in case of an error as a safer default).
-func wantsMFA(e *core.RequestEvent, record *core.Record) (bool, error) {
-	rule := record.Collection().MFA.Rule
-	if rule == "" {
-		return true, nil
-	}
-
-	requestInfo, err := e.RequestInfo()
-	if err != nil {
-		return true, err
-	}
-
-	var exists int
-
-	query := e.App.RecordQuery(record.Collection()).
-		Select("(1)").
-		AndWhere(dbx.HashExp{record.Collection().Name + ".id": record.Id})
-
-	// parse and apply the access rule filter
-	resolver := core.NewRecordFieldResolver(e.App, record.Collection(), requestInfo, true)
-	expr, err := search.FilterData(rule).BuildExpr(resolver)
-	if err != nil {
-		return true, err
-	}
-
-	err = resolver.UpdateQuery(query)
-	if err != nil {
-		return true, err
-	}
-
-	err = query.AndWhere(expr).Limit(1).Row(&exists)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return true, err
-	}
-
-	return exists > 0, nil
-}
-
-// checkMFA handles any MFA auth checks that needs to be performed for the specified request event.
-// Returns the mfaId that needs to be written as response to the user.
-//
-// (note: all auth methods are treated as equal and there is no requirement for "pairing").
-func checkMFA(e *core.RequestEvent, authRecord *core.Record, currentAuthMethod string) (string, error) {
-	if !authRecord.Collection().MFA.Enabled || currentAuthMethod == "" {
-		return "", nil
-	}
-
-	ok, err := wantsMFA(e, authRecord)
-	if err != nil {
-		return "", e.BadRequestError("Failed to authenticate.", fmt.Errorf("MFA rule failure: %w", err))
-	}
-	if !ok {
-		return "", nil // no mfa needed for this auth record
-	}
-
-	// read the mfaId either from the qyery params or request body
-	mfaId := e.Request.URL.Query().Get("mfaId")
-	if mfaId == "" {
-		// check the body
-		data := struct {
-			MfaId string `form:"mfaId" json:"mfaId" xml:"mfaId"`
-		}{}
-		if err := e.BindBody(&data); err != nil {
-			return "", firstApiError(err, e.BadRequestError("Failed to read MFA Id", err))
-		}
-		mfaId = data.MfaId
-	}
-
-	// first-time auth
-	// ---
-	if mfaId == "" {
-		mfa := core.NewMFA(e.App)
-		mfa.SetCollectionRef(authRecord.Collection().Id)
-		mfa.SetRecordRef(authRecord.Id)
-		mfa.SetMethod(currentAuthMethod)
-		if err := e.App.Save(mfa); err != nil {
-			return "", firstApiError(err, e.InternalServerError("Failed to create MFA record", err))
-		}
-
-		return mfa.Id, nil
-	}
-
-	// second-time auth
-	// ---
-	mfa, err := e.App.FindMFAById(mfaId)
-	deleteMFA := func() {
-		// try to delete the expired mfa
-		if mfa != nil {
-			if deleteErr := e.App.Delete(mfa); deleteErr != nil {
-				e.App.Logger().Warn("Failed to delete expired MFA record", "error", deleteErr, "mfaId", mfa.Id)
+		for _, f := range finalizers {
+			if err := f(e.Token); err != nil {
+				return err
 			}
 		}
-	}
-	if err != nil || mfa.HasExpired(authRecord.Collection().MFA.DurationTime()) {
-		deleteMFA()
-		return "", e.BadRequestError("Invalid or expired MFA session.", err)
-	}
 
-	if mfa.RecordRef() != authRecord.Id || mfa.CollectionRef() != authRecord.Collection().Id {
-		return "", e.BadRequestError("Invalid MFA session.", nil)
-	}
-
-	if mfa.Method() == currentAuthMethod {
-		return "", e.BadRequestError("A different authentication method is required.", nil)
-	}
-
-	deleteMFA()
-
-	return "", nil
+		return e.HttpContext.JSON(http.StatusOK, result)
+	})
 }
 
 // EnrichRecord parses the request context and enrich the provided record:
 //   - expands relations (if defaultExpands and/or ?expand query param is set)
 //   - ensures that the emails of the auth record and its expanded auth relations
-//     are visible only for the current logged superuser, record owner or record with manage access
-func EnrichRecord(e *core.RequestEvent, record *core.Record, defaultExpands ...string) error {
-	return EnrichRecords(e, []*core.Record{record}, defaultExpands...)
+//     are visible only for the current logged admin, record owner or record with manage access
+func EnrichRecord(c echo.Context, dao *daos.Dao, record *models.Record, defaultExpands ...string) error {
+	return EnrichRecords(c, dao, []*models.Record{record}, defaultExpands...)
 }
 
 // EnrichRecords parses the request context and enriches the provided records:
 //   - expands relations (if defaultExpands and/or ?expand query param is set)
 //   - ensures that the emails of the auth records and their expanded auth relations
-//     are visible only for the current logged superuser, record owner or record with manage access
-//
-// Note: Expects all records to be from the same collection!
-func EnrichRecords(e *core.RequestEvent, records []*core.Record, defaultExpands ...string) error {
-	if len(records) == 0 {
-		return nil
+//     are visible only for the current logged admin, record owner or record with manage access
+func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defaultExpands ...string) error {
+	requestInfo := RequestInfo(c)
+
+	if err := autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo); err != nil {
+		return fmt.Errorf("failed to resolve email visibility: %w", err)
 	}
 
-	info, err := e.RequestInfo()
-	if err != nil {
-		return err
+	expands := defaultExpands
+	if param := c.QueryParam(expandQueryParam); param != "" {
+		expands = append(expands, strings.Split(param, ",")...)
+	}
+	if len(expands) == 0 {
+		return nil // nothing to expand
 	}
 
-	return triggerRecordEnrichHooks(e.App, info, records, func() error {
-		expands := defaultExpands
-		if param := info.Query[expandQueryParam]; param != "" {
-			expands = append(expands, strings.Split(param, ",")...)
-		}
-
-		err := defaultEnrichRecords(e.App, info, records, expands...)
-		if err != nil {
-			// only log because it is not critical
-			e.App.Logger().Warn("failed to apply default enriching", "error", err)
-		}
-
-		return nil
-	})
-}
-
-type iterator[T any] struct {
-	items []T
-	index int
-}
-
-func (ri *iterator[T]) next() T {
-	var item T
-
-	if ri.index < len(ri.items) {
-		item = ri.items[ri.index]
-		ri.index++
-	}
-
-	return item
-}
-
-func triggerRecordEnrichHooks(app core.App, requestInfo *core.RequestInfo, records []*core.Record, finalizer func() error) error {
-	it := iterator[*core.Record]{items: records}
-
-	enrichHook := app.OnRecordEnrich()
-
-	event := new(core.RecordEnrichEvent)
-	event.App = app
-	event.RequestInfo = requestInfo
-
-	var iterate func(record *core.Record) error
-	iterate = func(record *core.Record) error {
-		if record == nil {
-			return nil
-		}
-
-		event.Record = record
-
-		return enrichHook.Trigger(event, func(ee *core.RecordEnrichEvent) error {
-			next := it.next()
-			if next == nil {
-				if finalizer != nil {
-					return finalizer()
-				}
-				return nil
-			}
-
-			event.App = ee.App // in case it was replaced with a transaction
-			event.Record = next
-
-			err := iterate(next)
-
-			event.App = app
-			event.Record = record
-
-			return err
-		})
-	}
-
-	return iterate(it.next())
-}
-
-func defaultEnrichRecords(app core.App, requestInfo *core.RequestInfo, records []*core.Record, expands ...string) error {
-	err := autoResolveRecordsFlags(app, records, requestInfo)
-	if err != nil {
-		return fmt.Errorf("failed to resolve records flags: %w", err)
-	}
-
-	if len(expands) > 0 {
-		expandErrs := app.ExpandRecords(records, expands, expandFetch(app, requestInfo))
-		if len(expandErrs) > 0 {
-			errsSlice := make([]error, 0, len(expandErrs))
-			for key, err := range expandErrs {
-				errsSlice = append(errsSlice, fmt.Errorf("failed to expand %q: %w", key, err))
-			}
-			return fmt.Errorf("failed to expand records: %w", errors.Join(errsSlice...))
-		}
+	errs := dao.ExpandRecords(records, expands, expandFetch(dao, requestInfo))
+	if len(errs) > 0 {
+		return fmt.Errorf("failed to expand: %v", errs)
 	}
 
 	return nil
 }
 
 // expandFetch is the records fetch function that is used to expand related records.
-func expandFetch(app core.App, originalRequestInfo *core.RequestInfo) core.ExpandFetchFunc {
-	// shallow clone the provided request info to set an "expand" context
-	requestInfoClone := *originalRequestInfo
-	requestInfoPtr := &requestInfoClone
-	requestInfoPtr.Context = core.RequestInfoContextExpand
-
-	return func(relCollection *core.Collection, relIds []string) ([]*core.Record, error) {
-		records, findErr := app.FindRecordsByIds(relCollection.Id, relIds, func(q *dbx.SelectQuery) error {
-			if requestInfoPtr.Auth != nil && requestInfoPtr.Auth.IsSuperuser() {
-				return nil // superusers can access everything
+func expandFetch(
+	dao *daos.Dao,
+	requestInfo *models.RequestInfo,
+) daos.ExpandFetchFunc {
+	return func(relCollection *models.Collection, relIds []string) ([]*models.Record, error) {
+		records, err := dao.FindRecordsByIds(relCollection.Id, relIds, func(q *dbx.SelectQuery) error {
+			if requestInfo.Admin != nil {
+				return nil // admins can access everything
 			}
 
 			if relCollection.ViewRule == nil {
-				return fmt.Errorf("only superusers can view collection %q records", relCollection.Name)
+				return fmt.Errorf("only admins can view collection %q records", relCollection.Name)
 			}
 
 			if *relCollection.ViewRule != "" {
-				resolver := core.NewRecordFieldResolver(app, relCollection, requestInfoPtr, true)
-
+				resolver := resolvers.NewRecordFieldResolver(dao, relCollection, requestInfo, true)
 				expr, err := search.FilterData(*(relCollection.ViewRule)).BuildExpr(resolver)
 				if err != nil {
 					return err
 				}
-
+				resolver.UpdateQuery(q)
 				q.AndWhere(expr)
-
-				err = resolver.UpdateQuery(q)
-				if err != nil {
-					return err
-				}
 			}
 
 			return nil
 		})
-		if findErr != nil {
-			return nil, findErr
+
+		if err == nil && len(records) > 0 {
+			autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo)
 		}
 
-		enrichErr := triggerRecordEnrichHooks(app, requestInfoPtr, records, func() error {
-			if err := autoResolveRecordsFlags(app, records, requestInfoPtr); err != nil {
-				// non-critical error
-				app.Logger().Warn("Failed to apply autoResolveRecordsFlags for the expanded records", "error", err)
-			}
-
-			return nil
-		})
-		if enrichErr != nil {
-			return nil, enrichErr
-		}
-
-		return records, nil
+		return records, err
 	}
 }
 
-// autoResolveRecordsFlags resolves various visibility flags of the provided records.
+// autoIgnoreAuthRecordsEmailVisibility ignores the email visibility check for
+// the provided record if the current auth model is admin, owner or a "manager".
 //
-// Currently it enables:
-// - export of hidden fields if the current auth model is a superuser
-// - email export ignoring the emailVisibity checks if the current auth model is superuser, owner or a "manager".
-//
-// Note: Expects all records to be from the same collection!
-func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *core.RequestInfo) error {
-	if len(records) == 0 {
-		return nil // nothing to resolve
+// Note: Expects all records to be from the same auth collection!
+func autoIgnoreAuthRecordsEmailVisibility(
+	dao *daos.Dao,
+	records []*models.Record,
+	requestInfo *models.RequestInfo,
+) error {
+	if len(records) == 0 || !records[0].Collection().IsAuth() {
+		return nil // nothing to check
 	}
 
-	if requestInfo.HasSuperuserAuth() {
-		hiddenFields := records[0].Collection().Fields.FieldNames()
+	if requestInfo.Admin != nil {
 		for _, rec := range records {
-			rec.Unhide(hiddenFields...)
 			rec.IgnoreEmailVisibility(true)
 		}
-	}
-
-	// additional emailVisibility checks
-	// ---------------------------------------------------------------
-	if !records[0].Collection().IsAuth() {
-		return nil // not auth collection records
+		return nil
 	}
 
 	collection := records[0].Collection()
 
-	mappedRecords := make(map[string]*core.Record, len(records))
+	mappedRecords := make(map[string]*models.Record, len(records))
 	recordIds := make([]any, len(records))
 	for i, rec := range records {
 		mappedRecords[rec.Id] = rec
 		recordIds[i] = rec.Id
 	}
 
-	if requestInfo.Auth != nil && mappedRecords[requestInfo.Auth.Id] != nil {
-		mappedRecords[requestInfo.Auth.Id].IgnoreEmailVisibility(true)
+	if requestInfo != nil && requestInfo.AuthRecord != nil && mappedRecords[requestInfo.AuthRecord.Id] != nil {
+		mappedRecords[requestInfo.AuthRecord.Id].IgnoreEmailVisibility(true)
 	}
 
-	if collection.ManageRule == nil || *collection.ManageRule == "" {
+	authOptions := collection.AuthOptions()
+	if authOptions.ManageRule == nil || *authOptions.ManageRule == "" {
 		return nil // no manage rule to check
 	}
 
@@ -474,25 +251,19 @@ func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *
 	// ---
 	managedIds := []string{}
 
-	query := app.RecordQuery(collection).
-		Select(app.ConcurrentDB().QuoteSimpleColumnName(collection.Name) + ".id").
-		AndWhere(dbx.In(app.ConcurrentDB().QuoteSimpleColumnName(collection.Name)+".id", recordIds...))
+	query := dao.RecordQuery(collection).
+		Select(dao.DB().QuoteSimpleColumnName(collection.Name) + ".id").
+		AndWhere(dbx.In(dao.DB().QuoteSimpleColumnName(collection.Name)+".id", recordIds...))
 
-	resolver := core.NewRecordFieldResolver(app, collection, requestInfo, true)
-	expr, err := search.FilterData(*collection.ManageRule).BuildExpr(resolver)
+	resolver := resolvers.NewRecordFieldResolver(dao, collection, requestInfo, true)
+	expr, err := search.FilterData(*authOptions.ManageRule).BuildExpr(resolver)
 	if err != nil {
 		return err
 	}
-
+	resolver.UpdateQuery(query)
 	query.AndWhere(expr)
 
-	err = resolver.UpdateQuery(query)
-	if err != nil {
-		return err
-	}
-
-	err = query.Column(&managedIds)
-	if err != nil {
+	if err := query.Column(&managedIds); err != nil {
 		return err
 	}
 	// ---
@@ -507,158 +278,68 @@ func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *
 	return nil
 }
 
-var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
-var superuserOnlyRuleFields = []string{"@collection.", "@request."}
+// hasAuthManageAccess checks whether the client is allowed to have full
+// [forms.RecordUpsert] auth management permissions
+// (aka. allowing to change system auth fields without oldPassword).
+func hasAuthManageAccess(
+	dao *daos.Dao,
+	record *models.Record,
+	requestInfo *models.RequestInfo,
+) bool {
+	if !record.Collection().IsAuth() {
+		return false
+	}
 
-// checkForSuperuserOnlyRuleFields loosely checks and returns an error if
-// the provided RequestInfo contains rule fields that only the superuser can use.
-func checkForSuperuserOnlyRuleFields(requestInfo *core.RequestInfo) error {
-	if len(requestInfo.Query) == 0 || requestInfo.HasSuperuserAuth() {
-		return nil // superuser or nothing to check
+	manageRule := record.Collection().AuthOptions().ManageRule
+
+	if manageRule == nil || *manageRule == "" {
+		return false // only for admins (manageRule can't be empty)
+	}
+
+	if requestInfo == nil || requestInfo.AuthRecord == nil {
+		return false // no auth record
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		resolver := resolvers.NewRecordFieldResolver(dao, record.Collection(), requestInfo, true)
+		expr, err := search.FilterData(*manageRule).BuildExpr(resolver)
+		if err != nil {
+			return err
+		}
+		resolver.UpdateQuery(q)
+		q.AndWhere(expr)
+		return nil
+	}
+
+	_, findErr := dao.FindRecordById(record.Collection().Id, record.Id, ruleFunc)
+
+	return findErr == nil
+}
+
+var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
+var adminOnlyRuleFields = []string{"@collection.", "@request."}
+
+// @todo consider moving the rules check to the RecordFieldResolver.
+//
+// checkForAdminOnlyRuleFields loosely checks and returns an error if
+// the provided RequestInfo contains rule fields that only the admin can use.
+func checkForAdminOnlyRuleFields(requestInfo *models.RequestInfo) error {
+	if requestInfo.Admin != nil || len(requestInfo.Query) == 0 {
+		return nil // admin or nothing to check
 	}
 
 	for _, param := range ruleQueryParams {
-		v := requestInfo.Query[param]
+		v, _ := requestInfo.Query[param].(string)
 		if v == "" {
 			continue
 		}
 
-		for _, field := range superuserOnlyRuleFields {
+		for _, field := range adminOnlyRuleFields {
 			if strings.Contains(v, field) {
-				return router.NewForbiddenError("Only superusers can filter by "+field, nil)
+				return NewForbiddenError("Only admins can filter by "+field, nil)
 			}
 		}
 	}
 
 	return nil
 }
-
-// firstApiError returns the first ApiError from the errors list
-// (this is used usually to prevent unnecessary wraping and to allow bubling ApiError from nested hooks)
-//
-// If no ApiError is found, returns a default "Internal server" error.
-func firstApiError(errs ...error) *router.ApiError {
-	var apiErr *router.ApiError
-	var ok bool
-
-	for _, err := range errs {
-		if err == nil {
-			continue
-		}
-
-		// quick assert to avoid the reflection checks
-		apiErr, ok = err.(*router.ApiError)
-		if ok {
-			return apiErr
-		}
-
-		// nested/wrapped errors
-		if errors.As(err, &apiErr) {
-			return apiErr
-		}
-	}
-
-	return router.NewInternalServerError("", errors.Join(errs...))
-}
-
-// execAfterSuccessTx ensures that fn is executed only after a successful transaction.
-//
-// If the current app instance is not a transactional or checkTx is false,
-// then fn is directly executed.
-//
-// It could be usually used to allow propagating an error or writing
-// custom response from within the wrapped transaction block.
-func execAfterSuccessTx(checkTx bool, app core.App, fn func() error) error {
-	if txInfo := app.TxInfo(); txInfo != nil && checkTx {
-		txInfo.OnComplete(func(txErr error) error {
-			if txErr == nil {
-				return fn()
-			}
-			return nil
-		})
-		return nil
-	}
-
-	return fn()
-}
-
-// -------------------------------------------------------------------
-
-const maxAuthOrigins = 5
-
-func authAlert(e *core.RequestEvent, authRecord *core.Record) error {
-	// generate fingerprint
-	// ---
-	ip := e.RealIP()
-
-	userAgent := e.Request.UserAgent()
-	if len(userAgent) > 200 {
-		userAgent = userAgent[:200] + "..."
-	}
-
-	fingerprint := security.MD5(ip + userAgent)
-	alertInfo := fmt.Sprintf("%s - %s %s", types.NowDateTime().String(), ip, userAgent)
-	// ---
-
-	origins, err := e.App.FindAllAuthOriginsByRecord(authRecord)
-	if err != nil {
-		return err
-	}
-
-	isFirstLogin := len(origins) == 0
-
-	var currentOrigin *core.AuthOrigin
-	for _, origin := range origins {
-		if origin.Fingerprint() == fingerprint {
-			currentOrigin = origin
-			break
-		}
-	}
-	if currentOrigin == nil {
-		currentOrigin = core.NewAuthOrigin(e.App)
-		currentOrigin.SetCollectionRef(authRecord.Collection().Id)
-		currentOrigin.SetRecordRef(authRecord.Id)
-		currentOrigin.SetFingerprint(fingerprint)
-	}
-
-	// send email alert for the new origin auth (skip first login)
-	//
-	// Note: The "fake" timeout is a temp solution to avoid blocking
-	//       for too long when the SMTP server is not accessible, due
-	//       to the lack of context cancellation support in the underlying
-	//       mailer and net/smtp package.
-	//       The goroutine technically "leaks" but we assume that the OS will
-	//       terminate the connection after some time (usually after 3-4 mins).
-	if !isFirstLogin && currentOrigin.IsNew() && authRecord.Email() != "" {
-		mailSent := make(chan error, 1)
-
-		timer := time.AfterFunc(15*time.Second, func() {
-			mailSent <- errors.New("auth alert mail send wait timeout reached")
-		})
-
-		routine.FireAndForget(func() {
-			err := mails.SendRecordAuthAlert(e.App, authRecord, alertInfo)
-			timer.Stop()
-			mailSent <- err
-		})
-
-		err = <-mailSent
-		if err != nil {
-			return err
-		}
-	}
-
-	// try to keep only up to maxAuthOrigins
-	// (pop the last used ones; it is not executed in a transaction to avoid unnecessary locks)
-	if currentOrigin.IsNew() && len(origins) >= maxAuthOrigins {
-		for i := len(origins) - 1; i >= maxAuthOrigins-1; i-- {
-			if err := e.App.Delete(origins[i]); err != nil {
-				// treat as non-critical error, just log for now
-				e.App.Logger().Warn("Failed to delete old AuthOrigin record", "error", err, "authOriginId", origins[i].Id)
-			}
-		}
-	}
-
-	// create/update the origin fingerprint
-	return e.App.Save(currentOrigin)
-}

apis/serve.go

@@ -3,7 +3,6 @@ package apis
 import (
 	"context"
 	"crypto/tls"
-	"errors"
 	"log"
 	"net"
 	"net/http"
@@ -13,26 +12,27 @@ import (
 	"time"
 
 	"github.com/fatih/color"
+	"github.com/labstack/echo/v5"
+	"github.com/labstack/echo/v5/middleware"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/routine"
-	"github.com/pocketbase/pocketbase/ui"
+	"github.com/pocketbase/pocketbase/tools/migrate"
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 )
 
-const defaultCSP = "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' http://127.0.0.1:* https://tile.openstreetmap.org data: blob:; connect-src 'self' http://127.0.0.1:* https://nominatim.openstreetmap.org; script-src 'self' http://127.0.0.1:*; frame-ancestors 'none'"
-
 // ServeConfig defines a configuration struct for apis.Serve().
 type ServeConfig struct {
 	// ShowStartBanner indicates whether to show or hide the server start console message.
 	ShowStartBanner bool
 
-	// HttpAddr is the TCP address to listen for the HTTP server (eg. "127.0.0.1:80").
+	// HttpAddr is the TCP address to listen for the HTTP server (eg. `127.0.0.1:80`).
 	HttpAddr string
 
-	// HttpsAddr is the TCP address to listen for the HTTPS server (eg. "127.0.0.1:443").
+	// HttpsAddr is the TCP address to listen for the HTTPS server (eg. `127.0.0.1:443`).
 	HttpsAddr string
 
 	// Optional domains list to use when issuing the TLS certificate.
@@ -58,47 +58,37 @@ type ServeConfig struct {
 //		HttpAddr:        "127.0.0.1:8080",
 //		ShowStartBanner: false,
 //	})
-func Serve(app core.App, config ServeConfig) error {
+func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 	if len(config.AllowedOrigins) == 0 {
 		config.AllowedOrigins = []string{"*"}
 	}
 
 	// ensure that the latest migrations are applied before starting the server
-	err := app.RunAllMigrations()
-	if err != nil {
-		return err
+	if err := runMigrations(app); err != nil {
+		return nil, err
 	}
 
-	pbRouter, err := NewRouter(app)
-	if err != nil {
-		return err
+	// reload app settings in case a new default value was set with a migration
+	// (or if this is the first time the init migration was executed)
+	if err := app.RefreshSettings(); err != nil {
+		color.Yellow("=====================================")
+		color.Yellow("WARNING: Settings load error! \n%v", err)
+		color.Yellow("Fallback to the application defaults.")
+		color.Yellow("=====================================")
 	}
 
-	pbRouter.Bind(CORS(CORSConfig{
+	router, err := InitApi(app)
+	if err != nil {
+		return nil, err
+	}
+
+	// configure cors
+	router.Use(middleware.CORSWithConfig(middleware.CORSConfig{
+		Skipper:      middleware.DefaultSkipper,
 		AllowOrigins: config.AllowedOrigins,
 		AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
 	}))
 
-	// @todo consider moving in base
-	if ui.DistDirFS != nil {
-		pbRouter.GET("/_/{path...}", Static(ui.DistDirFS, false)).
-			BindFunc(func(e *core.RequestEvent) error {
-				if !e.App.IsDev() &&
-					// exclude root path
-					e.Request.PathValue(StaticWildcardParam) != "" &&
-					e.Response.Header().Get("Cache-Control") == "" {
-					e.Response.Header().Set("Cache-Control", "max-age=1209600, stale-while-revalidate=86400")
-				}
-
-				if e.Response.Header().Get("Content-Security-Policy") == "" {
-					e.Response.Header().Set("Content-Security-Policy", defaultCSP)
-				}
-
-				return e.Next()
-			}).
-			Bind(Gzip())
-	}
-
 	// start http server
 	// ---
 	mainAddr := config.HttpAddr
@@ -128,12 +118,25 @@ func Serve(app core.App, config ServeConfig) error {
 
 	// implicit www->non-www redirect(s)
 	if len(wwwRedirects) > 0 {
-		pbRouter.Bind(wwwRedirect(wwwRedirects))
+		router.Pre(func(next echo.HandlerFunc) echo.HandlerFunc {
+			return func(c echo.Context) error {
+				host := c.Request().Host
+
+				if strings.HasPrefix(host, "www.") && list.ExistInSlice(host, wwwRedirects) {
+					return c.Redirect(
+						http.StatusTemporaryRedirect,
+						(c.Scheme() + "://" + host[4:] + c.Request().RequestURI),
+					)
+				}
+
+				return next(c)
+			}
+		})
 	}
 
 	certManager := &autocert.Manager{
 		Prompt:     autocert.AcceptTOS,
-		Cache:      autocert.DirCache(filepath.Join(app.DataDir(), core.LocalAutocertCacheDirName)),
+		Cache:      autocert.DirCache(filepath.Join(app.DataDir(), ".autocert_cache")),
 		HostPolicy: autocert.HostWhitelist(hostNames...),
 	}
 
@@ -148,132 +151,39 @@ func Serve(app core.App, config ServeConfig) error {
 			GetCertificate: certManager.GetCertificate,
 			NextProtos:     []string{acme.ALPNProto},
 		},
-		// higher defaults to accommodate large file uploads/downloads
-		WriteTimeout:      5 * time.Minute,
-		ReadTimeout:       5 * time.Minute,
-		ReadHeaderTimeout: 1 * time.Minute,
-		Addr:              mainAddr,
+		ReadTimeout:       10 * time.Minute,
+		ReadHeaderTimeout: 30 * time.Second,
+		// WriteTimeout: 60 * time.Second, // breaks sse!
+		Handler: router,
+		Addr:    mainAddr,
 		BaseContext: func(l net.Listener) context.Context {
 			return baseCtx
 		},
 		ErrorLog: log.New(&serverErrorLogWriter{app: app}, "", 0),
 	}
 
-	var listener net.Listener
-
-	// graceful shutdown
-	// ---------------------------------------------------------------
-	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
-	// Note that the WaitGroup would do nothing if the app.OnTerminate() hook isn't triggered.
-	var wg sync.WaitGroup
-
-	// try to gracefully shutdown the server on app termination
-	app.OnTerminate().Bind(&hook.Handler[*core.TerminateEvent]{
-		Id: "pbGracefulShutdown",
-		Func: func(te *core.TerminateEvent) error {
-			cancelBaseCtx()
-
-			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
-			defer cancel()
-
-			wg.Add(1)
-
-			_ = server.Shutdown(ctx)
-
-			if te.IsRestart {
-				// wait for execve and other handlers up to 3 seconds before exit
-				time.AfterFunc(3*time.Second, func() {
-					wg.Done()
-				})
-			} else {
-				wg.Done()
-			}
-
-			return te.Next()
-		},
-		Priority: -9999,
-	})
-
-	// wait for the graceful shutdown to complete before exit
-	defer func() {
-		wg.Wait()
-
-		if listener != nil {
-			_ = listener.Close()
-		}
-	}()
-	// ---------------------------------------------------------------
-
-	var baseURL string
-
-	serveEvent := new(core.ServeEvent)
-	serveEvent.App = app
-	serveEvent.Router = pbRouter
-	serveEvent.Server = server
-	serveEvent.CertManager = certManager
-	serveEvent.InstallerFunc = DefaultInstallerFunc
-
-	// trigger the OnServe hook and start the tcp listener
-	serveHookErr := app.OnServe().Trigger(serveEvent, func(e *core.ServeEvent) error {
-		handler, err := e.Router.BuildMux()
-		if err != nil {
-			return err
-		}
-
-		e.Server.Handler = handler
-
-		if config.HttpsAddr == "" {
-			baseURL = "http://" + serverAddrToHost(serveEvent.Server.Addr)
-		} else {
-			baseURL = "https://"
-			if len(config.CertificateDomains) > 0 {
-				baseURL += config.CertificateDomains[0]
-			} else {
-				baseURL += serverAddrToHost(serveEvent.Server.Addr)
-			}
-		}
-
-		addr := e.Server.Addr
-		if addr == "" {
-			// fallback similar to the std Server.ListenAndServe/ListenAndServeTLS
-			if config.HttpsAddr != "" {
-				addr = ":https"
-			} else {
-				addr = ":http"
-			}
-		}
-
-		if e.Listener == nil {
-			listener, err = net.Listen("tcp", addr)
-			if err != nil {
-				return err
-			}
-		} else {
-			listener = e.Listener
-		}
-
-		if e.InstallerFunc != nil {
-			app := e.App
-			installerFunc := e.InstallerFunc
-			routine.FireAndForget(func() {
-				if err := loadInstaller(app, baseURL, installerFunc); err != nil {
-					app.Logger().Warn("Failed to initialize installer", "error", err)
-				}
-			})
-		}
-
-		return nil
-	})
-	if serveHookErr != nil {
-		return serveHookErr
+	serveEvent := &core.ServeEvent{
+		App:         app,
+		Router:      router,
+		Server:      server,
+		CertManager: certManager,
 	}
-
-	if listener == nil {
-		//nolint:staticcheck
-		return errors.New("The OnServe listener was not initialized. Did you forget to call the ServeEvent.Next() method?")
+	if err := app.OnBeforeServe().Trigger(serveEvent); err != nil {
+		return nil, err
 	}
 
 	if config.ShowStartBanner {
+		schema := "http"
+		addr := server.Addr
+
+		if config.HttpsAddr != "" {
+			schema = "https"
+
+			if len(config.CertificateDomains) > 0 {
+				addr = config.CertificateDomains[0]
+			}
+		}
+
 		date := new(strings.Builder)
 		log.New(date, "", log.LstdFlags).Print()
 
@@ -281,46 +191,92 @@ func Serve(app core.App, config ServeConfig) error {
 		bold.Printf(
 			"%s Server started at %s\n",
 			strings.TrimSpace(date.String()),
-			color.CyanString("%s", baseURL),
+			color.CyanString("%s://%s", schema, addr),
 		)
 
 		regular := color.New()
-		if ui.DistDirFS == nil {
-			regular.Printf("└─ REST API:  %s\n", color.CyanString("%s/api/", baseURL))
-		} else {
-			regular.Printf("├─ REST API:  %s\n", color.CyanString("%s/api/", baseURL))
-			regular.Printf("└─ Dashboard: %s\n", color.CyanString("%s/_/", baseURL))
-		}
+		regular.Printf("├─ REST API: %s\n", color.CyanString("%s://%s/api/", schema, addr))
+		regular.Printf("└─ Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, addr))
 	}
 
-	var serveErr error
+	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
+	// Note that the WaitGroup would not do anything if the app.OnTerminate() hook isn't triggered.
+	var wg sync.WaitGroup
+
+	// try to gracefully shutdown the server on app termination
+	app.OnTerminate().Add(func(e *core.TerminateEvent) error {
+		cancelBaseCtx()
+
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+
+		wg.Add(1)
+		server.Shutdown(ctx)
+		if e.IsRestart {
+			// wait for execve and other handlers up to 5 seconds before exit
+			time.AfterFunc(5*time.Second, func() {
+				wg.Done()
+			})
+		} else {
+			wg.Done()
+		}
+
+		return nil
+	})
+
+	// wait for the graceful shutdown to complete before exit
+	defer wg.Wait()
+
+	// ---
+	// @todo consider removing the server return value because it is
+	// not really useful when combined with the blocking serve calls
+	// ---
+
+	// start HTTPS server
 	if config.HttpsAddr != "" {
+		// if httpAddr is set, start an HTTP server to redirect the traffic to the HTTPS version
 		if config.HttpAddr != "" {
-			// start an additional HTTP server for redirecting the traffic to the HTTPS version
 			go http.ListenAndServe(config.HttpAddr, certManager.HTTPHandler(nil))
 		}
 
-		// start HTTPS server
-		serveErr = serveEvent.Server.ServeTLS(listener, "", "")
-	} else {
-		// OR start HTTP server
-		serveErr = serveEvent.Server.Serve(listener)
+		return server, server.ListenAndServeTLS("", "")
 	}
-	if serveErr != nil && !errors.Is(serveErr, http.ErrServerClosed) {
-		return serveErr
+
+	// OR start HTTP server
+	return server, server.ListenAndServe()
+}
+
+type migrationsConnection struct {
+	DB             *dbx.DB
+	MigrationsList migrate.MigrationsList
+}
+
+func runMigrations(app core.App) error {
+	connections := []migrationsConnection{
+		{
+			DB:             app.DB(),
+			MigrationsList: migrations.AppMigrations,
+		},
+		{
+			DB:             app.LogsDB(),
+			MigrationsList: logs.LogsMigrations,
+		},
+	}
+
+	for _, c := range connections {
+		runner, err := migrate.NewRunner(c.DB, c.MigrationsList)
+		if err != nil {
+			return err
+		}
+
+		if _, err := runner.Up(); err != nil {
+			return err
+		}
 	}
 
 	return nil
 }
 
-// serverAddrToHost loosely converts http.Server.Addr string into a host to print.
-func serverAddrToHost(addr string) string {
-	if addr == "" || strings.HasSuffix(addr, ":http") || strings.HasSuffix(addr, ":https") {
-		return "127.0.0.1"
-	}
-	return addr
-}
-
 type serverErrorLogWriter struct {
 	app core.App
 }

apis/settings.go

@@ -3,128 +3,137 @@ package apis
 import (
 	"net/http"
 
-	validation "github.com/pocketbase/ozzo-validation/v4"
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
-	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/models/settings"
 )
 
 // bindSettingsApi registers the settings api endpoints.
-func bindSettingsApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	subGroup := rg.Group("/settings").Bind(RequireSuperuserAuth())
-	subGroup.GET("", settingsList)
-	subGroup.PATCH("", settingsSet)
-	subGroup.POST("/test/s3", settingsTestS3)
-	subGroup.POST("/test/email", settingsTestEmail)
+func bindSettingsApi(app core.App, rg *echo.Group) {
+	api := settingsApi{app: app}
 
-	// @todo move to collections
-	subGroup.POST("/apple/generate-client-secret", settingsGenerateAppleClientSecret)
+	subGroup := rg.Group("/settings", ActivityLogger(app), RequireAdminAuth())
+	subGroup.GET("", api.list)
+	subGroup.PATCH("", api.set)
+	subGroup.POST("/test/s3", api.testS3)
+	subGroup.POST("/test/email", api.testEmail)
+	subGroup.POST("/apple/generate-client-secret", api.generateAppleClientSecret)
 }
 
-func settingsList(e *core.RequestEvent) error {
-	clone, err := e.App.Settings().Clone()
+type settingsApi struct {
+	app core.App
+}
+
+func (api *settingsApi) list(c echo.Context) error {
+	settings, err := api.app.Settings().RedactClone()
 	if err != nil {
-		return e.InternalServerError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	event := new(core.SettingsListRequestEvent)
-	event.RequestEvent = e
-	event.Settings = clone
+	event := new(core.SettingsListEvent)
+	event.HttpContext = c
+	event.RedactedSettings = settings
 
-	return e.App.OnSettingsListRequest().Trigger(event, func(e *core.SettingsListRequestEvent) error {
-		return execAfterSuccessTx(true, e.App, func() error {
-			return e.JSON(http.StatusOK, e.Settings)
-		})
-	})
-}
-
-func settingsSet(e *core.RequestEvent) error {
-	event := new(core.SettingsUpdateRequestEvent)
-	event.RequestEvent = e
-
-	if clone, err := e.App.Settings().Clone(); err == nil {
-		event.OldSettings = clone
-	} else {
-		return e.BadRequestError("", err)
-	}
-
-	if clone, err := e.App.Settings().Clone(); err == nil {
-		event.NewSettings = clone
-	} else {
-		return e.BadRequestError("", err)
-	}
-
-	if err := e.BindBody(&event.NewSettings); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
-	}
-
-	return e.App.OnSettingsUpdateRequest().Trigger(event, func(e *core.SettingsUpdateRequestEvent) error {
-		err := e.App.Save(e.NewSettings)
-		if err != nil {
-			return e.BadRequestError("An error occurred while saving the new settings.", err)
+	return api.app.OnSettingsListRequest().Trigger(event, func(e *core.SettingsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
 		}
 
-		return execAfterSuccessTx(true, e.App, func() error {
-			appSettings, err := e.App.Settings().Clone()
-			if err != nil {
-				return e.InternalServerError("Failed to clone app settings.", err)
-			}
-
-			return e.JSON(http.StatusOK, appSettings)
-		})
+		return e.HttpContext.JSON(http.StatusOK, e.RedactedSettings)
 	})
 }
 
-func settingsTestS3(e *core.RequestEvent) error {
-	form := forms.NewTestS3Filesystem(e.App)
+func (api *settingsApi) set(c echo.Context) error {
+	form := forms.NewSettingsUpsert(api.app)
 
 	// load request
-	if err := e.BindBody(form); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	event := new(core.SettingsUpdateEvent)
+	event.HttpContext = c
+	event.OldSettings = api.app.Settings()
+
+	// update the settings
+	return form.Submit(func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+		return func(s *settings.Settings) error {
+			event.NewSettings = s
+
+			return api.app.OnSettingsBeforeUpdateRequest().Trigger(event, func(e *core.SettingsUpdateEvent) error {
+				if err := next(e.NewSettings); err != nil {
+					return NewBadRequestError("An error occurred while submitting the form.", err)
+				}
+
+				return api.app.OnSettingsAfterUpdateRequest().Trigger(event, func(e *core.SettingsUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					redactedSettings, err := api.app.Settings().RedactClone()
+					if err != nil {
+						return NewBadRequestError("", err)
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, redactedSettings)
+				})
+			})
+		}
+	})
+}
+
+func (api *settingsApi) testS3(c echo.Context) error {
+	form := forms.NewTestS3Filesystem(api.app)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	// send
 	if err := form.Submit(); err != nil {
 		// form error
 		if fErr, ok := err.(validation.Errors); ok {
-			return e.BadRequestError("Failed to test the S3 filesystem.", fErr)
+			return NewBadRequestError("Failed to test the S3 filesystem.", fErr)
 		}
 
 		// mailer error
-		return e.BadRequestError("Failed to test the S3 filesystem. Raw error: \n"+err.Error(), nil)
+		return NewBadRequestError("Failed to test the S3 filesystem. Raw error: \n"+err.Error(), nil)
 	}
 
-	return e.NoContent(http.StatusNoContent)
+	return c.NoContent(http.StatusNoContent)
 }
 
-func settingsTestEmail(e *core.RequestEvent) error {
-	form := forms.NewTestEmailSend(e.App)
+func (api *settingsApi) testEmail(c echo.Context) error {
+	form := forms.NewTestEmailSend(api.app)
 
 	// load request
-	if err := e.BindBody(form); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	// send
 	if err := form.Submit(); err != nil {
 		// form error
 		if fErr, ok := err.(validation.Errors); ok {
-			return e.BadRequestError("Failed to send the test email.", fErr)
+			return NewBadRequestError("Failed to send the test email.", fErr)
 		}
 
 		// mailer error
-		return e.BadRequestError("Failed to send the test email. Raw error: \n"+err.Error(), nil)
+		return NewBadRequestError("Failed to send the test email. Raw error: \n"+err.Error(), nil)
 	}
 
-	return e.NoContent(http.StatusNoContent)
+	return c.NoContent(http.StatusNoContent)
 }
 
-func settingsGenerateAppleClientSecret(e *core.RequestEvent) error {
-	form := forms.NewAppleClientSecretCreate(e.App)
+func (api *settingsApi) generateAppleClientSecret(c echo.Context) error {
+	form := forms.NewAppleClientSecretCreate(api.app)
 
 	// load request
-	if err := e.BindBody(form); err != nil {
-		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	// generate
@@ -132,14 +141,14 @@ func settingsGenerateAppleClientSecret(e *core.RequestEvent) error {
 	if err != nil {
 		// form error
 		if fErr, ok := err.(validation.Errors); ok {
-			return e.BadRequestError("Invalid client secret data.", fErr)
+			return NewBadRequestError("Invalid client secret data.", fErr)
 		}
 
 		// secret generation error
-		return e.BadRequestError("Failed to generate client secret. Raw error: \n"+err.Error(), nil)
+		return NewBadRequestError("Failed to generate client secret. Raw error: \n"+err.Error(), nil)
 	}
 
-	return e.JSON(http.StatusOK, map[string]string{
+	return c.JSON(http.StatusOK, map[string]any{
 		"secret": secret,
 	})
 }

apis/settings_test.go

@@ -6,11 +6,13 @@ import (
 	"crypto/rand"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
 	"testing"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 )
@@ -22,28 +24,26 @@ func TestSettingsList(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			URL:             "/api/settings",
+			Url:             "/api/settings",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			URL:    "/api/settings",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/settings",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser",
+			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			URL:    "/api/settings",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/settings",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -52,39 +52,47 @@ func TestSettingsList(t *testing.T) {
 				`"smtp":{`,
 				`"s3":{`,
 				`"backups":{`,
-				`"batch":{`,
+				`"adminAuthToken":{`,
+				`"adminPasswordResetToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
+				`"emailAuth":{`,
+				`"googleAuth":{`,
+				`"facebookAuth":{`,
+				`"githubAuth":{`,
+				`"gitlabAuth":{`,
+				`"twitterAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
+				`"secret":"******"`,
+				`"clientSecret":"******"`,
 			},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
 				"OnSettingsListRequest": 1,
 			},
 		},
-		{
-			Name:   "OnSettingsListRequest tx body write check",
-			Method: http.MethodGet,
-			URL:    "/api/settings",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnSettingsListRequest().BindFunc(func(e *core.SettingsListRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
-				})
-			},
-			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnSettingsListRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
-		},
 	}
 
 	for _, scenario := range scenarios {
@@ -95,42 +103,35 @@ func TestSettingsList(t *testing.T) {
 func TestSettingsSet(t *testing.T) {
 	t.Parallel()
 
-	validData := `{
-		"meta":{"appName":"update_test"},
-		"smtp":{"password": "new_smtp_password"},
-		"s3":{"secret": "new_s3_secret"},
-		"backups":{"s3":{"secret":"new_backups_s3_secret"}}
-	}`
+	validData := `{"meta":{"appName":"update_test"}}`
 
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPatch,
-			URL:             "/api/settings",
+			Url:             "/api/settings",
 			Body:            strings.NewReader(validData),
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPatch,
-			URL:    "/api/settings",
+			Url:    "/api/settings",
 			Body:   strings.NewReader(validData),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser submitting empty data",
+			Name:   "authorized as admin submitting empty data",
 			Method: http.MethodPatch,
-			URL:    "/api/settings",
+			Url:    "/api/settings",
 			Body:   strings.NewReader(``),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -139,65 +140,71 @@ func TestSettingsSet(t *testing.T) {
 				`"smtp":{`,
 				`"s3":{`,
 				`"backups":{`,
-				`"batch":{`,
+				`"adminAuthToken":{`,
+				`"adminPasswordResetToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
+				`"emailAuth":{`,
+				`"googleAuth":{`,
+				`"facebookAuth":{`,
+				`"githubAuth":{`,
+				`"gitlabAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
+				`"secret":"******"`,
+				`"clientSecret":"******"`,
+				`"appName":"acme_test"`,
 			},
 			ExpectedEvents: map[string]int{
-				"*":                         0,
-				"OnSettingsUpdateRequest":   1,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           1,
-				"OnSettingsReload":          1,
+				"OnModelBeforeUpdate":           1,
+				"OnModelAfterUpdate":            1,
+				"OnSettingsBeforeUpdateRequest": 1,
+				"OnSettingsAfterUpdateRequest":  1,
 			},
 		},
 		{
-			Name:   "authorized as superuser submitting invalid data",
+			Name:   "authorized as admin submitting invalid data",
 			Method: http.MethodPatch,
-			URL:    "/api/settings",
+			Url:    "/api/settings",
 			Body:   strings.NewReader(`{"meta":{"appName":""}}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{`,
 				`"meta":{"appName":{"code":"validation_required"`,
 			},
-			ExpectedEvents: map[string]int{
-				"*":                       0,
-				"OnModelUpdate":           1,
-				"OnModelAfterUpdateError": 1,
-				"OnModelValidate":         1,
-				"OnSettingsUpdateRequest": 1,
-			},
 		},
 		{
-			Name:   "authorized as superuser submitting valid data",
+			Name:   "authorized as admin submitting valid data",
 			Method: http.MethodPatch,
-			URL:    "/api/settings",
+			Url:    "/api/settings",
 			Body:   strings.NewReader(validData),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				settings := app.Settings()
-
-				// verify that the secret values are persisted
-				secrets := map[string]struct {
-					current  string
-					expected string
-				}{
-					"smtp.password":     {settings.SMTP.Password, "new_smtp_password"},
-					"s3.secret":         {settings.S3.Secret, "new_s3_secret"},
-					"backups.s3.secret": {settings.Backups.S3.Secret, "new_backups_s3_secret"},
-				}
-
-				for name, secret := range secrets {
-					if secret.current != secret.expected {
-						t.Errorf("[%s] expected secret %q, got %q", name, secret.expected, secret.current)
-					}
-				}
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -206,49 +213,72 @@ func TestSettingsSet(t *testing.T) {
 				`"smtp":{`,
 				`"s3":{`,
 				`"backups":{`,
-				`"batch":{`,
+				`"adminAuthToken":{`,
+				`"adminPasswordResetToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
+				`"emailAuth":{`,
+				`"googleAuth":{`,
+				`"facebookAuth":{`,
+				`"githubAuth":{`,
+				`"gitlabAuth":{`,
+				`"twitterAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
+				`"secret":"******"`,
+				`"clientSecret":"******"`,
 				`"appName":"update_test"`,
 			},
-			NotExpectedContent: []string{
-				"secret",
-				"password",
-			},
 			ExpectedEvents: map[string]int{
-				"*":                         0,
-				"OnSettingsUpdateRequest":   1,
-				"OnModelUpdate":             1,
-				"OnModelUpdateExecute":      1,
-				"OnModelAfterUpdateSuccess": 1,
-				"OnModelValidate":           1,
-				"OnSettingsReload":          1,
+				"OnModelBeforeUpdate":           1,
+				"OnModelAfterUpdate":            1,
+				"OnSettingsBeforeUpdateRequest": 1,
+				"OnSettingsAfterUpdateRequest":  1,
 			},
 		},
 		{
-			Name:   "OnSettingsUpdateRequest tx body write check",
+			Name:   "OnSettingsAfterUpdateRequest error response",
 			Method: http.MethodPatch,
-			URL:    "/api/settings",
+			Url:    "/api/settings",
 			Body:   strings.NewReader(validData),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
-				app.OnSettingsUpdateRequest().BindFunc(func(e *core.SettingsUpdateRequestEvent) error {
-					original := e.App
-					return e.App.RunInTransaction(func(txApp core.App) error {
-						e.App = txApp
-						defer func() { e.App = original }()
-
-						if err := e.Next(); err != nil {
-							return err
-						}
-
-						return e.BadRequestError("TX_ERROR", nil)
-					})
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnSettingsAfterUpdateRequest().Add(func(e *core.SettingsUpdateEvent) error {
+					return errors.New("error")
 				})
 			},
 			ExpectedStatus:  400,
-			ExpectedEvents:  map[string]int{"OnSettingsUpdateRequest": 1},
-			ExpectedContent: []string{"TX_ERROR"},
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":           1,
+				"OnModelAfterUpdate":            1,
+				"OnSettingsBeforeUpdateRequest": 1,
+				"OnSettingsAfterUpdateRequest":  1,
+			},
 		},
 	}
 
@@ -264,64 +294,59 @@ func TestSettingsTestS3(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPost,
-			URL:             "/api/settings/test/s3",
+			Url:             "/api/settings/test/s3",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/s3",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (missing body + no s3)",
+			Name:   "authorized as admin (missing body + no s3)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/s3",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{`,
 				`"filesystem":{`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (invalid filesystem)",
+			Name:   "authorized as admin (invalid filesystem)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/s3",
+			Url:    "/api/settings/test/s3",
 			Body:   strings.NewReader(`{"filesystem":"invalid"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{`,
 				`"filesystem":{`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (valid filesystem and no s3)",
+			Name:   "authorized as admin (valid filesystem and no s3)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/s3",
+			Url:    "/api/settings/test/s3",
 			Body:   strings.NewReader(`{"filesystem":"storage"}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 
@@ -337,199 +362,156 @@ func TestSettingsTestEmail(t *testing.T) {
 		{
 			Name:   "unauthorized",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body: strings.NewReader(`{
 				"template": "verification",
 				"email": "test@example.com"
 			}`),
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body: strings.NewReader(`{
 				"template": "verification",
 				"email": "test@example.com"
 			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (invalid body)",
+			Name:   "authorized as admin (invalid body)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body:   strings.NewReader(`{`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (empty json)",
+			Name:   "authorized as admin (empty json)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body:   strings.NewReader(`{}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"email":{"code":"validation_required"`,
 				`"template":{"code":"validation_required"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (verifiation template)",
+			Name:   "authorized as admin (verifiation template)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body: strings.NewReader(`{
 				"template": "verification",
 				"email": "test@example.com"
 			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 1 {
-					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if len(app.TestMailer.LastMessage().To) != 1 {
-					t.Fatalf("[verification] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[verification] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
 				}
 
-				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
-					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Verify") {
-					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Verify") {
+					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,
 			ExpectedContent: []string{},
 			ExpectedEvents: map[string]int{
-				"*":                              0,
-				"OnMailerSend":                   1,
-				"OnMailerRecordVerificationSend": 1,
+				"OnMailerBeforeRecordVerificationSend": 1,
+				"OnMailerAfterRecordVerificationSend":  1,
 			},
 		},
 		{
-			Name:   "authorized as superuser (password reset template)",
+			Name:   "authorized as admin (password reset template)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body: strings.NewReader(`{
 				"template": "password-reset",
 				"email": "test@example.com"
 			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 1 {
-					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if len(app.TestMailer.LastMessage().To) != 1 {
-					t.Fatalf("[password-reset] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[password-reset] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
 				}
 
-				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
-					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Reset password") {
-					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Reset password") {
+					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,
 			ExpectedContent: []string{},
 			ExpectedEvents: map[string]int{
-				"*":                               0,
-				"OnMailerSend":                    1,
-				"OnMailerRecordPasswordResetSend": 1,
+				"OnMailerBeforeRecordResetPasswordSend": 1,
+				"OnMailerAfterRecordResetPasswordSend":  1,
 			},
 		},
 		{
-			Name:   "authorized as superuser (email change)",
+			Name:   "authorized as admin (email change)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
+			Url:    "/api/settings/test/email",
 			Body: strings.NewReader(`{
 				"template": "email-change",
 				"email": "test@example.com"
 			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 1 {
-					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if len(app.TestMailer.LastMessage().To) != 1 {
-					t.Fatalf("[email-change] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[email-change] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
 				}
 
-				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
-					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Confirm new email") {
-					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Confirm new email") {
+					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,
 			ExpectedContent: []string{},
 			ExpectedEvents: map[string]int{
-				"*":                             0,
-				"OnMailerSend":                  1,
-				"OnMailerRecordEmailChangeSend": 1,
-			},
-		},
-		{
-			Name:   "authorized as superuser (otp)",
-			Method: http.MethodPost,
-			URL:    "/api/settings/test/email",
-			Body: strings.NewReader(`{
-				"template": "otp",
-				"email": "test@example.com"
-			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.TestMailer.TotalSend() != 1 {
-					t.Fatalf("[otp] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
-				}
-
-				if len(app.TestMailer.LastMessage().To) != 1 {
-					t.Fatalf("[otp] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
-				}
-
-				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
-					t.Fatalf("[otp] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
-				}
-
-				if !strings.Contains(app.TestMailer.LastMessage().HTML, "one-time password") {
-					t.Fatalf("[otp] Expected to sent OTP email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
-				}
-			},
-			ExpectedStatus:  204,
-			ExpectedContent: []string{},
-			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnMailerSend":          1,
-				"OnMailerRecordOTPSend": 1,
+				"OnMailerBeforeRecordChangeEmailSend": 1,
+				"OnMailerAfterRecordChangeEmailSend":  1,
 			},
 		},
 	}
@@ -563,41 +545,38 @@ func TestGenerateAppleClientSecret(t *testing.T) {
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPost,
-			URL:             "/api/settings/apple/generate-client-secret",
+			Url:             "/api/settings/apple/generate-client-secret",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as regular user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPost,
-			URL:    "/api/settings/apple/generate-client-secret",
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			Url:    "/api/settings/apple/generate-client-secret",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			ExpectedStatus:  403,
+			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (invalid body)",
+			Name:   "authorized as admin (invalid body)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/apple/generate-client-secret",
+			Url:    "/api/settings/apple/generate-client-secret",
 			Body:   strings.NewReader(`{`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (empty json)",
+			Name:   "authorized as admin (empty json)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/apple/generate-client-secret",
+			Url:    "/api/settings/apple/generate-client-secret",
 			Body:   strings.NewReader(`{}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
@@ -607,12 +586,11 @@ func TestGenerateAppleClientSecret(t *testing.T) {
 				`"privateKey":{"code":"validation_required"`,
 				`"duration":{"code":"validation_required"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (invalid data)",
+			Name:   "authorized as admin (invalid data)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/apple/generate-client-secret",
+			Url:    "/api/settings/apple/generate-client-secret",
 			Body: strings.NewReader(`{
 				"clientId": "",
 				"teamId": "123456789",
@@ -620,8 +598,8 @@ func TestGenerateAppleClientSecret(t *testing.T) {
 				"privateKey": "invalid",
 				"duration": -1
 			}`),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
@@ -631,12 +609,11 @@ func TestGenerateAppleClientSecret(t *testing.T) {
 				`"privateKey":{"code":"validation_match_invalid"`,
 				`"duration":{"code":"validation_min_greater_equal_than_required"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 		{
-			Name:   "authorized as superuser (valid data)",
+			Name:   "authorized as admin (valid data)",
 			Method: http.MethodPost,
-			URL:    "/api/settings/apple/generate-client-secret",
+			Url:    "/api/settings/apple/generate-client-secret",
 			Body: strings.NewReader(fmt.Sprintf(`{
 				"clientId": "123",
 				"teamId": "1234567890",
@@ -644,14 +621,13 @@ func TestGenerateAppleClientSecret(t *testing.T) {
 				"privateKey": %q,
 				"duration": 1
 			}`, privatePem)),
-			Headers: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"secret":"`,
 			},
-			ExpectedEvents: map[string]int{"*": 0},
 		},
 	}
 

apis/sql.go

@@ -1,194 +0,0 @@
-package apis
-
-import (
-	"context"
-	"errors"
-	"log/slog"
-	"net/http"
-	"strings"
-	"time"
-
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/router"
-)
-
-const (
-	runSQLMaxRows    = 1000
-	runSQLMaxTimeout = 3 * time.Minute
-)
-
-// bindSQLApi registers the SQL api endpoints.
-func bindSQLApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
-	subGroup := rg.Group("/sql").Bind(RequireSuperuserAuth())
-	subGroup.POST("", runSQL)
-}
-
-func runSQL(e *core.RequestEvent) error {
-	// extra precaution in case manually invoked from somewhere else
-	if !e.HasSuperuserAuth() {
-		return e.ForbiddenError("", nil)
-	}
-
-	form := runSQLForm{}
-
-	err := e.BindBody(&form)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
-	}
-
-	err = form.validate()
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
-	}
-
-	result, err := executeQuery(e.App, form.Query, runSQLMaxRows)
-	if err != nil {
-		return firstApiError(err, e.BadRequestError("Failed to execute query. Raw error:\n"+err.Error(), nil))
-	}
-
-	return e.JSON(http.StatusOK, result)
-}
-
-type runSQLForm struct {
-	Query string `form:"query" json:"query"`
-}
-
-func (form *runSQLForm) validate() error {
-	return validation.ValidateStruct(form,
-		validation.Field(&form.Query, validation.Required, validation.Length(0, 5000)),
-	)
-}
-
-type runSQLResultColumn struct {
-	Name     string `json:"name"`
-	Type     string `json:"type"`
-	Nullable bool   `json:"nullable"`
-}
-
-type runSQLResult struct {
-	ExecTime     int64                `json:"execTime"`
-	AffectedRows int64                `json:"affectedRows"`
-	Columns      []runSQLResultColumn `json:"columns"`
-	Rows         [][]any              `json:"rows"`
-}
-
-var knownWriteQueryPrefixes = []string{
-	"INSERT", "CREATE", "UPDATE", "DELETE",
-	"DROP", "DETACH", "ALTER", "REPLACE",
-}
-
-func executeQuery(app core.App, query string, maxRows int) (*runSQLResult, error) {
-	query = strings.TrimSpace(query)
-	if query == "" {
-		// see https://github.com/mattn/go-sqlite3/issues/950
-		return nil, errors.New("empty query")
-	}
-
-	var isPossibleWriteQuery bool
-
-	// loosely check the query type
-	ucQuery := strings.ToUpper(query)
-	if !strings.HasPrefix(ucQuery, "SELECT") {
-		for _, prefix := range knownWriteQueryPrefixes {
-			if strings.HasPrefix(ucQuery, prefix) {
-				isPossibleWriteQuery = true
-				break
-			}
-		}
-	}
-
-	// note: don't extend the request context to minimize the risk of
-	// causing integrity issues with custom non-transaction mutations
-	ctx, cancelFunc := context.WithTimeout(context.Background(), runSQLMaxTimeout)
-	defer cancelFunc()
-
-	result := &runSQLResult{
-		// init empty slices to ensure "[]" serialization
-		Columns: []runSQLResultColumn{},
-		Rows:    [][]any{},
-	}
-
-	now := time.Now()
-	defer func() {
-		result.ExecTime = time.Since(now).Milliseconds()
-	}()
-
-	// assume write/mutation query
-	// ---------------------------------------------------------------
-	if isPossibleWriteQuery {
-		// auto wrap in transaction in case there are multiple inline queries
-		txErr := app.RunInTransaction(func(txApp core.App) error {
-			execResult, err := txApp.NonconcurrentDB().NewQuery(query).WithContext(ctx).Execute()
-			if err != nil {
-				return err
-			}
-
-			result.AffectedRows, err = execResult.RowsAffected()
-			if err != nil {
-				// non-critical error (e.g. not supported by the driver)
-				txApp.Logger().Debug("Unable to fetch affected rows", slog.String("error", err.Error()))
-			}
-
-			return nil
-		})
-		if txErr != nil {
-			return nil, txErr
-		}
-
-		return result, nil
-	}
-
-	// assume query returning rows
-	// ---------------------------------------------------------------
-	rows, err := app.ConcurrentDB().NewQuery(query).WithContext(ctx).Rows()
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	// populate columns info
-	// ---
-	colTypes, err := rows.ColumnTypes()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, colType := range colTypes {
-		col := runSQLResultColumn{
-			Name: colType.Name(),
-			Type: colType.DatabaseTypeName(),
-		}
-		col.Nullable, _ = colType.Nullable()
-
-		result.Columns = append(result.Columns, col)
-	}
-
-	// populate rows
-	// ---
-	for rows.Next() {
-		if len(result.Rows) >= maxRows {
-			break
-		}
-
-		rowData := make([]any, len(colTypes))
-		for i := 0; i < len(colTypes); i++ {
-			var v *string
-			rowData[i] = &v
-		}
-
-		err := rows.Scan(rowData...)
-		if err != nil {
-			return nil, err
-		}
-
-		result.Rows = append(result.Rows, rowData)
-	}
-
-	err = rows.Err()
-	if err != nil {
-		return nil, err
-	}
-
-	return result, nil
-}

apis/sql_test.go

@@ -1,220 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestSQLRun(t *testing.T) {
-	t.Parallel()
-
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "guest",
-			Method:          http.MethodPost,
-			URL:             "/api/sql",
-			Body:            strings.NewReader(`{"query":"select 1"}`),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "regular user",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"select 1"}`),
-			Headers: map[string]string{
-				// users, test2@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
-		},
-		{
-			Name:   "superuser",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"select 1"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"execTime":`,
-				`"affectedRows":0`,
-				`"columns":[{"name":"1","type":"","nullable":true}]`,
-				`"rows":[["1"]]`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "empty query",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":""}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"query":{`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "invalid query",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"invalid"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{}`,
-				`Raw error:`,
-				`SQL logic error`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "query with length above the limit",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"` + strings.Repeat("a", 5001) + `"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"query":{`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "query with length equal to the limit",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"select '` + strings.Repeat("a", 4985) + `' as id"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"execTime":`,
-				`"affectedRows":0`,
-				`"columns":[{"name":"id","type":"","nullable":true}]`,
-				`"rows":[["aaa`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "single write query",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"create table test_sql_table(id int primary key)"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if !app.HasTable("test_sql_table") {
-					t.Fatalf("Missing expected new %q table", "test_sql_table")
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"execTime":`,
-				`"affectedRows":0`,
-				`"columns":[]`,
-				`"rows":[]`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "multiple write queries",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"create table test_sql_table(id int primary key);insert into test_sql_table(id)VALUES(1)"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				var total int
-				err := app.DB().NewQuery("select count(*) from test_sql_table").Row(&total)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if total != 1 {
-					t.Fatalf("Expected exactly 1 row, found: %d", total)
-				}
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"execTime":`,
-				`"affectedRows":1`,
-				`"columns":[]`,
-				`"rows":[]`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "multiple write queries (transaction rollback)",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"create table test_sql_table(id int primary key);insert into test_sql_table(id)VALUES(1);invalid"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
-				if app.HasTable("test_sql_table") {
-					t.Fatalf("Expected table %q to not be created", "test_sql_table")
-				}
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{}`,
-				`Raw error:`,
-				`SQL logic error`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-		{
-			Name:   "multiple read queries",
-			Method: http.MethodPost,
-			URL:    "/api/sql",
-			Body:   strings.NewReader(`{"query":"select 1;select 2"}`),
-			Headers: map[string]string{
-				// superusers, test@example.com
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"execTime":`,
-				`"affectedRows":0`,
-				// only the result of the last query should be returned
-				`"columns":[{"name":"2","type":"","nullable":true}]`,
-				`"rows":[["2"]]`,
-			},
-			ExpectedEvents: map[string]int{"*": 0},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

cmd/admin.go

@@ -0,0 +1,141 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/fatih/color"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/spf13/cobra"
+)
+
+// NewAdminCommand creates and returns new command for managing
+// admin accounts (create, update, delete).
+func NewAdminCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:   "admin",
+		Short: "Manages admin accounts",
+	}
+
+	command.AddCommand(adminCreateCommand(app))
+	command.AddCommand(adminUpdateCommand(app))
+	command.AddCommand(adminDeleteCommand(app))
+
+	return command
+}
+
+func adminCreateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "create",
+		Example:      "admin create test@example.com 1234567890",
+		Short:        "Creates a new admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("Missing email and password arguments.")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Missing or invalid email address.")
+			}
+
+			if len(args[1]) < 8 {
+				return errors.New("The password must be at least 8 chars long.")
+			}
+
+			admin := &models.Admin{}
+			admin.Email = args[0]
+			admin.SetPassword(args[1])
+
+			if !app.Dao().HasTable(admin.TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			if err := app.Dao().SaveAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to create new admin account: %v", err)
+			}
+
+			color.Green("Successfully created new admin %s!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}
+
+func adminUpdateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "update",
+		Example:      "admin update test@example.com 1234567890",
+		Short:        "Changes the password of a single admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("Missing email and password arguments.")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Missing or invalid email address.")
+			}
+
+			if len(args[1]) < 8 {
+				return errors.New("The new password must be at least 8 chars long.")
+			}
+
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			admin, err := app.Dao().FindAdminByEmail(args[0])
+			if err != nil {
+				return fmt.Errorf("Admin with email %s doesn't exist.", args[0])
+			}
+
+			admin.SetPassword(args[1])
+
+			if err := app.Dao().SaveAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to change admin %s password: %v", admin.Email, err)
+			}
+
+			color.Green("Successfully changed admin %s password!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}
+
+func adminDeleteCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "delete",
+		Example:      "admin delete test@example.com",
+		Short:        "Deletes an existing admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Invalid or missing email address.")
+			}
+
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			admin, err := app.Dao().FindAdminByEmail(args[0])
+			if err != nil {
+				color.Yellow("Admin %s is already deleted.", args[0])
+				return nil
+			}
+
+			if err := app.Dao().DeleteAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to delete admin %s: %v", admin.Email, err)
+			}
+
+			color.Green("Successfully deleted admin %s!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}

cmd/admin_test.go

@@ -0,0 +1,221 @@
+package cmd_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/cmd"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestAdminCreateCommand(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"duplicated email",
+			"test@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test_new@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"create", s.email, s.password})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin account was actually created
+		admin, err := app.Dao().FindAdminByEmail(s.email)
+		if err != nil {
+			t.Errorf("[%s] Failed to fetch created admin %s: %v", s.name, s.email, err)
+		} else if !admin.ValidatePassword(s.password) {
+			t.Errorf("[%s] Expected the admin password to match", s.name)
+		}
+	}
+}
+
+func TestAdminUpdateCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"nonexisting admin",
+			"test_missing@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"update", s.email, s.password})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin password was actually changed
+		admin, err := app.Dao().FindAdminByEmail(s.email)
+		if err != nil {
+			t.Errorf("[%s] Failed to fetch admin %s: %v", s.name, s.email, err)
+		} else if !admin.ValidatePassword(s.password) {
+			t.Errorf("[%s] Expected the admin password to match", s.name)
+		}
+	}
+}
+
+func TestAdminDeleteCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		expectError bool
+	}{
+		{
+			"empty email",
+			"",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			true,
+		},
+		{
+			"nonexisting admin",
+			"test_missing@example.com",
+			false,
+		},
+		{
+			"existing admin",
+			"test@example.com",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"delete", s.email})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin account was actually deleted
+		if _, err := app.Dao().FindAdminByEmail(s.email); err == nil {
+			t.Errorf("[%s] Expected the admin account to be deleted", s.name)
+		}
+	}
+}

cmd/serve.go

@@ -36,7 +36,7 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 				}
 			}
 
-			err := apis.Serve(app, apis.ServeConfig{
+			_, err := apis.Serve(app, apis.ServeConfig{
 				HttpAddr:           httpAddr,
 				HttpsAddr:          httpsAddr,
 				ShowStartBanner:    showStartBanner,

cmd/superuser.go

@@ -1,247 +0,0 @@
-package cmd
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/fatih/color"
-	"github.com/pocketbase/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/spf13/cobra"
-)
-
-// NewSuperuserCommand creates and returns new command for managing
-// superuser accounts (create, update, upsert, delete).
-func NewSuperuserCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:   "superuser",
-		Short: "Manage superusers",
-	}
-
-	command.AddCommand(superuserUpsertCommand(app))
-	command.AddCommand(superuserCreateCommand(app))
-	command.AddCommand(superuserUpdateCommand(app))
-	command.AddCommand(superuserDeleteCommand(app))
-	command.AddCommand(superuserOTPCommand(app))
-	command.AddCommand(superuserIPsCommand(app))
-
-	return command
-}
-
-func superuserUpsertCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "upsert",
-		Example:      "superuser upsert test@example.com 1234567890",
-		Short:        "Creates, or updates if email exists, a single superuser",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			if len(args) != 2 {
-				return errors.New("missing email and password arguments")
-			}
-
-			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("missing or invalid email address")
-			}
-
-			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
-			if err != nil {
-				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
-			}
-
-			superuser, err := app.FindAuthRecordByEmail(superusersCol, args[0])
-			if err != nil {
-				superuser = core.NewRecord(superusersCol)
-			}
-
-			superuser.SetEmail(args[0])
-			superuser.SetPassword(args[1])
-
-			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("failed to upsert superuser account: %w", err)
-			}
-
-			color.Green("Successfully saved superuser %q!", superuser.Email())
-			return nil
-		},
-	}
-
-	return command
-}
-
-func superuserCreateCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "create",
-		Example:      "superuser create test@example.com 1234567890",
-		Short:        "Creates a new superuser",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			if len(args) != 2 {
-				return errors.New("missing email and password arguments")
-			}
-
-			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("missing or invalid email address")
-			}
-
-			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
-			if err != nil {
-				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
-			}
-
-			superuser := core.NewRecord(superusersCol)
-			superuser.SetEmail(args[0])
-			superuser.SetPassword(args[1])
-
-			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("failed to create new superuser account: %w", err)
-			}
-
-			color.Green("Successfully created new superuser %q!", superuser.Email())
-			return nil
-		},
-	}
-
-	return command
-}
-
-func superuserUpdateCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "update",
-		Example:      "superuser update test@example.com 1234567890",
-		Short:        "Changes the password of a single superuser",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			if len(args) != 2 {
-				return errors.New("missing email and password arguments")
-			}
-
-			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("missing or invalid email address")
-			}
-
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
-			if err != nil {
-				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
-			}
-
-			superuser.SetPassword(args[1])
-
-			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("failed to change superuser %q password: %w", superuser.Email(), err)
-			}
-
-			color.Green("Successfully changed superuser %q password!", superuser.Email())
-			return nil
-		},
-	}
-
-	return command
-}
-
-func superuserDeleteCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "delete",
-		Example:      "superuser delete test@example.com",
-		Short:        "Deletes an existing superuser",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("invalid or missing email address")
-			}
-
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
-			if err != nil {
-				color.Yellow("superuser %q is missing or already deleted", args[0])
-				return nil
-			}
-
-			if err := app.Delete(superuser); err != nil {
-				return fmt.Errorf("failed to delete superuser %q: %w", superuser.Email(), err)
-			}
-
-			color.Green("Successfully deleted superuser %q!", superuser.Email())
-			return nil
-		},
-	}
-
-	return command
-}
-
-func superuserOTPCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "otp",
-		Example:      "superuser otp test@example.com",
-		Short:        "Creates a new OTP for the specified superuser",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("invalid or missing email address")
-			}
-
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
-			if err != nil {
-				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
-			}
-
-			if !superuser.Collection().OTP.Enabled {
-				return errors.New("OTP auth is not enabled for the _superusers collection")
-			}
-
-			pass := security.RandomStringWithAlphabet(superuser.Collection().OTP.Length, "1234567890")
-
-			otp := core.NewOTP(app)
-			otp.SetCollectionRef(superuser.Collection().Id)
-			otp.SetRecordRef(superuser.Id)
-			otp.SetPassword(pass)
-
-			err = app.Save(otp)
-			if err != nil {
-				return fmt.Errorf("failed to create OTP: %w", err)
-			}
-
-			color.New(color.BgGreen, color.FgBlack).Printf("Successfully created OTP for superuser %q:", superuser.Email())
-			color.Green("\n├─ Id:    %s", otp.Id)
-			color.Green("├─ Pass:  %s", pass)
-			color.Green("└─ Valid: %ds\n\n", superuser.Collection().OTP.Duration)
-			return nil
-		},
-	}
-
-	return command
-}
-
-func superuserIPsCommand(app core.App) *cobra.Command {
-	command := &cobra.Command{
-		Use:          "ips",
-		Example:      "superuser ips 127.0.0.1 10.0.0.0/24",
-		Short:        "Updates the superuser IPs whitelist setting (the IPs/subnets arguments must be space separated; leave empty to clear the whitelist restriction)",
-		SilenceUsage: true,
-		RunE: func(command *cobra.Command, args []string) error {
-			settings := app.Settings()
-			settings.SuperuserIPs = args
-
-			if err := app.Save(settings); err != nil {
-				return err
-			}
-
-			if len(args) == 0 {
-				color.Green("Successfully cleared SuperuserIPs setting!")
-			} else {
-				color.New(color.BgGreen, color.FgBlack).Println("Successfully updated SuperuserIPs setting:")
-				superuserIPs := app.Settings().SuperuserIPs
-				for i, ip := range superuserIPs {
-					if i == len(superuserIPs)-1 {
-						color.Green("└─ %s", ip)
-					} else {
-						color.Green("├─ %s", ip)
-					}
-				}
-			}
-
-			return nil
-		},
-	}
-
-	return command
-}

cmd/superuser_test.go

@@ -1,464 +0,0 @@
-package cmd_test
-
-import (
-	"slices"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/cmd"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestSuperuserUpsertCommand(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name        string
-		email       string
-		password    string
-		expectError bool
-	}{
-		{
-			"empty email and password",
-			"",
-			"",
-			true,
-		},
-		{
-			"empty email",
-			"",
-			"1234567890",
-			true,
-		},
-		{
-			"invalid email",
-			"invalid",
-			"1234567890",
-			true,
-		},
-		{
-			"empty password",
-			"test@example.com",
-			"",
-			true,
-		},
-		{
-			"short password",
-			"test_new@example.com",
-			"1234567",
-			true,
-		},
-		{
-			"existing user",
-			"test@example.com",
-			"1234567890!",
-			false,
-		},
-		{
-			"new user",
-			"test_new@example.com",
-			"1234567890!",
-			false,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs([]string{"upsert", s.email, s.password})
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			// check whether the superuser account was actually upserted
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
-			if err != nil {
-				t.Fatalf("Failed to fetch superuser %s: %v", s.email, err)
-			} else if !superuser.ValidatePassword(s.password) {
-				t.Fatal("Expected the superuser password to match")
-			}
-		})
-	}
-}
-
-func TestSuperuserCreateCommand(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name        string
-		email       string
-		password    string
-		expectError bool
-	}{
-		{
-			"empty email and password",
-			"",
-			"",
-			true,
-		},
-		{
-			"empty email",
-			"",
-			"1234567890",
-			true,
-		},
-		{
-			"invalid email",
-			"invalid",
-			"1234567890",
-			true,
-		},
-		{
-			"duplicated email",
-			"test@example.com",
-			"1234567890",
-			true,
-		},
-		{
-			"empty password",
-			"test@example.com",
-			"",
-			true,
-		},
-		{
-			"short password",
-			"test_new@example.com",
-			"1234567",
-			true,
-		},
-		{
-			"valid email and password",
-			"test_new@example.com",
-			"12345678",
-			false,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs([]string{"create", s.email, s.password})
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			// check whether the superuser account was actually created
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
-			if err != nil {
-				t.Fatalf("Failed to fetch created superuser %s: %v", s.email, err)
-			} else if !superuser.ValidatePassword(s.password) {
-				t.Fatal("Expected the superuser password to match")
-			}
-		})
-	}
-}
-
-func TestSuperuserUpdateCommand(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name        string
-		email       string
-		password    string
-		expectError bool
-	}{
-		{
-			"empty email and password",
-			"",
-			"",
-			true,
-		},
-		{
-			"empty email",
-			"",
-			"1234567890",
-			true,
-		},
-		{
-			"invalid email",
-			"invalid",
-			"1234567890",
-			true,
-		},
-		{
-			"nonexisting superuser",
-			"test_missing@example.com",
-			"1234567890",
-			true,
-		},
-		{
-			"empty password",
-			"test@example.com",
-			"",
-			true,
-		},
-		{
-			"short password",
-			"test_new@example.com",
-			"1234567",
-			true,
-		},
-		{
-			"valid email and password",
-			"test@example.com",
-			"12345678",
-			false,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs([]string{"update", s.email, s.password})
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			// check whether the superuser password was actually changed
-			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
-			if err != nil {
-				t.Fatalf("Failed to fetch superuser %s: %v", s.email, err)
-			} else if !superuser.ValidatePassword(s.password) {
-				t.Fatal("Expected the superuser password to match")
-			}
-		})
-	}
-}
-
-func TestSuperuserDeleteCommand(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name        string
-		email       string
-		expectError bool
-	}{
-		{
-			"empty email",
-			"",
-			true,
-		},
-		{
-			"invalid email",
-			"invalid",
-			true,
-		},
-		{
-			"nonexisting superuser",
-			"test_missing@example.com",
-			false,
-		},
-		{
-			"existing superuser",
-			"test@example.com",
-			false,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs([]string{"delete", s.email})
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			if _, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email); err == nil {
-				t.Fatal("Expected the superuser account to be deleted")
-			}
-		})
-	}
-}
-
-func TestSuperuserOTPCommand(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	superusersCollection, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// remove all existing otps
-	otps, err := app.FindAllOTPsByCollection(superusersCollection)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, otp := range otps {
-		err = app.Delete(otp)
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	scenarios := []struct {
-		name        string
-		email       string
-		enabled     bool
-		expectError bool
-	}{
-		{
-			"empty email",
-			"",
-			true,
-			true,
-		},
-		{
-			"invalid email",
-			"invalid",
-			true,
-			true,
-		},
-		{
-			"nonexisting superuser",
-			"test_missing@example.com",
-			true,
-			true,
-		},
-		{
-			"existing superuser",
-			"test@example.com",
-			true,
-			false,
-		},
-		{
-			"existing superuser with disabled OTP",
-			"test@example.com",
-			false,
-			true,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs([]string{"otp", s.email})
-
-			superusersCollection.OTP.Enabled = s.enabled
-			if err = app.SaveNoValidate(superusersCollection); err != nil {
-				t.Fatal(err)
-			}
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			superuser, err := app.FindAuthRecordByEmail(superusersCollection, s.email)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			otps, _ := app.FindAllOTPsByRecord(superuser)
-			if total := len(otps); total != 1 {
-				t.Fatalf("Expected 1 OTP, got %d", total)
-			}
-		})
-	}
-}
-
-func TestSuperuserIPsCommand(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name        string
-		ips         []string
-		expectError bool
-	}{
-		{
-			"no ips",
-			nil,
-			false,
-		},
-		{
-			"invalid ips",
-			[]string{"127.0.0.1", "invalid"},
-			true,
-		},
-		{
-			"valid ips",
-			[]string{"127.0.0.1", "::1", "127.0.0.1/24"},
-			false,
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			args := []string{"ips"}
-			args = append(args, s.ips...)
-
-			command := cmd.NewSuperuserCommand(app)
-			command.SetArgs(args)
-
-			err := command.Execute()
-
-			hasErr := err != nil
-			if s.expectError != hasErr {
-				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
-			}
-
-			if hasErr {
-				return
-			}
-
-			settingIPs := app.Settings().SuperuserIPs
-
-			if len(settingIPs) != len(s.ips) {
-				t.Fatalf("Expected %d ips, got %d (%v)", len(s.ips), len(settingIPs), settingIPs)
-			}
-
-			for _, ip := range settingIPs {
-				if !slices.Contains(s.ips, ip) {
-					t.Fatalf("Missing expected ip %q (%v)", ip, settingIPs)
-				}
-			}
-		})
-	}
-}

core/auth_origin_model.go

@@ -1,239 +0,0 @@
-package core
-
-import (
-	"context"
-	"errors"
-	"slices"
-
-	"github.com/pocketbase/dbx"
-	validation "github.com/pocketbase/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/tools/hook"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-const CollectionNameAuthOrigins = "_authOrigins"
-
-var (
-	_ Model        = (*AuthOrigin)(nil)
-	_ PreValidator = (*AuthOrigin)(nil)
-	_ RecordProxy  = (*AuthOrigin)(nil)
-)
-
-// AuthOrigin defines a Record proxy for working with the authOrigins collection.
-type AuthOrigin struct {
-	*Record
-}
-
-// NewAuthOrigin instantiates and returns a new blank *AuthOrigin model.
-//
-// Example usage:
-//
-//	origin := core.NewOrigin(app)
-//	origin.SetRecordRef(user.Id)
-//	origin.SetCollectionRef(user.Collection().Id)
-//	origin.SetFingerprint("...")
-//	app.Save(origin)
-func NewAuthOrigin(app App) *AuthOrigin {
-	m := &AuthOrigin{}
-
-	c, err := app.FindCachedCollectionByNameOrId(CollectionNameAuthOrigins)
-	if err != nil {
-		// this is just to make tests easier since authOrigins is a system collection and it is expected to be always accessible
-		// (note: the loaded record is further checked on AuthOrigin.PreValidate())
-		c = NewBaseCollection("@___invalid___")
-	}
-
-	m.Record = NewRecord(c)
-
-	return m
-}
-
-// PreValidate implements the [PreValidator] interface and checks
-// whether the proxy is properly loaded.
-func (m *AuthOrigin) PreValidate(ctx context.Context, app App) error {
-	if m.Record == nil || m.Record.Collection().Name != CollectionNameAuthOrigins {
-		return errors.New("missing or invalid AuthOrigin ProxyRecord")
-	}
-
-	return nil
-}
-
-// ProxyRecord returns the proxied Record model.
-func (m *AuthOrigin) ProxyRecord() *Record {
-	return m.Record
-}
-
-// SetProxyRecord loads the specified record model into the current proxy.
-func (m *AuthOrigin) SetProxyRecord(record *Record) {
-	m.Record = record
-}
-
-// CollectionRef returns the "collectionRef" field value.
-func (m *AuthOrigin) CollectionRef() string {
-	return m.GetString("collectionRef")
-}
-
-// SetCollectionRef updates the "collectionRef" record field value.
-func (m *AuthOrigin) SetCollectionRef(collectionId string) {
-	m.Set("collectionRef", collectionId)
-}
-
-// RecordRef returns the "recordRef" record field value.
-func (m *AuthOrigin) RecordRef() string {
-	return m.GetString("recordRef")
-}
-
-// SetRecordRef updates the "recordRef" record field value.
-func (m *AuthOrigin) SetRecordRef(recordId string) {
-	m.Set("recordRef", recordId)
-}
-
-// Fingerprint returns the "fingerprint" record field value.
-func (m *AuthOrigin) Fingerprint() string {
-	return m.GetString("fingerprint")
-}
-
-// SetFingerprint updates the "fingerprint" record field value.
-func (m *AuthOrigin) SetFingerprint(fingerprint string) {
-	m.Set("fingerprint", fingerprint)
-}
-
-// Created returns the "created" record field value.
-func (m *AuthOrigin) Created() types.DateTime {
-	return m.GetDateTime("created")
-}
-
-// Updated returns the "updated" record field value.
-func (m *AuthOrigin) Updated() types.DateTime {
-	return m.GetDateTime("updated")
-}
-
-func (app *BaseApp) registerAuthOriginHooks() {
-	recordRefHooks[*AuthOrigin](app, CollectionNameAuthOrigins, CollectionTypeAuth)
-
-	// delete existing auth origins on password change
-	app.OnRecordUpdate().Bind(&hook.Handler[*RecordEvent]{
-		Func: func(e *RecordEvent) error {
-			err := e.Next()
-			if err != nil || !e.Record.Collection().IsAuth() {
-				return err
-			}
-
-			old := e.Record.Original().GetString(FieldNamePassword + ":hash")
-			new := e.Record.GetString(FieldNamePassword + ":hash")
-			if old != new {
-				err = e.App.DeleteAllAuthOriginsByRecord(e.Record)
-				if err != nil {
-					e.App.Logger().Warn(
-						"Failed to delete all previous auth origin fingerprints",
-						"error", err,
-						"recordId", e.Record.Id,
-						"collectionId", e.Record.Collection().Id,
-					)
-				}
-			}
-
-			return nil
-		},
-		Priority: 99,
-	})
-}
-
-// -------------------------------------------------------------------
-
-// recordRefHooks registers common hooks that are usually used with record proxies
-// that have polymorphic record relations (aka. "collectionRef" and "recordRef" fields).
-func recordRefHooks[T RecordProxy](app App, collectionName string, optCollectionTypes ...string) {
-	app.OnRecordValidate(collectionName).Bind(&hook.Handler[*RecordEvent]{
-		Func: func(e *RecordEvent) error {
-			collectionId := e.Record.GetString("collectionRef")
-			err := validation.Validate(collectionId, validation.Required, validation.By(validateCollectionId(e.App, optCollectionTypes...)))
-			if err != nil {
-				return validation.Errors{"collectionRef": err}
-			}
-
-			recordId := e.Record.GetString("recordRef")
-			err = validation.Validate(recordId, validation.Required, validation.By(validateRecordId(e.App, collectionId)))
-			if err != nil {
-				return validation.Errors{"recordRef": err}
-			}
-
-			return e.Next()
-		},
-		Priority: 99,
-	})
-
-	// delete on collection ref delete
-	app.OnCollectionDeleteExecute().Bind(&hook.Handler[*CollectionEvent]{
-		Func: func(e *CollectionEvent) error {
-			if e.Collection.Name == collectionName || (len(optCollectionTypes) > 0 && !slices.Contains(optCollectionTypes, e.Collection.Type)) {
-				return e.Next()
-			}
-
-			originalApp := e.App
-			txErr := e.App.RunInTransaction(func(txApp App) error {
-				e.App = txApp
-
-				if err := e.Next(); err != nil {
-					return err
-				}
-
-				rels, err := txApp.FindAllRecords(collectionName, dbx.HashExp{"collectionRef": e.Collection.Id})
-				if err != nil {
-					return err
-				}
-
-				for _, mfa := range rels {
-					if err := txApp.Delete(mfa); err != nil {
-						return err
-					}
-				}
-
-				return nil
-			})
-			e.App = originalApp
-
-			return txErr
-		},
-		Priority: 99,
-	})
-
-	// delete on record ref delete
-	app.OnRecordDeleteExecute().Bind(&hook.Handler[*RecordEvent]{
-		Func: func(e *RecordEvent) error {
-			if e.Record.Collection().Name == collectionName ||
-				(len(optCollectionTypes) > 0 && !slices.Contains(optCollectionTypes, e.Record.Collection().Type)) {
-				return e.Next()
-			}
-
-			originalApp := e.App
-			txErr := e.App.RunInTransaction(func(txApp App) error {
-				e.App = txApp
-
-				if err := e.Next(); err != nil {
-					return err
-				}
-
-				rels, err := txApp.FindAllRecords(collectionName, dbx.HashExp{
-					"collectionRef": e.Record.Collection().Id,
-					"recordRef":     e.Record.Id,
-				})
-				if err != nil {
-					return err
-				}
-
-				for _, rel := range rels {
-					if err := txApp.Delete(rel); err != nil {
-						return err
-					}
-				}
-
-				return nil
-			})
-			e.App = originalApp
-
-			return txErr
-		},
-		Priority: 99,
-	})
-}

core/auth_origin_model_test.go

@@ -1,332 +0,0 @@
-package core_test
-
-import (
-	"fmt"
-	"slices"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-func TestNewAuthOrigin(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	if origin.Collection().Name != core.CollectionNameAuthOrigins {
-		t.Fatalf("Expected record with %q collection, got %q", core.CollectionNameAuthOrigins, origin.Collection().Name)
-	}
-}
-
-func TestAuthOriginProxyRecord(t *testing.T) {
-	t.Parallel()
-
-	record := core.NewRecord(core.NewBaseCollection("test"))
-	record.Id = "test_id"
-
-	origin := core.AuthOrigin{}
-	origin.SetProxyRecord(record)
-
-	if origin.ProxyRecord() == nil || origin.ProxyRecord().Id != record.Id {
-		t.Fatalf("Expected proxy record with id %q, got %v", record.Id, origin.ProxyRecord())
-	}
-}
-
-func TestAuthOriginRecordRef(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	testValues := []string{"test_1", "test2", ""}
-	for i, testValue := range testValues {
-		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
-			origin.SetRecordRef(testValue)
-
-			if v := origin.RecordRef(); v != testValue {
-				t.Fatalf("Expected getter %q, got %q", testValue, v)
-			}
-
-			if v := origin.GetString("recordRef"); v != testValue {
-				t.Fatalf("Expected field value %q, got %q", testValue, v)
-			}
-		})
-	}
-}
-
-func TestAuthOriginCollectionRef(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	testValues := []string{"test_1", "test2", ""}
-	for i, testValue := range testValues {
-		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
-			origin.SetCollectionRef(testValue)
-
-			if v := origin.CollectionRef(); v != testValue {
-				t.Fatalf("Expected getter %q, got %q", testValue, v)
-			}
-
-			if v := origin.GetString("collectionRef"); v != testValue {
-				t.Fatalf("Expected field value %q, got %q", testValue, v)
-			}
-		})
-	}
-}
-
-func TestAuthOriginFingerprint(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	testValues := []string{"test_1", "test2", ""}
-	for i, testValue := range testValues {
-		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
-			origin.SetFingerprint(testValue)
-
-			if v := origin.Fingerprint(); v != testValue {
-				t.Fatalf("Expected getter %q, got %q", testValue, v)
-			}
-
-			if v := origin.GetString("fingerprint"); v != testValue {
-				t.Fatalf("Expected field value %q, got %q", testValue, v)
-			}
-		})
-	}
-}
-
-func TestAuthOriginCreated(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	if v := origin.Created().String(); v != "" {
-		t.Fatalf("Expected empty created, got %q", v)
-	}
-
-	now := types.NowDateTime()
-	origin.SetRaw("created", now)
-
-	if v := origin.Created().String(); v != now.String() {
-		t.Fatalf("Expected %q created, got %q", now.String(), v)
-	}
-}
-
-func TestAuthOriginUpdated(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	origin := core.NewAuthOrigin(app)
-
-	if v := origin.Updated().String(); v != "" {
-		t.Fatalf("Expected empty updated, got %q", v)
-	}
-
-	now := types.NowDateTime()
-	origin.SetRaw("updated", now)
-
-	if v := origin.Updated().String(); v != now.String() {
-		t.Fatalf("Expected %q updated, got %q", now.String(), v)
-	}
-}
-
-func TestAuthOriginPreValidate(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	originsCol, err := app.FindCollectionByNameOrId(core.CollectionNameAuthOrigins)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	t.Run("no proxy record", func(t *testing.T) {
-		origin := &core.AuthOrigin{}
-
-		if err := app.Validate(origin); err == nil {
-			t.Fatal("Expected collection validation error")
-		}
-	})
-
-	t.Run("non-AuthOrigin collection", func(t *testing.T) {
-		origin := &core.AuthOrigin{}
-		origin.SetProxyRecord(core.NewRecord(core.NewBaseCollection("invalid")))
-		origin.SetRecordRef(user.Id)
-		origin.SetCollectionRef(user.Collection().Id)
-		origin.SetFingerprint("abc")
-
-		if err := app.Validate(origin); err == nil {
-			t.Fatal("Expected collection validation error")
-		}
-	})
-
-	t.Run("AuthOrigin collection", func(t *testing.T) {
-		origin := &core.AuthOrigin{}
-		origin.SetProxyRecord(core.NewRecord(originsCol))
-		origin.SetRecordRef(user.Id)
-		origin.SetCollectionRef(user.Collection().Id)
-		origin.SetFingerprint("abc")
-
-		if err := app.Validate(origin); err != nil {
-			t.Fatalf("Expected nil validation error, got %v", err)
-		}
-	})
-}
-
-func TestAuthOriginValidateHook(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	scenarios := []struct {
-		name         string
-		origin       func() *core.AuthOrigin
-		expectErrors []string
-	}{
-		{
-			"empty",
-			func() *core.AuthOrigin {
-				return core.NewAuthOrigin(app)
-			},
-			[]string{"collectionRef", "recordRef", "fingerprint"},
-		},
-		{
-			"non-auth collection",
-			func() *core.AuthOrigin {
-				origin := core.NewAuthOrigin(app)
-				origin.SetCollectionRef(demo1.Collection().Id)
-				origin.SetRecordRef(demo1.Id)
-				origin.SetFingerprint("abc")
-				return origin
-			},
-			[]string{"collectionRef"},
-		},
-		{
-			"missing record id",
-			func() *core.AuthOrigin {
-				origin := core.NewAuthOrigin(app)
-				origin.SetCollectionRef(user.Collection().Id)
-				origin.SetRecordRef("missing")
-				origin.SetFingerprint("abc")
-				return origin
-			},
-			[]string{"recordRef"},
-		},
-		{
-			"valid ref",
-			func() *core.AuthOrigin {
-				origin := core.NewAuthOrigin(app)
-				origin.SetCollectionRef(user.Collection().Id)
-				origin.SetRecordRef(user.Id)
-				origin.SetFingerprint("abc")
-				return origin
-			},
-			[]string{},
-		},
-	}
-
-	for _, s := range scenarios {
-		t.Run(s.name, func(t *testing.T) {
-			errs := app.Validate(s.origin())
-			tests.TestValidationErrors(t, errs, s.expectErrors)
-		})
-	}
-}
-
-func TestAuthOriginPasswordChangeDeletion(t *testing.T) {
-	t.Parallel()
-
-	testApp, _ := tests.NewTestApp()
-	defer testApp.Cleanup()
-
-	// no auth origin associated with it
-	user1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	superuser2, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	client1, err := testApp.FindAuthRecordByEmail("clients", "test@example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	scenarios := []struct {
-		record     *core.Record
-		deletedIds []string
-	}{
-		{user1, nil},
-		{superuser2, []string{"5798yh833k6w6w0", "ic55o70g4f8pcl4", "dmy260k6ksjr4ib"}},
-		{client1, []string{"9r2j0m74260ur8i"}},
-	}
-
-	for i, s := range scenarios {
-		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Collection().Name, s.record.Id), func(t *testing.T) {
-			app, _ := tests.NewTestApp()
-			defer app.Cleanup()
-
-			deletedIds := []string{}
-			app.OnRecordDelete().BindFunc(func(e *core.RecordEvent) error {
-				deletedIds = append(deletedIds, e.Record.Id)
-				return e.Next()
-			})
-
-			s.record.SetPassword("new_password")
-
-			err := app.Save(s.record)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if len(deletedIds) != len(s.deletedIds) {
-				t.Fatalf("Expected deleted ids\n%v\ngot\n%v", s.deletedIds, deletedIds)
-			}
-
-			for _, id := range s.deletedIds {
-				if !slices.Contains(deletedIds, id) {
-					t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
-				}
-			}
-		})
-	}
-}