[#1822] logged the current datetime on server start

Co-authored-by: HarryTr <hung.tv@hanbiro.com>

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '>=1.19.4'
+          go-version: '>=1.20.0'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

CHANGELOG.md

@@ -1,3 +1,262 @@
+## v0.12.3
+
+- Fixed "Toggle column" reactivity when navigating between collections ([#1836](https://github.com/pocketbase/pocketbase/pull/1836)).
+
+- Logged the current datetime on server start ([#1822](https://github.com/pocketbase/pocketbase/issues/1822)).
+
+
+## v0.12.2
+
+- Fixed the "Clear" button of the datepicker component not clearing the value ([#1730](https://github.com/pocketbase/pocketbase/discussions/1730)).
+
+- Increased slightly the fields contrast ([#1742](https://github.com/pocketbase/pocketbase/issues/1742)).
+
+- Auto close the multi-select dropdown if "Max select" is reached.
+
+
+## v0.12.1
+
+- Fixed js error on empty relation save.
+
+- Fixed `overlay-active` css class not being removed on nested overlay panel close ([#1718](https://github.com/pocketbase/pocketbase/issues/1718)).
+
+- Added the collection name in the page title ([#1711](https://github.com/pocketbase/pocketbase/issues/1711)).
+
+
+## v0.12.0
+
+- Refactored the relation picker UI to allow server-side search, sort, create, update and delete of relation records ([#976](https://github.com/pocketbase/pocketbase/issues/976)).
+
+- Added new `RelationOptions.DisplayFields` option to specify custom relation field(s) visualization in the Admin UI.
+
+- Added Authentik OAuth2 provider ([#1377](https://github.com/pocketbase/pocketbase/pull/1377); thanks @pr0ton11).
+
+- Added LiveChat OAuth2 provider ([#1573](https://github.com/pocketbase/pocketbase/pull/1573); thanks @mariosant).
+
+- Added Gitea OAuth2 provider ([#1643](https://github.com/pocketbase/pocketbase/pull/1643); thanks @hlanderdev).
+
+- Added PDF file previews ([#1548](https://github.com/pocketbase/pocketbase/pull/1548); thanks @mjadobson).
+
+- Added video and audio file previews.
+
+- Added rich text editor (`editor`) field for HTML content based on TinyMCE ([#370](https://github.com/pocketbase/pocketbase/issues/370)).
+  _Currently the new field doesn't have any configuration options or validations but this may change in the future depending on how devs ended up using it._
+
+- Added "Duplicate" Collection and Record options in the Admin UI ([#1656](https://github.com/pocketbase/pocketbase/issues/1656)).
+
+- Added `filesystem.GetFile()` helper to read files through the FileSystem abstraction ([#1578](https://github.com/pocketbase/pocketbase/pull/1578); thanks @avarabyeu).
+
+- Added new auth event hooks for finer control and more advanced auth scenarios handling:
+
+  ```go
+  // auth record
+  OnRecordBeforeAuthWithPasswordRequest()
+  OnRecordAfterAuthWithPasswordRequest()
+  OnRecordBeforeAuthWithOAuth2Request()
+  OnRecordAfterAuthWithOAuth2Request()
+  OnRecordBeforeAuthRefreshRequest()
+  OnRecordAfterAuthRefreshRequest()
+
+  // admin
+  OnAdminBeforeAuthWithPasswordRequest()
+  OnAdminAfterAuthWithPasswordRequest()
+  OnAdminBeforeAuthRefreshRequest()
+  OnAdminAfterAuthRefreshRequest()
+  OnAdminBeforeRequestPasswordResetRequest()
+  OnAdminAfterRequestPasswordResetRequest()
+  OnAdminBeforeConfirmPasswordResetRequest()
+  OnAdminAfterConfirmPasswordResetRequest()
+  ```
+
+- Added `models.Record.CleanCopy()` helper that creates a new record copy with only the latest data state of the existing one and all other options reset to their defaults.
+
+- Added new helper `apis.RecordAuthResponse(app, httpContext, record, meta)` to return a standard Record auth API response ([#1623](https://github.com/pocketbase/pocketbase/issues/1623)).
+
+- Refactored `models.Record` expand and data change operations to be concurrent safe.
+
+- Refactored all `forms` Submit interceptors to use a generic data type as their payload.
+
+- Added several `store.Store` helpers:
+  ```go
+  store.Reset(newData map[string]T)
+  store.Length() int
+  store.GetAll() map[string]T
+  ```
+
+- Added "tags" support for all Record and Model related event hooks.
+
+    The "tags" allow registering event handlers that will be called only on matching table name(s) or colleciton id(s)/name(s).
+    For example:
+    ```go
+    app.OnRecordBeforeCreateRequest("articles").Add(func(e *core.RecordCreateEvent) error {
+      // called only on "articles" record creation
+      log.Println(e.Record)
+      return nil
+    })
+    ```
+    For all those event hooks `*hook.Hook` was replaced with `*hooks.TaggedHook`, but the hook methods signatures are the same so it should behave as it was previously if no tags were specified.
+
+- **!** Fixed the `json` field **string** value normalization ([#1703](https://github.com/pocketbase/pocketbase/issues/1703)).
+
+    In order to support seamlessly both `application/json` and `multipart/form-data`
+    requests, the following normalization rules are applied if the `json` field is a
+    **plain string value**:
+
+    - "true" is converted to the json `true`
+    - "false" is converted to the json `false`
+    - "null" is converted to the json `null`
+    - "[1,2,3]" is converted to the json `[1,2,3]`
+    - "{\"a\":1,\"b\":2}" is converted to the json `{"a":1,"b":2}`
+    - numeric strings are converted to json number
+    - double quoted strings are left as they are (aka. without normalizations)
+    - any other string (empty string too) is double quoted
+
+    Additionally, the "Nonempty" `json` field constraint now checks for `null`, `[]`, `{}` and `""` (empty string).
+
+- Added `aria-label` to some of the buttons in the Admin UI for better accessibility ([#1702](https://github.com/pocketbase/pocketbase/pull/1702); thanks @ndarilek).
+
+- Updated the filename extension checks in the Admin UI to be case-insensitive ([#1707](https://github.com/pocketbase/pocketbase/pull/1707); thanks @hungcrush).
+
+- Other minor improvements (more detailed API file upload errors, UI optimizations, docs improvements, etc.)
+
+
+## v0.11.4
+
+- Fixed cascade delete for rel records with the same id as the main record ([#1689](https://github.com/pocketbase/pocketbase/issues/1689)).
+
+
+## v0.11.3
+
+- Fix realtime API panic on concurrent clients iteration ([#1628](https://github.com/pocketbase/pocketbase/issues/1628))
+
+  - `app.SubscriptionsBroker().Clients()` now returns a shallow copy of the underlying map.
+
+  - Added `Discard()` and `IsDiscarded()` helper methods to the `subscriptions.Client` interface.
+
+  - Slow clients should no longer "block" the main action completion.
+
+
+## v0.11.2
+
+- Fixed `fs.DeleteByPrefix()` hang on invalid S3 settings ([#1575](https://github.com/pocketbase/pocketbase/discussions/1575#discussioncomment-4661089)).
+
+- Updated file(s) delete to run in the background on record/collection delete to avoid blocking the delete model transaction.
+  _Currently the cascade files delete operation is treated as "non-critical" and in case of an error it is just logged during debug._
+  _This will be improved in the near future with the planned async job queue implementation._
+
+
+## v0.11.1
+
+- Unescaped path parameter values ([#1552](https://github.com/pocketbase/pocketbase/issues/1552)).
+
+
+## v0.11.0
+
+- Added `+` and `-` body field modifiers for `number`, `files`, `select` and `relation` fields.
+  ```js
+  {
+    // oldValue + 2
+    "someNumber+": 2,
+
+    // oldValue + ["id1", "id2"] - ["id3"]
+    "someRelation+": ["id1", "id2"],
+    "someRelation-": ["id3"],
+
+    // delete single file by its name (file fields supports only the "-" modifier!)
+    "someFile-": "filename.png",
+  }
+  ```
+  _Note1: `@request.data.someField` will contain the final resolved value._
+
+  _Note2: The old index (`"field.0":null`) and filename (`"field.filename.png":null`) based suffixed syntax for deleting files is still supported._
+
+- ! Added support for multi-match/match-all request data and collection multi-valued fields (`select`, `relation`) conditions.
+  If you want a "at least one of" type of condition, you can prefix the operator with `?`.
+  ```js
+  // for each someRelA.someRelB record require the "status" field to be "active"
+  someRelA.someRelB.status = "active"
+
+  // OR for "at least one of" condition
+  someRelA.someRelB.status ?= "active"
+  ```
+  _**Note: Previously the behavior for multi-valued fields was as the "at least one of" type.
+  The release comes with system db migration that will update your existing API rules (if needed) to preserve the compatibility.
+  If you have multi-select or multi-relation filter checks in your client-side code and want to preserve the old behavior, you'll have to prefix with `?` your operators.**_
+
+- Added support for querying `@request.data.someRelField.*` relation fields.
+  ```js
+  // example submitted data: {"someRel": "REL_RECORD_ID"}
+  @request.data.someRel.status = "active"
+  ```
+
+- Added `:isset` modifier for the static request data fields.
+  ```js
+  // prevent changing the "role" field
+  @request.data.role:isset = false
+  ```
+
+- Added `:length` modifier for the arrayable request data and collection fields (`select`, `file`, `relation`).
+  ```js
+  // example submitted data: {"someSelectField": ["val1", "val2"]}
+  @request.data.someSelectField:length = 2
+
+  // check existing record field length
+  someSelectField:length = 2
+  ```
+
+- Added `:each` modifier support for the multi-`select` request data and collection field.
+  ```js
+  // check if all selected rows has "pb_" prefix
+  roles:each ~ 'pb_%'
+  ```
+
+- Improved the Admin UI filters autocomplete.
+
+- Added `@random` sort key for `RANDOM()` sorted list results.
+
+- Added Strava OAuth2 provider ([#1443](https://github.com/pocketbase/pocketbase/pull/1443); thanks @szsascha).
+
+- Added Gitee OAuth2 provider ([#1448](https://github.com/pocketbase/pocketbase/pull/1448); thanks @yuxiang-gao).
+
+- Added IME status check to the textarea keydown handler ([#1370](https://github.com/pocketbase/pocketbase/pull/1370); thanks @tenthree).
+
+- Added `filesystem.NewFileFromBytes()` helper ([#1420](https://github.com/pocketbase/pocketbase/pull/1420); thanks @dschissler).
+
+- Added support for reordering uploaded multiple files.
+
+- Added `webp` to the default images mime type presets list ([#1469](https://github.com/pocketbase/pocketbase/pull/1469); thanks @khairulhaaziq).
+
+- Added the OAuth2 refresh token to the auth meta response ([#1487](https://github.com/pocketbase/pocketbase/issues/1487)).
+
+- Fixed the text wrapping in the Admin UI listing searchbar ([#1416](https://github.com/pocketbase/pocketbase/issues/1416)).
+
+- Fixed number field value output in the records listing ([#1447](https://github.com/pocketbase/pocketbase/issues/1447)).
+
+- Fixed duplicated settings view pages caused by uncompleted transitions ([#1498](https://github.com/pocketbase/pocketbase/issues/1498)).
+
+- Allowed sending `Authorization` header with the `/auth-with-password` record and admin login requests ([#1494](https://github.com/pocketbase/pocketbase/discussions/1494)).
+
+- `migrate down` now reverts migrations in the applied order.
+
+- Added additional list-bucket check in the S3 config test API.
+
+- Other minor improvements.
+
+
+## v0.10.4
+
+- Fixed `Record.MergeExpand` panic when the main model expand map is not initialized ([#1365](https://github.com/pocketbase/pocketbase/issues/1365)).
+
+
+## v0.10.3
+
+- ! Renamed the metadata key `original_filename` to `original-filename` due to an S3 file upload error caused by the underscore character ([#1343](https://github.com/pocketbase/pocketbase/pull/1343); thanks @yuxiang-gao).
+
+- Fixed request verification docs api url ([#1332](https://github.com/pocketbase/pocketbase/pull/1332); thanks @JoyMajumdar2001)
+
+- Excluded `collectionId` and `collectionName` from the displayable relation props list ([1322](https://github.com/pocketbase/pocketbase/issues/1322); thanks @dhall2).
+
+
 ## v0.10.2
 
 - Fixed nested multiple expands with shared path ([#586](https://github.com/pocketbase/pocketbase/issues/586#issuecomment-1357784227)).

LICENSE.md

@@ -1,5 +1,5 @@
 The MIT License (MIT)
-Copyright (c) 2022, Gani Georgiev
+Copyright (c) 2022 - present, Gani Georgiev
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software
 and associated documentation files (the "Software"), to deal in the Software without restriction,

README.md

@@ -90,11 +90,33 @@ Running/building the application is the same as for any other Go program, aka. j
 
 **PocketBase embeds SQLite, but doesn't require CGO.**
 
-If CGO is enabled, it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite). You can enable and disable CGO by setting the `CGO_ENABLED` environment variable to `1` or `0` respectively.
-
+If CGO is enabled (aka. `CGO_ENABLED=1`), it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite).
 Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
 
-To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory.
+To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:
+
+0. [Install Go 1.18+](https://go.dev/doc/install) (_if you haven't already_)
+1. Clone/download the repo
+2. Navigate to `examples/base`
+3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
+    (_https://go.dev/doc/install/source#environment_)
+4. Start the created executable by running `./base serve`.
+
+The supported build targets by the non-cgo driver at the moment are:
+```
+darwin  amd64
+darwin  arm64
+freebsd amd64
+freebsd arm64
+linux   386
+linux   amd64
+linux   arm
+linux   arm64
+linux   ppc64le
+linux   riscv64
+windows amd64
+windows arm64
+```
 
 ### Testing
 

apis/admin.go

@@ -18,7 +18,7 @@ func bindAdminApi(app core.App, rg *echo.Group) {
 	api := adminApi{app: app}
 
 	subGroup := rg.Group("/admins", ActivityLogger(app))
-	subGroup.POST("/auth-with-password", api.authWithPassword, RequireGuestOnly())
+	subGroup.POST("/auth-with-password", api.authWithPassword)
 	subGroup.POST("/request-password-reset", api.requestPasswordReset)
 	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
 	subGroup.POST("/auth-refresh", api.authRefresh, RequireAdminAuth())
@@ -39,11 +39,10 @@ func (api *adminApi) authResponse(c echo.Context, admin *models.Admin) error {
 		return NewBadRequestError("Failed to create auth token.", tokenErr)
 	}
 
-	event := &core.AdminAuthEvent{
-		HttpContext: c,
-		Admin:       admin,
-		Token:       token,
-	}
+	event := new(core.AdminAuthEvent)
+	event.HttpContext = c
+	event.Admin = admin
+	event.Token = token
 
 	return api.app.OnAdminAuthRequest().Trigger(event, func(e *core.AdminAuthEvent) error {
 		return e.HttpContext.JSON(200, map[string]any{
@@ -59,21 +58,55 @@ func (api *adminApi) authRefresh(c echo.Context) error {
 		return NewNotFoundError("Missing auth admin context.", nil)
 	}
 
-	return api.authResponse(c, admin)
+	event := new(core.AdminAuthRefreshEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	handlerErr := api.app.OnAdminBeforeAuthRefreshRequest().Trigger(event, func(e *core.AdminAuthRefreshEvent) error {
+		return api.authResponse(e.HttpContext, e.Admin)
+	})
+
+	if handlerErr == nil {
+		if err := api.app.OnAdminAfterAuthRefreshRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
+	}
+
+	return handlerErr
 }
 
 func (api *adminApi) authWithPassword(c echo.Context) error {
 	form := forms.NewAdminLogin(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	admin, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("Failed to authenticate.", submitErr)
+	event := new(core.AdminAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Password = form.Password
+	event.Identity = form.Identity
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.AdminAuthWithPasswordEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				return api.authResponse(e.HttpContext, e.Admin)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		if err := api.app.OnAdminAfterAuthWithPasswordRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
-	return api.authResponse(c, admin)
+	return submitErr
 }
 
 func (api *adminApi) requestPasswordReset(c echo.Context) error {
@@ -86,15 +119,40 @@ func (api *adminApi) requestPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	// run in background because we don't need to show the result
-	// (prevents admins enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
+	event := new(core.AdminRequestPasswordResetEvent)
+	event.HttpContext = c
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(Admin *models.Admin) error {
+			event.Admin = Admin
+
+			return api.app.OnAdminBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Admin); err != nil && api.app.IsDebug() {
+						log.Println(err)
+					}
+				})
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
 		}
 	})
 
-	return c.NoContent(http.StatusNoContent)
+	if submitErr == nil {
+		if err := api.app.OnAdminAfterRequestPasswordResetRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
+	} else if api.app.IsDebug() {
+		log.Println(submitErr)
+	}
+
+	// don't return the response error to prevent emails enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return nil
 }
 
 func (api *adminApi) confirmPasswordReset(c echo.Context) error {
@@ -103,12 +161,30 @@ func (api *adminApi) confirmPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	_, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("Failed to set new password.", submitErr)
+	event := new(core.AdminConfirmPasswordResetEvent)
+	event.HttpContext = c
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.AdminConfirmPasswordResetEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		if err := api.app.OnAdminAfterConfirmPasswordResetRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
-	return c.NoContent(http.StatusNoContent)
+	return submitErr
 }
 
 func (api *adminApi) list(c echo.Context) error {
@@ -126,11 +202,10 @@ func (api *adminApi) list(c echo.Context) error {
 		return NewBadRequestError("", err)
 	}
 
-	event := &core.AdminsListEvent{
-		HttpContext: c,
-		Admins:      admins,
-		Result:      result,
-	}
+	event := new(core.AdminsListEvent)
+	event.HttpContext = c
+	event.Admins = admins
+	event.Result = result
 
 	return api.app.OnAdminsListRequest().Trigger(event, func(e *core.AdminsListEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
@@ -148,10 +223,9 @@ func (api *adminApi) view(c echo.Context) error {
 		return NewNotFoundError("", err)
 	}
 
-	event := &core.AdminViewEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminViewEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	return api.app.OnAdminViewRequest().Trigger(event, func(e *core.AdminViewEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.Admin)
@@ -168,16 +242,17 @@ func (api *adminApi) create(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.AdminCreateEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminCreateEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	// create the admin
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
 			return api.app.OnAdminBeforeCreateRequest().Trigger(event, func(e *core.AdminCreateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Admin); err != nil {
 					return NewBadRequestError("Failed to create admin.", err)
 				}
 
@@ -187,7 +262,9 @@ func (api *adminApi) create(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnAdminAfterCreateRequest().Trigger(event)
+		if err := api.app.OnAdminAfterCreateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -211,16 +288,17 @@ func (api *adminApi) update(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.AdminUpdateEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminUpdateEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	// update the admin
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
 			return api.app.OnAdminBeforeUpdateRequest().Trigger(event, func(e *core.AdminUpdateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Admin); err != nil {
 					return NewBadRequestError("Failed to update admin.", err)
 				}
 
@@ -230,7 +308,9 @@ func (api *adminApi) update(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnAdminAfterUpdateRequest().Trigger(event)
+		if err := api.app.OnAdminAfterUpdateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -247,10 +327,9 @@ func (api *adminApi) delete(c echo.Context) error {
 		return NewNotFoundError("", err)
 	}
 
-	event := &core.AdminDeleteEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminDeleteEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	handlerErr := api.app.OnAdminBeforeDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
 		if err := api.app.Dao().DeleteAdmin(e.Admin); err != nil {
@@ -261,7 +340,9 @@ func (api *adminApi) delete(c echo.Context) error {
 	})
 
 	if handlerErr == nil {
-		api.app.OnAdminAfterDeleteRequest().Trigger(event)
+		if err := api.app.OnAdminAfterDeleteRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return handlerErr

apis/admin_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-func TestAdminAuthWithEmail(t *testing.T) {
+func TestAdminAuthWithPassword(t *testing.T) {
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -39,6 +39,9 @@ func TestAdminAuthWithEmail(t *testing.T) {
 			Body:            strings.NewReader(`{"identity":"missing@example.com","password":"1234567890"}`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:            "wrong password",
@@ -47,17 +50,9 @@ func TestAdminAuthWithEmail(t *testing.T) {
 			Body:            strings.NewReader(`{"identity":"test@example.com","password":"invalid"}`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "valid email/password (already authorized)",
-			Method: http.MethodPost,
-			Url:    "/api/admins/auth-with-password",
-			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
 			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"message":"The request can be accessed only by guests.","data":{}`},
 		},
 		{
 			Name:           "valid email/password (guest)",
@@ -70,7 +65,28 @@ func TestAdminAuthWithEmail(t *testing.T) {
 				`"token":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnAdminAuthRequest": 1,
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "valid email/password (already authorized)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-with-password",
+			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"admin":{"id":"sywbhecnh46rhm0"`,
+				`"token":`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
 			},
 		},
 	}
@@ -114,10 +130,12 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                  1,
-				"OnModelAfterUpdate":                   1,
-				"OnMailerBeforeAdminResetPasswordSend": 1,
-				"OnMailerAfterAdminResetPasswordSend":  1,
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnMailerBeforeAdminResetPasswordSend":     1,
+				"OnMailerAfterAdminResetPasswordSend":      1,
+				"OnAdminBeforeRequestPasswordResetRequest": 1,
+				"OnAdminAfterRequestPasswordResetRequest":  1,
 			},
 		},
 		{
@@ -200,8 +218,10 @@ func TestAdminConfirmPasswordReset(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate": 1,
-				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnAdminBeforeConfirmPasswordResetRequest": 1,
+				"OnAdminAfterConfirmPasswordResetRequest":  1,
 			},
 		},
 	}
@@ -253,7 +273,9 @@ func TestAdminRefresh(t *testing.T) {
 				`"token":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnAdminAuthRequest": 1,
+				"OnAdminAuthRequest":              1,
+				"OnAdminBeforeAuthRefreshRequest": 1,
+				"OnAdminAfterAuthRefreshRequest":  1,
 			},
 		},
 	}

apis/base.go

@@ -26,6 +26,13 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	e := echo.New()
 	e.Debug = app.IsDebug()
 
+	// configure a custom router
+	e.ResetRouterCreator(func(ec *echo.Echo) echo.Router {
+		return echo.NewRouter(echo.RouterConfig{
+			UnescapePathParamValues: true,
+		})
+	})
+
 	// default middlewares
 	e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{
 		Skipper: func(c echo.Context) bool {
@@ -64,10 +71,9 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			apiErr = NewBadRequestError("", err)
 		}
 
-		event := &core.ApiErrorEvent{
-			HttpContext: c,
-			Error:       apiErr,
-		}
+		event := new(core.ApiErrorEvent)
+		event.HttpContext = c
+		event.Error = apiErr
 
 		// send error response
 		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {

apis/base_test.go

@@ -66,6 +66,22 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"test123"},
 		},
+		{
+			Name:   "custom route with url encoded parameter",
+			Method: http.MethodGet,
+			Url:    "/a%2Bb%2Bc",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/:param",
+					Handler: func(c echo.Context) error {
+						return c.String(200, c.PathParam("param"))
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"a+b+c"},
+		},
 		{
 			Name:   "route with HTTPError",
 			Method: http.MethodGet,

apis/collection.go

@@ -1,6 +1,7 @@
 package apis
 
 import (
+	"log"
 	"net/http"
 
 	"github.com/labstack/echo/v5"
@@ -42,11 +43,10 @@ func (api *collectionApi) list(c echo.Context) error {
 		return NewBadRequestError("", err)
 	}
 
-	event := &core.CollectionsListEvent{
-		HttpContext: c,
-		Collections: collections,
-		Result:      result,
-	}
+	event := new(core.CollectionsListEvent)
+	event.HttpContext = c
+	event.Collections = collections
+	event.Result = result
 
 	return api.app.OnCollectionsListRequest().Trigger(event, func(e *core.CollectionsListEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
@@ -59,10 +59,9 @@ func (api *collectionApi) view(c echo.Context) error {
 		return NewNotFoundError("", err)
 	}
 
-	event := &core.CollectionViewEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionViewEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	return api.app.OnCollectionViewRequest().Trigger(event, func(e *core.CollectionViewEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.Collection)
@@ -79,16 +78,17 @@ func (api *collectionApi) create(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionCreateEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionCreateEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	// create the collection
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
+
 			return api.app.OnCollectionBeforeCreateRequest().Trigger(event, func(e *core.CollectionCreateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Collection); err != nil {
 					return NewBadRequestError("Failed to create the collection.", err)
 				}
 
@@ -98,7 +98,9 @@ func (api *collectionApi) create(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnCollectionAfterCreateRequest().Trigger(event)
+		if err := api.app.OnCollectionAfterCreateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -117,16 +119,17 @@ func (api *collectionApi) update(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionUpdateEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionUpdateEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	// update the collection
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
+
 			return api.app.OnCollectionBeforeUpdateRequest().Trigger(event, func(e *core.CollectionUpdateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Collection); err != nil {
 					return NewBadRequestError("Failed to update the collection.", err)
 				}
 
@@ -136,7 +139,9 @@ func (api *collectionApi) update(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnCollectionAfterUpdateRequest().Trigger(event)
+		if err := api.app.OnCollectionAfterUpdateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -148,10 +153,9 @@ func (api *collectionApi) delete(c echo.Context) error {
 		return NewNotFoundError("", err)
 	}
 
-	event := &core.CollectionDeleteEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionDeleteEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	handlerErr := api.app.OnCollectionBeforeDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
 		if err := api.app.Dao().DeleteCollection(e.Collection); err != nil {
@@ -162,7 +166,9 @@ func (api *collectionApi) delete(c echo.Context) error {
 	})
 
 	if handlerErr == nil {
-		api.app.OnCollectionAfterDeleteRequest().Trigger(event)
+		if err := api.app.OnCollectionAfterDeleteRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return handlerErr
@@ -176,18 +182,17 @@ func (api *collectionApi) bulkImport(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionsImportEvent{
-		HttpContext: c,
-		Collections: form.Collections,
-	}
+	event := new(core.CollectionsImportEvent)
+	event.HttpContext = c
+	event.Collections = form.Collections
 
 	// import collections
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
-				form.Collections = e.Collections // ensures that the form always has the latest changes
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[[]*models.Collection]) forms.InterceptorNextFunc[[]*models.Collection] {
+		return func(imports []*models.Collection) error {
+			event.Collections = imports
 
-				if err := next(); err != nil {
+			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+				if err := next(e.Collections); err != nil {
 					return NewBadRequestError("Failed to import the submitted collections.", err)
 				}
 
@@ -197,7 +202,9 @@ func (api *collectionApi) bulkImport(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnCollectionsAfterImportRequest().Trigger(event)
+		if err := api.app.OnCollectionsAfterImportRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr

apis/collection_test.go

@@ -6,10 +6,13 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
 )
 
 func TestCollectionsList(t *testing.T) {
@@ -42,7 +45,7 @@ func TestCollectionsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
-				`"totalItems":7`,
+				`"totalItems":8`,
 				`"items":[{`,
 				`"id":"_pb_users_auth_"`,
 				`"id":"v851q4r790rhknl"`,
@@ -51,6 +54,7 @@ func TestCollectionsList(t *testing.T) {
 				`"id":"sz5l5z67tg7gku0"`,
 				`"id":"wzlqyes4orhoygb"`,
 				`"id":"4d1blo5cuycfaca"`,
+				`"id":"9n89pl5vkct6330"`,
 				`"type":"auth"`,
 				`"type":"base"`,
 			},
@@ -69,10 +73,10 @@ func TestCollectionsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":2`,
 				`"perPage":2`,
-				`"totalItems":7`,
+				`"totalItems":8`,
 				`"items":[{`,
+				`"id":"v851q4r790rhknl"`,
 				`"id":"4d1blo5cuycfaca"`,
-				`"id":"wzlqyes4orhoygb"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnCollectionsListRequest": 1,
@@ -99,12 +103,13 @@ func TestCollectionsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
-				`"totalItems":4`,
+				`"totalItems":5`,
 				`"items":[{`,
 				`"id":"wsmn24bux7wo113"`,
 				`"id":"sz5l5z67tg7gku0"`,
 				`"id":"wzlqyes4orhoygb"`,
 				`"id":"4d1blo5cuycfaca"`,
+				`"id":"9n89pl5vkct6330"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnCollectionsListRequest": 1,
@@ -230,6 +235,7 @@ func TestCollectionDelete(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
+			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeDelete":             1,
@@ -248,6 +254,7 @@ func TestCollectionDelete(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
+			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeDelete":             1,
@@ -742,6 +749,87 @@ func TestCollectionUpdate(t *testing.T) {
 				`"options":{"minPasswordLength":{"code":"validation_min_greater_equal_than_required"`,
 			},
 		},
+
+		// rel field change displayFields propagation
+		{
+			Name:   "renaming a display field should also update the referenced displayFields value",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo3",
+			Body: strings.NewReader(`{
+				"schema":[
+					{
+						"id": "w5z2x0nq",
+						"type": "text",
+						"name": "title_change"
+					}
+				]
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"title_change"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":             2,
+				"OnModelAfterUpdate":              2,
+				"OnCollectionBeforeUpdateRequest": 1,
+				"OnCollectionAfterUpdateRequest":  1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo4")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				relField := collection.Schema.GetFieldByName("rel_many_no_cascade_required")
+				options := relField.Options.(*schema.RelationOptions)
+				expectedDisplayFields := []string{"title_change", "id"}
+				if len(list.SubtractSlice(options.DisplayFields, expectedDisplayFields)) != 0 {
+					t.Fatalf("Expected displayFields %v, got %v", expectedDisplayFields, options.DisplayFields)
+				}
+			},
+		},
+		{
+			Name:   "deleting a display field should also update the referenced displayFields value",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo3",
+			Body: strings.NewReader(`{
+				"schema":[
+					{
+						"type": "text",
+						"name": "new_field"
+					}
+				]
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"new_field"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":             2,
+				"OnModelAfterUpdate":              2,
+				"OnCollectionBeforeUpdateRequest": 1,
+				"OnCollectionAfterUpdateRequest":  1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo4")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				relField := collection.Schema.GetFieldByName("rel_many_no_cascade_required")
+				options := relField.Options.(*schema.RelationOptions)
+				expectedDisplayFields := []string{"id"}
+				if len(list.SubtractSlice(options.DisplayFields, expectedDisplayFields)) != 0 {
+					t.Fatalf("Expected displayFields %v, got %v", expectedDisplayFields, options.DisplayFields)
+				}
+			},
+		},
 	}
 
 	for _, scenario := range scenarios {
@@ -786,7 +874,7 @@ func TestCollectionImport(t *testing.T) {
 				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
 					t.Fatal(err)
 				}
-				expected := 7
+				expected := 8
 				if len(collections) != expected {
 					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
 				}
@@ -814,7 +902,7 @@ func TestCollectionImport(t *testing.T) {
 				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
 					t.Fatal(err)
 				}
-				expected := 7
+				expected := 8
 				if len(collections) != expected {
 					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
 				}
@@ -856,7 +944,7 @@ func TestCollectionImport(t *testing.T) {
 				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
 					t.Fatal(err)
 				}
-				expected := 7
+				expected := 8
 				if len(collections) != expected {
 					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
 				}
@@ -909,7 +997,7 @@ func TestCollectionImport(t *testing.T) {
 				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
 					t.Fatal(err)
 				}
-				expected := 10
+				expected := 11
 				if len(collections) != expected {
 					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
 				}
@@ -996,8 +1084,8 @@ func TestCollectionImport(t *testing.T) {
 			ExpectedEvents: map[string]int{
 				"OnCollectionsAfterImportRequest":  1,
 				"OnCollectionsBeforeImportRequest": 1,
-				"OnModelBeforeDelete":              5,
-				"OnModelAfterDelete":               5,
+				"OnModelBeforeDelete":              6,
+				"OnModelAfterDelete":               6,
 				"OnModelBeforeUpdate":              2,
 				"OnModelAfterUpdate":               2,
 				"OnModelBeforeCreate":              1,

apis/file.go

@@ -84,14 +84,13 @@ func (api *fileApi) download(c echo.Context) error {
 		}
 	}
 
-	event := &core.FileDownloadEvent{
-		HttpContext: c,
-		Record:      record,
-		Collection:  collection,
-		FileField:   fileField,
-		ServedPath:  servedPath,
-		ServedName:  servedName,
-	}
+	event := new(core.FileDownloadEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.FileField = fileField
+	event.ServedPath = servedPath
+	event.ServedName = servedName
 
 	return api.app.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadEvent) error {
 		res := e.HttpContext.Response()

apis/realtime.go

@@ -15,6 +15,7 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )
@@ -43,10 +44,14 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	client := subscriptions.NewDefaultClient()
 	api.app.SubscriptionsBroker().Register(client)
 	defer func() {
-		api.app.OnRealtimeDisconnectRequest().Trigger(&core.RealtimeDisconnectEvent{
+		disconnectEvent := &core.RealtimeDisconnectEvent{
 			HttpContext: c,
 			Client:      client,
-		})
+		}
+
+		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 
 		api.app.SubscriptionsBroker().Unregister(client.Id())
 	}()
@@ -259,21 +264,27 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterCreate().PreAdd(func(e *core.ModelEvent) error {
 		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("create", record)
+			if err := api.broadcastRecord("create", record); err != nil && api.app.IsDebug() {
+				log.Println(err)
+			}
 		}
 		return nil
 	})
 
 	api.app.OnModelAfterUpdate().PreAdd(func(e *core.ModelEvent) error {
 		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("update", record)
+			if err := api.broadcastRecord("update", record); err != nil && api.app.IsDebug() {
+				log.Println(err)
+			}
 		}
 		return nil
 	})
 
 	api.app.OnModelBeforeDelete().Add(func(e *core.ModelEvent) error {
 		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("delete", record)
+			if err := api.broadcastRecord("delete", record); err != nil && api.app.IsDebug() {
+				log.Println(err)
+			}
 		}
 		return nil
 	})
@@ -337,12 +348,9 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record) er
 		return nil // no subscribers
 	}
 
-	// remove the expand from the broadcasted record because we don't
-	// know if the clients have access to view the expanded records
-	cleanRecord := *record
-	cleanRecord.SetExpand(nil)
-	cleanRecord.WithUnkownData(false)
-	cleanRecord.IgnoreEmailVisibility(false)
+	// create a clean record copy without expand and unknown fields
+	// because we don't know if the clients have permissions to view them
+	cleanRecord := record.CleanCopy()
 
 	subscriptionRuleMap := map[string]*string{
 		(collection.Name + "/" + cleanRecord.Id): collection.ViewRule,
@@ -356,7 +364,7 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record) er
 
 	data := &recordData{
 		Action: action,
-		Record: &cleanRecord,
+		Record: cleanRecord,
 	}
 
 	dataBytes, err := json.Marshal(data)
@@ -370,6 +378,8 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record) er
 	encodedData := string(dataBytes)
 
 	for _, client := range clients {
+		client := client
+
 		for subscription, rule := range subscriptionRuleMap {
 			if !client.HasSubscription(subscription) {
 				continue
@@ -398,7 +408,11 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record) er
 				}
 			}
 
-			client.Channel() <- msg
+			routine.FireAndForget(func() {
+				if !client.IsDiscarded() {
+					client.Channel() <- msg
+				}
+			})
 		}
 	}
 

apis/record_auth.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"log"
 	"net/http"
-	"strings"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -14,7 +13,6 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
-	"github.com/pocketbase/pocketbase/tokens"
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
@@ -35,8 +33,8 @@ func bindRecordAuthApi(app core.App, rg *echo.Group) {
 
 	subGroup.GET("/auth-methods", api.authMethods)
 	subGroup.POST("/auth-refresh", api.authRefresh, RequireSameContextRecordAuth())
-	subGroup.POST("/auth-with-oauth2", api.authWithOAuth2) // allow anyone so that we can link the OAuth2 profile with the authenticated record
-	subGroup.POST("/auth-with-password", api.authWithPassword, RequireGuestOnly())
+	subGroup.POST("/auth-with-oauth2", api.authWithOAuth2)
+	subGroup.POST("/auth-with-password", api.authWithPassword)
 	subGroup.POST("/request-password-reset", api.requestPasswordReset)
 	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
 	subGroup.POST("/request-verification", api.requestVerification)
@@ -51,60 +49,28 @@ type recordAuthApi struct {
 	app core.App
 }
 
-func (api *recordAuthApi) authResponse(c echo.Context, authRecord *models.Record, meta any) error {
-	token, tokenErr := tokens.NewRecordAuthToken(api.app, authRecord)
-	if tokenErr != nil {
-		return NewBadRequestError("Failed to create auth token.", tokenErr)
-	}
-
-	event := &core.RecordAuthEvent{
-		HttpContext: c,
-		Record:      authRecord,
-		Token:       token,
-		Meta:        meta,
-	}
-
-	return api.app.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthEvent) error {
-		// allow always returning the email address of the authenticated account
-		e.Record.IgnoreEmailVisibility(true)
-
-		// expand record relations
-		expands := strings.Split(c.QueryParam(expandQueryParam), ",")
-		if len(expands) > 0 {
-			// create a copy of the cached request data and adjust it to the current auth record
-			requestData := *RequestData(e.HttpContext)
-			requestData.Admin = nil
-			requestData.AuthRecord = e.Record
-			failed := api.app.Dao().ExpandRecord(
-				e.Record,
-				expands,
-				expandFetch(api.app.Dao(), &requestData),
-			)
-			if len(failed) > 0 && api.app.IsDebug() {
-				log.Println("Failed to expand relations: ", failed)
-			}
-		}
-
-		result := map[string]any{
-			"token":  e.Token,
-			"record": e.Record,
-		}
-
-		if e.Meta != nil {
-			result["meta"] = e.Meta
-		}
-
-		return e.HttpContext.JSON(http.StatusOK, result)
-	})
-}
-
 func (api *recordAuthApi) authRefresh(c echo.Context) error {
 	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
 	if record == nil {
 		return NewNotFoundError("Missing auth record context.", nil)
 	}
 
-	return api.authResponse(c, record, nil)
+	event := new(core.RecordAuthRefreshEvent)
+	event.HttpContext = c
+	event.Collection = record.Collection()
+	event.Record = record
+
+	handlerErr := api.app.OnRecordBeforeAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshEvent) error {
+		return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+	})
+
+	if handlerErr == nil {
+		if err := api.app.OnRecordAfterAuthRefreshRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
+	}
+
+	return handlerErr
 }
 
 type providerInfo struct {
@@ -202,7 +168,7 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	record, authData, submitErr := form.Submit(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
+	form.SetBeforeNewRecordCreateFunc(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
 		return createForm.DrySubmit(func(txDao *daos.Dao) error {
 			requestData := RequestData(c)
 			requestData.Data = form.CreateData
@@ -237,11 +203,39 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 			return nil
 		})
 	})
-	if submitErr != nil {
-		return NewBadRequestError("Failed to authenticate.", submitErr)
+
+	event := new(core.RecordAuthWithOAuth2Event)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, _, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData]) forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData] {
+		return func(data *forms.RecordOAuth2LoginData) error {
+			event.Record = data.Record
+			event.OAuth2User = data.OAuth2User
+
+			return api.app.OnRecordBeforeAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+				data.Record = e.Record
+				data.OAuth2User = e.OAuth2User
+
+				if err := next(data); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				e.Record = data.Record
+				e.OAuth2User = data.OAuth2User
+
+				return RecordAuthResponse(api.app, e.HttpContext, e.Record, e.OAuth2User)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		if err := api.app.OnRecordAfterAuthWithOAuth2Request().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
-	return api.authResponse(c, record, authData)
+	return submitErr
 }
 
 func (api *recordAuthApi) authWithPassword(c echo.Context) error {
@@ -255,12 +249,33 @@ func (api *recordAuthApi) authWithPassword(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	record, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("Failed to authenticate.", submitErr)
+	event := new(core.RecordAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Password = form.Password
+	event.Identity = form.Identity
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		if err := api.app.OnRecordAfterAuthWithPasswordRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
-	return api.authResponse(c, record, nil)
+	return submitErr
 }
 
 func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
@@ -283,11 +298,11 @@ func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	event := &core.RecordRequestPasswordResetEvent{
-		HttpContext: c,
-	}
+	event := new(core.RecordRequestPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			event.Record = record
 
@@ -305,7 +320,9 @@ func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterRequestPasswordResetRequest().Trigger(event)
+		if err := api.app.OnRecordAfterRequestPasswordResetRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	} else if api.app.IsDebug() {
 		log.Println(submitErr)
 	}
@@ -329,11 +346,11 @@ func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	event := &core.RecordConfirmPasswordResetEvent{
-		HttpContext: c,
-	}
+	event := new(core.RecordConfirmPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			event.Record = record
 
@@ -348,7 +365,9 @@ func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterConfirmPasswordResetRequest().Trigger(event)
+		if err := api.app.OnRecordAfterConfirmPasswordResetRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -369,11 +388,11 @@ func (api *recordAuthApi) requestVerification(c echo.Context) error {
 		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	event := &core.RecordRequestVerificationEvent{
-		HttpContext: c,
-	}
+	event := new(core.RecordRequestVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			event.Record = record
 
@@ -391,7 +410,9 @@ func (api *recordAuthApi) requestVerification(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterRequestVerificationRequest().Trigger(event)
+		if err := api.app.OnRecordAfterRequestVerificationRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	} else if api.app.IsDebug() {
 		log.Println(submitErr)
 	}
@@ -415,11 +436,11 @@ func (api *recordAuthApi) confirmVerification(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	event := &core.RecordConfirmVerificationEvent{
-		HttpContext: c,
-	}
+	event := new(core.RecordConfirmVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			event.Record = record
 
@@ -434,13 +455,20 @@ func (api *recordAuthApi) confirmVerification(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterConfirmVerificationRequest().Trigger(event)
+		if err := api.app.OnRecordAfterConfirmVerificationRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
 }
 
 func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
 	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
 	if record == nil {
 		return NewUnauthorizedError("The request requires valid auth record.", nil)
@@ -451,12 +479,12 @@ func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	event := &core.RecordRequestEmailChangeEvent{
-		HttpContext: c,
-		Record:      record,
-	}
+	event := new(core.RecordRequestEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
 
-	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			return api.app.OnRecordBeforeRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
 				if err := next(e.Record); err != nil {
@@ -486,11 +514,11 @@ func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	event := &core.RecordConfirmEmailChangeEvent{
-		HttpContext: c,
-	}
+	event := new(core.RecordConfirmEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			event.Record = record
 
@@ -505,7 +533,9 @@ func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterConfirmEmailChangeRequest().Trigger(event)
+		if err := api.app.OnRecordAfterConfirmEmailChangeRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -532,11 +562,11 @@ func (api *recordAuthApi) listExternalAuths(c echo.Context) error {
 		return NewBadRequestError("Failed to fetch the external auths for the specified auth record.", err)
 	}
 
-	event := &core.RecordListExternalAuthsEvent{
-		HttpContext:   c,
-		Record:        record,
-		ExternalAuths: externalAuths,
-	}
+	event := new(core.RecordListExternalAuthsEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuths = externalAuths
 
 	return api.app.OnRecordListExternalAuthsRequest().Trigger(event, func(e *core.RecordListExternalAuthsEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.ExternalAuths)
@@ -565,11 +595,11 @@ func (api *recordAuthApi) unlinkExternalAuth(c echo.Context) error {
 		return NewNotFoundError("Missing external auth provider relation.", err)
 	}
 
-	event := &core.RecordUnlinkExternalAuthEvent{
-		HttpContext:  c,
-		Record:       record,
-		ExternalAuth: externalAuth,
-	}
+	event := new(core.RecordUnlinkExternalAuthEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuth = externalAuth
 
 	handlerErr := api.app.OnRecordBeforeUnlinkExternalAuthRequest().Trigger(event, func(e *core.RecordUnlinkExternalAuthEvent) error {
 		if err := api.app.Dao().DeleteExternalAuth(externalAuth); err != nil {

apis/record_auth_test.go

@@ -66,26 +66,6 @@ func TestRecordAuthMethodsList(t *testing.T) {
 
 func TestRecordAuthWithPassword(t *testing.T) {
 	scenarios := []tests.ApiScenario{
-		{
-			Name:   "authenticated record",
-			Method: http.MethodPost,
-			Url:    "/api/collections/users/auth-with-password",
-			RequestHeaders: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authenticated admin",
-			Method: http.MethodPost,
-			Url:    "/api/collections/users/auth-with-password",
-			RequestHeaders: map[string]string{
-				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
 		{
 			Name:            "invalid body format",
 			Method:          http.MethodPost,
@@ -120,6 +100,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid username and invalid password",
@@ -133,6 +116,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid username and valid password in restricted collection",
@@ -146,6 +132,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid username and valid password in allowed collection",
@@ -163,7 +152,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				`"email":"test2@example.com"`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnRecordAuthRequest": 1,
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
 			},
 		},
 
@@ -180,6 +171,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid email and invalid password",
@@ -193,6 +187,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid email and valid password in restricted collection",
@@ -206,6 +203,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			ExpectedContent: []string{
 				`"data":{}`,
 			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:   "valid email and valid password in allowed collection",
@@ -223,7 +223,59 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				`"email":"test@example.com"`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnRecordAuthRequest": 1,
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
+			},
+		},
+
+		// with already authenticated record or admin
+		{
+			Name:   "authenticated record",
+			Method: http.MethodPost,
+			Url:    "/api/collections/users/auth-with-password",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "authenticated admin",
+			Method: http.MethodPost,
+			Url:    "/api/collections/users/auth-with-password",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
 			},
 		},
 	}
@@ -294,7 +346,9 @@ func TestRecordAuthRefresh(t *testing.T) {
 				`"missing":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnRecordAuthRequest": 1,
+				"OnRecordBeforeAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":              1,
+				"OnRecordAfterAuthRefreshRequest":  1,
 			},
 		},
 	}

apis/record_crud.go

@@ -83,12 +83,11 @@ func (api *recordApi) list(c echo.Context) error {
 
 	result.Items = records
 
-	event := &core.RecordsListEvent{
-		HttpContext: c,
-		Collection:  collection,
-		Records:     records,
-		Result:      result,
-	}
+	event := new(core.RecordsListEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Records = records
+	event.Result = result
 
 	return api.app.OnRecordsListRequest().Trigger(event, func(e *core.RecordsListEvent) error {
 		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil && api.app.IsDebug() {
@@ -135,10 +134,10 @@ func (api *recordApi) view(c echo.Context) error {
 		return NewNotFoundError("", fetchErr)
 	}
 
-	event := &core.RecordViewEvent{
-		HttpContext: c,
-		Record:      record,
-	}
+	event := new(core.RecordViewEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
 
 	return api.app.OnRecordViewRequest().Trigger(event, func(e *core.RecordViewEvent) error {
 		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
@@ -166,6 +165,20 @@ func (api *recordApi) create(c echo.Context) error {
 
 	// temporary save the record and check it against the create rule
 	if requestData.Admin == nil && collection.CreateRule != nil {
+		testRecord := models.NewRecord(collection)
+
+		// replace modifiers fields so that the resolved value is always
+		// available when accessing requestData.Data using just the field name
+		if requestData.HasModifierDataKeys() {
+			requestData.Data = testRecord.ReplaceModifers(requestData.Data)
+		}
+
+		testForm := forms.NewRecordUpsert(api.app, testRecord)
+		testForm.SetFullManageAccess(true)
+		if err := testForm.LoadRequest(c.Request(), ""); err != nil {
+			return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		}
+
 		createRuleFunc := func(q *dbx.SelectQuery) error {
 			if *collection.CreateRule == "" {
 				return nil // no create rule to resolve
@@ -181,13 +194,6 @@ func (api *recordApi) create(c echo.Context) error {
 			return nil
 		}
 
-		testRecord := models.NewRecord(collection)
-		testForm := forms.NewRecordUpsert(api.app, testRecord)
-		testForm.SetFullManageAccess(true)
-		if err := testForm.LoadRequest(c.Request(), ""); err != nil {
-			return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-		}
-
 		testErr := testForm.DrySubmit(func(txDao *daos.Dao) error {
 			foundRecord, err := txDao.FindRecordById(collection.Id, testRecord.Id, createRuleFunc)
 			if err != nil {
@@ -211,16 +217,18 @@ func (api *recordApi) create(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.RecordCreateEvent{
-		HttpContext: c,
-		Record:      record,
-	}
+	event := new(core.RecordCreateEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
 
 	// create the record
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(m *models.Record) error {
+			event.Record = m
+
 			return api.app.OnRecordBeforeCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Record); err != nil {
 					return NewBadRequestError("Failed to create record.", err)
 				}
 
@@ -234,7 +242,9 @@ func (api *recordApi) create(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterCreateRequest().Trigger(event)
+		if err := api.app.OnRecordAfterCreateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -258,6 +268,16 @@ func (api *recordApi) update(c echo.Context) error {
 		return NewForbiddenError("Only admins can perform this action.", nil)
 	}
 
+	// eager fetch the record so that the modifier field values are replaced
+	// and available when accessing requestData.Data using just the field name
+	if requestData.HasModifierDataKeys() {
+		record, err := api.app.Dao().FindRecordById(collection.Id, recordId)
+		if err != nil || record == nil {
+			return NewNotFoundError("", err)
+		}
+		requestData.Data = record.ReplaceModifers(requestData.Data)
+	}
+
 	ruleFunc := func(q *dbx.SelectQuery) error {
 		if requestData.Admin == nil && collection.UpdateRule != nil && *collection.UpdateRule != "" {
 			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData, true)
@@ -285,16 +305,18 @@ func (api *recordApi) update(c echo.Context) error {
 		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.RecordUpdateEvent{
-		HttpContext: c,
-		Record:      record,
-	}
+	event := new(core.RecordUpdateEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
 
 	// update the record
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(m *models.Record) error {
+			event.Record = m
+
 			return api.app.OnRecordBeforeUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.Record); err != nil {
 					return NewBadRequestError("Failed to update record.", err)
 				}
 
@@ -308,7 +330,9 @@ func (api *recordApi) update(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnRecordAfterUpdateRequest().Trigger(event)
+		if err := api.app.OnRecordAfterUpdateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -350,10 +374,10 @@ func (api *recordApi) delete(c echo.Context) error {
 		return NewNotFoundError("", fetchErr)
 	}
 
-	event := &core.RecordDeleteEvent{
-		HttpContext: c,
-		Record:      record,
-	}
+	event := new(core.RecordDeleteEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
 
 	handlerErr := api.app.OnRecordBeforeDeleteRequest().Trigger(event, func(e *core.RecordDeleteEvent) error {
 		// delete the record
@@ -365,7 +389,9 @@ func (api *recordApi) delete(c echo.Context) error {
 	})
 
 	if handlerErr == nil {
-		api.app.OnRecordAfterDeleteRequest().Trigger(event)
+		if err := api.app.OnRecordAfterDeleteRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return handlerErr

apis/record_crud_test.go

@@ -2,10 +2,12 @@ package apis_test
 
 import (
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/models"
@@ -209,6 +211,50 @@ func TestRecordCrudList(t *testing.T) {
 			},
 			ExpectedEvents: map[string]int{"OnRecordsListRequest": 1},
 		},
+		{
+			Name:           ":rule modifer",
+			Method:         http.MethodGet,
+			Url:            "/api/collections/demo5/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"qjeql998mtp1azp"`,
+			},
+			ExpectedEvents: map[string]int{"OnRecordsListRequest": 1},
+		},
+		{
+			Name:           "multi-match - at least one of",
+			Method:         http.MethodGet,
+			Url:            "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length?=2"),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"qzaqccwrmva4o1n"`,
+			},
+			ExpectedEvents: map[string]int{"OnRecordsListRequest": 1},
+		},
+		{
+			Name:           "multi-match - all",
+			Method:         http.MethodGet,
+			Url:            "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length=2"),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":0`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{"OnRecordsListRequest": 1},
+		},
 
 		// auth collection checks
 		// -----------------------------------------------------------
@@ -691,6 +737,7 @@ func TestRecordCrudDelete(t *testing.T) {
 				// users, test@example.com
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
+			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnModelAfterDelete":          3, // +2 because of the external auths
@@ -716,6 +763,25 @@ func TestRecordCrudDelete(t *testing.T) {
 				}
 			},
 		},
+		{
+			Name:            "@request :isset (rule failure check)",
+			Method:          http.MethodDelete,
+			Url:             "/api/collections/demo5/records/la4y2w4o98acwuj",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:           "@request :isset (rule pass check)",
+			Method:         http.MethodDelete,
+			Url:            "/api/collections/demo5/records/la4y2w4o98acwuj?test=1",
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelAfterDelete":          1,
+				"OnModelBeforeDelete":         1,
+				"OnRecordAfterDeleteRequest":  1,
+				"OnRecordBeforeDeleteRequest": 1,
+			},
+		},
 
 		// cascade delete checks
 		// -----------------------------------------------------------
@@ -730,7 +796,7 @@ func TestRecordCrudDelete(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents: map[string]int{
 				"OnRecordBeforeDeleteRequest": 1,
-				"OnModelBeforeUpdate":         1, // self_rel_many update of test1 record
+				"OnModelBeforeUpdate":         2, // self_rel_many update of test1 record + rel_one_cascade demo4 cascaded in demo5
 				"OnModelBeforeDelete":         2, // the record itself + rel_one_cascade of test1 record
 			},
 		},
@@ -758,6 +824,7 @@ func TestRecordCrudDelete(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
+			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeDelete":         2,
@@ -1092,6 +1159,63 @@ func TestRecordCrudCreate(t *testing.T) {
 			},
 		},
 
+		// fields modifier checks
+		// -----------------------------------------------------------
+		{
+			Name:   "trying to delete a record while being part of a non-cascade required relation",
+			Method: http.MethodDelete,
+			Url:    "/api/collections/demo3/records/7nwo8tuiatetxdm",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeDeleteRequest": 1,
+				"OnModelBeforeUpdate":         2, // self_rel_many update of test1 record + rel_one_cascade demo4 cascaded in demo5
+				"OnModelBeforeDelete":         2, // the record itself + rel_one_cascade of test1 record
+			},
+		},
+
+		// check whether if @request.data modifer fields are properly resolved
+		// -----------------------------------------------------------
+		{
+			Name:   "@request.data.field with compute modifers (rule failure check)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo5/records",
+			Body: strings.NewReader(`{
+				"total":1,
+				"total+":4,
+				"total-":1
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+		},
+		{
+			Name:   "@request.data.field with compute modifers (rule pass check)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo5/records",
+			Body: strings.NewReader(`{
+				"total":1,
+				"total+":3,
+				"total-":1
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"collectionName":"demo5"`,
+				`"total":3`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelAfterCreate":          1,
+				"OnModelBeforeCreate":         1,
+				"OnRecordAfterCreateRequest":  1,
+				"OnRecordBeforeCreateRequest": 1,
+			},
+		},
+
 		// auth records
 		// -----------------------------------------------------------
 		{
@@ -1501,6 +1625,43 @@ func TestRecordCrudUpdate(t *testing.T) {
 			},
 		},
 
+		// check whether if @request.data modifer fields are properly resolved
+		// -----------------------------------------------------------
+		{
+			Name:   "@request.data.field with compute modifers (rule failure check)",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo5/records/la4y2w4o98acwuj",
+			Body: strings.NewReader(`{
+				"total+":3,
+				"total-":1
+			}`),
+			ExpectedStatus: 404,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+		},
+		{
+			Name:   "@request.data.field with compute modifers (rule pass check)",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo5/records/la4y2w4o98acwuj",
+			Body: strings.NewReader(`{
+				"total+":2,
+				"total-":1
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"la4y2w4o98acwuj"`,
+				`"collectionName":"demo5"`,
+				`"total":3`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelAfterUpdate":          1,
+				"OnModelBeforeUpdate":         1,
+				"OnRecordAfterUpdateRequest":  1,
+				"OnRecordBeforeUpdateRequest": 1,
+			},
+		},
+
 		// auth records
 		// -----------------------------------------------------------
 		{

apis/record_helpers.go

@@ -2,24 +2,23 @@ package apis
 
 import (
 	"fmt"
+	"log"
+	"net/http"
 	"strings"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tokens"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
 const ContextRequestDataKey = "requestData"
 
-// Deprecated: Will be removed after v0.9. Use apis.RequestData(c) instead.
-func GetRequestData(c echo.Context) *models.RequestData {
-	return RequestData(c)
-}
-
 // RequestData exports cached common request data fields
 // (query, body, logged auth state, etc.) from the provided context.
 func RequestData(c echo.Context) *models.RequestData {
@@ -46,18 +45,65 @@ func RequestData(c echo.Context) *models.RequestData {
 	return result
 }
 
+func RecordAuthResponse(app core.App, c echo.Context, authRecord *models.Record, meta any) error {
+	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
+	if tokenErr != nil {
+		return NewBadRequestError("Failed to create auth token.", tokenErr)
+	}
+
+	event := new(core.RecordAuthEvent)
+	event.HttpContext = c
+	event.Collection = authRecord.Collection()
+	event.Record = authRecord
+	event.Token = token
+	event.Meta = meta
+
+	return app.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthEvent) error {
+		// allow always returning the email address of the authenticated account
+		e.Record.IgnoreEmailVisibility(true)
+
+		// expand record relations
+		expands := strings.Split(c.QueryParam(expandQueryParam), ",")
+		if len(expands) > 0 {
+			// create a copy of the cached request data and adjust it to the current auth record
+			requestData := *RequestData(e.HttpContext)
+			requestData.Admin = nil
+			requestData.AuthRecord = e.Record
+			failed := app.Dao().ExpandRecord(
+				e.Record,
+				expands,
+				expandFetch(app.Dao(), &requestData),
+			)
+			if len(failed) > 0 && app.IsDebug() {
+				log.Println("Failed to expand relations: ", failed)
+			}
+		}
+
+		result := map[string]any{
+			"token":  e.Token,
+			"record": e.Record,
+		}
+
+		if e.Meta != nil {
+			result["meta"] = e.Meta
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, result)
+	})
+}
+
 // EnrichRecord parses the request context and enrich the provided record:
-// - expands relations (if defaultExpands and/or ?expand query param is set)
-// - ensures that the emails of the auth record and its expanded auth relations
-//   are visibe only for the current logged admin, record owner or record with manage access
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth record and its expanded auth relations
+//     are visibe only for the current logged admin, record owner or record with manage access
 func EnrichRecord(c echo.Context, dao *daos.Dao, record *models.Record, defaultExpands ...string) error {
 	return EnrichRecords(c, dao, []*models.Record{record}, defaultExpands...)
 }
 
 // EnrichRecords parses the request context and enriches the provided records:
-// - expands relations (if defaultExpands and/or ?expand query param is set)
-// - ensures that the emails of the auth records and their expanded auth relations
-//   are visibe only for the current logged admin, record owner or record with manage access
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth records and their expanded auth relations
+//     are visibe only for the current logged admin, record owner or record with manage access
 func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defaultExpands ...string) error {
 	requestData := RequestData(c)
 

apis/record_helpers_test.go

@@ -59,6 +59,118 @@ func TestRequestData(t *testing.T) {
 	}
 }
 
+func TestRecordAuthResponse(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	dummyAdmin := &models.Admin{}
+	dummyAdmin.Id = "id1"
+
+	nonAuthRecord, err := app.Dao().FindRecordById("demo1", "al1h9ijdeojtsjy")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := app.Dao().FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name               string
+		record             *models.Record
+		meta               any
+		expectError        bool
+		expectedContent    []string
+		notExpectedContent []string
+		expectedEvents     map[string]int
+	}{
+		{
+			name:        "non auth record",
+			record:      nonAuthRecord,
+			expectError: true,
+		},
+		{
+			name:        "valid auth record - without meta",
+			record:      authRecord,
+			expectError: false,
+			expectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"id":"`,
+				`"expand":{"rel":{`,
+			},
+			notExpectedContent: []string{
+				`"meta":`,
+			},
+			expectedEvents: map[string]int{
+				"OnRecordAuthRequest": 1,
+			},
+		},
+		{
+			name:        "valid auth record - with meta",
+			record:      authRecord,
+			meta:        map[string]any{"meta_test": 123},
+			expectError: false,
+			expectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"id":"`,
+				`"expand":{"rel":{`,
+				`"meta":{"meta_test":123`,
+			},
+			expectedEvents: map[string]int{
+				"OnRecordAuthRequest": 1,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		app.ResetEventCalls()
+
+		e := echo.New()
+		req := httptest.NewRequest(http.MethodGet, "/?expand=rel", nil)
+		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+		c.Set(apis.ContextAdminKey, dummyAdmin)
+
+		responseErr := apis.RecordAuthResponse(app, c, s.record, s.meta)
+
+		hasErr := responseErr != nil
+		if hasErr != s.expectError {
+			t.Fatalf("[%s] Expected hasErr to be %v, got %v (%v)", s.name, s.expectError, hasErr, responseErr)
+		}
+
+		if len(app.EventCalls) != len(s.expectedEvents) {
+			t.Fatalf("[%s] Expected events \n%v, \ngot \n%v", s.name, s.expectedEvents, app.EventCalls)
+		}
+		for k, v := range s.expectedEvents {
+			if app.EventCalls[k] != v {
+				t.Fatalf("[%s] Expected event %s to be called %d times, got %d", s.name, k, v, app.EventCalls[k])
+			}
+		}
+
+		if hasErr {
+			continue
+		}
+
+		response := rec.Body.String()
+
+		for _, v := range s.expectedContent {
+			if !strings.Contains(response, v) {
+				t.Fatalf("[%s] Missing %v in response \n%v", s.name, v, response)
+			}
+		}
+
+		for _, v := range s.notExpectedContent {
+			if strings.Contains(response, v) {
+				t.Fatalf("[%s] Unexpected %v in response \n%v", s.name, v, response)
+			}
+		}
+	}
+}
+
 func TestEnrichRecords(t *testing.T) {
 	e := echo.New()
 	req := httptest.NewRequest(http.MethodGet, "/?expand=rel_many", nil)

apis/settings.go

@@ -1,12 +1,15 @@
 package apis
 
 import (
+	"fmt"
+	"log"
 	"net/http"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
@@ -31,10 +34,9 @@ func (api *settingsApi) list(c echo.Context) error {
 		return NewBadRequestError("", err)
 	}
 
-	event := &core.SettingsListEvent{
-		HttpContext:      c,
-		RedactedSettings: settings,
-	}
+	event := new(core.SettingsListEvent)
+	event.HttpContext = c
+	event.RedactedSettings = settings
 
 	return api.app.OnSettingsListRequest().Trigger(event, func(e *core.SettingsListEvent) error {
 		return e.HttpContext.JSON(http.StatusOK, e.RedactedSettings)
@@ -49,17 +51,17 @@ func (api *settingsApi) set(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	event := &core.SettingsUpdateEvent{
-		HttpContext: c,
-		OldSettings: api.app.Settings(),
-		NewSettings: form.Settings,
-	}
+	event := new(core.SettingsUpdateEvent)
+	event.HttpContext = c
+	event.OldSettings = api.app.Settings()
 
 	// update the settings
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+		return func(s *settings.Settings) error {
+			event.NewSettings = s
+
 			return api.app.OnSettingsBeforeUpdateRequest().Trigger(event, func(e *core.SettingsUpdateEvent) error {
-				if err := next(); err != nil {
+				if err := next(e.NewSettings); err != nil {
 					return NewBadRequestError("An error occurred while submitting the form.", err)
 				}
 
@@ -74,7 +76,9 @@ func (api *settingsApi) set(c echo.Context) error {
 	})
 
 	if submitErr == nil {
-		api.app.OnSettingsAfterUpdateRequest().Trigger(event)
+		if err := api.app.OnSettingsAfterUpdateRequest().Trigger(event); err != nil && api.app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return submitErr
@@ -91,14 +95,17 @@ func (api *settingsApi) testS3(c echo.Context) error {
 	}
 	defer fs.Close()
 
-	testFileKey := "pb_test_" + security.PseudorandomString(5) + "/test.txt"
+	testPrefix := "pb_settings_test_" + security.PseudorandomString(5)
+	testFileKey := testPrefix + "/test.txt"
 
+	// try to upload a test file
 	if err := fs.Upload([]byte("test"), testFileKey); err != nil {
 		return NewBadRequestError("Failed to upload a test file. Raw error: \n"+err.Error(), nil)
 	}
 
-	if err := fs.Delete(testFileKey); err != nil {
-		return NewBadRequestError("Failed to delete a test file. Raw error: \n"+err.Error(), nil)
+	// test prefix deletion (ensures that both bucket list and delete works)
+	if errs := fs.DeletePrefix(testPrefix); len(errs) > 0 {
+		return NewBadRequestError(fmt.Sprintf("Failed to delete a test file. Raw error: %v", errs), nil)
 	}
 
 	return c.NoContent(http.StatusNoContent)

apis/settings_test.go

@@ -58,6 +58,11 @@ func TestSettingsList(t *testing.T) {
 				`"spotifyAuth":{`,
 				`"kakaoAuth":{`,
 				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"authentikAuth":{`,
+				`"giteaAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 			},
@@ -125,6 +130,11 @@ func TestSettingsSet(t *testing.T) {
 				`"spotifyAuth":{`,
 				`"kakaoAuth":{`,
 				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"authentikAuth":{`,
+				`"giteaAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"acme_test"`,
@@ -181,6 +191,11 @@ func TestSettingsSet(t *testing.T) {
 				`"spotifyAuth":{`,
 				`"kakaoAuth":{`,
 				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"authentikAuth":{`,
+				`"giteaAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"update_test"`,

cmd/serve.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/http"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/fatih/color"
@@ -78,7 +79,8 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 					GetCertificate: certManager.GetCertificate,
 					NextProtos:     []string{acme.ALPNProto},
 				},
-				ReadTimeout: 60 * time.Second,
+				ReadTimeout:       5 * time.Minute,
+				ReadHeaderTimeout: 30 * time.Second,
 				// WriteTimeout: 60 * time.Second, // breaks sse!
 				Handler: router,
 				Addr:    mainAddr,
@@ -89,11 +91,20 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 				if httpsAddr != "" {
 					schema = "https"
 				}
-				regular := color.New()
+
+				date := new(strings.Builder)
+				log.New(date, "", log.LstdFlags).Print()
+
 				bold := color.New(color.Bold).Add(color.FgGreen)
-				bold.Printf("> Server started at: %s\n", color.CyanString("%s://%s", schema, serverConfig.Addr))
-				regular.Printf("  - REST API: %s\n", color.CyanString("%s://%s/api/", schema, serverConfig.Addr))
-				regular.Printf("  - Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, serverConfig.Addr))
+				bold.Printf(
+					"%s Server started at %s\n",
+					strings.TrimSpace(date.String()),
+					color.CyanString("%s://%s", schema, serverConfig.Addr),
+				)
+
+				regular := color.New()
+				regular.Printf(" ➜ REST API: %s\n", color.CyanString("%s://%s/api/", schema, serverConfig.Addr))
+				regular.Printf(" ➜ Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, serverConfig.Addr))
 			}
 
 			var serveErr error

core/app.go

@@ -18,7 +18,7 @@ import (
 type App interface {
 	// Deprecated:
 	// This method may get removed in the near future.
-	// It is recommended to access the logs db instance from app.Dao().DB() or
+	// It is recommended to access the app db instance from app.Dao().DB() or
 	// if you want more flexibility - app.Dao().ConcurrentDB() and app.Dao().NonconcurrentDB().
 	//
 	// DB returns the default app database instance.
@@ -124,27 +124,51 @@ type App interface {
 
 	// OnModelBeforeCreate hook is triggered before inserting a new
 	// entry in the DB, allowing you to modify or validate the stored data.
-	OnModelBeforeCreate() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeCreate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelAfterCreate hook is triggered after successfully
 	// inserting a new entry in the DB.
-	OnModelAfterCreate() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterCreate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelBeforeUpdate hook is triggered before updating existing
 	// entry in the DB, allowing you to modify or validate the stored data.
-	OnModelBeforeUpdate() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeUpdate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelAfterUpdate hook is triggered after successfully updating
 	// existing entry in the DB.
-	OnModelAfterUpdate() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterUpdate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelBeforeDelete hook is triggered before deleting an
 	// existing entry from the DB.
-	OnModelBeforeDelete() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeDelete(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelAfterDelete is triggered after successfully deleting an
 	// existing entry from the DB.
-	OnModelAfterDelete() *hook.Hook[*ModelEvent]
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterDelete(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// ---------------------------------------------------------------
 	// Mailer event hooks
@@ -166,33 +190,57 @@ type App interface {
 	//
 	// Could be used to send your own custom email template if
 	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeRecordResetPasswordSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// OnMailerAfterRecordResetPasswordSend hook is triggered after
 	// an auth record password reset email was successfully sent.
-	OnMailerAfterRecordResetPasswordSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// OnMailerBeforeRecordVerificationSend hook is triggered right before
 	// sending a verification email to an auth record.
 	//
 	// Could be used to send your own custom email template if
 	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeRecordVerificationSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// OnMailerAfterRecordVerificationSend hook is triggered after a
 	// verification email was successfully sent to an auth record.
-	OnMailerAfterRecordVerificationSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// OnMailerBeforeRecordChangeEmailSend hook is triggered right before
 	// sending a confirmation new address email to an auth record.
 	//
 	// Could be used to send your own custom email template if
 	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeRecordChangeEmailSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// OnMailerAfterRecordChangeEmailSend hook is triggered after a
 	// verification email was successfully sent to an auth record.
-	OnMailerAfterRecordChangeEmailSend() *hook.Hook[*MailerRecordEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// ---------------------------------------------------------------
 	// Realtime API event hooks
@@ -257,7 +305,7 @@ type App interface {
 	//
 	// Could be used to validate or modify the file response before
 	// returning it to the client.
-	OnFileDownloadRequest() *hook.Hook[*FileDownloadEvent]
+	OnFileDownloadRequest(tags ...string) *hook.TaggedHook[*FileDownloadEvent]
 
 	// ---------------------------------------------------------------
 	// Admin API event hooks
@@ -313,6 +361,50 @@ type App interface {
 	// authenticated admin data and token.
 	OnAdminAuthRequest() *hook.Hook[*AdminAuthEvent]
 
+	// OnAdminBeforeAuthWithPasswordRequest hook is triggered before each Admin
+	// auth with password API request (after request data load and before password validation).
+	//
+	// Could be used to implement for example a custom password validation
+	// or to locate a different Admin identity (by assigning [AdminAuthWithPasswordEvent.Admin]).
+	OnAdminBeforeAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent]
+
+	// OnAdminAfterAuthWithPasswordRequest hook is triggered after each
+	// successful Admin auth with password API request.
+	OnAdminAfterAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent]
+
+	// OnAdminBeforeAuthRefreshRequest hook is triggered before each Admin
+	// auth refresh API request (right before generating a new auth token).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different auth refresh behavior (returning [hook.StopPropagation]).
+	OnAdminBeforeAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent]
+
+	// OnAdminAfterAuthRefreshRequest hook is triggered after each
+	// successful auth refresh API request (right after generating a new auth token).
+	OnAdminAfterAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent]
+
+	// OnAdminBeforeRequestPasswordResetRequest hook is triggered before each Admin
+	// request password reset API request (after request data load and before sending the reset email).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different password reset behavior (returning [hook.StopPropagation]).
+	OnAdminBeforeRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent]
+
+	// OnAdminAfterRequestPasswordResetRequest hook is triggered after each
+	// successful request password reset API request.
+	OnAdminAfterRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent]
+
+	// OnAdminBeforeConfirmPasswordResetRequest hook is triggered before each Admin
+	// confirm password reset API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior (returning [hook.StopPropagation]).
+	OnAdminBeforeConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent]
+
+	// OnAdminAfterConfirmPasswordResetRequest hook is triggered after each
+	// successful confirm password reset API request.
+	OnAdminAfterConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent]
+
 	// ---------------------------------------------------------------
 	// Record Auth API event hooks
 	// ---------------------------------------------------------------
@@ -322,89 +414,213 @@ type App interface {
 	//
 	// Could be used to additionally validate or modify the authenticated
 	// record data and token.
-	OnRecordAuthRequest() *hook.Hook[*RecordAuthEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthRequest(tags ...string) *hook.TaggedHook[*RecordAuthEvent]
+
+	// OnRecordBeforeAuthWithPasswordRequest hook is triggered before each Record
+	// auth with password API request (after request data load and before password validation).
+	//
+	// Could be used to implement for example a custom password validation
+	// or to locate a different Record identity (by assigning [RecordAuthWithPasswordEvent.Record]).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent]
+
+	// OnRecordAfterAuthWithPasswordRequest hook is triggered after each
+	// successful Record auth with password API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent]
+
+	// OnRecordBeforeAuthWithOAuth2Request hook is triggered before each Record
+	// OAuth2 sign-in/sign-up API request (after token exchange and before external provider linking).
+	//
+	// If the [RecordAuthWithOAuth2Event.Record] is nil, then the OAuth2
+	// request will try to create a new auth Record.
+	//
+	// To assign or link a different existing record model you can
+	// overwrite/modify the [RecordAuthWithOAuth2Event.Record] field.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event]
+
+	// OnRecordAfterAuthWithOAuth2Request hook is triggered after each
+	// successful Record OAuth2 API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event]
+
+	// OnRecordBeforeAuthRefreshRequest hook is triggered before each Record
+	// auth refresh API request (right before generating a new auth token).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different auth refresh behavior (returning [hook.StopPropagation]).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent]
+
+	// OnRecordAfterAuthRefreshRequest hook is triggered after each
+	// successful auth refresh API request (right after generating a new auth token).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent]
 
 	// OnRecordBeforeRequestPasswordResetRequest hook is triggered before each Record
 	// request password reset API request (after request data load and before sending the reset email).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different password reset behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent]
 
 	// OnRecordAfterRequestPasswordResetRequest hook is triggered after each
 	// successful request password reset API request.
-	OnRecordAfterRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent]
 
 	// OnRecordBeforeConfirmPasswordResetRequest hook is triggered before each Record
 	// confirm password reset API request (after request data load and before persistence).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent]
 
 	// OnRecordAfterConfirmPasswordResetRequest hook is triggered after each
 	// successful confirm password reset API request.
-	OnRecordAfterConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent]
 
 	// OnRecordBeforeRequestVerificationRequest hook is triggered before each Record
 	// request verification API request (after request data load and before sending the verification email).
 	//
 	// Could be used to additionally validate the loaded request data or implement
 	// completely different verification behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent]
 
 	// OnRecordAfterRequestVerificationRequest hook is triggered after each
 	// successful request verification API request.
-	OnRecordAfterRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent]
 
 	// OnRecordBeforeConfirmVerificationRequest hook is triggered before each Record
 	// confirm verification API request (after request data load and before persistence).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent]
 
 	// OnRecordAfterConfirmVerificationRequest hook is triggered after each
 	// successful confirm verification API request.
-	OnRecordAfterConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent]
 
 	// OnRecordBeforeRequestEmailChangeRequest hook is triggered before each Record request email change API request
 	// (after request data load and before sending the email link to confirm the change).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different request email change behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent]
 
 	// OnRecordAfterRequestEmailChangeRequest hook is triggered after each
 	// successful request email change API request.
-	OnRecordAfterRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent]
 
 	// OnRecordBeforeConfirmEmailChangeRequest hook is triggered before each Record
 	// confirm email change API request (after request data load and before persistence).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent]
 
 	// OnRecordAfterConfirmEmailChangeRequest hook is triggered after each
 	// successful confirm email change API request.
-	OnRecordAfterConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent]
 
 	// OnRecordListExternalAuthsRequest hook is triggered on each API record external auths list request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnRecordListExternalAuthsRequest() *hook.Hook[*RecordListExternalAuthsEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordListExternalAuthsRequest(tags ...string) *hook.TaggedHook[*RecordListExternalAuthsEvent]
 
 	// OnRecordBeforeUnlinkExternalAuthRequest hook is triggered before each API record
 	// external auth unlink request (after models load and before the actual relation deletion).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different delete behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeUnlinkExternalAuthRequest() *hook.Hook[*RecordUnlinkExternalAuthEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent]
 
 	// OnRecordAfterUnlinkExternalAuthRequest hook is triggered after each
 	// successful API record external auth unlink request.
-	OnRecordAfterUnlinkExternalAuthRequest() *hook.Hook[*RecordUnlinkExternalAuthEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent]
 
 	// ---------------------------------------------------------------
 	// Record CRUD API event hooks
@@ -413,45 +629,77 @@ type App interface {
 	// OnRecordsListRequest hook is triggered on each API Records list request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnRecordsListRequest() *hook.Hook[*RecordsListEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordsListRequest(tags ...string) *hook.TaggedHook[*RecordsListEvent]
 
 	// OnRecordViewRequest hook is triggered on each API Record view request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnRecordViewRequest() *hook.Hook[*RecordViewEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordViewRequest(tags ...string) *hook.TaggedHook[*RecordViewEvent]
 
 	// OnRecordBeforeCreateRequest hook is triggered before each API Record
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeCreateRequest() *hook.Hook[*RecordCreateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent]
 
 	// OnRecordAfterCreateRequest hook is triggered after each
 	// successful API Record create request.
-	OnRecordAfterCreateRequest() *hook.Hook[*RecordCreateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent]
 
 	// OnRecordBeforeUpdateRequest hook is triggered before each API Record
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeUpdateRequest() *hook.Hook[*RecordUpdateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent]
 
 	// OnRecordAfterUpdateRequest hook is triggered after each
 	// successful API Record update request.
-	OnRecordAfterUpdateRequest() *hook.Hook[*RecordUpdateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent]
 
 	// OnRecordBeforeDeleteRequest hook is triggered before each API Record
 	// delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
 	// completely different delete behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeDeleteRequest() *hook.Hook[*RecordDeleteEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent]
 
 	// OnRecordAfterDeleteRequest hook is triggered after each
 	// successful API Record delete request.
-	OnRecordAfterDeleteRequest() *hook.Hook[*RecordDeleteEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent]
 
 	// ---------------------------------------------------------------
 	// Collection API event hooks

core/base.go

@@ -17,6 +17,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )
@@ -90,18 +91,32 @@ type BaseApp struct {
 	onFileDownloadRequest *hook.Hook[*FileDownloadEvent]
 
 	// admin api event hooks
-	onAdminsListRequest        *hook.Hook[*AdminsListEvent]
-	onAdminViewRequest         *hook.Hook[*AdminViewEvent]
-	onAdminBeforeCreateRequest *hook.Hook[*AdminCreateEvent]
-	onAdminAfterCreateRequest  *hook.Hook[*AdminCreateEvent]
-	onAdminBeforeUpdateRequest *hook.Hook[*AdminUpdateEvent]
-	onAdminAfterUpdateRequest  *hook.Hook[*AdminUpdateEvent]
-	onAdminBeforeDeleteRequest *hook.Hook[*AdminDeleteEvent]
-	onAdminAfterDeleteRequest  *hook.Hook[*AdminDeleteEvent]
-	onAdminAuthRequest         *hook.Hook[*AdminAuthEvent]
+	onAdminsListRequest                      *hook.Hook[*AdminsListEvent]
+	onAdminViewRequest                       *hook.Hook[*AdminViewEvent]
+	onAdminBeforeCreateRequest               *hook.Hook[*AdminCreateEvent]
+	onAdminAfterCreateRequest                *hook.Hook[*AdminCreateEvent]
+	onAdminBeforeUpdateRequest               *hook.Hook[*AdminUpdateEvent]
+	onAdminAfterUpdateRequest                *hook.Hook[*AdminUpdateEvent]
+	onAdminBeforeDeleteRequest               *hook.Hook[*AdminDeleteEvent]
+	onAdminAfterDeleteRequest                *hook.Hook[*AdminDeleteEvent]
+	onAdminAuthRequest                       *hook.Hook[*AdminAuthEvent]
+	onAdminBeforeAuthWithPasswordRequest     *hook.Hook[*AdminAuthWithPasswordEvent]
+	onAdminAfterAuthWithPasswordRequest      *hook.Hook[*AdminAuthWithPasswordEvent]
+	onAdminBeforeAuthRefreshRequest          *hook.Hook[*AdminAuthRefreshEvent]
+	onAdminAfterAuthRefreshRequest           *hook.Hook[*AdminAuthRefreshEvent]
+	onAdminBeforeRequestPasswordResetRequest *hook.Hook[*AdminRequestPasswordResetEvent]
+	onAdminAfterRequestPasswordResetRequest  *hook.Hook[*AdminRequestPasswordResetEvent]
+	onAdminBeforeConfirmPasswordResetRequest *hook.Hook[*AdminConfirmPasswordResetEvent]
+	onAdminAfterConfirmPasswordResetRequest  *hook.Hook[*AdminConfirmPasswordResetEvent]
 
 	// record auth API event hooks
 	onRecordAuthRequest                       *hook.Hook[*RecordAuthEvent]
+	onRecordBeforeAuthWithPasswordRequest     *hook.Hook[*RecordAuthWithPasswordEvent]
+	onRecordAfterAuthWithPasswordRequest      *hook.Hook[*RecordAuthWithPasswordEvent]
+	onRecordBeforeAuthWithOAuth2Request       *hook.Hook[*RecordAuthWithOAuth2Event]
+	onRecordAfterAuthWithOAuth2Request        *hook.Hook[*RecordAuthWithOAuth2Event]
+	onRecordBeforeAuthRefreshRequest          *hook.Hook[*RecordAuthRefreshEvent]
+	onRecordAfterAuthRefreshRequest           *hook.Hook[*RecordAuthRefreshEvent]
 	onRecordBeforeRequestPasswordResetRequest *hook.Hook[*RecordRequestPasswordResetEvent]
 	onRecordAfterRequestPasswordResetRequest  *hook.Hook[*RecordRequestPasswordResetEvent]
 	onRecordBeforeConfirmPasswordResetRequest *hook.Hook[*RecordConfirmPasswordResetEvent]
@@ -211,18 +226,32 @@ func NewBaseApp(config *BaseAppConfig) *BaseApp {
 		onFileDownloadRequest: &hook.Hook[*FileDownloadEvent]{},
 
 		// admin API event hooks
-		onAdminsListRequest:        &hook.Hook[*AdminsListEvent]{},
-		onAdminViewRequest:         &hook.Hook[*AdminViewEvent]{},
-		onAdminBeforeCreateRequest: &hook.Hook[*AdminCreateEvent]{},
-		onAdminAfterCreateRequest:  &hook.Hook[*AdminCreateEvent]{},
-		onAdminBeforeUpdateRequest: &hook.Hook[*AdminUpdateEvent]{},
-		onAdminAfterUpdateRequest:  &hook.Hook[*AdminUpdateEvent]{},
-		onAdminBeforeDeleteRequest: &hook.Hook[*AdminDeleteEvent]{},
-		onAdminAfterDeleteRequest:  &hook.Hook[*AdminDeleteEvent]{},
-		onAdminAuthRequest:         &hook.Hook[*AdminAuthEvent]{},
+		onAdminsListRequest:                      &hook.Hook[*AdminsListEvent]{},
+		onAdminViewRequest:                       &hook.Hook[*AdminViewEvent]{},
+		onAdminBeforeCreateRequest:               &hook.Hook[*AdminCreateEvent]{},
+		onAdminAfterCreateRequest:                &hook.Hook[*AdminCreateEvent]{},
+		onAdminBeforeUpdateRequest:               &hook.Hook[*AdminUpdateEvent]{},
+		onAdminAfterUpdateRequest:                &hook.Hook[*AdminUpdateEvent]{},
+		onAdminBeforeDeleteRequest:               &hook.Hook[*AdminDeleteEvent]{},
+		onAdminAfterDeleteRequest:                &hook.Hook[*AdminDeleteEvent]{},
+		onAdminAuthRequest:                       &hook.Hook[*AdminAuthEvent]{},
+		onAdminBeforeAuthWithPasswordRequest:     &hook.Hook[*AdminAuthWithPasswordEvent]{},
+		onAdminAfterAuthWithPasswordRequest:      &hook.Hook[*AdminAuthWithPasswordEvent]{},
+		onAdminBeforeAuthRefreshRequest:          &hook.Hook[*AdminAuthRefreshEvent]{},
+		onAdminAfterAuthRefreshRequest:           &hook.Hook[*AdminAuthRefreshEvent]{},
+		onAdminBeforeRequestPasswordResetRequest: &hook.Hook[*AdminRequestPasswordResetEvent]{},
+		onAdminAfterRequestPasswordResetRequest:  &hook.Hook[*AdminRequestPasswordResetEvent]{},
+		onAdminBeforeConfirmPasswordResetRequest: &hook.Hook[*AdminConfirmPasswordResetEvent]{},
+		onAdminAfterConfirmPasswordResetRequest:  &hook.Hook[*AdminConfirmPasswordResetEvent]{},
 
 		// record auth API event hooks
 		onRecordAuthRequest:                       &hook.Hook[*RecordAuthEvent]{},
+		onRecordBeforeAuthWithPasswordRequest:     &hook.Hook[*RecordAuthWithPasswordEvent]{},
+		onRecordAfterAuthWithPasswordRequest:      &hook.Hook[*RecordAuthWithPasswordEvent]{},
+		onRecordBeforeAuthWithOAuth2Request:       &hook.Hook[*RecordAuthWithOAuth2Event]{},
+		onRecordAfterAuthWithOAuth2Request:        &hook.Hook[*RecordAuthWithOAuth2Event]{},
+		onRecordBeforeAuthRefreshRequest:          &hook.Hook[*RecordAuthRefreshEvent]{},
+		onRecordAfterAuthRefreshRequest:           &hook.Hook[*RecordAuthRefreshEvent]{},
 		onRecordBeforeRequestPasswordResetRequest: &hook.Hook[*RecordRequestPasswordResetEvent]{},
 		onRecordAfterRequestPasswordResetRequest:  &hook.Hook[*RecordRequestPasswordResetEvent]{},
 		onRecordBeforeConfirmPasswordResetRequest: &hook.Hook[*RecordConfirmPasswordResetEvent]{},
@@ -512,28 +541,28 @@ func (app *BaseApp) OnAfterApiError() *hook.Hook[*ApiErrorEvent] {
 // Dao event hooks
 // -------------------------------------------------------------------
 
-func (app *BaseApp) OnModelBeforeCreate() *hook.Hook[*ModelEvent] {
-	return app.onModelBeforeCreate
+func (app *BaseApp) OnModelBeforeCreate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelBeforeCreate, tags...)
 }
 
-func (app *BaseApp) OnModelAfterCreate() *hook.Hook[*ModelEvent] {
-	return app.onModelAfterCreate
+func (app *BaseApp) OnModelAfterCreate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterCreate, tags...)
 }
 
-func (app *BaseApp) OnModelBeforeUpdate() *hook.Hook[*ModelEvent] {
-	return app.onModelBeforeUpdate
+func (app *BaseApp) OnModelBeforeUpdate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelBeforeUpdate, tags...)
 }
 
-func (app *BaseApp) OnModelAfterUpdate() *hook.Hook[*ModelEvent] {
-	return app.onModelAfterUpdate
+func (app *BaseApp) OnModelAfterUpdate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterUpdate, tags...)
 }
 
-func (app *BaseApp) OnModelBeforeDelete() *hook.Hook[*ModelEvent] {
-	return app.onModelBeforeDelete
+func (app *BaseApp) OnModelBeforeDelete(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelBeforeDelete, tags...)
 }
 
-func (app *BaseApp) OnModelAfterDelete() *hook.Hook[*ModelEvent] {
-	return app.onModelAfterDelete
+func (app *BaseApp) OnModelAfterDelete(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterDelete, tags...)
 }
 
 // -------------------------------------------------------------------
@@ -548,28 +577,28 @@ func (app *BaseApp) OnMailerAfterAdminResetPasswordSend() *hook.Hook[*MailerAdmi
 	return app.onMailerAfterAdminResetPasswordSend
 }
 
-func (app *BaseApp) OnMailerBeforeRecordResetPasswordSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerBeforeRecordResetPasswordSend
+func (app *BaseApp) OnMailerBeforeRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerBeforeRecordResetPasswordSend, tags...)
 }
 
-func (app *BaseApp) OnMailerAfterRecordResetPasswordSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerAfterRecordResetPasswordSend
+func (app *BaseApp) OnMailerAfterRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerAfterRecordResetPasswordSend, tags...)
 }
 
-func (app *BaseApp) OnMailerBeforeRecordVerificationSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerBeforeRecordVerificationSend
+func (app *BaseApp) OnMailerBeforeRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerBeforeRecordVerificationSend, tags...)
 }
 
-func (app *BaseApp) OnMailerAfterRecordVerificationSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerAfterRecordVerificationSend
+func (app *BaseApp) OnMailerAfterRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerAfterRecordVerificationSend, tags...)
 }
 
-func (app *BaseApp) OnMailerBeforeRecordChangeEmailSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerBeforeRecordChangeEmailSend
+func (app *BaseApp) OnMailerBeforeRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerBeforeRecordChangeEmailSend, tags...)
 }
 
-func (app *BaseApp) OnMailerAfterRecordChangeEmailSend() *hook.Hook[*MailerRecordEvent] {
-	return app.onMailerAfterRecordChangeEmailSend
+func (app *BaseApp) OnMailerAfterRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerAfterRecordChangeEmailSend, tags...)
 }
 
 // -------------------------------------------------------------------
@@ -620,8 +649,8 @@ func (app *BaseApp) OnSettingsAfterUpdateRequest() *hook.Hook[*SettingsUpdateEve
 // File API event hooks
 // -------------------------------------------------------------------
 
-func (app *BaseApp) OnFileDownloadRequest() *hook.Hook[*FileDownloadEvent] {
-	return app.onFileDownloadRequest
+func (app *BaseApp) OnFileDownloadRequest(tags ...string) *hook.TaggedHook[*FileDownloadEvent] {
+	return hook.NewTaggedHook(app.onFileDownloadRequest, tags...)
 }
 
 // -------------------------------------------------------------------
@@ -664,108 +693,164 @@ func (app *BaseApp) OnAdminAuthRequest() *hook.Hook[*AdminAuthEvent] {
 	return app.onAdminAuthRequest
 }
 
+func (app *BaseApp) OnAdminBeforeAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent] {
+	return app.onAdminBeforeAuthWithPasswordRequest
+}
+
+func (app *BaseApp) OnAdminAfterAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent] {
+	return app.onAdminAfterAuthWithPasswordRequest
+}
+
+func (app *BaseApp) OnAdminBeforeAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent] {
+	return app.onAdminBeforeAuthRefreshRequest
+}
+
+func (app *BaseApp) OnAdminAfterAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent] {
+	return app.onAdminAfterAuthRefreshRequest
+}
+
+func (app *BaseApp) OnAdminBeforeRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent] {
+	return app.onAdminBeforeRequestPasswordResetRequest
+}
+
+func (app *BaseApp) OnAdminAfterRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent] {
+	return app.onAdminAfterRequestPasswordResetRequest
+}
+
+func (app *BaseApp) OnAdminBeforeConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent] {
+	return app.onAdminBeforeConfirmPasswordResetRequest
+}
+
+func (app *BaseApp) OnAdminAfterConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent] {
+	return app.onAdminAfterConfirmPasswordResetRequest
+}
+
 // -------------------------------------------------------------------
 // Record auth API event hooks
 // -------------------------------------------------------------------
 
-func (app *BaseApp) OnRecordAuthRequest() *hook.Hook[*RecordAuthEvent] {
-	return app.onRecordAuthRequest
+func (app *BaseApp) OnRecordAuthRequest(tags ...string) *hook.TaggedHook[*RecordAuthEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent] {
-	return app.onRecordBeforeRequestPasswordResetRequest
+func (app *BaseApp) OnRecordBeforeAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeAuthWithPasswordRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent] {
-	return app.onRecordAfterRequestPasswordResetRequest
+func (app *BaseApp) OnRecordAfterAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterAuthWithPasswordRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent] {
-	return app.onRecordBeforeConfirmPasswordResetRequest
+func (app *BaseApp) OnRecordBeforeAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event] {
+	return hook.NewTaggedHook(app.onRecordBeforeAuthWithOAuth2Request, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent] {
-	return app.onRecordAfterConfirmPasswordResetRequest
+func (app *BaseApp) OnRecordAfterAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event] {
+	return hook.NewTaggedHook(app.onRecordAfterAuthWithOAuth2Request, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent] {
-	return app.onRecordBeforeRequestVerificationRequest
+func (app *BaseApp) OnRecordBeforeAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeAuthRefreshRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent] {
-	return app.onRecordAfterRequestVerificationRequest
+func (app *BaseApp) OnRecordAfterAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterAuthRefreshRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent] {
-	return app.onRecordBeforeConfirmVerificationRequest
+func (app *BaseApp) OnRecordBeforeRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeRequestPasswordResetRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent] {
-	return app.onRecordAfterConfirmVerificationRequest
+func (app *BaseApp) OnRecordAfterRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterRequestPasswordResetRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent] {
-	return app.onRecordBeforeRequestEmailChangeRequest
+func (app *BaseApp) OnRecordBeforeConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeConfirmPasswordResetRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent] {
-	return app.onRecordAfterRequestEmailChangeRequest
+func (app *BaseApp) OnRecordAfterConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterConfirmPasswordResetRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent] {
-	return app.onRecordBeforeConfirmEmailChangeRequest
+func (app *BaseApp) OnRecordBeforeRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeRequestVerificationRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent] {
-	return app.onRecordAfterConfirmEmailChangeRequest
+func (app *BaseApp) OnRecordAfterRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterRequestVerificationRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordListExternalAuthsRequest() *hook.Hook[*RecordListExternalAuthsEvent] {
-	return app.onRecordListExternalAuthsRequest
+func (app *BaseApp) OnRecordBeforeConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeConfirmVerificationRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeUnlinkExternalAuthRequest() *hook.Hook[*RecordUnlinkExternalAuthEvent] {
-	return app.onRecordBeforeUnlinkExternalAuthRequest
+func (app *BaseApp) OnRecordAfterConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterConfirmVerificationRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterUnlinkExternalAuthRequest() *hook.Hook[*RecordUnlinkExternalAuthEvent] {
-	return app.onRecordAfterUnlinkExternalAuthRequest
+func (app *BaseApp) OnRecordBeforeRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeRequestEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterRequestEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordBeforeConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeConfirmEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterConfirmEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordListExternalAuthsRequest(tags ...string) *hook.TaggedHook[*RecordListExternalAuthsEvent] {
+	return hook.NewTaggedHook(app.onRecordListExternalAuthsRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordBeforeUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeUnlinkExternalAuthRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterUnlinkExternalAuthRequest, tags...)
 }
 
 // -------------------------------------------------------------------
 // Record CRUD API event hooks
 // -------------------------------------------------------------------
 
-func (app *BaseApp) OnRecordsListRequest() *hook.Hook[*RecordsListEvent] {
-	return app.onRecordsListRequest
+func (app *BaseApp) OnRecordsListRequest(tags ...string) *hook.TaggedHook[*RecordsListEvent] {
+	return hook.NewTaggedHook(app.onRecordsListRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordViewRequest() *hook.Hook[*RecordViewEvent] {
-	return app.onRecordViewRequest
+func (app *BaseApp) OnRecordViewRequest(tags ...string) *hook.TaggedHook[*RecordViewEvent] {
+	return hook.NewTaggedHook(app.onRecordViewRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeCreateRequest() *hook.Hook[*RecordCreateEvent] {
-	return app.onRecordBeforeCreateRequest
+func (app *BaseApp) OnRecordBeforeCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeCreateRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterCreateRequest() *hook.Hook[*RecordCreateEvent] {
-	return app.onRecordAfterCreateRequest
+func (app *BaseApp) OnRecordAfterCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterCreateRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeUpdateRequest() *hook.Hook[*RecordUpdateEvent] {
-	return app.onRecordBeforeUpdateRequest
+func (app *BaseApp) OnRecordBeforeUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeUpdateRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterUpdateRequest() *hook.Hook[*RecordUpdateEvent] {
-	return app.onRecordAfterUpdateRequest
+func (app *BaseApp) OnRecordAfterUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterUpdateRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordBeforeDeleteRequest() *hook.Hook[*RecordDeleteEvent] {
-	return app.onRecordBeforeDeleteRequest
+func (app *BaseApp) OnRecordBeforeDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent] {
+	return hook.NewTaggedHook(app.onRecordBeforeDeleteRequest, tags...)
 }
 
-func (app *BaseApp) OnRecordAfterDeleteRequest() *hook.Hook[*RecordDeleteEvent] {
-	return app.onRecordAfterDeleteRequest
+func (app *BaseApp) OnRecordAfterDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterDeleteRequest, tags...)
 }
 
 // -------------------------------------------------------------------
@@ -939,20 +1024,29 @@ func (app *BaseApp) registerDefaultHooks() {
 
 		failed := fs.DeletePrefix(prefix)
 		if len(failed) > 0 {
-			return errors.New("Failed to delete the files at " + prefix)
+			return errors.New("failed to delete the files at " + prefix)
 		}
 
 		return nil
 	}
 
-	// delete storage files from deleted Collection, Records, etc.
+	// try to delete the storage files from deleted Collection, Records, etc. model
 	app.OnModelAfterDelete().Add(func(e *ModelEvent) error {
 		if m, ok := e.Model.(models.FilesManager); ok && m.BaseFilesPath() != "" {
-			if err := deletePrefix(m.BaseFilesPath()); err != nil && app.IsDebug() {
-				// non critical error - only log for debug
-				// (usually could happen because of S3 api limits)
-				log.Println(err)
-			}
+			prefix := m.BaseFilesPath()
+
+			// run in the background for "optimistic" delete to avoid
+			// blocking the delete transaction
+			//
+			// @todo consider creating a bg process queue so that the
+			// call could be "retried" in case of a failure.
+			routine.FireAndForget(func() {
+				if err := deletePrefix(prefix); err != nil && app.IsDebug() {
+					// non critical error - only log for debug
+					// (usually could happen because of S3 api limits)
+					log.Println(err)
+				}
+			})
 		}
 
 		return nil

core/base_test.go

@@ -182,238 +182,6 @@ func TestBaseAppGetters(t *testing.T) {
 	if app.onBeforeServe != app.OnBeforeServe() || app.OnBeforeServe() == nil {
 		t.Fatalf("Getter app.OnBeforeServe does not match or nil (%v vs %v)", app.OnBeforeServe(), app.onBeforeServe)
 	}
-
-	if app.onModelBeforeCreate != app.OnModelBeforeCreate() || app.OnModelBeforeCreate() == nil {
-		t.Fatalf("Getter app.OnModelBeforeCreate does not match or nil (%v vs %v)", app.OnModelBeforeCreate(), app.onModelBeforeCreate)
-	}
-
-	if app.onModelAfterCreate != app.OnModelAfterCreate() || app.OnModelAfterCreate() == nil {
-		t.Fatalf("Getter app.OnModelAfterCreate does not match or nil (%v vs %v)", app.OnModelAfterCreate(), app.onModelAfterCreate)
-	}
-
-	if app.onModelBeforeUpdate != app.OnModelBeforeUpdate() || app.OnModelBeforeUpdate() == nil {
-		t.Fatalf("Getter app.OnModelBeforeUpdate does not match or nil (%v vs %v)", app.OnModelBeforeUpdate(), app.onModelBeforeUpdate)
-	}
-
-	if app.onModelAfterUpdate != app.OnModelAfterUpdate() || app.OnModelAfterUpdate() == nil {
-		t.Fatalf("Getter app.OnModelAfterUpdate does not match or nil (%v vs %v)", app.OnModelAfterUpdate(), app.onModelAfterUpdate)
-	}
-
-	if app.onModelBeforeDelete != app.OnModelBeforeDelete() || app.OnModelBeforeDelete() == nil {
-		t.Fatalf("Getter app.OnModelBeforeDelete does not match or nil (%v vs %v)", app.OnModelBeforeDelete(), app.onModelBeforeDelete)
-	}
-
-	if app.onModelAfterDelete != app.OnModelAfterDelete() || app.OnModelAfterDelete() == nil {
-		t.Fatalf("Getter app.OnModelAfterDelete does not match or nil (%v vs %v)", app.OnModelAfterDelete(), app.onModelAfterDelete)
-	}
-
-	if app.onMailerBeforeAdminResetPasswordSend != app.OnMailerBeforeAdminResetPasswordSend() || app.OnMailerBeforeAdminResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeAdminResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerBeforeAdminResetPasswordSend(), app.onMailerBeforeAdminResetPasswordSend)
-	}
-
-	if app.onMailerAfterAdminResetPasswordSend != app.OnMailerAfterAdminResetPasswordSend() || app.OnMailerAfterAdminResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterAdminResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerAfterAdminResetPasswordSend(), app.onMailerAfterAdminResetPasswordSend)
-	}
-
-	if app.onMailerBeforeRecordResetPasswordSend != app.OnMailerBeforeRecordResetPasswordSend() || app.OnMailerBeforeRecordResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeRecordResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerBeforeRecordResetPasswordSend(), app.onMailerBeforeRecordResetPasswordSend)
-	}
-
-	if app.onMailerAfterRecordResetPasswordSend != app.OnMailerAfterRecordResetPasswordSend() || app.OnMailerAfterRecordResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterRecordResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerAfterRecordResetPasswordSend(), app.onMailerAfterRecordResetPasswordSend)
-	}
-
-	if app.onMailerBeforeRecordVerificationSend != app.OnMailerBeforeRecordVerificationSend() || app.OnMailerBeforeRecordVerificationSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeRecordVerificationSend does not match or nil (%v vs %v)", app.OnMailerBeforeRecordVerificationSend(), app.onMailerBeforeRecordVerificationSend)
-	}
-
-	if app.onMailerAfterRecordVerificationSend != app.OnMailerAfterRecordVerificationSend() || app.OnMailerAfterRecordVerificationSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterRecordVerificationSend does not match or nil (%v vs %v)", app.OnMailerAfterRecordVerificationSend(), app.onMailerAfterRecordVerificationSend)
-	}
-
-	if app.onMailerBeforeRecordChangeEmailSend != app.OnMailerBeforeRecordChangeEmailSend() || app.OnMailerBeforeRecordChangeEmailSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeRecordChangeEmailSend does not match or nil (%v vs %v)", app.OnMailerBeforeRecordChangeEmailSend(), app.onMailerBeforeRecordChangeEmailSend)
-	}
-
-	if app.onMailerAfterRecordChangeEmailSend != app.OnMailerAfterRecordChangeEmailSend() || app.OnMailerAfterRecordChangeEmailSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterRecordChangeEmailSend does not match or nil (%v vs %v)", app.OnMailerAfterRecordChangeEmailSend(), app.onMailerAfterRecordChangeEmailSend)
-	}
-
-	if app.onRealtimeConnectRequest != app.OnRealtimeConnectRequest() || app.OnRealtimeConnectRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeConnectRequest does not match or nil (%v vs %v)", app.OnRealtimeConnectRequest(), app.onRealtimeConnectRequest)
-	}
-
-	if app.onRealtimeBeforeSubscribeRequest != app.OnRealtimeBeforeSubscribeRequest() || app.OnRealtimeBeforeSubscribeRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeBeforeSubscribeRequest does not match or nil (%v vs %v)", app.OnRealtimeBeforeSubscribeRequest(), app.onRealtimeBeforeSubscribeRequest)
-	}
-
-	if app.onRealtimeAfterSubscribeRequest != app.OnRealtimeAfterSubscribeRequest() || app.OnRealtimeAfterSubscribeRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeAfterSubscribeRequest does not match or nil (%v vs %v)", app.OnRealtimeAfterSubscribeRequest(), app.onRealtimeAfterSubscribeRequest)
-	}
-
-	if app.onSettingsListRequest != app.OnSettingsListRequest() || app.OnSettingsListRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsListRequest does not match or nil (%v vs %v)", app.OnSettingsListRequest(), app.onSettingsListRequest)
-	}
-
-	if app.onSettingsBeforeUpdateRequest != app.OnSettingsBeforeUpdateRequest() || app.OnSettingsBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnSettingsBeforeUpdateRequest(), app.onSettingsBeforeUpdateRequest)
-	}
-
-	if app.onSettingsAfterUpdateRequest != app.OnSettingsAfterUpdateRequest() || app.OnSettingsAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsAfterUpdateRequest does not match or nil (%v vs %v)", app.OnSettingsAfterUpdateRequest(), app.onSettingsAfterUpdateRequest)
-	}
-
-	if app.onFileDownloadRequest != app.OnFileDownloadRequest() || app.OnFileDownloadRequest() == nil {
-		t.Fatalf("Getter app.OnFileDownloadRequest does not match or nil (%v vs %v)", app.OnFileDownloadRequest(), app.onFileDownloadRequest)
-	}
-
-	if app.onAdminsListRequest != app.OnAdminsListRequest() || app.OnAdminsListRequest() == nil {
-		t.Fatalf("Getter app.OnAdminsListRequest does not match or nil (%v vs %v)", app.OnAdminsListRequest(), app.onAdminsListRequest)
-	}
-
-	if app.onAdminViewRequest != app.OnAdminViewRequest() || app.OnAdminViewRequest() == nil {
-		t.Fatalf("Getter app.OnAdminViewRequest does not match or nil (%v vs %v)", app.OnAdminViewRequest(), app.onAdminViewRequest)
-	}
-
-	if app.onAdminBeforeCreateRequest != app.OnAdminBeforeCreateRequest() || app.OnAdminBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeCreateRequest does not match or nil (%v vs %v)", app.OnAdminBeforeCreateRequest(), app.onAdminBeforeCreateRequest)
-	}
-
-	if app.onAdminAfterCreateRequest != app.OnAdminAfterCreateRequest() || app.OnAdminAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterCreateRequest does not match or nil (%v vs %v)", app.OnAdminAfterCreateRequest(), app.onAdminAfterCreateRequest)
-	}
-
-	if app.onAdminBeforeUpdateRequest != app.OnAdminBeforeUpdateRequest() || app.OnAdminBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnAdminBeforeUpdateRequest(), app.onAdminBeforeUpdateRequest)
-	}
-
-	if app.onAdminAfterUpdateRequest != app.OnAdminAfterUpdateRequest() || app.OnAdminAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterUpdateRequest does not match or nil (%v vs %v)", app.OnAdminAfterUpdateRequest(), app.onAdminAfterUpdateRequest)
-	}
-
-	if app.onAdminBeforeDeleteRequest != app.OnAdminBeforeDeleteRequest() || app.OnAdminBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnAdminBeforeDeleteRequest(), app.onAdminBeforeDeleteRequest)
-	}
-
-	if app.onAdminAfterDeleteRequest != app.OnAdminAfterDeleteRequest() || app.OnAdminAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterDeleteRequest does not match or nil (%v vs %v)", app.OnAdminAfterDeleteRequest(), app.onAdminAfterDeleteRequest)
-	}
-
-	if app.onAdminAuthRequest != app.OnAdminAuthRequest() || app.OnAdminAuthRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAuthRequest does not match or nil (%v vs %v)", app.OnAdminAuthRequest(), app.onAdminAuthRequest)
-	}
-
-	if app.onRecordsListRequest != app.OnRecordsListRequest() || app.OnRecordsListRequest() == nil {
-		t.Fatalf("Getter app.OnRecordsListRequest does not match or nil (%v vs %v)", app.OnRecordsListRequest(), app.onRecordsListRequest)
-	}
-
-	if app.onRecordViewRequest != app.OnRecordViewRequest() || app.OnRecordViewRequest() == nil {
-		t.Fatalf("Getter app.OnRecordViewRequest does not match or nil (%v vs %v)", app.OnRecordViewRequest(), app.onRecordViewRequest)
-	}
-
-	if app.onRecordBeforeCreateRequest != app.OnRecordBeforeCreateRequest() || app.OnRecordBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeCreateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeCreateRequest(), app.onRecordBeforeCreateRequest)
-	}
-
-	if app.onRecordAfterCreateRequest != app.OnRecordAfterCreateRequest() || app.OnRecordAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterCreateRequest does not match or nil (%v vs %v)", app.OnRecordAfterCreateRequest(), app.onRecordAfterCreateRequest)
-	}
-
-	if app.onRecordBeforeUpdateRequest != app.OnRecordBeforeUpdateRequest() || app.OnRecordBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeUpdateRequest(), app.onRecordBeforeUpdateRequest)
-	}
-
-	if app.onRecordAfterUpdateRequest != app.OnRecordAfterUpdateRequest() || app.OnRecordAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterUpdateRequest does not match or nil (%v vs %v)", app.OnRecordAfterUpdateRequest(), app.onRecordAfterUpdateRequest)
-	}
-
-	if app.onRecordBeforeDeleteRequest != app.OnRecordBeforeDeleteRequest() || app.OnRecordBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnRecordBeforeDeleteRequest(), app.onRecordBeforeDeleteRequest)
-	}
-
-	if app.onRecordAfterDeleteRequest != app.OnRecordAfterDeleteRequest() || app.OnRecordAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterDeleteRequest does not match or nil (%v vs %v)", app.OnRecordAfterDeleteRequest(), app.onRecordAfterDeleteRequest)
-	}
-
-	if app.onRecordAuthRequest != app.OnRecordAuthRequest() || app.OnRecordAuthRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAuthRequest does not match or nil (%v vs %v)", app.OnRecordAuthRequest(), app.onRecordAuthRequest)
-	}
-
-	if app.onRecordListExternalAuthsRequest != app.OnRecordListExternalAuthsRequest() || app.OnRecordListExternalAuthsRequest() == nil {
-		t.Fatalf("Getter app.OnRecordListExternalAuthsRequest does not match or nil (%v vs %v)", app.OnRecordListExternalAuthsRequest(), app.onRecordListExternalAuthsRequest)
-	}
-
-	if app.onRecordBeforeUnlinkExternalAuthRequest != app.OnRecordBeforeUnlinkExternalAuthRequest() || app.OnRecordBeforeUnlinkExternalAuthRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeUnlinkExternalAuthRequest does not match or nil (%v vs %v)", app.OnRecordBeforeUnlinkExternalAuthRequest(), app.onRecordBeforeUnlinkExternalAuthRequest)
-	}
-
-	if app.onRecordAfterUnlinkExternalAuthRequest != app.OnRecordAfterUnlinkExternalAuthRequest() || app.OnRecordAfterUnlinkExternalAuthRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterUnlinkExternalAuthRequest does not match or nil (%v vs %v)", app.OnRecordAfterUnlinkExternalAuthRequest(), app.onRecordAfterUnlinkExternalAuthRequest)
-	}
-
-	if app.onRecordsListRequest != app.OnRecordsListRequest() || app.OnRecordsListRequest() == nil {
-		t.Fatalf("Getter app.OnRecordsListRequest does not match or nil (%v vs %v)", app.OnRecordsListRequest(), app.onRecordsListRequest)
-	}
-
-	if app.onRecordViewRequest != app.OnRecordViewRequest() || app.OnRecordViewRequest() == nil {
-		t.Fatalf("Getter app.OnRecordViewRequest does not match or nil (%v vs %v)", app.OnRecordViewRequest(), app.onRecordViewRequest)
-	}
-
-	if app.onRecordBeforeCreateRequest != app.OnRecordBeforeCreateRequest() || app.OnRecordBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeCreateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeCreateRequest(), app.onRecordBeforeCreateRequest)
-	}
-
-	if app.onRecordAfterCreateRequest != app.OnRecordAfterCreateRequest() || app.OnRecordAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterCreateRequest does not match or nil (%v vs %v)", app.OnRecordAfterCreateRequest(), app.onRecordAfterCreateRequest)
-	}
-
-	if app.onRecordBeforeUpdateRequest != app.OnRecordBeforeUpdateRequest() || app.OnRecordBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeUpdateRequest(), app.onRecordBeforeUpdateRequest)
-	}
-
-	if app.onRecordAfterUpdateRequest != app.OnRecordAfterUpdateRequest() || app.OnRecordAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterUpdateRequest does not match or nil (%v vs %v)", app.OnRecordAfterUpdateRequest(), app.onRecordAfterUpdateRequest)
-	}
-
-	if app.onRecordBeforeDeleteRequest != app.OnRecordBeforeDeleteRequest() || app.OnRecordBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnRecordBeforeDeleteRequest(), app.onRecordBeforeDeleteRequest)
-	}
-
-	if app.onRecordAfterDeleteRequest != app.OnRecordAfterDeleteRequest() || app.OnRecordAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterDeleteRequest does not match or nil (%v vs %v)", app.OnRecordAfterDeleteRequest(), app.onRecordAfterDeleteRequest)
-	}
-
-	if app.onCollectionsListRequest != app.OnCollectionsListRequest() || app.OnCollectionsListRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionsListRequest does not match or nil (%v vs %v)", app.OnCollectionsListRequest(), app.onCollectionsListRequest)
-	}
-
-	if app.onCollectionViewRequest != app.OnCollectionViewRequest() || app.OnCollectionViewRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionViewRequest does not match or nil (%v vs %v)", app.OnCollectionViewRequest(), app.onCollectionViewRequest)
-	}
-
-	if app.onCollectionBeforeCreateRequest != app.OnCollectionBeforeCreateRequest() || app.OnCollectionBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeCreateRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeCreateRequest(), app.onCollectionBeforeCreateRequest)
-	}
-
-	if app.onCollectionAfterCreateRequest != app.OnCollectionAfterCreateRequest() || app.OnCollectionAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterCreateRequest does not match or nil (%v vs %v)", app.OnCollectionAfterCreateRequest(), app.onCollectionAfterCreateRequest)
-	}
-
-	if app.onCollectionBeforeUpdateRequest != app.OnCollectionBeforeUpdateRequest() || app.OnCollectionBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeUpdateRequest(), app.onCollectionBeforeUpdateRequest)
-	}
-
-	if app.onCollectionAfterUpdateRequest != app.OnCollectionAfterUpdateRequest() || app.OnCollectionAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterUpdateRequest does not match or nil (%v vs %v)", app.OnCollectionAfterUpdateRequest(), app.onCollectionAfterUpdateRequest)
-	}
-
-	if app.onCollectionBeforeDeleteRequest != app.OnCollectionBeforeDeleteRequest() || app.OnCollectionBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeDeleteRequest(), app.onCollectionBeforeDeleteRequest)
-	}
-
-	if app.onCollectionAfterDeleteRequest != app.OnCollectionAfterDeleteRequest() || app.OnCollectionAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterDeleteRequest does not match or nil (%v vs %v)", app.OnCollectionAfterDeleteRequest(), app.onCollectionAfterDeleteRequest)
-	}
 }
 
 func TestBaseAppNewMailClient(t *testing.T) {

core/db.go

@@ -11,7 +11,7 @@ func initPragmas(db *dbx.DB) error {
 	_, err := db.NewQuery(`
 		PRAGMA busy_timeout       = 10000;
 		PRAGMA journal_mode       = WAL;
-		PRAGMA journal_size_limit = 100000000;
+		PRAGMA journal_size_limit = 200000000;
 		PRAGMA synchronous        = NORMAL;
 		PRAGMA foreign_keys       = TRUE;
 	`).Execute()

core/events.go

@@ -5,6 +5,8 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/models/settings"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
@@ -12,6 +14,28 @@ import (
 	"github.com/labstack/echo/v5"
 )
 
+type BaseCollectionEvent struct {
+	Collection *models.Collection
+}
+
+func (e *BaseCollectionEvent) Tags() []string {
+	if e.Collection == nil {
+		return nil
+	}
+
+	tags := make([]string, 0, 2)
+
+	if e.Collection.Id != "" {
+		tags = append(tags, e.Collection.Id)
+	}
+
+	if e.Collection.Name != "" {
+		tags = append(tags, e.Collection.Name)
+	}
+
+	return tags
+}
+
 // -------------------------------------------------------------------
 // Serve events data
 // -------------------------------------------------------------------
@@ -34,16 +58,32 @@ type ApiErrorEvent struct {
 // Model DAO events data
 // -------------------------------------------------------------------
 
+var _ hook.Tagger = (*ModelEvent)(nil)
+
 type ModelEvent struct {
 	Dao   *daos.Dao
 	Model models.Model
 }
 
+func (e *ModelEvent) Tags() []string {
+	if e.Model == nil {
+		return nil
+	}
+
+	if r, ok := e.Model.(*models.Record); ok && r.Collection() != nil {
+		return []string{r.Collection().Id, r.Collection().Name}
+	}
+
+	return []string{e.Model.TableName()}
+}
+
 // -------------------------------------------------------------------
 // Mailer events data
 // -------------------------------------------------------------------
 
 type MailerRecordEvent struct {
+	BaseCollectionEvent
+
 	MailClient mailer.Mailer
 	Message    *mailer.Message
 	Record     *models.Record
@@ -103,28 +143,37 @@ type SettingsUpdateEvent struct {
 // -------------------------------------------------------------------
 
 type RecordsListEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 	Records     []*models.Record
 	Result      *search.Result
 }
 
 type RecordViewEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordCreateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordUpdateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordDeleteEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
@@ -134,49 +183,91 @@ type RecordDeleteEvent struct {
 // -------------------------------------------------------------------
 
 type RecordAuthEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 	Token       string
 	Meta        any
 }
 
+type RecordAuthWithPasswordEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+	Identity    string
+	Password    string
+}
+
+type RecordAuthWithOAuth2Event struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+	OAuth2User  *auth.AuthUser
+}
+
+type RecordAuthRefreshEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
 type RecordRequestPasswordResetEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordConfirmPasswordResetEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordRequestVerificationEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordConfirmVerificationEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordRequestEmailChangeEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordConfirmEmailChangeEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordListExternalAuthsEvent struct {
+	BaseCollectionEvent
+
 	HttpContext   echo.Context
 	Record        *models.Record
 	ExternalAuths []*models.ExternalAuth
 }
 
 type RecordUnlinkExternalAuthEvent struct {
+	BaseCollectionEvent
+
 	HttpContext  echo.Context
 	Record       *models.Record
 	ExternalAuth *models.ExternalAuth
@@ -218,6 +309,28 @@ type AdminAuthEvent struct {
 	Token       string
 }
 
+type AdminAuthWithPasswordEvent struct {
+	HttpContext echo.Context
+	Admin       *models.Admin
+	Identity    string
+	Password    string
+}
+
+type AdminAuthRefreshEvent struct {
+	HttpContext echo.Context
+	Admin       *models.Admin
+}
+
+type AdminRequestPasswordResetEvent struct {
+	HttpContext echo.Context
+	Admin       *models.Admin
+}
+
+type AdminConfirmPasswordResetEvent struct {
+	HttpContext echo.Context
+	Admin       *models.Admin
+}
+
 // -------------------------------------------------------------------
 // Collection API events data
 // -------------------------------------------------------------------
@@ -229,23 +342,27 @@ type CollectionsListEvent struct {
 }
 
 type CollectionViewEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionCreateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionUpdateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionDeleteEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionsImportEvent struct {
@@ -258,8 +375,9 @@ type CollectionsImportEvent struct {
 // -------------------------------------------------------------------
 
 type FileDownloadEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 	Record      *models.Record
 	FileField   *schema.SchemaField
 	ServedPath  string

core/events_test.go

@@ -0,0 +1,84 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestBaseCollectionEventTags(t *testing.T) {
+	c1 := new(models.Collection)
+
+	c2 := new(models.Collection)
+	c2.Id = "a"
+
+	c3 := new(models.Collection)
+	c3.Name = "b"
+
+	c4 := new(models.Collection)
+	c4.Id = "a"
+	c4.Name = "b"
+
+	scenarios := []struct {
+		collection   *models.Collection
+		expectedTags []string
+	}{
+		{c1, []string{}},
+		{c2, []string{"a"}},
+		{c3, []string{"b"}},
+		{c4, []string{"a", "b"}},
+	}
+
+	for i, s := range scenarios {
+		event := new(core.BaseCollectionEvent)
+		event.Collection = s.collection
+
+		tags := event.Tags()
+
+		if len(s.expectedTags) != len(tags) {
+			t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+		}
+
+		for _, tag := range s.expectedTags {
+			if !list.ExistInSlice(tag, tags) {
+				t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+			}
+		}
+	}
+}
+
+func TestModelEventTags(t *testing.T) {
+	m1 := new(models.Admin)
+
+	c := new(models.Collection)
+	c.Id = "a"
+	c.Name = "b"
+	m2 := models.NewRecord(c)
+
+	scenarios := []struct {
+		model        models.Model
+		expectedTags []string
+	}{
+		{m1, []string{"_admins"}},
+		{m2, []string{"a", "b"}},
+	}
+
+	for i, s := range scenarios {
+		event := new(core.ModelEvent)
+		event.Model = s.model
+
+		tags := event.Tags()
+
+		if len(s.expectedTags) != len(tags) {
+			t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+		}
+
+		for _, tag := range s.expectedTags {
+			if !list.ExistInSlice(tag, tags) {
+				t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+			}
+		}
+	}
+}

daos/admin.go

@@ -97,8 +97,8 @@ func (dao *Dao) IsAdminEmailUnique(email string, excludeIds ...string) bool {
 		AndWhere(dbx.HashExp{"email": email}).
 		Limit(1)
 
-	if len(excludeIds) > 0 {
-		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(excludeIds)...))
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
 	}
 
 	var exists bool

daos/collection.go

@@ -65,8 +65,7 @@ func (dao *Dao) IsCollectionNameUnique(name string, excludeIds ...string) bool {
 		AndWhere(dbx.NewExp("LOWER([[name]])={:name}", dbx.Params{"name": strings.ToLower(name)})).
 		Limit(1)
 
-	if len(excludeIds) > 0 {
-		uniqueExcludeIds := list.NonzeroUniques(excludeIds)
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
 		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
 	}
 
@@ -85,15 +84,17 @@ func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeI
 	collections := []*models.Collection{}
 
 	query := dao.CollectionQuery()
-	if len(excludeIds) > 0 {
-		uniqueExcludeIds := list.NonzeroUniques(excludeIds)
+
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
 		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
 	}
+
 	if err := query.All(&collections); err != nil {
 		return nil, err
 	}
 
 	result := map[*models.Collection][]*schema.SchemaField{}
+
 	for _, c := range collections {
 		for _, f := range c.Schema.Fields() {
 			if f.Type != schema.FieldTypeRelation {

daos/collection_test.go

@@ -37,7 +37,7 @@ func TestFindCollectionsByType(t *testing.T) {
 		{"", false, 0},
 		{"unknown", false, 0},
 		{models.CollectionTypeAuth, false, 3},
-		{models.CollectionTypeBase, false, 4},
+		{models.CollectionTypeBase, false, 5},
 	}
 
 	for i, scenario := range scenarios {
@@ -122,7 +122,13 @@ func TestFindCollectionReferences(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	result, err := app.Dao().FindCollectionReferences(collection, collection.Id)
+	result, err := app.Dao().FindCollectionReferences(
+		collection,
+		collection.Id,
+		// test whether "nonempty" exclude ids condition will be skipped
+		"",
+		"",
+	)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -296,7 +302,7 @@ func TestImportCollections(t *testing.T) {
 			name:                   "empty collections",
 			jsonData:               `[]`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 		},
 		{
 			name: "minimal collection import",
@@ -306,7 +312,7 @@ func TestImportCollections(t *testing.T) {
 			]`,
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 9,
+			expectCollectionsCount: 10,
 		},
 		{
 			name: "minimal collection import + failed beforeRecordsSync",
@@ -318,7 +324,7 @@ func TestImportCollections(t *testing.T) {
 			},
 			deleteMissing:          false,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 		},
 		{
 			name: "minimal collection import + successful beforeRecordsSync",
@@ -330,7 +336,7 @@ func TestImportCollections(t *testing.T) {
 			},
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 8,
+			expectCollectionsCount: 9,
 		},
 		{
 			name: "new + update + delete system collection",
@@ -366,7 +372,7 @@ func TestImportCollections(t *testing.T) {
 			]`,
 			deleteMissing:          true,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 		},
 		{
 			name: "new + update + delete non-system collection",
@@ -495,7 +501,7 @@ func TestImportCollections(t *testing.T) {
 			]`,
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 8,
+			expectCollectionsCount: 9,
 			afterTestFunc: func(testApp *tests.TestApp, resultCollections []*models.Collection) {
 				expectedCollectionFields := map[string]int{
 					"nologin":    1,
@@ -503,6 +509,7 @@ func TestImportCollections(t *testing.T) {
 					"demo2":      2,
 					"demo3":      2,
 					"demo4":      11,
+					"demo5":      5,
 					"new_import": 1,
 				}
 				for name, expectedCount := range expectedCollectionFields {

daos/record.go

@@ -3,7 +3,6 @@ package daos
 import (
 	"errors"
 	"fmt"
-	"math"
 	"strings"
 
 	"github.com/pocketbase/dbx"
@@ -84,7 +83,7 @@ func (dao *Dao) FindRecordsByIds(
 		}
 	}
 
-	rows := []dbx.NullStringMap{}
+	rows := make([]dbx.NullStringMap, 0, len(recordIds))
 	if err := query.All(&rows); err != nil {
 		return nil, err
 	}
@@ -99,6 +98,7 @@ func (dao *Dao) FindRecordsByIds(
 // Returns an empty slice if no records are found.
 //
 // Example:
+//
 //	expr1 := dbx.HashExp{"email": "test@example.com"}
 //	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
 //	dao.FindRecordsByExpr("example", expr1, expr2)
@@ -192,8 +192,7 @@ func (dao *Dao) IsRecordValueUnique(
 		AndWhere(expr).
 		Limit(1)
 
-	if len(excludeIds) > 0 {
-		uniqueExcludeIds := list.NonzeroUniques(excludeIds)
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
 		query.AndWhere(dbx.NotIn(collection.Name+".id", list.ToInterfaceSlice(uniqueExcludeIds)...))
 	}
 
@@ -390,8 +389,7 @@ func (dao *Dao) DeleteRecord(record *models.Record) error {
 	})
 }
 
-// cascadeRecordDelete triggers cascade deletion for the provided references
-// and split the work to a batched set of go routines.
+// cascadeRecordDelete triggers cascade deletion for the provided references.
 //
 // NB! This method is expected to be called inside a transaction.
 func (dao *Dao) cascadeRecordDelete(mainRecord *models.Record, refs map[*models.Collection][]*schema.SchemaField) error {
@@ -401,20 +399,24 @@ func (dao *Dao) cascadeRecordDelete(mainRecord *models.Record, refs map[*models.
 		for _, field := range fields {
 			recordTableName := inflector.Columnify(refCollection.Name)
 			prefixedFieldName := recordTableName + "." + inflector.Columnify(field.Name)
+
+			// @todo optimize single relation lookup in v0.12+
 			query := dao.RecordQuery(refCollection).
 				Distinct(true).
-				LeftJoin(fmt.Sprintf(
-					// note: the case is used to normalize value access for single and multiple relations.
+				InnerJoin(fmt.Sprintf(
+					// note: the case is used to normalize the value access
 					`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) as {{%s}}`,
 					prefixedFieldName, prefixedFieldName, prefixedFieldName, uniqueJsonEachAlias,
-				), nil).
-				AndWhere(dbx.Not(dbx.HashExp{recordTableName + ".id": mainRecord.Id})).
-				AndWhere(dbx.HashExp{uniqueJsonEachAlias + ".value": mainRecord.Id})
+				), dbx.HashExp{uniqueJsonEachAlias + ".value": mainRecord.Id})
 
-			// trigger cascade for each 1000 rel items until there is none
-			batchSize := 1000
+			if refCollection.Id == mainRecord.Collection().Id {
+				query.AndWhere(dbx.Not(dbx.HashExp{recordTableName + ".id": mainRecord.Id}))
+			}
+
+			// trigger cascade for each batchSize rel items until there is none
+			batchSize := 4000
+			rows := make([]dbx.NullStringMap, 0, batchSize)
 			for {
-				rows := make([]dbx.NullStringMap, 0, batchSize)
 				if err := query.Limit(int64(batchSize)).All(&rows); err != nil {
 					return err
 				}
@@ -424,45 +426,18 @@ func (dao *Dao) cascadeRecordDelete(mainRecord *models.Record, refs map[*models.
 					break
 				}
 
-				perWorker := 50
-				workers := int(math.Ceil(float64(total) / float64(perWorker)))
+				refRecords := models.NewRecordsFromNullStringMaps(refCollection, rows)
 
-				batchErr := func() error {
-					ch := make(chan error)
-					defer close(ch)
-
-					for i := 0; i < workers; i++ {
-						var chunks []dbx.NullStringMap
-						if len(rows) <= perWorker {
-							chunks = rows
-							rows = nil
-						} else {
-							chunks = rows[:perWorker]
-							rows = rows[perWorker:]
-						}
-
-						go func() {
-							refRecords := models.NewRecordsFromNullStringMaps(refCollection, chunks)
-							ch <- dao.deleteRefRecords(mainRecord, refRecords, field)
-						}()
-					}
-
-					for i := 0; i < workers; i++ {
-						if err := <-ch; err != nil {
-							return err
-						}
-					}
-
-					return nil
-				}()
-
-				if batchErr != nil {
-					return batchErr
+				err := dao.deleteRefRecords(mainRecord, refRecords, field)
+				if err != nil {
+					return err
 				}
 
 				if total < batchSize {
 					break // no more items
 				}
+
+				rows = rows[:0] // keep allocated memory
 			}
 		}
 	}

daos/record_expand.go

@@ -97,6 +97,8 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 			recordIds[i] = record.Id
 		}
 
+		// @todo after the index optimizations consider allowing
+		// indirect expand for multi-relation fields
 		indirectRecords, err := dao.FindRecordsByExpr(
 			indirectRel.Id,
 			dbx.In(inflector.Columnify(matches[2]), recordIds...),

daos/record_table_sync.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
@@ -82,6 +83,8 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 		newTableName := newCollection.Name
 		oldSchema := oldCollection.Schema
 		newSchema := newCollection.Schema
+		deletedFieldNames := []string{}
+		renamedFieldNames := map[string]string{}
 
 		// check for renamed table
 		if !strings.EqualFold(oldTableName, newTableName) {
@@ -101,6 +104,8 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 			if err != nil {
 				return err
 			}
+
+			deletedFieldNames = append(deletedFieldNames, oldField.Name)
 		}
 
 		// check for new or renamed columns
@@ -131,6 +136,8 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 				if err != nil {
 					return err
 				}
+
+				renamedFieldNames[oldField.Name] = field.Name
 			}
 		}
 
@@ -142,6 +149,50 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 			}
 		}
 
-		return nil
+		return txDao.syncCollectionReferences(newCollection, renamedFieldNames, deletedFieldNames)
 	})
 }
+
+func (dao *Dao) syncCollectionReferences(collection *models.Collection, renamedFieldNames map[string]string, deletedFieldNames []string) error {
+	if len(renamedFieldNames) == 0 && len(deletedFieldNames) == 0 {
+		return nil // nothing to sync
+	}
+
+	refs, err := dao.FindCollectionReferences(collection)
+	if err != nil {
+		return err
+	}
+
+	for refCollection, refFields := range refs {
+		for _, refField := range refFields {
+			options, _ := refField.Options.(*schema.RelationOptions)
+			if options == nil {
+				continue
+			}
+
+			// remove deleted (if any)
+			newDisplayFields := list.SubtractSlice(options.DisplayFields, deletedFieldNames)
+
+			for old, new := range renamedFieldNames {
+				for i, name := range newDisplayFields {
+					if name == old {
+						newDisplayFields[i] = new
+					}
+				}
+			}
+
+			// has changes
+			if len(list.SubtractSlice(options.DisplayFields, newDisplayFields)) > 0 {
+				options.DisplayFields = newDisplayFields
+
+				// direct collection save to prevent self-referencing
+				// recursion and unnecessary records table sync checks
+				if err := dao.Save(refCollection); err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}

daos/record_test.go

@@ -663,11 +663,11 @@ func TestDeleteRecord(t *testing.T) {
 	}
 	// ensure that the json rel fields were prefixed
 	joinedQueries := strings.Join(calledQueries, " ")
-	expectedRelManyJoin := "`demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END)"
+	expectedRelManyJoin := "`demo1` INNER JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END)"
 	if !strings.Contains(joinedQueries, expectedRelManyJoin) {
 		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelManyJoin, calledQueries)
 	}
-	expectedRelOneJoin := "`demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_one]]) THEN [[demo1.rel_one]] ELSE json_array([[demo1.rel_one]]) END)"
+	expectedRelOneJoin := "`demo1` INNER JOIN json_each(CASE WHEN json_valid([[demo1.rel_one]]) THEN [[demo1.rel_one]] ELSE json_array([[demo1.rel_one]]) END)"
 	if !strings.Contains(joinedQueries, expectedRelOneJoin) {
 		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelOneJoin, calledQueries)
 	}
@@ -693,6 +693,12 @@ func TestDeleteRecordBatchProcessing(t *testing.T) {
 		t.Fatal("The main record wasn't deleted")
 	}
 
+	// check if the c1 b rel field were updated
+	c1RecordB, err := app.Dao().FindRecordById("c1", "b")
+	if err != nil || c1RecordB.GetString("rel") != "" {
+		t.Fatalf("Expected c1RecordB.rel to be nil, got %v", c1RecordB.GetString("rel"))
+	}
+
 	// check if the c2 rel fields were updated
 	c2Records, err := app.Dao().FindRecordsByExpr("c2", nil)
 	if err != nil || len(c2Records) == 0 {
@@ -725,6 +731,16 @@ func createMockBatchProcessingData(dao *daos.Dao) error {
 			Name: "text",
 			Type: schema.FieldTypeText,
 		},
+		// self reference
+		&schema.SchemaField{
+			Name: "rel",
+			Type: schema.FieldTypeRelation,
+			Options: &schema.RelationOptions{
+				MaxSelect:     types.Pointer(1),
+				CollectionId:  "c1",
+				CascadeDelete: false, // should unset all rel fields
+			},
+		},
 	)
 	if err := dao.SaveCollection(c1); err != nil {
 		return err
@@ -771,15 +787,17 @@ func createMockBatchProcessingData(dao *daos.Dao) error {
 	// insert mock records
 	c1RecordA := models.NewRecord(c1)
 	c1RecordA.Id = "a"
+	c1RecordA.Set("rel", c1RecordA.Id) // self reference
 	if err := dao.Save(c1RecordA); err != nil {
 		return err
 	}
 	c1RecordB := models.NewRecord(c1)
 	c1RecordB.Id = "b"
+	c1RecordB.Set("rel", c1RecordA.Id) // rel to another record from the same collection
 	if err := dao.Save(c1RecordB); err != nil {
 		return err
 	}
-	for i := 0; i < 2400; i++ {
+	for i := 0; i < 4500; i++ {
 		c2Record := models.NewRecord(c2)
 		c2Record.Set("rel", []string{c1RecordA.Id, c1RecordB.Id})
 		if err := dao.Save(c2Record); err != nil {
@@ -793,5 +811,14 @@ func createMockBatchProcessingData(dao *daos.Dao) error {
 		}
 	}
 
+	// set the same id as the relation for at least 1 record
+	// to check whether the correct condition will be added
+	c3Record := models.NewRecord(c3)
+	c3Record.Set("rel", c1RecordA.Id)
+	c3Record.Id = c1RecordA.Id
+	if err := dao.Save(c3Record); err != nil {
+		return err
+	}
+
 	return nil
 }

forms/admin_login.go

@@ -1,6 +1,7 @@
 package forms
 
 import (
+	"database/sql"
 	"errors"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -46,19 +47,34 @@ func (form *AdminLogin) Validate() error {
 
 // Submit validates and submits the admin form.
 // On success returns the authorized admin model.
-func (form *AdminLogin) Submit() (*models.Admin, error) {
+//
+// You can optionally provide a list of InterceptorFunc to
+// further modify the form behavior before persisting it.
+func (form *AdminLogin) Submit(interceptors ...InterceptorFunc[*models.Admin]) (*models.Admin, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
 
-	admin, err := form.dao.FindAdminByEmail(form.Identity)
-	if err != nil {
-		return nil, err
+	admin, fetchErr := form.dao.FindAdminByEmail(form.Identity)
+
+	// ignore not found errors to allow custom fetch implementations
+	if fetchErr != nil && !errors.Is(fetchErr, sql.ErrNoRows) {
+		return nil, fetchErr
 	}
 
-	if admin.ValidatePassword(form.Password) {
-		return admin, nil
+	interceptorsErr := runInterceptors(admin, func(m *models.Admin) error {
+		admin = m
+
+		if admin == nil || !admin.ValidatePassword(form.Password) {
+			return errors.New("Invalid login credentials.")
+		}
+
+		return nil
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
-	return nil, errors.New("Invalid login credentials.")
+	return admin, nil
 }

forms/admin_login_test.go

@@ -1,9 +1,11 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -47,3 +49,48 @@ func TestAdminLoginValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminLoginInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	form := forms.NewAdminLogin(testApp)
+	form.Identity = "test@example.com"
+	form.Password = "123456"
+	var interceptorAdmin *models.Admin
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorAdmin = admin
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorAdmin == nil || interceptorAdmin.Email != form.Identity {
+		t.Fatalf("Expected Admin model with email %s, got %v", form.Identity, interceptorAdmin)
+	}
+}

forms/admin_password_reset_confirm.go

@@ -63,7 +63,10 @@ func (form *AdminPasswordResetConfirm) checkToken(value any) error {
 
 // Submit validates and submits the admin password reset confirmation form.
 // On success returns the updated admin model associated to `form.Token`.
-func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
+//
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *AdminPasswordResetConfirm) Submit(interceptors ...InterceptorFunc[*models.Admin]) (*models.Admin, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -80,8 +83,13 @@ func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
 		return nil, err
 	}
 
-	if err := form.dao.SaveAdmin(admin); err != nil {
-		return nil, err
+	interceptorsErr := runInterceptors(admin, func(m *models.Admin) error {
+		admin = m
+		return form.dao.SaveAdmin(m)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
 	return admin, nil

forms/admin_password_reset_confirm_test.go

@@ -1,9 +1,11 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -54,7 +56,24 @@ func TestAdminPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 		form.Password = s.password
 		form.PasswordConfirm = s.passwordConfirm
 
-		admin, err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
+				interceptorCalls++
+				return next(m)
+			}
+		}
+
+		admin, err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -78,3 +97,54 @@ func TestAdminPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminPasswordResetConfirmInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewAdminPasswordResetConfirm(testApp)
+	form.Token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc"
+	form.Password = "1234567891"
+	form.PasswordConfirm = "1234567891"
+	interceptorTokenKey := admin.TokenKey
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorTokenKey = admin.TokenKey
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorTokenKey == admin.TokenKey {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/admin_password_reset_request.go

@@ -9,6 +9,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -55,7 +56,10 @@ func (form *AdminPasswordResetRequest) Validate() error {
 
 // Submit validates and submits the form.
 // On success sends a password reset email to the `form.Email` admin.
-func (form *AdminPasswordResetRequest) Submit() error {
+//
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *AdminPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*models.Admin]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -71,12 +75,14 @@ func (form *AdminPasswordResetRequest) Submit() error {
 		return errors.New("You have already requested a password reset.")
 	}
 
-	if err := mails.SendAdminPasswordReset(form.app, admin); err != nil {
-		return err
-	}
-
 	// update last sent timestamp
 	admin.LastResetSentAt = types.NowDateTime()
 
-	return form.dao.SaveAdmin(admin)
+	return runInterceptors(admin, func(m *models.Admin) error {
+		if err := mails.SendAdminPasswordReset(form.app, m); err != nil {
+			return err
+		}
+
+		return form.dao.SaveAdmin(m)
+	}, interceptors...)
 }

forms/admin_password_reset_request_test.go

@@ -1,9 +1,11 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -31,7 +33,24 @@ func TestAdminPasswordResetRequestValidateAndSubmit(t *testing.T) {
 
 		adminBefore, _ := testApp.Dao().FindAdminByEmail(s.email)
 
-		err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
+				interceptorCalls++
+				return next(m)
+			}
+		}
+
+		err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -53,3 +72,52 @@ func TestAdminPasswordResetRequestValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminPasswordResetRequestInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewAdminPasswordResetRequest(testApp)
+	form.Email = admin.Email
+	interceptorLastResetSentAt := admin.LastResetSentAt
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorLastResetSentAt = admin.LastResetSentAt
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorLastResetSentAt.String() == admin.LastResetSentAt.String() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/admin_upsert.go

@@ -57,6 +57,7 @@ func (form *AdminUpsert) Validate() error {
 				form.admin.IsNew(),
 				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
 				validation.Match(idRegex),
+				validation.By(validators.UniqueId(form.dao, form.admin.TableName())),
 			).Else(validation.In(form.admin.Id)),
 		),
 		validation.Field(
@@ -98,7 +99,7 @@ func (form *AdminUpsert) checkUniqueEmail(value any) error {
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
+func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc[*models.Admin]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -116,7 +117,7 @@ func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
 		form.admin.SetPassword(form.Password)
 	}
 
-	return runInterceptors(func() error {
-		return form.dao.SaveAdmin(form.admin)
+	return runInterceptors(form.admin, func(admin *models.Admin) error {
+		return form.dao.SaveAdmin(admin)
 	}, interceptors...)
 }

forms/admin_upsert_test.go

@@ -137,10 +137,10 @@ func TestAdminUpsertValidateAndSubmit(t *testing.T) {
 
 		interceptorCalls := 0
 
-		err := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-			return func() error {
+		err := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
 				interceptorCalls++
-				return next()
+				return next(m)
 			}
 		})
 
@@ -196,16 +196,16 @@ func TestAdminUpsertSubmitInterceptors(t *testing.T) {
 	interceptorAdminEmail := ""
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
 			interceptor1Called = true
-			return next()
+			return next(m)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
 			interceptorAdminEmail = admin.Email // to check if the record was filled
 			interceptor2Called = true
 			return testErr

forms/base.go

@@ -4,8 +4,6 @@ package forms
 
 import (
 	"regexp"
-
-	"github.com/pocketbase/pocketbase/models"
 )
 
 // base ID value regex pattern
@@ -13,32 +11,21 @@ var idRegex = regexp.MustCompile(`^[^\@\#\$\&\|\.\,\'\"\\\/\s]+$`)
 
 // InterceptorNextFunc is a interceptor handler function.
 // Usually used in combination with InterceptorFunc.
-type InterceptorNextFunc = func() error
+type InterceptorNextFunc[T any] func(t T) error
 
 // InterceptorFunc defines a single interceptor function that
 // will execute the provided next func handler.
-type InterceptorFunc func(next InterceptorNextFunc) InterceptorNextFunc
+type InterceptorFunc[T any] func(next InterceptorNextFunc[T]) InterceptorNextFunc[T]
 
 // runInterceptors executes the provided list of interceptors.
-func runInterceptors(next InterceptorNextFunc, interceptors ...InterceptorFunc) error {
+func runInterceptors[T any](
+	data T,
+	next InterceptorNextFunc[T],
+	interceptors ...InterceptorFunc[T],
+) error {
 	for i := len(interceptors) - 1; i >= 0; i-- {
 		next = interceptors[i](next)
 	}
-	return next()
-}
 
-// InterceptorWithRecordNextFunc is a Record interceptor handler function.
-// Usually used in combination with InterceptorWithRecordFunc.
-type InterceptorWithRecordNextFunc = func(record *models.Record) error
-
-// InterceptorWithRecordFunc defines a single Record interceptor function
-// that will execute the provided next func handler.
-type InterceptorWithRecordFunc func(next InterceptorWithRecordNextFunc) InterceptorWithRecordNextFunc
-
-// runInterceptorsWithRecord executes the provided list of Record interceptors.
-func runInterceptorsWithRecord(record *models.Record, next InterceptorWithRecordNextFunc, interceptors ...InterceptorWithRecordFunc) error {
-	for i := len(interceptors) - 1; i >= 0; i-- {
-		next = interceptors[i](next)
-	}
-	return next(record)
+	return next(data)
 }

forms/collection_upsert.go

@@ -9,6 +9,7 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/resolvers"
@@ -93,6 +94,7 @@ func (form *CollectionUpsert) Validate() error {
 				form.collection.IsNew(),
 				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
 				validation.Match(idRegex),
+				validation.By(validators.UniqueId(form.dao, form.collection.TableName())),
 			).Else(validation.In(form.collection.Id)),
 		),
 		validation.Field(
@@ -119,7 +121,7 @@ func (form *CollectionUpsert) Validate() error {
 			validation.By(form.checkMinSchemaFields),
 			validation.By(form.ensureNoSystemFieldsChange),
 			validation.By(form.ensureNoFieldsTypeChange),
-			validation.By(form.ensureExistingRelationCollectionId),
+			validation.By(form.checkRelationFields),
 			validation.When(
 				isAuth,
 				validation.By(form.ensureNoAuthFieldName),
@@ -202,9 +204,17 @@ func (form *CollectionUpsert) ensureNoFieldsTypeChange(value any) error {
 	return nil
 }
 
-func (form *CollectionUpsert) ensureExistingRelationCollectionId(value any) error {
+func (form *CollectionUpsert) checkRelationFields(value any) error {
 	v, _ := value.(schema.Schema)
 
+	systemDisplayFields := schema.BaseModelFieldNames()
+	systemDisplayFields = append(systemDisplayFields,
+		schema.FieldNameUsername,
+		schema.FieldNameEmail,
+		schema.FieldNameEmailVisibility,
+		schema.FieldNameVerified,
+	)
+
 	for i, field := range v.Fields() {
 		if field.Type != schema.FieldTypeRelation {
 			continue
@@ -215,11 +225,32 @@ func (form *CollectionUpsert) ensureExistingRelationCollectionId(value any) erro
 			continue
 		}
 
-		if _, err := form.dao.FindCollectionByNameOrId(options.CollectionId); err != nil {
-			return validation.Errors{fmt.Sprint(i): validation.NewError(
-				"validation_field_invalid_relation",
-				"The relation collection doesn't exist.",
-			)}
+		collection, err := form.dao.FindCollectionByNameOrId(options.CollectionId)
+
+		// validate collectionId
+		if err != nil || collection.Id != options.CollectionId {
+			return validation.Errors{fmt.Sprint(i): validation.Errors{
+				"options": validation.Errors{
+					"collectionId": validation.NewError(
+						"validation_field_invalid_relation",
+						"The relation collection doesn't exist.",
+					),
+				}},
+			}
+		}
+
+		// validate displayFields (if any)
+		for _, name := range options.DisplayFields {
+			if collection.Schema.GetFieldByName(name) == nil && !list.ExistInSlice(name, systemDisplayFields) {
+				return validation.Errors{fmt.Sprint(i): validation.Errors{
+					"options": validation.Errors{
+						"displayFields": validation.NewError(
+							"validation_field_invalid_relation_displayFields",
+							fmt.Sprintf("%q does not exist in the related %q collection.", name, collection.Name),
+						),
+					}},
+				}
+			}
 		}
 	}
 
@@ -343,7 +374,7 @@ func (form *CollectionUpsert) checkOptions(value any) error {
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *CollectionUpsert) Submit(interceptors ...InterceptorFunc) error {
+func (form *CollectionUpsert) Submit(interceptors ...InterceptorFunc[*models.Collection]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -375,7 +406,7 @@ func (form *CollectionUpsert) Submit(interceptors ...InterceptorFunc) error {
 	form.collection.DeleteRule = form.DeleteRule
 	form.collection.SetOptions(form.Options)
 
-	return runInterceptors(func() error {
-		return form.dao.SaveCollection(form.collection)
+	return runInterceptors(form.collection, func(collection *models.Collection) error {
+		return form.dao.SaveCollection(collection)
 	}, interceptors...)
 }

forms/collection_upsert_test.go

@@ -168,6 +168,25 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 			}`,
 			[]string{"schema"},
 		},
+		{
+			"create failure - missing relation display field",
+			"",
+			`{
+				"name": "test_new",
+				"type": "base",
+				"schema": [
+					{
+						"name":"test",
+						"type":"relation",
+						"options":{
+							"collectionId":"wsmn24bux7wo113",
+							"displayFields":["text", "missing"]
+						}
+					}
+				]
+			}`,
+			[]string{"schema"},
+		},
 		{
 			"create failure - check type options validators",
 			"",
@@ -190,7 +209,15 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 				"system": true,
 				"schema": [
 					{"id":"a123456","name":"test1","type":"text"},
-					{"id":"b123456","name":"test2","type":"email"}
+					{"id":"b123456","name":"test2","type":"email"},
+					{
+						"name":"test3",
+						"type":"relation",
+						"options":{
+							"collectionId":"v851q4r790rhknl",
+							"displayFields":["name","id","created","updated","username","email","emailVisibility","verified"]
+						}
+					}
 				],
 				"listRule": "test1='123' && verified = true",
 				"viewRule": "test1='123' && emailVisibility = true",
@@ -351,10 +378,10 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-			return func() error {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+			return func(c *models.Collection) error {
 				interceptorCalls++
-				return next()
+				return next(c)
 			}
 		}
 
@@ -451,16 +478,16 @@ func TestCollectionUpsertSubmitInterceptors(t *testing.T) {
 	interceptorCollectionName := ""
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(c *models.Collection) error {
 			interceptor1Called = true
-			return next()
+			return next(c)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(c *models.Collection) error {
 			interceptorCollectionName = collection.Name // to check if the record was filled
 			interceptor2Called = true
 			return testErr

forms/collections_import.go

@@ -56,15 +56,15 @@ func (form *CollectionsImport) Validate() error {
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *CollectionsImport) Submit(interceptors ...InterceptorFunc) error {
+func (form *CollectionsImport) Submit(interceptors ...InterceptorFunc[[]*models.Collection]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	return runInterceptors(func() error {
+	return runInterceptors(form.Collections, func(collections []*models.Collection) error {
 		return form.dao.RunInTransaction(func(txDao *daos.Dao) error {
 			importErr := txDao.ImportCollections(
-				form.Collections,
+				collections,
 				form.DeleteMissing,
 				form.beforeRecordsSync,
 			)

forms/collections_import_test.go

@@ -52,7 +52,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				"collections": []
 			}`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 			expectEvents:           nil,
 		},
 		{
@@ -82,7 +82,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 			expectEvents: map[string]int{
 				"OnModelBeforeCreate": 2,
 			},
@@ -101,7 +101,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 			expectEvents: map[string]int{
 				"OnModelBeforeCreate": 2,
 			},
@@ -137,7 +137,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            false,
-			expectCollectionsCount: 10,
+			expectCollectionsCount: 11,
 			expectEvents: map[string]int{
 				"OnModelBeforeCreate": 3,
 				"OnModelAfterCreate":  3,
@@ -160,7 +160,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 			expectEvents: map[string]int{
 				"OnModelBeforeCreate": 1,
 			},
@@ -202,7 +202,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            true,
-			expectCollectionsCount: 7,
+			expectCollectionsCount: 8,
 			expectEvents: map[string]int{
 				"OnModelBeforeDelete": 5,
 			},
@@ -253,7 +253,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				]
 			}`,
 			expectError:            false,
-			expectCollectionsCount: 9,
+			expectCollectionsCount: 10,
 			expectEvents: map[string]int{
 				"OnModelBeforeUpdate": 1,
 				"OnModelAfterUpdate":  1,
@@ -341,8 +341,8 @@ func TestCollectionsImportSubmit(t *testing.T) {
 				"OnModelAfterUpdate":  2,
 				"OnModelBeforeCreate": 1,
 				"OnModelAfterCreate":  1,
-				"OnModelBeforeDelete": 5,
-				"OnModelAfterDelete":  5,
+				"OnModelBeforeDelete": 6,
+				"OnModelAfterDelete":  6,
 			},
 		},
 	}
@@ -404,16 +404,16 @@ func TestCollectionsImportSubmitInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[[]*models.Collection]) forms.InterceptorNextFunc[[]*models.Collection] {
+		return func(imports []*models.Collection) error {
 			interceptor1Called = true
-			return next()
+			return next(imports)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[[]*models.Collection]) forms.InterceptorNextFunc[[]*models.Collection] {
+		return func(imports []*models.Collection) error {
 			interceptor2Called = true
 			return testErr
 		}

forms/record_email_change_confirm.go

@@ -114,9 +114,9 @@ func (form *RecordEmailChangeConfirm) parseToken(token string) (*models.Record,
 // Submit validates and submits the auth record email change confirmation form.
 // On success returns the updated auth record associated to `form.Token`.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
+// You can optionally provide a list of InterceptorFunc to
 // further modify the form behavior before persisting it.
-func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
+func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorFunc[*models.Record]) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -130,7 +130,8 @@ func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorWithReco
 	authRecord.SetVerified(true)
 	authRecord.RefreshTokenKey() // invalidate old tokens
 
-	interceptorsErr := runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {
+		authRecord = m
 		return form.dao.SaveRecord(m)
 	}, interceptors...)
 

forms/record_email_change_confirm_test.go

@@ -85,7 +85,7 @@ func TestRecordEmailChangeConfirmValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -165,7 +165,7 @@ func TestRecordEmailChangeConfirmInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -173,7 +173,7 @@ func TestRecordEmailChangeConfirmInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptorEmail = record.Email()
 			interceptor2Called = true

forms/record_email_change_request.go

@@ -62,14 +62,14 @@ func (form *RecordEmailChangeRequest) checkUniqueEmail(value any) error {
 
 // Submit validates and sends the change email request.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
+// You can optionally provide a list of InterceptorFunc to
 // further modify the form behavior before persisting it.
-func (form *RecordEmailChangeRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
+func (form *RecordEmailChangeRequest) Submit(interceptors ...InterceptorFunc[*models.Record]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	return runInterceptorsWithRecord(form.record, func(m *models.Record) error {
+	return runInterceptors(form.record, func(m *models.Record) error {
 		return mails.SendRecordChangeEmail(form.app, m, form.NewEmail)
 	}, interceptors...)
 }

forms/record_email_change_request_test.go

@@ -60,7 +60,7 @@ func TestRecordEmailChangeRequestValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -119,7 +119,7 @@ func TestRecordEmailChangeRequestInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -127,7 +127,7 @@ func TestRecordEmailChangeRequestInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor2Called = true
 			return testErr

forms/record_oauth2_login.go

@@ -14,12 +14,25 @@ import (
 	"golang.org/x/oauth2"
 )
 
+// RecordOAuth2LoginData defines the OA
+type RecordOAuth2LoginData struct {
+	ExternalAuth *models.ExternalAuth
+	Record       *models.Record
+	OAuth2User   *auth.AuthUser
+}
+
+// BeforeOAuth2RecordCreateFunc defines a callback function that will
+// be called before OAuth2 new Record creation.
+type BeforeOAuth2RecordCreateFunc func(createForm *RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error
+
 // RecordOAuth2Login is an auth record OAuth2 login form.
 type RecordOAuth2Login struct {
 	app        core.App
 	dao        *daos.Dao
 	collection *models.Collection
 
+	beforeOAuth2RecordCreateFunc BeforeOAuth2RecordCreateFunc
+
 	// Optional auth record that will be used if no external
 	// auth relation is found (if it is from the same collection)
 	loggedAuthRecord *models.Record
@@ -62,6 +75,11 @@ func (form *RecordOAuth2Login) SetDao(dao *daos.Dao) {
 	form.dao = dao
 }
 
+// SetBeforeNewRecordCreateFunc sets a before OAuth2 record create callback handler.
+func (form *RecordOAuth2Login) SetBeforeNewRecordCreateFunc(f BeforeOAuth2RecordCreateFunc) {
+	form.beforeOAuth2RecordCreateFunc = f
+}
+
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *RecordOAuth2Login) Validate() error {
 	return validation.ValidateStruct(form,
@@ -87,11 +105,14 @@ func (form *RecordOAuth2Login) checkProviderName(value any) error {
 //
 // If an auth record doesn't exist, it will make an attempt to create it
 // based on the fetched OAuth2 profile data via a local [RecordUpsert] form.
-// You can intercept/modify the create form by setting the optional beforeCreateFuncs argument.
+// You can intercept/modify the Record create form with [form.SetBeforeNewRecordCreateFunc()].
+//
+// You can also optionally provide a list of InterceptorFunc to
+// further modify the form behavior before persisting it.
 //
 // On success returns the authorized record model and the fetched provider's data.
 func (form *RecordOAuth2Login) Submit(
-	beforeCreateFuncs ...func(createForm *RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error,
+	interceptors ...InterceptorFunc[*RecordOAuth2LoginData],
 ) (*models.Record, *auth.AuthUser, error) {
 	if err := form.Validate(); err != nil {
 		return nil, nil, err
@@ -147,16 +168,40 @@ func (form *RecordOAuth2Login) Submit(
 		authRecord, _ = form.dao.FindAuthRecordByEmail(form.collection.Id, authUser.Email)
 	}
 
-	saveErr := form.dao.RunInTransaction(func(txDao *daos.Dao) error {
-		if authRecord == nil {
-			authRecord = models.NewRecord(form.collection)
-			authRecord.RefreshId()
-			authRecord.MarkAsNew()
-			createForm := NewRecordUpsert(form.app, authRecord)
+	interceptorData := &RecordOAuth2LoginData{
+		ExternalAuth: rel,
+		Record:       authRecord,
+		OAuth2User:   authUser,
+	}
+
+	interceptorsErr := runInterceptors(interceptorData, func(newData *RecordOAuth2LoginData) error {
+		return form.submit(newData)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorData.OAuth2User, interceptorsErr
+	}
+
+	return interceptorData.Record, interceptorData.OAuth2User, nil
+}
+
+func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
+	return form.dao.RunInTransaction(func(txDao *daos.Dao) error {
+		if data.Record == nil {
+			data.Record = models.NewRecord(form.collection)
+			data.Record.RefreshId()
+			data.Record.MarkAsNew()
+			createForm := NewRecordUpsert(form.app, data.Record)
 			createForm.SetFullManageAccess(true)
 			createForm.SetDao(txDao)
-			if authUser.Username != "" && usernameRegex.MatchString(authUser.Username) {
-				createForm.Username = form.dao.SuggestUniqueAuthRecordUsername(form.collection.Id, authUser.Username)
+			if data.OAuth2User.Username != "" &&
+				len(data.OAuth2User.Username) >= 3 &&
+				len(data.OAuth2User.Username) <= 150 &&
+				usernameRegex.MatchString(data.OAuth2User.Username) {
+				createForm.Username = form.dao.SuggestUniqueAuthRecordUsername(
+					form.collection.Id,
+					data.OAuth2User.Username,
+				)
 			}
 
 			// load custom data
@@ -164,10 +209,10 @@ func (form *RecordOAuth2Login) Submit(
 
 			// load the OAuth2 profile data as fallback
 			if createForm.Email == "" {
-				createForm.Email = authUser.Email
+				createForm.Email = data.OAuth2User.Email
 			}
 			createForm.Verified = false
-			if createForm.Email == authUser.Email {
+			if createForm.Email == data.OAuth2User.Email {
 				// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
 				createForm.Verified = true
 			}
@@ -176,11 +221,8 @@ func (form *RecordOAuth2Login) Submit(
 				createForm.PasswordConfirm = createForm.Password
 			}
 
-			for _, f := range beforeCreateFuncs {
-				if f == nil {
-					continue
-				}
-				if err := f(createForm, authRecord, authUser); err != nil {
+			if form.beforeOAuth2RecordCreateFunc != nil {
+				if err := form.beforeOAuth2RecordCreateFunc(createForm, data.Record, data.OAuth2User); err != nil {
 					return err
 				}
 			}
@@ -190,45 +232,39 @@ func (form *RecordOAuth2Login) Submit(
 				return err
 			}
 		} else {
-			// update the existing auth record empty email if the authUser has one
+			// update the existing auth record empty email if the data.OAuth2User has one
 			// (this is in case previously the auth record was created
 			// with an OAuth2 provider that didn't return an email address)
-			if authRecord.Email() == "" && authUser.Email != "" {
-				authRecord.SetEmail(authUser.Email)
-				if err := txDao.SaveRecord(authRecord); err != nil {
+			if data.Record.Email() == "" && data.OAuth2User.Email != "" {
+				data.Record.SetEmail(data.OAuth2User.Email)
+				if err := txDao.SaveRecord(data.Record); err != nil {
 					return err
 				}
 			}
 
 			// update the existing auth record verified state
-			// (only if the auth record doesn't have an email or the auth record email match with the one in authUser)
-			if !authRecord.Verified() && (authRecord.Email() == "" || authRecord.Email() == authUser.Email) {
-				authRecord.SetVerified(true)
-				if err := txDao.SaveRecord(authRecord); err != nil {
+			// (only if the auth record doesn't have an email or the auth record email match with the one in data.OAuth2User)
+			if !data.Record.Verified() && (data.Record.Email() == "" || data.Record.Email() == data.OAuth2User.Email) {
+				data.Record.SetVerified(true)
+				if err := txDao.SaveRecord(data.Record); err != nil {
 					return err
 				}
 			}
 		}
 
 		// create ExternalAuth relation if missing
-		if rel == nil {
-			rel = &models.ExternalAuth{
-				CollectionId: authRecord.Collection().Id,
-				RecordId:     authRecord.Id,
+		if data.ExternalAuth == nil {
+			data.ExternalAuth = &models.ExternalAuth{
+				CollectionId: data.Record.Collection().Id,
+				RecordId:     data.Record.Id,
 				Provider:     form.Provider,
-				ProviderId:   authUser.Id,
+				ProviderId:   data.OAuth2User.Id,
 			}
-			if err := txDao.SaveExternalAuth(rel); err != nil {
+			if err := txDao.SaveExternalAuth(data.ExternalAuth); err != nil {
 				return err
 			}
 		}
 
 		return nil
 	})
-
-	if saveErr != nil {
-		return nil, authUser, saveErr
-	}
-
-	return authRecord, authUser, nil
 }

forms/record_password_login.go

@@ -1,6 +1,7 @@
 package forms
 
 import (
+	"database/sql"
 	"errors"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -48,30 +49,47 @@ func (form *RecordPasswordLogin) Validate() error {
 
 // Submit validates and submits the form.
 // On success returns the authorized record model.
-func (form *RecordPasswordLogin) Submit() (*models.Record, error) {
+//
+// You can optionally provide a list of InterceptorFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordPasswordLogin) Submit(interceptors ...InterceptorFunc[*models.Record]) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
 
 	authOptions := form.collection.AuthOptions()
 
-	if !authOptions.AllowEmailAuth && !authOptions.AllowUsernameAuth {
-		return nil, errors.New("Password authentication is not allowed for the collection.")
-	}
-
-	var record *models.Record
+	var authRecord *models.Record
 	var fetchErr error
 
-	if authOptions.AllowEmailAuth &&
-		(!authOptions.AllowUsernameAuth || is.EmailFormat.Validate(form.Identity) == nil) {
-		record, fetchErr = form.dao.FindAuthRecordByEmail(form.collection.Id, form.Identity)
-	} else {
-		record, fetchErr = form.dao.FindAuthRecordByUsername(form.collection.Id, form.Identity)
+	isEmail := is.EmailFormat.Validate(form.Identity) == nil
+
+	if isEmail {
+		if authOptions.AllowEmailAuth {
+			authRecord, fetchErr = form.dao.FindAuthRecordByEmail(form.collection.Id, form.Identity)
+		}
+	} else if authOptions.AllowUsernameAuth {
+		authRecord, fetchErr = form.dao.FindAuthRecordByUsername(form.collection.Id, form.Identity)
 	}
 
-	if fetchErr != nil || !record.ValidatePassword(form.Password) {
-		return nil, errors.New("Invalid login credentials.")
+	// ignore not found errors to allow custom fetch implementations
+	if fetchErr != nil && !errors.Is(fetchErr, sql.ErrNoRows) {
+		return nil, fetchErr
 	}
 
-	return record, nil
+	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {
+		authRecord = m
+
+		if authRecord == nil || !authRecord.ValidatePassword(form.Password) {
+			return errors.New("Invalid login credentials.")
+		}
+
+		return nil
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
+	}
+
+	return authRecord, nil
 }

forms/record_password_login_test.go

@@ -1,13 +1,15 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestRecordEmailLoginValidateAndSubmit(t *testing.T) {
+func TestRecordPasswordLoginValidateAndSubmit(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -128,3 +130,53 @@ func TestRecordEmailLoginValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordPasswordLoginInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordPasswordLogin(testApp, authCollection)
+	form.Identity = "test@example.com"
+	form.Password = "123456"
+	var interceptorRecord *models.Record
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			interceptorRecord = record
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorRecord == nil || interceptorRecord.Email() != form.Identity {
+		t.Fatalf("Expected auth Record model with email %s, got %v", form.Identity, interceptorRecord)
+	}
+}

forms/record_password_reset_confirm.go

@@ -72,9 +72,9 @@ func (form *RecordPasswordResetConfirm) checkToken(value any) error {
 // Submit validates and submits the form.
 // On success returns the updated auth record associated to `form.Token`.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
-// further modify the form behavior before persisting it.
-func (form *RecordPasswordResetConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *RecordPasswordResetConfirm) Submit(interceptors ...InterceptorFunc[*models.Record]) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -91,7 +91,8 @@ func (form *RecordPasswordResetConfirm) Submit(interceptors ...InterceptorWithRe
 		return nil, err
 	}
 
-	interceptorsErr := runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {
+		authRecord = m
 		return form.dao.SaveRecord(m)
 	}, interceptors...)
 

forms/record_password_reset_confirm_test.go

@@ -79,7 +79,7 @@ func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -157,7 +157,7 @@ func TestRecordPasswordResetConfirmInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -165,7 +165,7 @@ func TestRecordPasswordResetConfirmInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptorTokenKey = record.TokenKey()
 			interceptor2Called = true

forms/record_password_reset_request.go

@@ -60,9 +60,9 @@ func (form *RecordPasswordResetRequest) Validate() error {
 // Submit validates and submits the form.
 // On success, sends a password reset email to the `form.Email` auth record.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
-// further modify the form behavior before persisting it.
-func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*models.Record]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -81,7 +81,7 @@ func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorWithRe
 	// update last sent timestamp
 	authRecord.Set(schema.FieldNameLastResetSentAt, types.NowDateTime())
 
-	return runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+	return runInterceptors(authRecord, func(m *models.Record) error {
 		if err := mails.SendRecordPasswordReset(form.app, m); err != nil {
 			return err
 		}

forms/record_password_reset_request_test.go

@@ -67,7 +67,7 @@ func TestRecordPasswordResetRequestSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -135,7 +135,7 @@ func TestRecordPasswordResetRequestInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -143,7 +143,7 @@ func TestRecordPasswordResetRequestInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptorLastResetSentAt = record.LastResetSentAt()
 			interceptor2Called = true

forms/record_upsert.go

@@ -7,7 +7,6 @@ import (
 	"log"
 	"net/http"
 	"regexp"
-	"strconv"
 	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -219,11 +218,6 @@ func (form *RecordUpsert) extractMultipartFormData(
 // and lods it into the form.
 //
 // File upload is supported only via multipart/form-data.
-//
-// To DELETE previously uploaded file(s) you can suffix the field name
-// with the file index or filename (eg. `myfile.0`) and set it to null or empty string.
-// For single file upload fields, you can skip the index and directly
-// reset the field using its field name (eg. `myfile = null`).
 func (form *RecordUpsert) LoadRequest(r *http.Request, keyPrefix string) error {
 	requestData, uploadedFiles, err := form.extractRequestData(r, keyPrefix)
 	if err != nil {
@@ -345,29 +339,24 @@ func (form *RecordUpsert) RemoveFiles(key string, toDelete ...string) error {
 }
 
 // LoadData loads and normalizes the provided regular record data fields into the form.
-//
-// To DELETE previously uploaded file(s) you can suffix the field name
-// with the file index or filename (eg. `myfile.0`) and set it to null or empty string.
-// For single file upload fields, you can skip the index and directly
-// reset the field using its field name (eg. `myfile = null`).
 func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 	// load base system fields
-	if v, ok := requestData["id"]; ok {
+	if v, ok := requestData[schema.FieldNameId]; ok {
 		form.Id = cast.ToString(v)
 	}
 
 	// load auth system fields
 	if form.record.Collection().IsAuth() {
-		if v, ok := requestData["username"]; ok {
+		if v, ok := requestData[schema.FieldNameUsername]; ok {
 			form.Username = cast.ToString(v)
 		}
-		if v, ok := requestData["email"]; ok {
+		if v, ok := requestData[schema.FieldNameEmail]; ok {
 			form.Email = cast.ToString(v)
 		}
-		if v, ok := requestData["emailVisibility"]; ok {
+		if v, ok := requestData[schema.FieldNameEmailVisibility]; ok {
 			form.EmailVisibility = cast.ToBool(v)
 		}
-		if v, ok := requestData["verified"]; ok {
+		if v, ok := requestData[schema.FieldNameVerified]; ok {
 			form.Verified = cast.ToBool(v)
 		}
 		if v, ok := requestData["password"]; ok {
@@ -381,8 +370,16 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 		}
 	}
 
-	// extend the record schema data with the request data
-	extendedData := form.record.SchemaData()
+	// replace modifiers (if any)
+	requestData = form.record.ReplaceModifers(requestData)
+
+	// create a shallow copy of form.data
+	var extendedData = make(map[string]any, len(form.data))
+	for k, v := range form.data {
+		extendedData[k] = v
+	}
+
+	// extend form.data with the request data
 	rawData, err := json.Marshal(requestData)
 	if err != nil {
 		return err
@@ -393,8 +390,7 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 
 	for _, field := range form.record.Collection().Schema.Fields() {
 		key := field.Name
-		value := extendedData[key]
-		value = field.PrepareValue(value)
+		value := field.PrepareValue(extendedData[key])
 
 		if field.Type != schema.FieldTypeFile {
 			form.data[key] = value
@@ -405,30 +401,32 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 		// Delete previously uploaded file(s)
 		// -----------------------------------------------------------
 
-		oldNames := list.ToUniqueStringSlice(form.data[key])
+		oldNames := form.record.GetStringSlice(key)
+		submittedNames := list.ToUniqueStringSlice(value)
+
+		// ensure that all submitted names are existing to prevent accidental files deletions
+		if len(submittedNames) > len(oldNames) || len(list.SubtractSlice(submittedNames, oldNames)) != 0 {
+			return validation.Errors{
+				key: validation.NewError(
+					"validation_unknown_filenames",
+					"The field contains unknown filenames.",
+				),
+			}
+		}
 
 		// if empty value was set, mark all previously uploaded files for deletion
-		if len(list.ToUniqueStringSlice(value)) == 0 && len(oldNames) > 0 {
+		// otherwise check for "deleted" (aka. unsubmitted) file names
+		if len(submittedNames) == 0 && len(oldNames) > 0 {
 			form.RemoveFiles(key)
 		} else if len(oldNames) > 0 {
+
 			toDelete := []string{}
 
-			// search for individual file name to delete (eg. "file.test.png = null")
 			for _, name := range oldNames {
-				if v, ok := extendedData[key+"."+name]; ok && cast.ToString(v) == "" {
+				// submitted as a modifier or a new array
+				if !list.ExistInSlice(name, submittedNames) {
 					toDelete = append(toDelete, name)
-				}
-			}
-
-			// search for individual file index to delete (eg. "file.0 = null")
-			keyExp, _ := regexp.Compile(`^` + regexp.QuoteMeta(key) + `\.\d+$`)
-			for indexedKey := range extendedData {
-				if keyExp.MatchString(indexedKey) && cast.ToString(extendedData[indexedKey]) == "" {
-					index, indexErr := strconv.Atoi(indexedKey[len(key)+1:])
-					if indexErr != nil || index >= len(oldNames) {
-						continue
-					}
-					toDelete = append(toDelete, oldNames[index])
+					continue
 				}
 			}
 
@@ -436,6 +434,12 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 				form.RemoveFiles(key, toDelete...)
 			}
 		}
+
+		// allow file key reasignments for file names sorting
+		// (only if all submitted values already exists)
+		if len(submittedNames) > 0 && len(list.SubtractSlice(submittedNames, oldNames)) == 0 {
+			form.data[key] = submittedNames
+		}
 	}
 
 	return nil
@@ -451,6 +455,7 @@ func (form *RecordUpsert) Validate() error {
 				form.record.IsNew(),
 				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
 				validation.Match(idRegex),
+				validation.By(validators.UniqueId(form.dao, form.record.TableName())),
 			).Else(validation.In(form.record.Id)),
 		),
 	}
@@ -462,7 +467,7 @@ func (form *RecordUpsert) Validate() error {
 				&form.Username,
 				// require only on update, because on create we fallback to auto generated username
 				validation.When(!form.record.IsNew(), validation.Required),
-				validation.Length(3, 100),
+				validation.Length(3, 150),
 				validation.Match(usernameRegex),
 				validation.By(form.checkUniqueUsername),
 			),
@@ -713,12 +718,14 @@ func (form *RecordUpsert) DrySubmit(callback func(txDao *daos.Dao) error) error
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc) error {
+func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]) error {
 	if err := form.ValidateAndFill(); err != nil {
 		return err
 	}
 
-	return runInterceptors(func() error {
+	return runInterceptors(form.record, func(record *models.Record) error {
+		form.record = record
+
 		if !form.record.HasId() {
 			form.record.RefreshId()
 			form.record.MarkAsNew()

forms/record_upsert_test.go

@@ -89,9 +89,10 @@ func TestRecordUpsertLoadRequestJson(t *testing.T) {
 				"unknown": "test456",
 				// file fields unset/delete
 				"file_one":                     nil,
-				"file_many.0":                  "",         // delete by index
-				"file_many.1":                  "test.png", // should be ignored
-				"file_many.300_WlbFWSGmW9.png": nil,        // delete by filename
+				"file_many.0":                  "",                                                     // delete by index
+				"file_many-":                   []string{"test_MaWC6mWyrP.txt", "test_tC1Yc87DfC.txt"}, // multiple delete with modifier
+				"file_many.300_WlbFWSGmW9.png": nil,                                                    // delete by filename
+				"file_many.2":                  "test.png",                                             // should be ignored
 			},
 		},
 	}
@@ -149,11 +150,12 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 		"a.b.text":    "test123",
 		"a.b.unknown": "test456",
 		// file fields unset/delete
-		"a.b.file_one":                     "",
-		"a.b.file_many.0":                  "",
-		"a.b.file_many.300_WlbFWSGmW9.png": "test.png", // delete by name
-		"a.b.file_many.1":                  "test.png", // should be ignored
-	}, "file_many")
+		"a.b.file_one-":                    "test_d61b33QdDU.txt", // delete with modifier
+		"a.b.file_many.0":                  "",                    // delete by index
+		"a.b.file_many-":                   "test_tC1Yc87DfC.txt", // delete with modifier
+		"a.b.file_many.300_WlbFWSGmW9.png": "",                    // delete by filename
+		"a.b.file_many.2":                  "test.png",            // should be ignored
+	}, "a.b.file_many")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -191,7 +193,7 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 		t.Fatal("Expect file_many field to be set")
 	}
 	manyfilesRemains := len(list.ToUniqueStringSlice(fileMany))
-	expectedRemains := 2 // -2 from 3 removed + 1 new upload
+	expectedRemains := 3 // 5 old; 3 deleted and 1 new uploaded
 	if manyfilesRemains != expectedRemains {
 		t.Fatalf("Expect file_many to be %d, got %d (%v)", expectedRemains, manyfilesRemains, fileMany)
 	}
@@ -426,10 +428,10 @@ func TestRecordUpsertSubmitFailure(t *testing.T) {
 	form.LoadRequest(req, "")
 
 	interceptorCalls := 0
-	interceptor := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(r *models.Record) error {
 			interceptorCalls++
-			return next()
+			return next(r)
 		}
 	}
 
@@ -465,7 +467,7 @@ func TestRecordUpsertSubmitFailure(t *testing.T) {
 	if v := recordAfter.Get("email"); v == "invalid" {
 		t.Fatalf("Expected record.email not to change, got %v", v)
 	}
-	if v := recordAfter.GetStringSlice("file_many"); len(v) != 3 {
+	if v := recordAfter.GetStringSlice("file_many"); len(v) != 5 {
 		t.Fatalf("Expected record.file_many not to change, got %v", v)
 	}
 
@@ -503,10 +505,10 @@ func TestRecordUpsertSubmitSuccess(t *testing.T) {
 	form.LoadRequest(req, "")
 
 	interceptorCalls := 0
-	interceptor := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(r *models.Record) error {
 			interceptorCalls++
-			return next()
+			return next(r)
 		}
 	}
 
@@ -537,8 +539,8 @@ func TestRecordUpsertSubmitSuccess(t *testing.T) {
 	}
 
 	fileMany := (recordAfter.GetStringSlice("file_many"))
-	if len(fileMany) != 4 { // 1 replace + 1 new
-		t.Fatalf("Expected 4 record.file_many, got %d (%v)", len(fileMany), fileMany)
+	if len(fileMany) != 6 { // 1 replace + 1 new
+		t.Fatalf("Expected 6 record.file_many, got %d (%v)", len(fileMany), fileMany)
 	}
 	for _, f := range fileMany {
 		if !hasRecordFile(app, recordAfter, f) {
@@ -564,16 +566,16 @@ func TestRecordUpsertSubmitInterceptors(t *testing.T) {
 	interceptorRecordTitle := ""
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(r *models.Record) error {
 			interceptor1Called = true
-			return next()
+			return next(r)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(r *models.Record) error {
 			interceptorRecordTitle = record.GetString("title") // to check if the record was filled
 			interceptor2Called = true
 			return testErr
@@ -778,10 +780,10 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 			true,
 		},
 		{
-			"invalid username length (more than 100)",
+			"invalid username length (more than 150)",
 			"",
 			map[string]any{
-				"username":        strings.Repeat("a", 101),
+				"username":        strings.Repeat("a", 151),
 				"password":        "12345678",
 				"passwordConfirm": "12345678",
 			},
@@ -1009,7 +1011,7 @@ func TestRecordUpsertAddAndRemoveFiles(t *testing.T) {
 	}
 
 	fileMany := recordAfter.GetStringSlice("file_many")
-	if len(fileMany) != 3 {
-		t.Fatalf("Expected file_many to be 3, got %v", fileMany)
+	if len(fileMany) != 5 {
+		t.Fatalf("Expected file_many to be 5, got %v", fileMany)
 	}
 }

forms/record_verification_confirm.go

@@ -77,9 +77,9 @@ func (form *RecordVerificationConfirm) checkToken(value any) error {
 // Submit validates and submits the form.
 // On success returns the verified auth record associated to `form.Token`.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
-// further modify the form behavior before persisting it.
-func (form *RecordVerificationConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *RecordVerificationConfirm) Submit(interceptors ...InterceptorFunc[*models.Record]) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -98,7 +98,9 @@ func (form *RecordVerificationConfirm) Submit(interceptors ...InterceptorWithRec
 		record.SetVerified(true)
 	}
 
-	interceptorsErr := runInterceptorsWithRecord(record, func(m *models.Record) error {
+	interceptorsErr := runInterceptors(record, func(m *models.Record) error {
+		record = m
+
 		if wasVerified {
 			return nil // already verified
 		}

forms/record_verification_confirm_test.go

@@ -57,7 +57,7 @@ func TestRecordVerificationConfirmValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -117,7 +117,7 @@ func TestRecordVerificationConfirmInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -125,7 +125,7 @@ func TestRecordVerificationConfirmInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptorVerified = record.Verified()
 			interceptor2Called = true

forms/record_verification_request.go

@@ -60,9 +60,9 @@ func (form *RecordVerificationRequest) Validate() error {
 // Submit validates and sends a verification request email
 // to the `form.Email` auth record.
 //
-// You can optionally provide a list of InterceptorWithRecordFunc to
-// further modify the form behavior before persisting it.
-func (form *RecordVerificationRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *RecordVerificationRequest) Submit(interceptors ...InterceptorFunc[*models.Record]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -87,7 +87,7 @@ func (form *RecordVerificationRequest) Submit(interceptors ...InterceptorWithRec
 		record.SetLastVerificationSentAt(types.NowDateTime())
 	}
 
-	return runInterceptorsWithRecord(record, func(m *models.Record) error {
+	return runInterceptors(record, func(m *models.Record) error {
 		if m.Verified() {
 			return nil // already verified
 		}

forms/record_verification_request_test.go

@@ -85,7 +85,7 @@ func TestRecordVerificationRequestSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		interceptor := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 			return func(r *models.Record) error {
 				interceptorCalls++
 				return next(r)
@@ -153,7 +153,7 @@ func TestRecordVerificationRequestInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptor1Called = true
 			return next(record)
@@ -161,7 +161,7 @@ func TestRecordVerificationRequestInterceptors(t *testing.T) {
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
 		return func(record *models.Record) error {
 			interceptorLastVerificationSentAt = record.LastVerificationSentAt()
 			interceptor2Called = true

forms/settings_upsert.go

@@ -50,12 +50,14 @@ func (form *SettingsUpsert) Validate() error {
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc) error {
+func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc[*settings.Settings]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	return runInterceptors(func() error {
+	return runInterceptors(form.Settings, func(s *settings.Settings) error {
+		form.Settings = s
+
 		encryptionKey := os.Getenv(form.app.EncryptionEnv())
 		if err := form.dao.SaveSettings(form.Settings, encryptionKey); err != nil {
 			return err

forms/settings_upsert_test.go

@@ -8,6 +8,7 @@ import (
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -78,10 +79,10 @@ func TestSettingsUpsertValidateAndSubmit(t *testing.T) {
 		}
 
 		interceptorCalls := 0
-		interceptor := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-			return func() error {
+		interceptor := func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+			return func(s *settings.Settings) error {
 				interceptorCalls++
-				return next()
+				return next(s)
 			}
 		}
 
@@ -135,16 +136,16 @@ func TestSettingsUpsertSubmitInterceptors(t *testing.T) {
 	testErr := errors.New("test_error")
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+		return func(s *settings.Settings) error {
 			interceptor1Called = true
-			return next()
+			return next(s)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+		return func(s *settings.Settings) error {
 			interceptor2Called = true
 			return testErr
 		}

forms/validators/file.go

@@ -22,7 +22,10 @@ func UploadedFileSize(maxBytes int) validation.RuleFunc {
 		}
 
 		if int(v.Size) > maxBytes {
-			return validation.NewError("validation_file_size_limit", fmt.Sprintf("Maximum allowed file size is %v bytes.", maxBytes))
+			return validation.NewError(
+				"validation_file_size_limit",
+				fmt.Sprintf("Failed to upload %q - the maximum allowed file size is %v bytes.", v.OriginalName, maxBytes),
+			)
 		}
 
 		return nil
@@ -42,19 +45,24 @@ func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
 			return nil // nothing to validate
 		}
 
+		baseErr := validation.NewError(
+			"validation_invalid_mime_type",
+			fmt.Sprintf("Failed to upload %q due to unsupported file type.", v.OriginalName),
+		)
+
 		if len(validTypes) == 0 {
-			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
+			return baseErr
 		}
 
 		f, err := v.Reader.Open()
 		if err != nil {
-			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
+			return baseErr
 		}
 		defer f.Close()
 
 		filetype, err := mimetype.DetectReader(f)
 		if err != nil {
-			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
+			return baseErr
 		}
 
 		for _, t := range validTypes {
@@ -63,9 +71,13 @@ func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
 			}
 		}
 
-		return validation.NewError("validation_invalid_mime_type", fmt.Sprintf(
-			"The following mime types are only allowed: %s.",
-			strings.Join(validTypes, ","),
-		))
+		return validation.NewError(
+			"validation_invalid_mime_type",
+			fmt.Sprintf(
+				"%q mime type must be one of: %s.",
+				v.Name,
+				strings.Join(validTypes, ", "),
+			),
+		)
 	}
 }

forms/validators/model.go

@@ -0,0 +1,38 @@
+package validators
+
+import (
+	"database/sql"
+	"errors"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+)
+
+// Compare checks whether the provided model id exists.
+//
+// Example:
+//	validation.Field(&form.Id, validation.By(validators.UniqueId(form.dao, tableName)))
+func UniqueId(dao *daos.Dao, tableName string) validation.RuleFunc {
+	return func(value any) error {
+		v, _ := value.(string)
+		if v == "" {
+			return nil // nothing to check
+		}
+
+		var foundId string
+
+		err := dao.DB().
+			Select("id").
+			From(tableName).
+			Where(dbx.HashExp{"id": v}).
+			Limit(1).
+			Row(&foundId)
+
+		if (err != nil && !errors.Is(err, sql.ErrNoRows)) || foundId != "" {
+			return validation.NewError("validation_invalid_id", "The model id is invalid or already exists.")
+		}
+
+		return nil
+	}
+}

forms/validators/model_test.go

@@ -0,0 +1,34 @@
+package validators_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/forms/validators"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestUniqueId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		id          string
+		tableName   string
+		expectError bool
+	}{
+		{"", "", false},
+		{"test", "", true},
+		{"wsmn24bux7wo113", "_collections", true},
+		{"test_unique_id", "unknown_table", true},
+		{"test_unique_id", "_collections", false},
+	}
+
+	for i, s := range scenarios {
+		err := validators.UniqueId(app.Dao(), s.tableName)(s.id)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+		}
+	}
+}

forms/validators/record_data.go

@@ -23,6 +23,7 @@ var requiredErr = validation.NewError("validation_required", "Missing required v
 // using the provided record constraints and schema.
 //
 // Example:
+//
 //	validator := NewRecordDataValidator(app.Dao(), record, nil)
 //	err := validator.Validate(map[string]any{"test":123})
 func NewRecordDataValidator(
@@ -117,6 +118,8 @@ func (validator *RecordDataValidator) checkFieldValue(field *schema.SchemaField,
 		return validator.checkEmailValue(field, value)
 	case schema.FieldTypeUrl:
 		return validator.checkUrlValue(field, value)
+	case schema.FieldTypeEditor:
+		return validator.checkEditorValue(field, value)
 	case schema.FieldTypeDate:
 		return validator.checkDateValue(field, value)
 	case schema.FieldTypeSelect:
@@ -236,6 +239,10 @@ func (validator *RecordDataValidator) checkUrlValue(field *schema.SchemaField, v
 	return nil
 }
 
+func (validator *RecordDataValidator) checkEditorValue(field *schema.SchemaField, value any) error {
+	return nil
+}
+
 func (validator *RecordDataValidator) checkDateValue(field *schema.SchemaField, value any) error {
 	val, _ := value.(types.DateTime)
 	if val.IsZero() {
@@ -288,16 +295,22 @@ func (validator *RecordDataValidator) checkSelectValue(field *schema.SchemaField
 	return nil
 }
 
-func (validator *RecordDataValidator) checkJsonValue(field *schema.SchemaField, value any) error {
-	raw, _ := types.ParseJsonRaw(value)
-	if len(raw) == 0 {
-		return nil // nothing to check
-	}
+var emptyJsonValues = []string{
+	"null", `""`, "[]", "{}",
+}
 
+func (validator *RecordDataValidator) checkJsonValue(field *schema.SchemaField, value any) error {
 	if is.JSON.Validate(value) != nil {
 		return validation.NewError("validation_invalid_json", "Must be a valid json value")
 	}
 
+	raw, _ := types.ParseJsonRaw(value)
+	rawStr := strings.TrimSpace(raw.String())
+
+	if field.Required && list.ExistInSlice(rawStr, emptyJsonValues) {
+		return requiredErr
+	}
+
 	return nil
 }
 

forms/validators/record_data_test.go

@@ -965,7 +965,7 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 				"field3": []string{},
 			},
 			nil,
-			[]string{},
+			[]string{"field2"},
 		},
 		{
 			"(json) check required constraint - zero map",
@@ -975,7 +975,7 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 				"field3": map[string]string{},
 			},
 			nil,
-			[]string{},
+			[]string{"field2"},
 		},
 		{
 			"(json) check unique constraint",
@@ -988,14 +988,24 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 			[]string{"field3"},
 		},
 		{
-			"(json) check json text validator",
+			"(json) check json text invalid obj, array and number normalizations",
 			map[string]any{
-				"field1": `[1, 2, 3`,
-				"field2": `invalid`,
-				"field3": `null`, // valid
+				"field1": `[1 2 3]`,
+				"field2": `{a: 123}`,
+				"field3": `123.456 abc`,
 			},
 			nil,
-			[]string{"field1", "field2"},
+			[]string{},
+		},
+		{
+			"(json) check json text reserved literals normalizations",
+			map[string]any{
+				"field1": `true`,
+				"field2": `false`,
+				"field3": `null`,
+			},
+			nil,
+			[]string{},
 		},
 		{
 			"(json) valid data - only required fields",

go.mod

@@ -4,37 +4,37 @@ go 1.18
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.6
-	github.com/aws/aws-sdk-go v1.44.161
+	github.com/aws/aws-sdk-go v1.44.187
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.3.4
 	github.com/dop251/goja v0.0.0-20221118162653-d4bf6fde1b86
 	github.com/dop251/goja_nodejs v0.0.0-20221009164102-3aa5028e57f6
-	github.com/fatih/color v1.13.0
+	github.com/fatih/color v1.14.1
 	github.com/gabriel-vasile/mimetype v1.4.1
-	github.com/ganigeorgiev/fexpr v0.1.1
+	github.com/ganigeorgiev/fexpr v0.3.0
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
 	github.com/golang-jwt/jwt/v4 v4.4.3
 	github.com/labstack/echo/v5 v5.0.0-20220201181537-ed2888cfa198
 	github.com/mattn/go-sqlite3 v1.14.16
-	github.com/pocketbase/dbx v1.8.0
+	github.com/pocketbase/dbx v1.9.0
 	github.com/spf13/cast v1.5.0
 	github.com/spf13/cobra v1.6.1
-	gocloud.dev v0.27.0
-	golang.org/x/crypto v0.4.0
-	golang.org/x/net v0.4.0
-	golang.org/x/oauth2 v0.3.0
+	gocloud.dev v0.28.0
+	golang.org/x/crypto v0.5.0
+	golang.org/x/net v0.5.0
+	golang.org/x/oauth2 v0.4.0
 	golang.org/x/sync v0.1.0
-	modernc.org/sqlite v1.20.0
+	modernc.org/sqlite v1.20.3
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/aws/aws-sdk-go-v2 v1.17.3 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.5 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.10 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.10 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.44 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.49 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.28 // indirect
@@ -43,12 +43,13 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.22 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.29.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.17.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.30.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.2 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/dlclark/regexp2 v1.7.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
@@ -59,30 +60,30 @@ require (
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20220927061507-ef77025ab5aa // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230126093431-47fa9a501578 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/image v0.2.0 // indirect
+	golang.org/x/image v0.3.0 // indirect
 	golang.org/x/mod v0.7.0 // indirect
-	golang.org/x/sys v0.3.0 // indirect
-	golang.org/x/term v0.3.0 // indirect
-	golang.org/x/text v0.5.0 // indirect
+	golang.org/x/sys v0.4.0 // indirect
+	golang.org/x/term v0.4.0 // indirect
+	golang.org/x/text v0.6.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.4.0 // indirect
+	golang.org/x/tools v0.5.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.105.0 // indirect
+	google.golang.org/api v0.108.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20221207170731-23e4bf6bdc37 // indirect
-	google.golang.org/grpc v1.51.0 // indirect
+	google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa // indirect
+	google.golang.org/grpc v1.52.3 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	lukechampine.com/uint128 v1.2.0 // indirect
 	modernc.org/cc/v3 v3.40.0 // indirect
 	modernc.org/ccgo/v3 v3.16.13 // indirect
-	modernc.org/libc v1.21.5 // indirect
+	modernc.org/libc v1.22.2 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
 	modernc.org/memory v1.5.0 // indirect
 	modernc.org/opt v0.1.3 // indirect

mails/admin.go

@@ -61,12 +61,11 @@ func SendAdminPasswordReset(app core.App, admin *models.Admin) error {
 		HTML:    body,
 	}
 
-	event := &core.MailerAdminEvent{
-		MailClient: mailClient,
-		Message:    message,
-		Admin:      admin,
-		Meta:       map[string]any{"token": token},
-	}
+	event := new(core.MailerAdminEvent)
+	event.MailClient = mailClient
+	event.Message = message
+	event.Admin = admin
+	event.Meta = map[string]any{"token": token}
 
 	sendErr := app.OnMailerBeforeAdminResetPasswordSend().Trigger(event, func(e *core.MailerAdminEvent) error {
 		return e.MailClient.Send(e.Message)

mails/record.go

@@ -37,12 +37,12 @@ func SendRecordPasswordReset(app core.App, authRecord *models.Record) error {
 		HTML:    body,
 	}
 
-	event := &core.MailerRecordEvent{
-		MailClient: mailClient,
-		Message:    message,
-		Record:     authRecord,
-		Meta:       map[string]any{"token": token},
-	}
+	event := new(core.MailerRecordEvent)
+	event.MailClient = mailClient
+	event.Message = message
+	event.Collection = authRecord.Collection()
+	event.Record = authRecord
+	event.Meta = map[string]any{"token": token}
 
 	sendErr := app.OnMailerBeforeRecordResetPasswordSend().Trigger(event, func(e *core.MailerRecordEvent) error {
 		return e.MailClient.Send(e.Message)
@@ -81,12 +81,12 @@ func SendRecordVerification(app core.App, authRecord *models.Record) error {
 		HTML:    body,
 	}
 
-	event := &core.MailerRecordEvent{
-		MailClient: mailClient,
-		Message:    message,
-		Record:     authRecord,
-		Meta:       map[string]any{"token": token},
-	}
+	event := new(core.MailerRecordEvent)
+	event.MailClient = mailClient
+	event.Message = message
+	event.Collection = authRecord.Collection()
+	event.Record = authRecord
+	event.Meta = map[string]any{"token": token}
 
 	sendErr := app.OnMailerBeforeRecordVerificationSend().Trigger(event, func(e *core.MailerRecordEvent) error {
 		return e.MailClient.Send(e.Message)
@@ -125,14 +125,14 @@ func SendRecordChangeEmail(app core.App, record *models.Record, newEmail string)
 		HTML:    body,
 	}
 
-	event := &core.MailerRecordEvent{
-		MailClient: mailClient,
-		Message:    message,
-		Record:     record,
-		Meta: map[string]any{
-			"token":    token,
-			"newEmail": newEmail,
-		},
+	event := new(core.MailerRecordEvent)
+	event.MailClient = mailClient
+	event.Message = message
+	event.Collection = record.Collection()
+	event.Record = record
+	event.Meta = map[string]any{
+		"token":    token,
+		"newEmail": newEmail,
 	}
 
 	sendErr := app.OnMailerBeforeRecordChangeEmailSend().Trigger(event, func(e *core.MailerRecordEvent) error {

migrations/1640988000_init.go

@@ -128,11 +128,11 @@ func init() {
 					MaxSelect: 1,
 					MaxSize:   5242880,
 					MimeTypes: []string{
-						"image/jpg",
 						"image/jpeg",
 						"image/png",
 						"image/svg+xml",
 						"image/gif",
+						"image/webp",
 					},
 				},
 			},

migrations/1673167670_multi_match_migrate.go

@@ -0,0 +1,215 @@
+package migrations
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+)
+
+// This migration replaces for backward compatibility the default operators
+// (=, !=, >, etc.) with their any/opt equivalent (?=, ?=, ?>, etc.)
+// in any muli-rel expression collection rule.
+func init() {
+	AppMigrations.Register(func(db dbx.Builder) error {
+		dao := daos.New(db)
+
+		exprRegex := regexp.MustCompile(`([\@\'\"\w\.]+)\s*(=|!=|~|!~|>|>=|<|<=)\s*([\@\'\"\w\.]+)`)
+
+		collections := []*models.Collection{}
+		if err := dao.CollectionQuery().All(&collections); err != nil {
+			return err
+		}
+
+		findCollection := func(nameOrId string) *models.Collection {
+			for _, c := range collections {
+				if c.Id == nameOrId || c.Name == nameOrId {
+					return c
+				}
+			}
+
+			return nil
+		}
+
+		var isMultiRelLiteral func(mainCollection *models.Collection, literal string) bool
+		isMultiRelLiteral = func(mainCollection *models.Collection, literal string) bool {
+			if strings.HasPrefix(literal, "@collection.") {
+				return true
+			}
+
+			if strings.HasPrefix(literal, `"`) ||
+				strings.HasPrefix(literal, `'`) ||
+				strings.HasPrefix(literal, "@request.method") ||
+				strings.HasPrefix(literal, "@request.data") ||
+				strings.HasPrefix(literal, "@request.query") {
+				return false
+			}
+
+			parts := strings.Split(literal, ".")
+			if len(parts) <= 1 {
+				return false
+			}
+
+			if strings.HasPrefix(literal, "@request.auth") && len(parts) >= 4 {
+				// check each auth collection
+				for _, c := range collections {
+					if c.IsAuth() && isMultiRelLiteral(c, strings.Join(parts[2:], ".")) {
+						return true
+					}
+				}
+
+				return false
+			}
+
+			activeCollection := mainCollection
+
+			for i, p := range parts {
+				f := activeCollection.Schema.GetFieldByName(p)
+				if f == nil || f.Type != schema.FieldTypeRelation {
+					return false // not a  relation field
+				}
+
+				// is multi-relation and not the last prop
+				opt, ok := f.Options.(*schema.RelationOptions)
+				if ok && (opt.MaxSelect == nil || *opt.MaxSelect != 1) && i != len(parts)-1 {
+					return true
+				}
+
+				activeCollection = findCollection(opt.CollectionId)
+				if activeCollection == nil {
+					return false
+				}
+			}
+
+			return false
+		}
+
+		// replace all multi-match operators to their any/opt equivalent, eg. "=" => "?="
+		migrateRule := func(collection *models.Collection, rule *string) (*string, error) {
+			if rule == nil || *rule == "" {
+				return rule, nil
+			}
+
+			newRule := *rule
+			parts := exprRegex.FindAllStringSubmatch(newRule, -1)
+
+			for _, p := range parts {
+				if isMultiRelLiteral(collection, p[1]) || isMultiRelLiteral(collection, p[3]) {
+					newRule = strings.ReplaceAll(newRule, p[0], p[1]+" ?"+p[2]+" "+p[3])
+				}
+			}
+
+			return &newRule, nil
+		}
+
+		var ruleErr error
+		for _, c := range collections {
+			c.ListRule, ruleErr = migrateRule(c, c.ListRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.ViewRule, ruleErr = migrateRule(c, c.ViewRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.CreateRule, ruleErr = migrateRule(c, c.CreateRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.UpdateRule, ruleErr = migrateRule(c, c.UpdateRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.DeleteRule, ruleErr = migrateRule(c, c.DeleteRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			if c.IsAuth() {
+				opt := c.AuthOptions()
+				opt.ManageRule, ruleErr = migrateRule(c, opt.ManageRule)
+				if ruleErr != nil {
+					return ruleErr
+				}
+				c.SetOptions(opt)
+			}
+
+			if err := dao.Save(c); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db)
+
+		collections := []*models.Collection{}
+		if err := dao.CollectionQuery().All(&collections); err != nil {
+			return err
+		}
+
+		anyOpRegex := regexp.MustCompile(`\?(=|!=|~|!~|>|>=|<|<=)`)
+
+		// replace any/opt operators to their old versions, eg. "?=" => "="
+		revertRule := func(rule *string) (*string, error) {
+			if rule == nil || *rule == "" {
+				return rule, nil
+			}
+
+			newRule := *rule
+			newRule = anyOpRegex.ReplaceAllString(newRule, "${1}")
+
+			return &newRule, nil
+		}
+
+		var ruleErr error
+		for _, c := range collections {
+			c.ListRule, ruleErr = revertRule(c.ListRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.ViewRule, ruleErr = revertRule(c.ViewRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.CreateRule, ruleErr = revertRule(c.CreateRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.UpdateRule, ruleErr = revertRule(c.UpdateRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			c.DeleteRule, ruleErr = revertRule(c.DeleteRule)
+			if ruleErr != nil {
+				return ruleErr
+			}
+
+			if c.IsAuth() {
+				opt := c.AuthOptions()
+				opt.ManageRule, ruleErr = revertRule(opt.ManageRule)
+				if ruleErr != nil {
+					return ruleErr
+				}
+				c.SetOptions(opt)
+			}
+
+			if err := dao.Save(c); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}

models/record.go

@@ -4,12 +4,15 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
+	"strconv"
 	"time"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 	"golang.org/x/crypto/bcrypt"
@@ -26,19 +29,19 @@ type Record struct {
 
 	collection *Collection
 
-	exportUnknown         bool           // whether to export unknown fields
-	ignoreEmailVisibility bool           // whether to ignore the emailVisibility flag for auth collections
-	data                  map[string]any // any custom data in addition to the base model fields
-	expand                map[string]any // expanded relations
+	exportUnknown         bool // whether to export unknown fields
+	ignoreEmailVisibility bool // whether to ignore the emailVisibility flag for auth collections
 	loaded                bool
-	originalData          map[string]any // the original (aka. first loaded) model data
+	originalData          map[string]any    // the original (aka. first loaded) model data
+	expand                *store.Store[any] // expanded relations
+	data                  *store.Store[any] // any custom data in addition to the base model fields
 }
 
 // NewRecord initializes a new empty Record model.
 func NewRecord(collection *Collection) *Record {
 	return &Record{
 		collection: collection,
-		data:       map[string]any{},
+		data:       store.New[any](nil),
 	}
 }
 
@@ -57,7 +60,7 @@ func nullStringMapValue(data dbx.NullStringMap, key string) any {
 // NewRecordFromNullStringMap initializes a single new Record model
 // with data loaded from the provided NullStringMap.
 func NewRecordFromNullStringMap(collection *Collection, data dbx.NullStringMap) *Record {
-	resultMap := map[string]any{}
+	resultMap := make(map[string]any, len(data))
 
 	// load schema fields
 	for _, field := range collection.Schema.Fields() {
@@ -107,7 +110,8 @@ func (m *Record) Collection() *Collection {
 }
 
 // OriginalCopy returns a copy of the current record model populated
-// with its original (aka. the initially loaded) data state.
+// with its ORIGINAL data state (aka. the initially loaded) and
+// everything else reset to the defaults.
 func (m *Record) OriginalCopy() *Record {
 	newRecord := NewRecord(m.collection)
 	newRecord.Load(m.originalData)
@@ -121,15 +125,40 @@ func (m *Record) OriginalCopy() *Record {
 	return newRecord
 }
 
-// Expand returns a shallow copy of  the record.expand data
-// attached to the current Record model.
-func (m *Record) Expand() map[string]any {
-	return shallowCopy(m.expand)
+// CleanCopy returns a copy of the current record model populated only
+// with its LATEST data state and everything else reset to the defaults.
+func (m *Record) CleanCopy() *Record {
+	newRecord := NewRecord(m.collection)
+	newRecord.Load(m.data.GetAll())
+	newRecord.Id = m.Id
+	newRecord.Created = m.Created
+	newRecord.Updated = m.Updated
+
+	if m.IsNew() {
+		newRecord.MarkAsNew()
+	} else {
+		newRecord.MarkAsNotNew()
+	}
+
+	return newRecord
 }
 
-// SetExpand assigns the provided data to record.expand.
+// Expand returns a shallow copy of the current Record model expand data.
+func (m *Record) Expand() map[string]any {
+	if m.expand == nil {
+		m.expand = store.New[any](nil)
+	}
+
+	return m.expand.GetAll()
+}
+
+// SetExpand shallow copies the provided data to the current Record model's expand.
 func (m *Record) SetExpand(expand map[string]any) {
-	m.expand = shallowCopy(expand)
+	if m.expand == nil {
+		m.expand = store.New[any](nil)
+	}
+
+	m.expand.Reset(expand)
 }
 
 // MergeExpand merges recursively the provided expand data into
@@ -139,10 +168,23 @@ func (m *Record) SetExpand(expand map[string]any) {
 // then both old and new records will be merged into a new slice (aka. a :merge: [b,c] => [a,b,c]).
 // Otherwise the "old" expanded record will be replace with the "new" one (aka. a :merge: aNew => aNew).
 func (m *Record) MergeExpand(expand map[string]any) {
+	// nothing to merge
+	if len(expand) == 0 {
+		return
+	}
+
+	// no old expand
+	if m.expand == nil {
+		m.expand = store.New(expand)
+		return
+	}
+
+	oldExpand := m.expand.GetAll()
+
 	for key, new := range expand {
-		old, ok := m.expand[key]
+		old, ok := oldExpand[key]
 		if !ok {
-			m.expand[key] = new
+			oldExpand[key] = new
 			continue
 		}
 
@@ -157,7 +199,7 @@ func (m *Record) MergeExpand(expand map[string]any) {
 		default:
 			// invalid old expand data -> assign directly the new
 			// (no matter whether new is valid or not)
-			m.expand[key] = new
+			oldExpand[key] = new
 			continue
 		}
 
@@ -174,7 +216,7 @@ func (m *Record) MergeExpand(expand map[string]any) {
 			continue
 		}
 
-		oldIndexed := map[string]*Record{}
+		oldIndexed := make(map[string]*Record, len(oldSlice))
 		for _, oldRecord := range oldSlice {
 			oldIndexed[oldRecord.Id] = oldRecord
 		}
@@ -190,20 +232,24 @@ func (m *Record) MergeExpand(expand map[string]any) {
 			}
 		}
 
-		if wasOldSlice || wasNewSlice {
-			m.expand[key] = oldSlice
+		if wasOldSlice || wasNewSlice || len(oldSlice) == 0 {
+			oldExpand[key] = oldSlice
 		} else {
-			m.expand[key] = oldSlice[0]
+			oldExpand[key] = oldSlice[0]
 		}
 	}
+
+	m.expand.Reset(oldExpand)
 }
 
 // SchemaData returns a shallow copy ONLY of the defined record schema fields data.
 func (m *Record) SchemaData() map[string]any {
-	result := map[string]any{}
+	result := make(map[string]any, len(m.collection.Schema.Fields()))
+
+	data := m.data.GetAll()
 
 	for _, field := range m.collection.Schema.Fields() {
-		if v, ok := m.data[field.Name]; ok {
+		if v, ok := data[field.Name]; ok {
 			result[field.Name] = v
 		}
 	}
@@ -215,7 +261,11 @@ func (m *Record) SchemaData() map[string]any {
 // aka. fields that are neither one of the base and special system ones,
 // nor defined by the collection schema.
 func (m *Record) UnknownData() map[string]any {
-	return m.extractUnknownData(m.data)
+	if m.data == nil {
+		return nil
+	}
+
+	return m.extractUnknownData(m.data.GetAll())
 }
 
 // IgnoreEmailVisibility toggles the flag to ignore the auth record email visibility check.
@@ -261,10 +311,10 @@ func (m *Record) Set(key string, value any) {
 		}
 
 		if m.data == nil {
-			m.data = map[string]any{}
+			m.data = store.New[any](nil)
 		}
 
-		m.data[key] = v
+		m.data.Set(key, v)
 	}
 }
 
@@ -278,11 +328,11 @@ func (m *Record) Get(key string) any {
 	case schema.FieldNameUpdated:
 		return m.Updated
 	default:
-		if v, ok := m.data[key]; ok {
-			return v
+		if m.data == nil {
+			return nil
 		}
 
-		return nil
+		return m.data.Get(key)
 	}
 }
 
@@ -325,10 +375,11 @@ func (m *Record) GetStringSlice(key string) []string {
 // Retrieves the "key" json field value and unmarshals it into "result".
 //
 // Example
-//  result := struct {
-//      FirstName string `json:"first_name"`
-//  }{}
-//  err := m.UnmarshalJSONField("my_field_name", &result)
+//
+//	result := struct {
+//	    FirstName string `json:"first_name"`
+//	}{}
+//	err := m.UnmarshalJSONField("my_field_name", &result)
 func (m *Record) UnmarshalJSONField(key string, result any) error {
 	return json.Unmarshal([]byte(m.GetString(key)), &result)
 }
@@ -366,7 +417,7 @@ func (m *Record) Load(data map[string]any) {
 
 // ColumnValueMap implements [ColumnValueMapper] interface.
 func (m *Record) ColumnValueMap() map[string]any {
-	result := map[string]any{}
+	result := make(map[string]any, len(m.collection.Schema.Fields())+3)
 
 	// export schema field values
 	for _, field := range m.collection.Schema.Fields() {
@@ -392,7 +443,7 @@ func (m *Record) ColumnValueMap() map[string]any {
 //
 // Fields marked as hidden will be exported only if `m.IgnoreEmailVisibility(true)` is set.
 func (m *Record) PublicExport() map[string]any {
-	result := map[string]any{}
+	result := make(map[string]any, len(m.collection.Schema.Fields())+5)
 
 	// export unknown data fields if allowed
 	if m.exportUnknown {
@@ -426,8 +477,8 @@ func (m *Record) PublicExport() map[string]any {
 	result[schema.FieldNameCollectionName] = m.collection.Name
 
 	// add expand (if set)
-	if m.expand != nil {
-		result[schema.FieldNameExpand] = m.expand
+	if m.expand != nil && m.expand.Length() > 0 {
+		result[schema.FieldNameExpand] = m.expand.GetAll()
 	}
 
 	return result
@@ -453,6 +504,101 @@ func (m *Record) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
+// ReplaceModifers returns a new map with applied modifier
+// values based on the current record and the specified data.
+//
+// The resolved modifier keys will be removed.
+//
+// Multiple modifiers will be applied one after another,
+// while reusing the previous base key value result (eg. 1; -5; +2 => -2).
+//
+// Example usage:
+//
+//	 newData := record.ReplaceModifers(data)
+//		// record:  {"field": 10}
+//		// data:    {"field+": 5}
+//		// newData: {"field": 15}
+func (m *Record) ReplaceModifers(data map[string]any) map[string]any {
+	var clone = shallowCopy(data)
+	if len(clone) == 0 {
+		return clone
+	}
+
+	var recordDataCache map[string]any
+
+	// export recordData lazily
+	recordData := func() map[string]any {
+		if recordDataCache == nil {
+			recordDataCache = m.SchemaData()
+		}
+		return recordDataCache
+	}
+
+	modifiers := schema.FieldValueModifiers()
+
+	for _, field := range m.Collection().Schema.Fields() {
+		key := field.Name
+
+		for _, m := range modifiers {
+			if mv, mOk := clone[key+m]; mOk {
+				if _, ok := clone[key]; !ok {
+					// get base value from the merged data
+					clone[key] = recordData()[key]
+				}
+
+				clone[key] = field.PrepareValueWithModifier(clone[key], m, mv)
+				delete(clone, key+m)
+			}
+		}
+
+		if field.Type != schema.FieldTypeFile {
+			continue
+		}
+
+		// -----------------------------------------------------------
+		// legacy file field modifiers (kept for backward compatability)
+		// -----------------------------------------------------------
+
+		var oldNames []string
+		var toDelete []string
+		if _, ok := clone[key]; ok {
+			oldNames = list.ToUniqueStringSlice(clone[key])
+		} else {
+			// get oldNames from the model
+			oldNames = list.ToUniqueStringSlice(recordData()[key])
+		}
+
+		// search for individual file name to delete (eg. "file.test.png = null")
+		for _, name := range oldNames {
+			suffixedKey := key + "." + name
+			if v, ok := clone[suffixedKey]; ok && cast.ToString(v) == "" {
+				toDelete = append(toDelete, name)
+				delete(clone, suffixedKey)
+				continue
+			}
+		}
+
+		// search for individual file index to delete (eg. "file.0 = null")
+		keyExp, _ := regexp.Compile(`^` + regexp.QuoteMeta(key) + `\.\d+$`)
+		for indexedKey := range clone {
+			if keyExp.MatchString(indexedKey) && cast.ToString(clone[indexedKey]) == "" {
+				index, indexErr := strconv.Atoi(indexedKey[len(key)+1:])
+				if indexErr != nil || index < 0 || index >= len(oldNames) {
+					continue
+				}
+				toDelete = append(toDelete, oldNames[index])
+				delete(clone, indexedKey)
+			}
+		}
+
+		if toDelete != nil {
+			clone[key] = field.PrepareValue(list.SubtractSlice(oldNames, toDelete))
+		}
+	}
+
+	return clone
+}
+
 // getNormalizeDataValueForDB returns the "key" data value formatted for db storage.
 func (m *Record) getNormalizeDataValueForDB(key string) any {
 	var val any
@@ -523,7 +669,7 @@ func (m *Record) extractUnknownData(data map[string]any) map[string]any {
 
 	result := map[string]any{}
 
-	for k, v := range m.data {
+	for k, v := range data {
 		if _, ok := knownFields[k]; !ok {
 			result[k] = v
 		}

models/record_test.go

@@ -1,6 +1,7 @@
 package models_test
 
 import (
+	"bytes"
 	"database/sql"
 	"encoding/json"
 	"testing"
@@ -138,7 +139,7 @@ func TestNewRecordFromNullStringMap(t *testing.T) {
 			Valid:  true,
 		},
 		"field5": sql.NullString{
-			String: `["test1","test2"]`, // will select only the first elem
+			String: `["test1","test2"]`, // will select only the last elem
 			Valid:  true,
 		},
 		"field6": sql.NullString{
@@ -157,11 +158,11 @@ func TestNewRecordFromNullStringMap(t *testing.T) {
 	}{
 		{
 			models.CollectionTypeBase,
-			`{"collectionId":"","collectionName":"test","created":"2022-01-01 10:00:00.123Z","field1":"test","field2":"","field3":true,"field4":123.123,"field5":"test1","field6":["test"],"id":"test_id","updated":"2022-01-01 10:00:00.456Z"}`,
+			`{"collectionId":"","collectionName":"test","created":"2022-01-01 10:00:00.123Z","field1":"test","field2":"","field3":true,"field4":123.123,"field5":"test2","field6":["test"],"id":"test_id","updated":"2022-01-01 10:00:00.456Z"}`,
 		},
 		{
 			models.CollectionTypeAuth,
-			`{"collectionId":"","collectionName":"test","created":"2022-01-01 10:00:00.123Z","email":"test_email","emailVisibility":true,"field1":"test","field2":"","field3":true,"field4":123.123,"field5":"test1","field6":["test"],"id":"test_id","updated":"2022-01-01 10:00:00.456Z","username":"test_username","verified":false}`,
+			`{"collectionId":"","collectionName":"test","created":"2022-01-01 10:00:00.123Z","email":"test_email","emailVisibility":true,"field1":"test","field2":"","field3":true,"field4":123.123,"field5":"test2","field6":["test"],"id":"test_id","updated":"2022-01-01 10:00:00.456Z","username":"test_username","verified":false}`,
 		},
 	}
 
@@ -346,7 +347,7 @@ func TestRecordOriginalCopy(t *testing.T) {
 		t.Fatalf("Expected the initial/original f to be %q, got %q", "123", v)
 	}
 
-	// Loading new data shouldn't affect the original state
+	// loading new data shouldn't affect the original state
 	m.Load(map[string]any{"f": "789"})
 
 	if v := m.GetString("f"); v != "789" {
@@ -358,6 +359,38 @@ func TestRecordOriginalCopy(t *testing.T) {
 	}
 }
 
+func TestRecordCleanCopy(t *testing.T) {
+	m := models.NewRecord(&models.Collection{
+		Name: "cname",
+		Type: models.CollectionTypeAuth,
+	})
+	m.Load(map[string]any{
+		"id":       "id1",
+		"created":  "2023-01-01 00:00:00.000Z",
+		"updated":  "2023-01-02 00:00:00.000Z",
+		"username": "test",
+		"verified": true,
+		"email":    "test@example.com",
+		"unknown":  "456",
+	})
+
+	// make a change to ensure that the latest data is targeted
+	m.Set("id", "id2")
+
+	// allow the special flags and options to check whether they will be ignored
+	m.SetExpand(map[string]any{"test": 123})
+	m.IgnoreEmailVisibility(true)
+	m.WithUnkownData(true)
+
+	copy := m.CleanCopy()
+	copyExport, _ := copy.MarshalJSON()
+
+	expectedExport := []byte(`{"collectionId":"","collectionName":"cname","created":"2023-01-01 00:00:00.000Z","emailVisibility":false,"id":"id2","updated":"2023-01-02 00:00:00.000Z","username":"test","verified":true}`)
+	if !bytes.Equal(copyExport, expectedExport) {
+		t.Fatalf("Expected clean export \n%s, \ngot \n%s", expectedExport, copyExport)
+	}
+}
+
 func TestRecordSetAndGetExpand(t *testing.T) {
 	collection := &models.Collection{}
 	m := models.NewRecord(collection)
@@ -375,7 +408,7 @@ func TestRecordSetAndGetExpand(t *testing.T) {
 	}
 }
 
-func TestRecordMergeExpandDirect(t *testing.T) {
+func TestRecordMergeExpand(t *testing.T) {
 	collection := &models.Collection{}
 	m := models.NewRecord(collection)
 	m.Id = "m"
@@ -467,6 +500,47 @@ func TestRecordMergeExpandDirect(t *testing.T) {
 	}
 }
 
+func TestRecordMergeExpandNilCheck(t *testing.T) {
+	collection := &models.Collection{}
+
+	scenarios := []struct {
+		name     string
+		expand   map[string]any
+		expected string
+	}{
+		{
+			"nil expand",
+			nil,
+			`{"collectionId":"","collectionName":"","created":"","id":"","updated":""}`,
+		},
+		{
+			"empty expand",
+			map[string]any{},
+			`{"collectionId":"","collectionName":"","created":"","id":"","updated":""}`,
+		},
+		{
+			"non-empty expand",
+			map[string]any{"test": models.NewRecord(collection)},
+			`{"collectionId":"","collectionName":"","created":"","expand":{"test":{"collectionId":"","collectionName":"","created":"","id":"","updated":""}},"id":"","updated":""}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		m := models.NewRecord(collection)
+		m.MergeExpand(s.expand)
+
+		raw, err := json.Marshal(m)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rawStr := string(raw)
+
+		if rawStr != s.expected {
+			t.Fatalf("[%s] Expected \n%v, \ngot \n%v", s.name, s.expected, rawStr)
+		}
+	}
+}
+
 func TestRecordSchemaData(t *testing.T) {
 	collection := &models.Collection{
 		Type: models.CollectionTypeAuth,
@@ -887,7 +961,7 @@ func TestRecordUnmarshalJSONField(t *testing.T) {
 		expectedJson string
 	}{
 		{nil, testStr, true, `""`},
-		{"", testStr, true, `""`},
+		{"", testStr, false, `""`},
 		{1, testInt, false, `1`},
 		{true, testBool, false, `true`},
 		{[]int{1, 2, 3}, testSlice, false, `[1,2,3]`},
@@ -1384,6 +1458,109 @@ func TestRecordUnmarshalJSON(t *testing.T) {
 	}
 }
 
+func TestRecordReplaceModifers(t *testing.T) {
+	collection := &models.Collection{
+		Schema: schema.NewSchema(
+			&schema.SchemaField{
+				Name: "text",
+				Type: schema.FieldTypeText,
+			},
+			&schema.SchemaField{
+				Name: "number",
+				Type: schema.FieldTypeNumber,
+			},
+			&schema.SchemaField{
+				Name:    "rel_one",
+				Type:    schema.FieldTypeRelation,
+				Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)},
+			},
+			&schema.SchemaField{
+				Name: "rel_many",
+				Type: schema.FieldTypeRelation,
+			},
+			&schema.SchemaField{
+				Name:    "select_one",
+				Type:    schema.FieldTypeSelect,
+				Options: &schema.SelectOptions{MaxSelect: 1},
+			},
+			&schema.SchemaField{
+				Name:    "select_many",
+				Type:    schema.FieldTypeSelect,
+				Options: &schema.SelectOptions{MaxSelect: 10},
+			},
+			&schema.SchemaField{
+				Name:    "file_one",
+				Type:    schema.FieldTypeFile,
+				Options: &schema.FileOptions{MaxSelect: 1},
+			},
+			&schema.SchemaField{
+				Name:    "file_one_index",
+				Type:    schema.FieldTypeFile,
+				Options: &schema.FileOptions{MaxSelect: 1},
+			},
+			&schema.SchemaField{
+				Name:    "file_one_name",
+				Type:    schema.FieldTypeFile,
+				Options: &schema.FileOptions{MaxSelect: 1},
+			},
+			&schema.SchemaField{
+				Name:    "file_many",
+				Type:    schema.FieldTypeFile,
+				Options: &schema.FileOptions{MaxSelect: 10},
+			},
+		),
+	}
+
+	record := models.NewRecord(collection)
+
+	record.Load(map[string]any{
+		"text":           "test",
+		"number":         10,
+		"rel_one":        "a",
+		"rel_many":       []string{"a", "b"},
+		"select_one":     "a",
+		"select_many":    []string{"a", "b", "c"},
+		"file_one":       "a",
+		"file_one_index": "b",
+		"file_one_name":  "c",
+		"file_many":      []string{"a", "b", "c", "d", "e", "f"},
+	})
+
+	result := record.ReplaceModifers(map[string]any{
+		"text-":            "m-",
+		"text+":            "m+",
+		"number-":          3,
+		"number+":          5,
+		"rel_one-":         "a",
+		"rel_one+":         "b",
+		"rel_many-":        []string{"a"},
+		"rel_many+":        []string{"c", "d", "e"},
+		"select_one-":      "a",
+		"select_one+":      "c",
+		"select_many-":     []string{"b", "c"},
+		"select_many+":     []string{"d", "e"},
+		"file_one+":        "skip", // should be ignored
+		"file_one-":        "a",
+		"file_one_index.0": "",
+		"file_one_name.c":  "",
+		"file_many+":       []string{"e", "f"}, // should be ignored
+		"file_many-":       []string{"c", "d"},
+		"file_many.f":      nil,
+		"file_many.0":      nil,
+	})
+
+	raw, err := json.Marshal(result)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"file_many":["b","e"],"file_one":"","file_one_index":"","file_one_name":"","number":12,"rel_many":["b","c","d","e"],"rel_one":"b","select_many":["a","d","e"],"select_one":"c","text":"test"}`
+
+	if v := string(raw); v != expected {
+		t.Fatalf("Expected \n%s, \ngot \n%s", expected, v)
+	}
+}
+
 // -------------------------------------------------------------------
 // Auth helpers:
 // -------------------------------------------------------------------

models/request_data.go

@@ -1,5 +1,11 @@
 package models
 
+import (
+	"strings"
+
+	"github.com/pocketbase/pocketbase/models/schema"
+)
+
 // RequestData defines a HTTP request data struct, usually used
 // as part of the `@request.*` filter resolver.
 type RequestData struct {
@@ -9,3 +15,18 @@ type RequestData struct {
 	AuthRecord *Record        `json:"authRecord"`
 	Admin      *Admin         `json:"admin"`
 }
+
+// HasModifierDataKeys loosely checks if the current struct has any modifier Data keys.
+func (r *RequestData) HasModifierDataKeys() bool {
+	allModifiers := schema.FieldValueModifiers()
+
+	for key := range r.Data {
+		for _, m := range allModifiers {
+			if strings.HasSuffix(key, m) {
+				return true
+			}
+		}
+	}
+
+	return false
+}

models/request_data_test.go

@@ -0,0 +1,58 @@
+package models_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func TestRequestDataHasModifierDataKeys(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		requestData *models.RequestData
+		expected    bool
+	}{
+		{
+			"empty",
+			&models.RequestData{},
+			false,
+		},
+		{
+			"Data with regular fields",
+			&models.RequestData{
+				Query: map[string]any{"data+": "demo"}, // should be ignored
+				Data:  map[string]any{"a": 123, "b": "test", "c.d": false},
+			},
+			false,
+		},
+		{
+			"Data with +modifier fields",
+			&models.RequestData{
+				Data: map[string]any{"a+": 123, "b": "test", "c.d": false},
+			},
+			true,
+		},
+		{
+			"Data with -modifier fields",
+			&models.RequestData{
+				Data: map[string]any{"a": 123, "b-": "test", "c.d": false},
+			},
+			true,
+		},
+		{
+			"Data with mixed modifier fields",
+			&models.RequestData{
+				Data: map[string]any{"a": 123, "b-": "test", "c.d+": false},
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		result := s.requestData.HasModifierDataKeys()
+
+		if result != s.expected {
+			t.Fatalf("[%s] Expected %v, got %v", s.name, s.expected, result)
+		}
+	}
+}

models/schema/schema_field.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"regexp"
+	"strconv"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
@@ -15,22 +16,36 @@ import (
 
 var schemaFieldNameRegex = regexp.MustCompile(`^\w+$`)
 
+// field value modifiers
+const (
+	FieldValueModifierAdd      string = "+"
+	FieldValueModifierSubtract string = "-"
+)
+
+// FieldValueModifiers returns a list with all available field modifier tokens.
+func FieldValueModifiers() []string {
+	return []string{
+		FieldValueModifierAdd,
+		FieldValueModifierSubtract,
+	}
+}
+
 // commonly used field names
 const (
-	FieldNameId                     = "id"
-	FieldNameCreated                = "created"
-	FieldNameUpdated                = "updated"
-	FieldNameCollectionId           = "collectionId"
-	FieldNameCollectionName         = "collectionName"
-	FieldNameExpand                 = "expand"
-	FieldNameUsername               = "username"
-	FieldNameEmail                  = "email"
-	FieldNameEmailVisibility        = "emailVisibility"
-	FieldNameVerified               = "verified"
-	FieldNameTokenKey               = "tokenKey"
-	FieldNamePasswordHash           = "passwordHash"
-	FieldNameLastResetSentAt        = "lastResetSentAt"
-	FieldNameLastVerificationSentAt = "lastVerificationSentAt"
+	FieldNameId                     string = "id"
+	FieldNameCreated                string = "created"
+	FieldNameUpdated                string = "updated"
+	FieldNameCollectionId           string = "collectionId"
+	FieldNameCollectionName         string = "collectionName"
+	FieldNameExpand                 string = "expand"
+	FieldNameUsername               string = "username"
+	FieldNameEmail                  string = "email"
+	FieldNameEmailVisibility        string = "emailVisibility"
+	FieldNameVerified               string = "verified"
+	FieldNameTokenKey               string = "tokenKey"
+	FieldNamePasswordHash           string = "passwordHash"
+	FieldNameLastResetSentAt        string = "lastResetSentAt"
+	FieldNameLastVerificationSentAt string = "lastVerificationSentAt"
 )
 
 // BaseModelFieldNames returns the field names that all models have (id, created, updated).
@@ -72,6 +87,7 @@ const (
 	FieldTypeBool     string = "bool"
 	FieldTypeEmail    string = "email"
 	FieldTypeUrl      string = "url"
+	FieldTypeEditor   string = "editor"
 	FieldTypeDate     string = "date"
 	FieldTypeSelect   string = "select"
 	FieldTypeJson     string = "json"
@@ -90,6 +106,7 @@ func FieldTypes() []string {
 		FieldTypeBool,
 		FieldTypeEmail,
 		FieldTypeUrl,
+		FieldTypeEditor,
 		FieldTypeDate,
 		FieldTypeSelect,
 		FieldTypeJson,
@@ -168,7 +185,7 @@ func (f SchemaField) Validate() error {
 	f.InitOptions()
 
 	excludeNames := BaseModelFieldNames()
-	// exclude filter literals
+	// exclude special filter literals
 	excludeNames = append(excludeNames, "null", "true", "false")
 	// exclude system literals
 	excludeNames = append(excludeNames, SystemFieldNames()...)
@@ -224,6 +241,8 @@ func (f *SchemaField) InitOptions() error {
 		options = &EmailOptions{}
 	case FieldTypeUrl:
 		options = &UrlOptions{}
+	case FieldTypeEditor:
+		options = &EditorOptions{}
 	case FieldTypeDate:
 		options = &DateOptions{}
 	case FieldTypeSelect:
@@ -258,10 +277,38 @@ func (f *SchemaField) PrepareValue(value any) any {
 	f.InitOptions()
 
 	switch f.Type {
-	case FieldTypeText, FieldTypeEmail, FieldTypeUrl:
+	case FieldTypeText, FieldTypeEmail, FieldTypeUrl, FieldTypeEditor:
 		return cast.ToString(value)
 	case FieldTypeJson:
-		val, _ := types.ParseJsonRaw(value)
+		val := value
+
+		if str, ok := val.(string); ok {
+			// in order to support seamlessly both json and multipart/form-data requests,
+			// the following normalization rules are applied for plain string values:
+			// - "true" is converted to the json `true`
+			// - "false" is converted to the json `false`
+			// - "null" is converted to the json `null`
+			// - "[1,2,3]" is converted to the json `[1,2,3]`
+			// - "{\"a\":1,\"b\":2}" is converted to the json `{"a":1,"b":2}`
+			// - numeric strings are converted to json number
+			// - double quoted strings are left as they are (aka. without normalizations)
+			// - any other string (empty string too) is double quoted
+			if str == "" {
+				val = strconv.Quote(str)
+			} else if str == "null" || str == "true" || str == "false" {
+				val = str
+			} else if ((str[0] >= '0' && str[0] <= '9') ||
+				str[0] == '"' ||
+				str[0] == '[' ||
+				str[0] == '{') &&
+				is.JSON.Validate(str) == nil {
+				val = str
+			} else {
+				val = strconv.Quote(str)
+			}
+		}
+
+		val, _ = types.ParseJsonRaw(val)
 		return val
 	case FieldTypeNumber:
 		return cast.ToFloat64(value)
@@ -276,7 +323,7 @@ func (f *SchemaField) PrepareValue(value any) any {
 		options, _ := f.Options.(*SelectOptions)
 		if options.MaxSelect <= 1 {
 			if len(val) > 0 {
-				return val[0]
+				return val[len(val)-1] // the last selected
 			}
 			return ""
 		}
@@ -288,7 +335,7 @@ func (f *SchemaField) PrepareValue(value any) any {
 		options, _ := f.Options.(*FileOptions)
 		if options.MaxSelect <= 1 {
 			if len(val) > 0 {
-				return val[0]
+				return val[len(val)-1] // the last selected
 			}
 			return ""
 		}
@@ -300,7 +347,7 @@ func (f *SchemaField) PrepareValue(value any) any {
 		options, _ := f.Options.(*RelationOptions)
 		if options.MaxSelect != nil && *options.MaxSelect <= 1 {
 			if len(ids) > 0 {
-				return ids[0]
+				return ids[len(ids)-1] // the last selected
 			}
 			return ""
 		}
@@ -311,6 +358,46 @@ func (f *SchemaField) PrepareValue(value any) any {
 	}
 }
 
+// PrepareValueWithModifier returns normalized and properly formatted field value
+// by "merging" baseValue with the modifierValue based on the specified modifier (+ or -).
+func (f *SchemaField) PrepareValueWithModifier(baseValue any, modifier string, modifierValue any) any {
+	resolvedValue := baseValue
+
+	switch f.Type {
+	case FieldTypeNumber:
+		switch modifier {
+		case FieldValueModifierAdd:
+			resolvedValue = cast.ToFloat64(baseValue) + cast.ToFloat64(modifierValue)
+		case FieldValueModifierSubtract:
+			resolvedValue = cast.ToFloat64(baseValue) - cast.ToFloat64(modifierValue)
+		}
+	case FieldTypeSelect, FieldTypeRelation:
+		switch modifier {
+		case FieldValueModifierAdd:
+			resolvedValue = append(
+				list.ToUniqueStringSlice(baseValue),
+				list.ToUniqueStringSlice(modifierValue)...,
+			)
+		case FieldValueModifierSubtract:
+			resolvedValue = list.SubtractSlice(
+				list.ToUniqueStringSlice(baseValue),
+				list.ToUniqueStringSlice(modifierValue),
+			)
+		}
+	case FieldTypeFile:
+		// note: file for now supports only the subtract modifier
+		switch modifier {
+		case FieldValueModifierSubtract:
+			resolvedValue = list.SubtractSlice(
+				list.ToUniqueStringSlice(baseValue),
+				list.ToUniqueStringSlice(modifierValue),
+			)
+		}
+	}
+
+	return f.PrepareValue(resolvedValue)
+}
+
 // -------------------------------------------------------------------
 
 // FieldOptions interfaces that defines common methods that every field options struct has.
@@ -419,6 +506,15 @@ func (o UrlOptions) Validate() error {
 
 // -------------------------------------------------------------------
 
+type EditorOptions struct {
+}
+
+func (o EditorOptions) Validate() error {
+	return nil
+}
+
+// -------------------------------------------------------------------
+
 type DateOptions struct {
 	Min types.DateTime `form:"min" json:"min"`
 	Max types.DateTime `form:"max" json:"max"`
@@ -501,9 +597,21 @@ func (o FileOptions) Validate() error {
 // -------------------------------------------------------------------
 
 type RelationOptions struct {
-	MaxSelect     *int   `form:"maxSelect" json:"maxSelect"`
-	CollectionId  string `form:"collectionId" json:"collectionId"`
-	CascadeDelete bool   `form:"cascadeDelete" json:"cascadeDelete"`
+	// CollectionId is the id of the related collection.
+	CollectionId string `form:"collectionId" json:"collectionId"`
+
+	// CascadeDelete indicates whether the root model should be deleted
+	// in case of delete of all linked relations.
+	CascadeDelete bool `form:"cascadeDelete" json:"cascadeDelete"`
+
+	// MaxSelect indicates the max number of allowed relation records
+	// that could be linked to the main model.
+	//
+	// If nil no limits are applied.
+	MaxSelect *int `form:"maxSelect" json:"maxSelect"`
+
+	// DisplayFields is optional slice of collection field names used for UI purposes.
+	DisplayFields []string `form:"displayFields" json:"displayFields"`
 }
 
 func (o RelationOptions) Validate() error {

models/schema/schema_field_test.go

@@ -40,7 +40,7 @@ func TestAuthFieldNames(t *testing.T) {
 
 func TestFieldTypes(t *testing.T) {
 	result := schema.FieldTypes()
-	expected := 10
+	expected := 11
 
 	if len(result) != expected {
 		t.Fatalf("Expected %d types, got %d (%v)", expected, len(result), result)
@@ -81,6 +81,10 @@ func TestSchemaFieldColDefinition(t *testing.T) {
 			schema.SchemaField{Type: schema.FieldTypeUrl, Name: "test"},
 			"TEXT DEFAULT ''",
 		},
+		{
+			schema.SchemaField{Type: schema.FieldTypeEditor, Name: "test"},
+			"TEXT DEFAULT ''",
+		},
 		{
 			schema.SchemaField{Type: schema.FieldTypeDate, Name: "test"},
 			"TEXT DEFAULT ''",
@@ -477,6 +481,11 @@ func TestSchemaFieldInitOptions(t *testing.T) {
 			false,
 			`{"system":false,"id":"","name":"","type":"url","required":false,"unique":false,"options":{"exceptDomains":null,"onlyDomains":null}}`,
 		},
+		{
+			schema.SchemaField{Type: schema.FieldTypeEditor},
+			false,
+			`{"system":false,"id":"","name":"","type":"editor","required":false,"unique":false,"options":{}}`,
+		},
 		{
 			schema.SchemaField{Type: schema.FieldTypeDate},
 			false,
@@ -500,7 +509,7 @@ func TestSchemaFieldInitOptions(t *testing.T) {
 		{
 			schema.SchemaField{Type: schema.FieldTypeRelation},
 			false,
-			`{"system":false,"id":"","name":"","type":"relation","required":false,"unique":false,"options":{"maxSelect":null,"collectionId":"","cascadeDelete":false}}`,
+			`{"system":false,"id":"","name":"","type":"relation","required":false,"unique":false,"options":{"collectionId":"","cascadeDelete":false,"maxSelect":null,"displayFields":null}}`,
 		},
 		{
 			schema.SchemaField{Type: schema.FieldTypeUser},
@@ -562,12 +571,38 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 		{schema.SchemaField{Type: schema.FieldTypeUrl}, "test", `"test"`},
 		{schema.SchemaField{Type: schema.FieldTypeUrl}, 123, `"123"`},
 
+		// editor
+		{schema.SchemaField{Type: schema.FieldTypeEditor}, nil, `""`},
+		{schema.SchemaField{Type: schema.FieldTypeEditor}, "", `""`},
+		{schema.SchemaField{Type: schema.FieldTypeEditor}, []int{1, 2}, `""`},
+		{schema.SchemaField{Type: schema.FieldTypeEditor}, "test", `"test"`},
+		{schema.SchemaField{Type: schema.FieldTypeEditor}, 123, `"123"`},
+
 		// json
 		{schema.SchemaField{Type: schema.FieldTypeJson}, nil, "null"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "null", "null"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, 123, "123"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "123", "123"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, 123.456, "123.456"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "123.456", "123.456"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "123.456 abc", `"123.456 abc"`}, // invalid numeric string
+		{schema.SchemaField{Type: schema.FieldTypeJson}, true, "true"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "true", "true"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, false, "false"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "false", "false"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "", `""`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `test`, `"test"`},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, `"test"`, `"test"`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `{test":1}`, `"{test\":1}"`}, // invalid object string
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `[1 2 3]`, `"[1 2 3]"`},      // invalid array string
+		{schema.SchemaField{Type: schema.FieldTypeJson}, map[string]int{}, `{}`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `{}`, `{}`},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, map[string]int{"test": 123}, `{"test":123}`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `{"test":123}`, `{"test":123}`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, []int{}, `[]`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `[]`, `[]`},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, []int{1, 2, 1}, `[1,2,1]`},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, `[1,2,1]`, `[1,2,1]`},
 
 		// number
 		{schema.SchemaField{Type: schema.FieldTypeNumber}, nil, "0"},
@@ -603,7 +638,7 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 		{schema.SchemaField{Type: schema.FieldTypeSelect}, "", `""`},
 		{schema.SchemaField{Type: schema.FieldTypeSelect}, 123, `"123"`},
 		{schema.SchemaField{Type: schema.FieldTypeSelect}, "test", `"test"`},
-		{schema.SchemaField{Type: schema.FieldTypeSelect}, []string{"test1", "test2"}, `"test1"`},
+		{schema.SchemaField{Type: schema.FieldTypeSelect}, []string{"test1", "test2"}, `"test2"`},
 		{
 			// no values validation/filtering
 			schema.SchemaField{
@@ -680,7 +715,7 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 		{schema.SchemaField{Type: schema.FieldTypeFile}, "", `""`},
 		{schema.SchemaField{Type: schema.FieldTypeFile}, 123, `"123"`},
 		{schema.SchemaField{Type: schema.FieldTypeFile}, "test", `"test"`},
-		{schema.SchemaField{Type: schema.FieldTypeFile}, []string{"test1", "test2"}, `"test1"`},
+		{schema.SchemaField{Type: schema.FieldTypeFile}, []string{"test1", "test2"}, `"test2"`},
 		// file (multiple)
 		{
 			schema.SchemaField{
@@ -785,7 +820,7 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 		{
 			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
 			[]string{"1ba88b4f-e9da-42f0-9764-9a55c953e724", "2ba88b4f-e9da-42f0-9764-9a55c953e724"},
-			`"1ba88b4f-e9da-42f0-9764-9a55c953e724"`,
+			`"2ba88b4f-e9da-42f0-9764-9a55c953e724"`,
 		},
 		// relation (multiple)
 		{
@@ -863,6 +898,730 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 	}
 }
 
+func TestSchemaFieldPrepareValueWithModifier(t *testing.T) {
+	scenarios := []struct {
+		name          string
+		field         schema.SchemaField
+		baseValue     any
+		modifier      string
+		modifierValue any
+		expectJson    string
+	}{
+		// text
+		{
+			"text with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeText},
+			"base",
+			"+",
+			"new",
+			`"base"`,
+		},
+		{
+			"text with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeText},
+			"base",
+			"-",
+			"new",
+			`"base"`,
+		},
+		{
+			"text with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeText},
+			"base",
+			"?",
+			"new",
+			`"base"`,
+		},
+		{
+			"text cast check",
+			schema.SchemaField{Type: schema.FieldTypeText},
+			123,
+			"?",
+			"new",
+			`"123"`,
+		},
+
+		// number
+		{
+			"number with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeNumber},
+			1,
+			"+",
+			4,
+			`5`,
+		},
+		{
+			"number with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeNumber},
+			1,
+			"-",
+			4,
+			`-3`,
+		},
+		{
+			"number with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeNumber},
+			"1",
+			"?",
+			4,
+			`1`,
+		},
+		{
+			"number cast check",
+			schema.SchemaField{Type: schema.FieldTypeNumber},
+			"test",
+			"+",
+			"4",
+			`4`,
+		},
+
+		// bool
+		{
+			"bool with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeBool},
+			true,
+			"+",
+			false,
+			`true`,
+		},
+		{
+			"bool with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeBool},
+			true,
+			"-",
+			false,
+			`true`,
+		},
+		{
+			"bool with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeBool},
+			true,
+			"?",
+			false,
+			`true`,
+		},
+		{
+			"bool cast check",
+			schema.SchemaField{Type: schema.FieldTypeBool},
+			"true",
+			"?",
+			false,
+			`true`,
+		},
+
+		// email
+		{
+			"email with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeEmail},
+			"base",
+			"+",
+			"new",
+			`"base"`,
+		},
+		{
+			"email with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeEmail},
+			"base",
+			"-",
+			"new",
+			`"base"`,
+		},
+		{
+			"email with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeEmail},
+			"base",
+			"?",
+			"new",
+			`"base"`,
+		},
+		{
+			"email cast check",
+			schema.SchemaField{Type: schema.FieldTypeEmail},
+			123,
+			"?",
+			"new",
+			`"123"`,
+		},
+
+		// url
+		{
+			"url with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeUrl},
+			"base",
+			"+",
+			"new",
+			`"base"`,
+		},
+		{
+			"url with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeUrl},
+			"base",
+			"-",
+			"new",
+			`"base"`,
+		},
+		{
+			"url with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeUrl},
+			"base",
+			"?",
+			"new",
+			`"base"`,
+		},
+		{
+			"url cast check",
+			schema.SchemaField{Type: schema.FieldTypeUrl},
+			123,
+			"-",
+			"new",
+			`"123"`,
+		},
+
+		// editor
+		{
+			"editor with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeEditor},
+			"base",
+			"+",
+			"new",
+			`"base"`,
+		},
+		{
+			"editor with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeEditor},
+			"base",
+			"-",
+			"new",
+			`"base"`,
+		},
+		{
+			"editor with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeEditor},
+			"base",
+			"?",
+			"new",
+			`"base"`,
+		},
+		{
+			"editor cast check",
+			schema.SchemaField{Type: schema.FieldTypeEditor},
+			123,
+			"-",
+			"new",
+			`"123"`,
+		},
+
+		// date
+		{
+			"date with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeDate},
+			"2023-01-01 00:00:00.123",
+			"+",
+			"2023-02-01 00:00:00.456",
+			`"2023-01-01 00:00:00.123Z"`,
+		},
+		{
+			"date with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeDate},
+			"2023-01-01 00:00:00.123Z",
+			"-",
+			"2023-02-01 00:00:00.456Z",
+			`"2023-01-01 00:00:00.123Z"`,
+		},
+		{
+			"date with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeDate},
+			"2023-01-01 00:00:00.123",
+			"?",
+			"2023-01-01 00:00:00.456",
+			`"2023-01-01 00:00:00.123Z"`,
+		},
+		{
+			"date cast check",
+			schema.SchemaField{Type: schema.FieldTypeDate},
+			1672524000, // 2022-12-31 22:00:00.000Z
+			"+",
+			100,
+			`"2022-12-31 22:00:00.000Z"`,
+		},
+
+		// json
+		{
+			"json with '+' modifier",
+			schema.SchemaField{Type: schema.FieldTypeJson},
+			10,
+			"+",
+			5,
+			`10`,
+		},
+		{
+			"json with '+' modifier (slice)",
+			schema.SchemaField{Type: schema.FieldTypeJson},
+			[]string{"a", "b"},
+			"+",
+			"c",
+			`["a","b"]`,
+		},
+		{
+			"json with '-' modifier",
+			schema.SchemaField{Type: schema.FieldTypeJson},
+			10,
+			"-",
+			5,
+			`10`,
+		},
+		{
+			"json with '-' modifier (slice)",
+			schema.SchemaField{Type: schema.FieldTypeJson},
+			`["a","b"]`,
+			"-",
+			"c",
+			`["a","b"]`,
+		},
+		{
+			"json with unknown modifier",
+			schema.SchemaField{Type: schema.FieldTypeJson},
+			`"base"`,
+			"?",
+			`"new"`,
+			`"base"`,
+		},
+
+		// single select
+		{
+			"single select with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"",
+			"+",
+			"b",
+			`"b"`,
+		},
+		{
+			"single select with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"a",
+			"+",
+			"b",
+			`"b"`,
+		},
+		{
+			"single select with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single select with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"",
+			`"a"`,
+		},
+		{
+			"single select with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"b",
+			`"a"`,
+		},
+		{
+			"single select with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single select with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			[]string{"b", "a", "c", "123"},
+			`""`,
+		},
+		{
+			"single select with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 1}},
+			"",
+			"?",
+			"a",
+			`""`,
+		},
+
+		// multi select
+		{
+			"multi select with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			nil,
+			"+",
+			"b",
+			`["b"]`,
+		},
+		{
+			"multi select with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			[]string{"a"},
+			"+",
+			[]string{"b", "c"},
+			`["a","b","c"]`,
+		},
+		{
+			"multi select with '+' modifier (nonempty base; already existing value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			[]string{"a", "b"},
+			"+",
+			"b",
+			`["a","b"]`,
+		},
+		{
+			"multi select with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			nil,
+			"-",
+			[]string{"a"},
+			`[]`,
+		},
+		{
+			"multi select with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			"a",
+			"-",
+			"",
+			`["a"]`,
+		},
+		{
+			"multi select with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			"a",
+			"-",
+			"b",
+			`["a"]`,
+		},
+		{
+			"multi select with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			"c",
+			`["a","b","d"]`,
+		},
+		{
+			"multi select with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			[]string{"b", "a", "123"},
+			`["c","d"]`,
+		},
+		{
+			"multi select with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeSelect, Options: &schema.SelectOptions{MaxSelect: 10}},
+			[]string{"a", "b"},
+			"?",
+			"a",
+			`["a","b"]`,
+		},
+
+		// single relation
+		{
+			"single relation with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"",
+			"+",
+			"b",
+			`"b"`,
+		},
+		{
+			"single relation with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"a",
+			"+",
+			"b",
+			`"b"`,
+		},
+		{
+			"single relation with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single relation with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"a",
+			"-",
+			"",
+			`"a"`,
+		},
+		{
+			"single relation with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"a",
+			"-",
+			"b",
+			`"a"`,
+		},
+		{
+			"single relation with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"a",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single relation with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"a",
+			"-",
+			[]string{"b", "a", "c", "123"},
+			`""`,
+		},
+		{
+			"single relation with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeRelation, Options: &schema.RelationOptions{MaxSelect: types.Pointer(1)}},
+			"",
+			"?",
+			"a",
+			`""`,
+		},
+
+		// multi relation
+		{
+			"multi relation with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			nil,
+			"+",
+			"b",
+			`["b"]`,
+		},
+		{
+			"multi relation with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			[]string{"a"},
+			"+",
+			[]string{"b", "c"},
+			`["a","b","c"]`,
+		},
+		{
+			"multi relation with '+' modifier (nonempty base; already existing value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			[]string{"a", "b"},
+			"+",
+			"b",
+			`["a","b"]`,
+		},
+		{
+			"multi relation with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			nil,
+			"-",
+			[]string{"a"},
+			`[]`,
+		},
+		{
+			"multi relation with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			"a",
+			"-",
+			"",
+			`["a"]`,
+		},
+		{
+			"multi relation with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			"a",
+			"-",
+			"b",
+			`["a"]`,
+		},
+		{
+			"multi relation with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			"c",
+			`["a","b","d"]`,
+		},
+		{
+			"multi relation with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			[]string{"b", "a", "123"},
+			`["c","d"]`,
+		},
+		{
+			"multi relation with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeRelation},
+			[]string{"a", "b"},
+			"?",
+			"a",
+			`["a","b"]`,
+		},
+
+		// single file
+		{
+			"single file with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"",
+			"+",
+			"b",
+			`""`,
+		},
+		{
+			"single file with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"a",
+			"+",
+			"b",
+			`"a"`,
+		},
+		{
+			"single file with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single file with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"",
+			`"a"`,
+		},
+		{
+			"single file with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"b",
+			`"a"`,
+		},
+		{
+			"single file with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			"a",
+			`""`,
+		},
+		{
+			"single file with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"a",
+			"-",
+			[]string{"b", "a", "c", "123"},
+			`""`,
+		},
+		{
+			"single file with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 1}},
+			"",
+			"?",
+			"a",
+			`""`,
+		},
+
+		// multi file
+		{
+			"multi file with '+' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			nil,
+			"+",
+			"b",
+			`[]`,
+		},
+		{
+			"multi file with '+' modifier (nonempty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			[]string{"a"},
+			"+",
+			[]string{"b", "c"},
+			`["a"]`,
+		},
+		{
+			"multi file with '+' modifier (nonempty base; already existing value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			[]string{"a", "b"},
+			"+",
+			"b",
+			`["a","b"]`,
+		},
+		{
+			"multi file with '-' modifier (empty base)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			nil,
+			"-",
+			[]string{"a"},
+			`[]`,
+		},
+		{
+			"multi file with '-' modifier (nonempty base and empty modifier value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			"a",
+			"-",
+			"",
+			`["a"]`,
+		},
+		{
+			"multi file with '-' modifier (nonempty base and different value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			"a",
+			"-",
+			"b",
+			`["a"]`,
+		},
+		{
+			"multi file with '-' modifier (nonempty base and matching value)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			"c",
+			`["a","b","d"]`,
+		},
+		{
+			"multi file with '-' modifier (nonempty base and matching value in a slice)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			[]string{"a", "b", "c", "d"},
+			"-",
+			[]string{"b", "a", "123"},
+			`["c","d"]`,
+		},
+		{
+			"multi file with unknown modifier (nonempty)",
+			schema.SchemaField{Type: schema.FieldTypeFile, Options: &schema.FileOptions{MaxSelect: 10}},
+			[]string{"a", "b"},
+			"?",
+			"a",
+			`["a","b"]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		result := s.field.PrepareValueWithModifier(s.baseValue, s.modifier, s.modifierValue)
+
+		encoded, err := json.Marshal(result)
+		if err != nil {
+			t.Fatalf("[%s] %v", s.name, err)
+		}
+
+		if string(encoded) != s.expectJson {
+			t.Fatalf("[%s], Expected %v, got %v", s.name, s.expectJson, string(encoded))
+		}
+	}
+}
+
 // -------------------------------------------------------------------
 
 type fieldOptionsScenario struct {
@@ -1107,6 +1866,18 @@ func TestUrlOptionsValidate(t *testing.T) {
 	checkFieldOptionsScenarios(t, scenarios)
 }
 
+func TestEditorOptionsValidate(t *testing.T) {
+	scenarios := []fieldOptionsScenario{
+		{
+			"empty",
+			schema.EditorOptions{},
+			[]string{},
+		},
+	}
+
+	checkFieldOptionsScenarios(t, scenarios)
+}
+
 func TestDateOptionsValidate(t *testing.T) {
 	date1 := types.NowDateTime()
 	date2, _ := types.ParseDateTime(date1.Time().AddDate(1, 0, 0))
@@ -1306,7 +2077,7 @@ func TestRelationOptionsValidate(t *testing.T) {
 			[]string{"maxSelect"},
 		},
 		{
-			"MaxSelect > 0 && non-empty CollectionId",
+			"MaxSelect > 0 && nonempty CollectionId",
 			schema.RelationOptions{
 				CollectionId: "abc",
 				MaxSelect:    types.Pointer(1),

models/settings/settings.go

@@ -44,6 +44,11 @@ type Settings struct {
 	SpotifyAuth   AuthProviderConfig `form:"spotifyAuth" json:"spotifyAuth"`
 	KakaoAuth     AuthProviderConfig `form:"kakaoAuth" json:"kakaoAuth"`
 	TwitchAuth    AuthProviderConfig `form:"twitchAuth" json:"twitchAuth"`
+	StravaAuth    AuthProviderConfig `form:"stravaAuth" json:"stravaAuth"`
+	GiteeAuth     AuthProviderConfig `form:"giteeAuth" json:"giteeAuth"`
+	LivechatAuth  AuthProviderConfig `form:"livechatAuth" json:"livechatAuth"`
+	AuthentikAuth AuthProviderConfig `form:"authentikAuth" json:"authentikAuth"`
+	GiteaAuth     AuthProviderConfig `form:"giteaAuth" json:"giteaAuth"`
 }
 
 // New creates and returns a new default Settings instance.
@@ -124,6 +129,21 @@ func New() *Settings {
 		TwitchAuth: AuthProviderConfig{
 			Enabled: false,
 		},
+		StravaAuth: AuthProviderConfig{
+			Enabled: false,
+		},
+		GiteeAuth: AuthProviderConfig{
+			Enabled: false,
+		},
+		LivechatAuth: AuthProviderConfig{
+			Enabled: false,
+		},
+		AuthentikAuth: AuthProviderConfig{
+			Enabled: false,
+		},
+		GiteaAuth: AuthProviderConfig{
+			Enabled: false,
+		},
 	}
 }
 
@@ -153,6 +173,11 @@ func (s *Settings) Validate() error {
 		validation.Field(&s.SpotifyAuth),
 		validation.Field(&s.KakaoAuth),
 		validation.Field(&s.TwitchAuth),
+		validation.Field(&s.StravaAuth),
+		validation.Field(&s.GiteeAuth),
+		validation.Field(&s.LivechatAuth),
+		validation.Field(&s.AuthentikAuth),
+		validation.Field(&s.GiteaAuth),
 	)
 }
 
@@ -207,6 +232,11 @@ func (s *Settings) RedactClone() (*Settings, error) {
 		&clone.SpotifyAuth.ClientSecret,
 		&clone.KakaoAuth.ClientSecret,
 		&clone.TwitchAuth.ClientSecret,
+		&clone.StravaAuth.ClientSecret,
+		&clone.GiteeAuth.ClientSecret,
+		&clone.LivechatAuth.ClientSecret,
+		&clone.AuthentikAuth.ClientSecret,
+		&clone.GiteaAuth.ClientSecret,
 	}
 
 	// mask all sensitive fields
@@ -236,6 +266,11 @@ func (s *Settings) NamedAuthProviderConfigs() map[string]AuthProviderConfig {
 		auth.NameSpotify:   s.SpotifyAuth,
 		auth.NameKakao:     s.KakaoAuth,
 		auth.NameTwitch:    s.TwitchAuth,
+		auth.NameStrava:    s.StravaAuth,
+		auth.NameGitee:     s.GiteeAuth,
+		auth.NameLivechat:  s.LivechatAuth,
+		auth.NameAuthentik: s.AuthentikAuth,
+		auth.NameGitea:     s.GiteaAuth,
 	}
 }
 

models/settings/settings_test.go

@@ -48,6 +48,16 @@ func TestSettingsValidate(t *testing.T) {
 	s.KakaoAuth.ClientId = ""
 	s.TwitchAuth.Enabled = true
 	s.TwitchAuth.ClientId = ""
+	s.StravaAuth.Enabled = true
+	s.StravaAuth.ClientId = ""
+	s.GiteeAuth.Enabled = true
+	s.GiteeAuth.ClientId = ""
+	s.LivechatAuth.Enabled = true
+	s.LivechatAuth.ClientId = ""
+	s.AuthentikAuth.Enabled = true
+	s.AuthentikAuth.ClientId = ""
+	s.GiteaAuth.Enabled = true
+	s.GiteaAuth.ClientId = ""
 
 	// check if Validate() is triggering the members validate methods.
 	err := s.Validate()
@@ -76,6 +86,11 @@ func TestSettingsValidate(t *testing.T) {
 		`"spotifyAuth":{`,
 		`"kakaoAuth":{`,
 		`"twitchAuth":{`,
+		`"stravaAuth":{`,
+		`"giteeAuth":{`,
+		`"livechatAuth":{`,
+		`"authentikAuth":{`,
+		`"giteaAuth":{`,
 	}
 
 	errBytes, _ := json.Marshal(err)
@@ -124,6 +139,16 @@ func TestSettingsMerge(t *testing.T) {
 	s2.KakaoAuth.ClientId = "kakao_test"
 	s2.TwitchAuth.Enabled = true
 	s2.TwitchAuth.ClientId = "twitch_test"
+	s2.StravaAuth.Enabled = true
+	s2.StravaAuth.ClientId = "strava_test"
+	s2.GiteeAuth.Enabled = true
+	s2.GiteeAuth.ClientId = "gitee_test"
+	s2.LivechatAuth.Enabled = true
+	s2.LivechatAuth.ClientId = "livechat_test"
+	s2.AuthentikAuth.Enabled = true
+	s2.AuthentikAuth.ClientId = "authentik_test"
+	s2.GiteaAuth.Enabled = true
+	s2.GiteaAuth.ClientId = "gitea_test"
 
 	if err := s1.Merge(s2); err != nil {
 		t.Fatal(err)
@@ -195,6 +220,11 @@ func TestSettingsRedactClone(t *testing.T) {
 	s1.SpotifyAuth.ClientSecret = "test123"
 	s1.KakaoAuth.ClientSecret = "test123"
 	s1.TwitchAuth.ClientSecret = "test123"
+	s1.StravaAuth.ClientSecret = "test123"
+	s1.GiteeAuth.ClientSecret = "test123"
+	s1.LivechatAuth.ClientSecret = "test123"
+	s1.AuthentikAuth.ClientSecret = "test123"
+	s1.GiteaAuth.ClientSecret = "test123"
 
 	s2, err := s1.RedactClone()
 	if err != nil {
@@ -206,7 +236,7 @@ func TestSettingsRedactClone(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","hideControls":false,"senderName":"Support","senderAddress":"support@example.com","verificationTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Verify your {APP_NAME} email","actionUrl":"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}"},"resetPasswordTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Reset your {APP_NAME} password","actionUrl":"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}"},"confirmEmailChangeTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Confirm your {APP_NAME} new email address","actionUrl":"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}"}},"logs":{"maxDays":5},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","authMethod":"","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"recordAuthToken":{"secret":"******","duration":1209600},"recordPasswordResetToken":{"secret":"******","duration":1800},"recordEmailChangeToken":{"secret":"******","duration":1800},"recordVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":false,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":0},"googleAuth":{"enabled":false,"clientSecret":"******"},"facebookAuth":{"enabled":false,"clientSecret":"******"},"githubAuth":{"enabled":false,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"clientSecret":"******"},"discordAuth":{"enabled":false,"clientSecret":"******"},"twitterAuth":{"enabled":false,"clientSecret":"******"},"microsoftAuth":{"enabled":false,"clientSecret":"******"},"spotifyAuth":{"enabled":false,"clientSecret":"******"},"kakaoAuth":{"enabled":false,"clientSecret":"******"},"twitchAuth":{"enabled":false,"clientSecret":"******"}}`
+	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","hideControls":false,"senderName":"Support","senderAddress":"support@example.com","verificationTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Verify your {APP_NAME} email","actionUrl":"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}"},"resetPasswordTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Reset your {APP_NAME} password","actionUrl":"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}"},"confirmEmailChangeTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Confirm your {APP_NAME} new email address","actionUrl":"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}"}},"logs":{"maxDays":5},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","authMethod":"","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"recordAuthToken":{"secret":"******","duration":1209600},"recordPasswordResetToken":{"secret":"******","duration":1800},"recordEmailChangeToken":{"secret":"******","duration":1800},"recordVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":false,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":0},"googleAuth":{"enabled":false,"clientSecret":"******"},"facebookAuth":{"enabled":false,"clientSecret":"******"},"githubAuth":{"enabled":false,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"clientSecret":"******"},"discordAuth":{"enabled":false,"clientSecret":"******"},"twitterAuth":{"enabled":false,"clientSecret":"******"},"microsoftAuth":{"enabled":false,"clientSecret":"******"},"spotifyAuth":{"enabled":false,"clientSecret":"******"},"kakaoAuth":{"enabled":false,"clientSecret":"******"},"twitchAuth":{"enabled":false,"clientSecret":"******"},"stravaAuth":{"enabled":false,"clientSecret":"******"},"giteeAuth":{"enabled":false,"clientSecret":"******"},"livechatAuth":{"enabled":false,"clientSecret":"******"},"authentikAuth":{"enabled":false,"clientSecret":"******"},"giteaAuth":{"enabled":false,"clientSecret":"******"}}`
 
 	if encodedStr := string(encoded); encodedStr != expected {
 		t.Fatalf("Expected\n%v\ngot\n%v", expected, encodedStr)
@@ -227,6 +257,11 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 	s.SpotifyAuth.ClientId = "spotify_test"
 	s.KakaoAuth.ClientId = "kakao_test"
 	s.TwitchAuth.ClientId = "twitch_test"
+	s.StravaAuth.ClientId = "strava_test"
+	s.GiteeAuth.ClientId = "gitee_test"
+	s.LivechatAuth.ClientId = "livechat_test"
+	s.AuthentikAuth.ClientId = "authentik_test"
+	s.GiteaAuth.ClientId = "gitea_test"
 
 	result := s.NamedAuthProviderConfigs()
 
@@ -247,6 +282,11 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 		`"twitter":{"enabled":false,"clientId":"twitter_test"}`,
 		`"kakao":{"enabled":false,"clientId":"kakao_test"}`,
 		`"twitch":{"enabled":false,"clientId":"twitch_test"}`,
+		`"strava":{"enabled":false,"clientId":"strava_test"}`,
+		`"gitee":{"enabled":false,"clientId":"gitee_test"}`,
+		`"livechat":{"enabled":false,"clientId":"livechat_test"}`,
+		`"authentik":{"enabled":false,"clientId":"authentik_test"}`,
+		`"gitea":{"enabled":false,"clientId":"gitea_test"}`,
 	}
 	for _, p := range expectedParts {
 		if !strings.Contains(encodedStr, p) {

plugins/jsvm/migrations.go

@@ -1,8 +1,10 @@
 package jsvm
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/dop251/goja_nodejs/console"
 	"github.com/dop251/goja_nodejs/require"
@@ -75,7 +77,7 @@ func RegisterMigrations(app core.App, options *MigrationsOptions) error {
 
 		_, err := vm.RunString(string(content))
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to run migration %s: %w", file, err)
 		}
 	}
 
@@ -97,8 +99,8 @@ func readDirFiles(dirPath string) (map[string][]byte, error) {
 	result := map[string][]byte{}
 
 	for _, f := range files {
-		if f.IsDir() {
-			continue
+		if f.IsDir() || !strings.HasSuffix(f.Name(), ".js") {
+			continue // not a .js file
 		}
 		raw, err := os.ReadFile(filepath.Join(dirPath, f.Name()))
 		if err != nil {

resolvers/multi_match_subquery.go

@@ -0,0 +1,70 @@
+package resolvers
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+var _ dbx.Expression = (*multiMatchSubquery)(nil)
+
+// join defines the specification for a single SQL JOIN clause.
+type join struct {
+	tableName  string
+	tableAlias string
+	on         dbx.Expression
+}
+
+// multiMatchSubquery defines a record multi-match subquery expression.
+type multiMatchSubquery struct {
+	baseTableAlias  string
+	fromTableName   string
+	fromTableAlias  string
+	valueIdentifier string
+	joins           []*join
+	params          dbx.Params
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (m *multiMatchSubquery) Build(db *dbx.DB, params dbx.Params) string {
+	if m.baseTableAlias == "" || m.fromTableName == "" || m.fromTableAlias == "" {
+		return "0=1"
+	}
+
+	if params == nil {
+		params = m.params
+	} else {
+		// merge by updating the parent params
+		for k, v := range m.params {
+			params[k] = v
+		}
+	}
+
+	var mergedJoins strings.Builder
+	for i, j := range m.joins {
+		if i > 0 {
+			mergedJoins.WriteString(" ")
+		}
+		mergedJoins.WriteString("LEFT JOIN ")
+		mergedJoins.WriteString(db.QuoteTableName(j.tableName))
+		mergedJoins.WriteString(" ")
+		mergedJoins.WriteString(db.QuoteTableName(j.tableAlias))
+		if j.on != nil {
+			mergedJoins.WriteString(" ON ")
+			mergedJoins.WriteString(j.on.Build(db, params))
+		}
+	}
+
+	return fmt.Sprintf(
+		`SELECT %s as [[multiMatchValue]] FROM %s %s %s WHERE %s = %s`,
+		db.QuoteColumnName(m.valueIdentifier),
+		db.QuoteTableName(m.fromTableName),
+		db.QuoteTableName(m.fromTableAlias),
+		mergedJoins.String(),
+		db.QuoteColumnName(m.fromTableAlias+".id"),
+		db.QuoteColumnName(m.baseTableAlias+".id"),
+	)
+}

resolvers/record_field_resolve_runner.go

@@ -0,0 +1,589 @@
+package resolvers
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// parseAndRun starts a new one-off RecordFieldResolver.Resolve execution.
+func parseAndRun(fieldName string, resolver *RecordFieldResolver) (*search.ResolverResult, error) {
+	r := &runner{
+		fieldName: fieldName,
+		resolver:  resolver,
+	}
+
+	return r.run()
+}
+
+type runner struct {
+	used      bool                 // indicates whether the runner was already executed
+	resolver  *RecordFieldResolver // resolver is the shared expression fields resolver
+	fieldName string               // the name of the single field expression the runner is responsible for
+
+	// shared processing state
+	// ---------------------------------------------------------------
+	activeProps                []string            // holds the active props that remains to be processed
+	activeCollectionName       string              // the last used collection name
+	activeTableAlias           string              // the last used table alias
+	allowHiddenFields          bool                // indicates whether hidden fields (eg. email) should be allowed without extra conditions
+	nullifyMisingField         bool                // indicating whether to return null on missing field or return an error
+	withMultiMatch             bool                // indicates whether to attach a multiMatchSubquery condition to the ResolverResult
+	multiMatchActiveTableAlias string              // the last used multi-match table alias
+	multiMatch                 *multiMatchSubquery // the multi-match subquery expression generated from the fieldName
+}
+
+func (r *runner) run() (*search.ResolverResult, error) {
+	if r.used {
+		return nil, fmt.Errorf("the runner was already used")
+	}
+
+	if len(r.resolver.allowedFields) > 0 && !list.ExistInSliceWithRegex(r.fieldName, r.resolver.allowedFields) {
+		return nil, fmt.Errorf("failed to resolve field %q", r.fieldName)
+	}
+
+	defer func() {
+		r.used = true
+	}()
+
+	r.prepare()
+
+	// check for @collection field (aka. non-relational join)
+	// must be in the format "@collection.COLLECTION_NAME.FIELD[.FIELD2....]"
+	if r.activeProps[0] == "@collection" {
+		return r.processCollectionField()
+	}
+
+	if r.activeProps[0] == "@request" {
+		if r.resolver.requestData == nil {
+			return &search.ResolverResult{Identifier: "NULL"}, nil
+		}
+
+		if strings.HasPrefix(r.fieldName, "@request.auth.") {
+			return r.processRequestAuthField()
+		}
+
+		if strings.HasPrefix(r.fieldName, "@request.data.") && len(r.activeProps) > 2 {
+			name, modifier, err := splitModifier(r.activeProps[2])
+			if err != nil {
+				return nil, err
+			}
+
+			dataField := r.resolver.baseCollection.Schema.GetFieldByName(name)
+			if dataField == nil {
+				return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+			}
+
+			dataField.InitOptions()
+
+			// check for data relation field
+			if dataField.Type == schema.FieldTypeRelation && len(r.activeProps) > 3 {
+				return r.processRequestDataRelationField(dataField)
+			}
+
+			// check for select:each field
+			if modifier == eachModifier && dataField.Type == schema.FieldTypeSelect && len(r.activeProps) == 3 {
+				return r.processRequestDataSelectEachModifier(dataField)
+			}
+
+			// check for data arrayble fields ":length" modifier
+			if modifier == lengthModifier && list.ExistInSlice(dataField.Type, schema.ArraybleFieldTypes()) && len(r.activeProps) == 3 {
+				return r.processRequestDataLengthModifier(dataField)
+			}
+		}
+
+		// some other @request.* static field
+		return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+	}
+
+	// regular field
+	return r.processActiveProps()
+}
+
+func (r *runner) prepare() {
+	r.activeProps = strings.Split(r.fieldName, ".")
+
+	r.activeCollectionName = r.resolver.baseCollection.Name
+	r.activeTableAlias = inflector.Columnify(r.activeCollectionName)
+
+	r.allowHiddenFields = r.resolver.allowHiddenFields
+	// always allow hidden fields since the @.* filter is a system one
+	if r.activeProps[0] == "@collection" || r.activeProps[0] == "@request" {
+		r.allowHiddenFields = true
+	}
+
+	// enable the ignore flag for missing @request.* fields for backward
+	// compatibility and consistency with all @request.* filter fields and types
+	r.nullifyMisingField = r.activeProps[0] == "@request"
+
+	// prepare a multi-match subquery
+	r.multiMatch = &multiMatchSubquery{
+		baseTableAlias: r.activeTableAlias,
+		params:         dbx.Params{},
+	}
+	r.multiMatch.fromTableName = inflector.Columnify(r.activeCollectionName)
+	r.multiMatch.fromTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatchActiveTableAlias = r.multiMatch.fromTableAlias
+	r.withMultiMatch = false
+}
+
+func (r *runner) processCollectionField() (*search.ResolverResult, error) {
+	if len(r.activeProps) < 3 {
+		return nil, fmt.Errorf("invalid @collection field path in %q", r.fieldName)
+	}
+
+	collection, err := r.resolver.loadCollection(r.activeProps[1])
+	if err != nil {
+		return nil, fmt.Errorf("failed to load collection %q from field path %q", r.activeProps[1], r.fieldName)
+	}
+
+	r.activeCollectionName = collection.Name
+	r.activeTableAlias = inflector.Columnify("__collection_" + r.activeCollectionName)
+
+	r.withMultiMatch = true
+
+	// join the collection to the main query
+	r.resolver.registerJoin(inflector.Columnify(collection.Name), r.activeTableAlias, nil)
+
+	// join the collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = "__mm" + r.activeTableAlias
+	r.multiMatch.joins = append(r.multiMatch.joins, &join{
+		tableName:  inflector.Columnify(collection.Name),
+		tableAlias: r.multiMatchActiveTableAlias,
+	})
+
+	// leave only the collection fields
+	// aka. @collection.someCollection.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[2:]
+
+	return r.processActiveProps()
+}
+
+func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
+	// plain auth field
+	// ---
+	if list.ExistInSlice(r.fieldName, plainRequestAuthFields) {
+		return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+	}
+
+	// resolve the auth collection field
+	// ---
+	if r.resolver.requestData == nil || r.resolver.requestData.AuthRecord == nil || r.resolver.requestData.AuthRecord.Collection() == nil {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	collection := r.resolver.requestData.AuthRecord.Collection()
+	r.resolver.loadedCollections = append(r.resolver.loadedCollections, collection)
+
+	r.activeCollectionName = collection.Name
+	r.activeTableAlias = "__auth_" + inflector.Columnify(r.activeCollectionName)
+
+	// join the auth collection to the main query
+	r.resolver.registerJoin(
+		inflector.Columnify(r.activeCollectionName),
+		r.activeTableAlias,
+		dbx.HashExp{
+			// aka. __auth_users.id = :userId
+			(r.activeTableAlias + ".id"): r.resolver.requestData.AuthRecord.Id,
+		},
+	)
+
+	// join the auth collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.joins = append(
+		r.multiMatch.joins,
+		&join{
+			tableName:  inflector.Columnify(r.activeCollectionName),
+			tableAlias: r.multiMatchActiveTableAlias,
+			on: dbx.HashExp{
+				(r.multiMatchActiveTableAlias + ".id"): r.resolver.requestData.AuthRecord.Id,
+			},
+		},
+	)
+
+	// leave only the auth relation fields
+	// aka. @request.auth.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[2:]
+
+	return r.processActiveProps()
+}
+
+func (r *runner) processRequestDataLengthModifier(dataField *schema.SchemaField) (*search.ResolverResult, error) {
+	dataItems := list.ToUniqueStringSlice(r.resolver.requestData.Data[dataField.Name])
+
+	result := &search.ResolverResult{
+		Identifier: fmt.Sprintf("%d", len(dataItems)),
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestDataSelectEachModifier(dataField *schema.SchemaField) (*search.ResolverResult, error) {
+	options, ok := dataField.Options.(*schema.SelectOptions)
+	if !ok {
+		return nil, fmt.Errorf("failed to initialize field %q options", dataField.Name)
+	}
+
+	dataItems := list.ToUniqueStringSlice(r.resolver.requestData.Data[dataField.Name])
+	rawJson, err := json.Marshal(dataItems)
+	if err != nil {
+		return nil, fmt.Errorf("cannot marshalize the data select item for field %q", r.activeProps[2])
+	}
+
+	placeholder := "dataSelect" + security.PseudorandomString(4)
+	cleanFieldName := inflector.Columnify(dataField.Name)
+	jeTable := fmt.Sprintf("json_each({:%s})", placeholder)
+	jeAlias := "__dataSelect_" + cleanFieldName + "_je"
+	r.resolver.registerJoin(jeTable, jeAlias, nil)
+
+	result := &search.ResolverResult{
+		Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
+		Params:     dbx.Params{placeholder: rawJson},
+	}
+
+	if options.MaxSelect != 1 {
+		r.withMultiMatch = true
+	}
+
+	if r.withMultiMatch {
+		placeholder2 := "mm" + placeholder
+		jeTable2 := fmt.Sprintf("json_each({:%s})", placeholder2)
+		jeAlias2 := "__mm" + jeAlias
+
+		r.multiMatch.joins = append(r.multiMatch.joins, &join{
+			tableName:  jeTable2,
+			tableAlias: jeAlias2,
+		})
+		r.multiMatch.params[placeholder2] = rawJson
+		r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+
+		result.MultiMatchSubQuery = r.multiMatch
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestDataRelationField(dataField *schema.SchemaField) (*search.ResolverResult, error) {
+	options, ok := dataField.Options.(*schema.RelationOptions)
+	if !ok {
+		return nil, fmt.Errorf("failed to initialize data field %q options", dataField.Name)
+	}
+
+	dataRelCollection, err := r.resolver.loadCollection(options.CollectionId)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load collection %q from data field %q", options.CollectionId, dataField.Name)
+	}
+
+	var dataRelIds []string
+	if r.resolver.requestData != nil && len(r.resolver.requestData.Data) != 0 {
+		dataRelIds = list.ToUniqueStringSlice(r.resolver.requestData.Data[dataField.Name])
+	}
+	if len(dataRelIds) == 0 {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	r.activeCollectionName = dataRelCollection.Name
+	r.activeTableAlias = inflector.Columnify("__data_" + dataRelCollection.Name)
+
+	// join the data rel collection to the main collection
+	r.resolver.registerJoin(
+		inflector.Columnify(r.activeCollectionName),
+		r.activeTableAlias,
+		dbx.In(
+			fmt.Sprintf("[[%s.id]]", inflector.Columnify(r.activeTableAlias)),
+			list.ToInterfaceSlice(dataRelIds)...,
+		),
+	)
+
+	if options.MaxSelect == nil || *options.MaxSelect != 1 {
+		r.withMultiMatch = true
+	}
+
+	// join the data rel collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = inflector.Columnify("__data_mm_" + dataRelCollection.Name)
+	r.multiMatch.joins = append(
+		r.multiMatch.joins,
+		&join{
+			tableName:  inflector.Columnify(r.activeCollectionName),
+			tableAlias: r.multiMatchActiveTableAlias,
+			on:         dbx.In(r.multiMatchActiveTableAlias+".id", list.ToInterfaceSlice(dataRelIds)...),
+		},
+	)
+
+	// leave only the data relation fields
+	// aka. @request.data.someRel.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[3:]
+
+	return r.processActiveProps()
+}
+
+func (r *runner) processActiveProps() (*search.ResolverResult, error) {
+	totalProps := len(r.activeProps)
+
+	for i, prop := range r.activeProps {
+		collection, err := r.resolver.loadCollection(r.activeCollectionName)
+		if err != nil {
+			return nil, fmt.Errorf("failed to resolve field %q", prop)
+		}
+
+		// last prop
+		if i == totalProps-1 {
+			// system field, aka. internal model prop
+			// (always available but not part of the collection schema)
+			// -------------------------------------------------------
+			if list.ExistInSlice(prop, resolvableSystemFieldNames(collection)) {
+				result := &search.ResolverResult{
+					Identifier: fmt.Sprintf("[[%s.%s]]", r.activeTableAlias, inflector.Columnify(prop)),
+				}
+
+				// allow querying only auth records with emails marked as public
+				if prop == schema.FieldNameEmail && !r.allowHiddenFields {
+					result.AfterBuild = func(expr dbx.Expression) dbx.Expression {
+						return dbx.Enclose(dbx.And(expr, dbx.NewExp(fmt.Sprintf(
+							"[[%s.%s]] = TRUE",
+							r.activeTableAlias,
+							schema.FieldNameEmailVisibility,
+						))))
+					}
+				}
+
+				if r.withMultiMatch {
+					r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.%s]]", r.multiMatchActiveTableAlias, inflector.Columnify(prop))
+					result.MultiMatchSubQuery = r.multiMatch
+				}
+
+				return result, nil
+			}
+
+			name, modifier, err := splitModifier(prop)
+			if err != nil {
+				return nil, err
+			}
+
+			field := collection.Schema.GetFieldByName(name)
+			if field == nil {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("unknown field %q", name)
+			}
+
+			cleanFieldName := inflector.Columnify(field.Name)
+
+			// arrayble fields ":length" modifier
+			// -------------------------------------------------------
+			if modifier == lengthModifier && list.ExistInSlice(field.Type, schema.ArraybleFieldTypes()) {
+				jePair := r.activeTableAlias + "." + cleanFieldName
+
+				result := &search.ResolverResult{
+					Identifier: jsonArrayLength(jePair),
+				}
+
+				if r.withMultiMatch {
+					jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+					r.multiMatch.valueIdentifier = jsonArrayLength(jePair2)
+					result.MultiMatchSubQuery = r.multiMatch
+				}
+
+				return result, nil
+			}
+
+			// select field with ":each" modifier
+			// -------------------------------------------------------
+			if field.Type == schema.FieldTypeSelect && modifier == eachModifier {
+				jePair := r.activeTableAlias + "." + cleanFieldName
+				jeAlias := r.activeTableAlias + "_" + cleanFieldName + "_je"
+				r.resolver.registerJoin(jsonEach(jePair), jeAlias, nil)
+
+				result := &search.ResolverResult{
+					Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
+				}
+
+				field.InitOptions()
+				options, ok := field.Options.(*schema.SelectOptions)
+				if !ok {
+					return nil, fmt.Errorf("failed to initialize field %q options", prop)
+				}
+
+				if options.MaxSelect != 1 {
+					r.withMultiMatch = true
+				}
+
+				if r.withMultiMatch {
+					jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+					jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName + "_je"
+
+					r.multiMatch.joins = append(r.multiMatch.joins, &join{
+						tableName:  jsonEach(jePair2),
+						tableAlias: jeAlias2,
+					})
+					r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+
+					result.MultiMatchSubQuery = r.multiMatch
+				}
+
+				return result, nil
+			}
+
+			// default
+			// -------------------------------------------------------
+			result := &search.ResolverResult{
+				Identifier: fmt.Sprintf("[[%s.%s]]", r.activeTableAlias, cleanFieldName),
+			}
+
+			if r.withMultiMatch {
+				r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.%s]]", r.multiMatchActiveTableAlias, cleanFieldName)
+				result.MultiMatchSubQuery = r.multiMatch
+			}
+
+			return result, nil
+		}
+
+		field := collection.Schema.GetFieldByName(prop)
+		if field == nil {
+			if r.nullifyMisingField {
+				return &search.ResolverResult{Identifier: "NULL"}, nil
+			}
+			return nil, fmt.Errorf("unknown field %q", prop)
+		}
+
+		// check if it is a json field
+		if field.Type == schema.FieldTypeJson {
+			var jsonPath strings.Builder
+			jsonPath.WriteString("$")
+			for _, p := range r.activeProps[i+1:] {
+				if _, err := strconv.Atoi(p); err == nil {
+					jsonPath.WriteString("[")
+					jsonPath.WriteString(inflector.Columnify(p))
+					jsonPath.WriteString("]")
+				} else {
+					jsonPath.WriteString(".")
+					jsonPath.WriteString(inflector.Columnify(p))
+				}
+			}
+
+			result := &search.ResolverResult{
+				Identifier: fmt.Sprintf(
+					"JSON_EXTRACT([[%s.%s]], '%s')",
+					r.activeTableAlias,
+					inflector.Columnify(prop),
+					jsonPath.String(),
+				),
+			}
+
+			if r.withMultiMatch {
+				r.multiMatch.valueIdentifier = fmt.Sprintf(
+					"JSON_EXTRACT([[%s.%s]], '%s')",
+					r.multiMatchActiveTableAlias,
+					inflector.Columnify(prop),
+					jsonPath.String(),
+				)
+				result.MultiMatchSubQuery = r.multiMatch
+			}
+
+			return result, nil
+		}
+
+		// check if it is a relation field
+		if field.Type != schema.FieldTypeRelation {
+			return nil, fmt.Errorf("field %q is not a valid relation", prop)
+		}
+
+		// join the relation to the main query
+		// ---
+		field.InitOptions()
+		options, ok := field.Options.(*schema.RelationOptions)
+		if !ok {
+			return nil, fmt.Errorf("failed to initialize field %q options", prop)
+		}
+
+		relCollection, relErr := r.resolver.loadCollection(options.CollectionId)
+		if relErr != nil {
+			return nil, fmt.Errorf("failed to find field %q collection", prop)
+		}
+
+		cleanFieldName := inflector.Columnify(field.Name)
+		newCollectionName := relCollection.Name
+		newTableAlias := r.activeTableAlias + "_" + cleanFieldName
+
+		jeAlias := r.activeTableAlias + "_" + cleanFieldName + "_je"
+		jePair := r.activeTableAlias + "." + cleanFieldName
+		r.resolver.registerJoin(jsonEach(jePair), jeAlias, nil)
+		r.resolver.registerJoin(
+			inflector.Columnify(newCollectionName),
+			newTableAlias,
+			dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias, jeAlias)),
+		)
+		r.activeCollectionName = newCollectionName
+		r.activeTableAlias = newTableAlias
+		// ---
+
+		// join the relation to the multi-match subquery
+		// ---
+		if options.MaxSelect == nil || *options.MaxSelect != 1 {
+			r.withMultiMatch = true
+		}
+
+		newTableAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName
+		jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName + "_je"
+		jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+		r.multiMatchActiveTableAlias = newTableAlias2
+
+		r.multiMatch.joins = append(
+			r.multiMatch.joins,
+			&join{
+				tableName:  jsonEach(jePair2),
+				tableAlias: jeAlias2,
+			},
+			&join{
+				tableName:  inflector.Columnify(newCollectionName),
+				tableAlias: newTableAlias2,
+				on:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias2, jeAlias2)),
+			},
+		)
+		// ---
+	}
+
+	return nil, fmt.Errorf("failed to resolve field %q", r.fieldName)
+}
+
+func jsonArrayLength(tableColumnPair string) string {
+	return fmt.Sprintf(
+		// note: the case is used to normalize value access for single and multiple relations.
+		`json_array_length(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END)`,
+		tableColumnPair, tableColumnPair, tableColumnPair,
+	)
+}
+
+func jsonEach(tableColumnPair string) string {
+	return fmt.Sprintf(
+		// note: the case is used to normalize value access for single and multiple relations.
+		`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END)`,
+		tableColumnPair, tableColumnPair, tableColumnPair,
+	)
+}
+
+func resolvableSystemFieldNames(collection *models.Collection) []string {
+	result := schema.BaseModelFieldNames()
+
+	if collection.IsAuth() {
+		result = append(
+			result,
+			schema.FieldNameUsername,
+			schema.FieldNameVerified,
+			schema.FieldNameEmailVisibility,
+			schema.FieldNameEmail,
+		)
+	}
+
+	return result
+}

resolvers/record_field_resolver.go

@@ -10,18 +10,20 @@ import (
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
-	"github.com/pocketbase/pocketbase/tools/inflector"
-	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
 )
 
-// ensure that `search.FieldResolver` interface is implemented
-var _ search.FieldResolver = (*RecordFieldResolver)(nil)
+// filter modifiers
+const (
+	eachModifier   string = "each"
+	issetModifier  string = "isset"
+	lengthModifier string = "length"
+)
 
 // list of auth filter fields that don't require join with the auth
-// collection or any other extra checks to be resolved
+// collection or any other extra checks to be resolved.
 var plainRequestAuthFields = []string{
 	"@request.auth." + schema.FieldNameId,
 	"@request.auth." + schema.FieldNameCollectionId,
@@ -34,32 +36,28 @@ var plainRequestAuthFields = []string{
 	"@request.auth." + schema.FieldNameUpdated,
 }
 
-type join struct {
-	id    string
-	table string
-	on    dbx.Expression
-}
+// ensure that `search.FieldResolver` interface is implemented
+var _ search.FieldResolver = (*RecordFieldResolver)(nil)
 
 // RecordFieldResolver defines a custom search resolver struct for
 // managing Record model search fields.
 //
 // Usually used together with `search.Provider`. Example:
-//	resolver := resolvers.NewRecordFieldResolver(
-//		app.Dao(),
-//		myCollection,
-//		&models.RequestData{...},
-//		true,
-//	)
-//	provider := search.NewProvider(resolver)
-//	...
+//  resolver := resolvers.NewRecordFieldResolver(
+//      app.Dao(),
+//      myCollection,
+//      &models.RequestData{...},
+//      true,
+//  )
+//  provider := search.NewProvider(resolver)
+//  ...
 type RecordFieldResolver struct {
 	dao               *daos.Dao
 	baseCollection    *models.Collection
 	allowHiddenFields bool
 	allowedFields     []string
 	loadedCollections []*models.Collection
-	joins             []join // we cannot use a map because the insertion order is not preserved
-	exprs             []dbx.Expression
+	joins             []*join // we cannot use a map because the insertion order is not preserved
 	requestData       *models.RequestData
 	staticRequestData map[string]any
 }
@@ -76,20 +74,18 @@ func NewRecordFieldResolver(
 		baseCollection:    baseCollection,
 		requestData:       requestData,
 		allowHiddenFields: allowHiddenFields,
-		joins:             []join{},
-		exprs:             []dbx.Expression{},
+		joins:             []*join{},
 		loadedCollections: []*models.Collection{baseCollection},
 		allowedFields: []string{
-			`^\w+[\w\.]*$`,
+			`^\w+[\w\.\:]*$`,
 			`^\@request\.method$`,
-			`^\@request\.auth\.\w+[\w\.]*$`,
-			`^\@request\.data\.\w+[\w\.]*$`,
-			`^\@request\.query\.\w+[\w\.]*$`,
-			`^\@collection\.\w+\.\w+[\w\.]*$`,
+			`^\@request\.auth\.[\w\.\:]*\w+$`,
+			`^\@request\.data\.[\w\.\:]*\w+$`,
+			`^\@request\.query\.[\w\.\:]*\w+$`,
+			`^\@collection\.\w+\.[\w\.\:]*\w+$`,
 		},
 	}
 
-	// @todo remove after IN operator and multi-match filter enhancements
 	r.staticRequestData = map[string]any{}
 	if r.requestData != nil {
 		r.staticRequestData["method"] = r.requestData.Method
@@ -115,13 +111,10 @@ func (r *RecordFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
 		query.Distinct(true)
 
 		for _, join := range r.joins {
-			query.LeftJoin(join.table, join.on)
-		}
-	}
-
-	for _, expr := range r.exprs {
-		if expr != nil {
-			query.AndWhere(expr)
+			query.LeftJoin(
+				(join.tableName + " " + join.tableAlias),
+				join.on,
+			)
 		}
 	}
 
@@ -130,225 +123,63 @@ func (r *RecordFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
 
 // Resolve implements `search.FieldResolver` interface.
 //
-// Example of resolvable field formats:
-//	id
-//	project.screen.status
-//	@request.status
-//	@request.auth.someRelation.name
-//	@collection.product.name
-func (r *RecordFieldResolver) Resolve(fieldName string) (resultName string, placeholderParams dbx.Params, err error) {
-	if len(r.allowedFields) > 0 && !list.ExistInSliceWithRegex(fieldName, r.allowedFields) {
-		return "", nil, fmt.Errorf("Failed to resolve field %q", fieldName)
-	}
-
-	props := strings.Split(fieldName, ".")
-
-	currentCollectionName := r.baseCollection.Name
-	currentTableAlias := inflector.Columnify(currentCollectionName)
-
-	// flag indicating whether to return null on missing field or return on an error
-	nullifyMisingField := false
-
-	allowHiddenFields := r.allowHiddenFields
-
-	// check for @collection field (aka. non-relational join)
-	// must be in the format "@collection.COLLECTION_NAME.FIELD[.FIELD2....]"
-	if props[0] == "@collection" {
-		if len(props) < 3 {
-			return "", nil, fmt.Errorf("Invalid @collection field path in %q.", fieldName)
-		}
-
-		currentCollectionName = props[1]
-		currentTableAlias = inflector.Columnify("__collection_" + currentCollectionName)
-
-		collection, err := r.loadCollection(currentCollectionName)
-		if err != nil {
-			return "", nil, fmt.Errorf("Failed to load collection %q from field path %q.", currentCollectionName, fieldName)
-		}
-
-		// always allow hidden fields since the @collection.* filter is a system one
-		allowHiddenFields = true
-
-		r.registerJoin(inflector.Columnify(collection.Name), currentTableAlias, nil)
-
-		props = props[2:] // leave only the collection fields
-	} else if props[0] == "@request" {
-		if len(props) == 1 {
-			return "", nil, fmt.Errorf("Invalid @request data field path in %q.", fieldName)
-		}
-
-		if r.requestData == nil {
-			return "NULL", nil, nil
-		}
-
-		// plain @request.* field
-		if !strings.HasPrefix(fieldName, "@request.auth.") || list.ExistInSlice(fieldName, plainRequestAuthFields) {
-			return r.resolveStaticRequestField(props[1:]...)
-		}
-
-		// always allow hidden fields since the @request.* filter is a system one
-		allowHiddenFields = true
-
-		// enable the ignore flag for missing @request.auth.* fields
-		// for consistency with @request.data.* and @request.query.*
-		nullifyMisingField = true
-
-		// resolve the auth collection fields
-		// ---
-		if r.requestData == nil || r.requestData.AuthRecord == nil || r.requestData.AuthRecord.Collection() == nil {
-			return "NULL", nil, nil
-		}
-
-		collection := r.requestData.AuthRecord.Collection()
-		r.loadedCollections = append(r.loadedCollections, collection)
-
-		currentCollectionName = collection.Name
-		currentTableAlias = "__auth_" + inflector.Columnify(currentCollectionName)
-
-		authIdParamKey := "auth" + security.PseudorandomString(5)
-		authIdParams := dbx.Params{authIdParamKey: r.requestData.AuthRecord.Id}
-		// ---
-
-		// join the auth collection
-		r.registerJoin(
-			inflector.Columnify(collection.Name),
-			currentTableAlias,
-			dbx.NewExp(fmt.Sprintf(
-				// aka. __auth_users.id = :userId
-				"[[%s.id]] = {:%s}",
-				inflector.Columnify(currentTableAlias),
-				authIdParamKey,
-			), authIdParams),
-		)
-
-		props = props[2:] // leave only the auth relation fields
-	}
-
-	totalProps := len(props)
-
-	for i, prop := range props {
-		collection, err := r.loadCollection(currentCollectionName)
-		if err != nil {
-			return "", nil, fmt.Errorf("Failed to resolve field %q.", prop)
-		}
-
-		systemFieldNames := schema.BaseModelFieldNames()
-		if collection.IsAuth() {
-			systemFieldNames = append(
-				systemFieldNames,
-				schema.FieldNameUsername,
-				schema.FieldNameVerified,
-				schema.FieldNameEmailVisibility,
-				schema.FieldNameEmail,
-			)
-		}
-
-		// internal model prop (always available but not part of the collection schema)
-		if list.ExistInSlice(prop, systemFieldNames) {
-			// allow querying only auth records with emails marked as public
-			if prop == schema.FieldNameEmail && !allowHiddenFields {
-				r.registerExpr(dbx.NewExp(fmt.Sprintf(
-					"[[%s.%s]] = TRUE",
-					currentTableAlias,
-					inflector.Columnify(schema.FieldNameEmailVisibility),
-				)))
-			}
-
-			return fmt.Sprintf("[[%s.%s]]", currentTableAlias, inflector.Columnify(prop)), nil, nil
-		}
-
-		field := collection.Schema.GetFieldByName(prop)
-		if field == nil {
-			if nullifyMisingField {
-				return "NULL", nil, nil
-			}
-
-			return "", nil, fmt.Errorf("Unrecognized field %q.", prop)
-		}
-
-		// last prop
-		if i == totalProps-1 {
-			return fmt.Sprintf("[[%s.%s]]", currentTableAlias, inflector.Columnify(prop)), nil, nil
-		}
-
-		// check if it is a json field
-		if field.Type == schema.FieldTypeJson {
-			var jsonPath strings.Builder
-			jsonPath.WriteString("$")
-			for _, p := range props[i+1:] {
-				if _, err := strconv.Atoi(p); err == nil {
-					jsonPath.WriteString("[")
-					jsonPath.WriteString(inflector.Columnify(p))
-					jsonPath.WriteString("]")
-				} else {
-					jsonPath.WriteString(".")
-					jsonPath.WriteString(inflector.Columnify(p))
-				}
-			}
-			return fmt.Sprintf(
-				"JSON_EXTRACT([[%s.%s]], '%s')",
-				currentTableAlias,
-				inflector.Columnify(prop),
-				jsonPath.String(),
-			), nil, nil
-		}
-
-		// check if it is a relation field
-		if field.Type != schema.FieldTypeRelation {
-			return "", nil, fmt.Errorf("Field %q is not a valid relation.", prop)
-		}
-
-		// auto join the relation
-		// ---
-		field.InitOptions()
-		options, ok := field.Options.(*schema.RelationOptions)
-		if !ok {
-			return "", nil, fmt.Errorf("Failed to initialize field %q options.", prop)
-		}
-
-		relCollection, relErr := r.loadCollection(options.CollectionId)
-		if relErr != nil {
-			return "", nil, fmt.Errorf("Failed to find field %q collection.", prop)
-		}
-
-		cleanFieldName := inflector.Columnify(field.Name)
-		newCollectionName := relCollection.Name
-		newTableAlias := currentTableAlias + "_" + cleanFieldName
-
-		jeTable := currentTableAlias + "_" + cleanFieldName + "_je"
-		jePair := currentTableAlias + "." + cleanFieldName
-
-		r.registerJoin(
-			fmt.Sprintf(
-				// note: the case is used to normalize value access for single and multiple relations.
-				`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END)`,
-				jePair, jePair, jePair,
-			),
-			jeTable,
-			nil,
-		)
-		r.registerJoin(
-			inflector.Columnify(newCollectionName),
-			newTableAlias,
-			dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias, jeTable)),
-		)
-
-		currentCollectionName = newCollectionName
-		currentTableAlias = newTableAlias
-	}
-
-	return "", nil, fmt.Errorf("Failed to resolve field %q.", fieldName)
+// Example of some resolvable fieldName formats:
+//
+//  id
+//  someSelect.each
+//  project.screen.status
+//  @request.status
+//  @request.query.filter
+//  @request.auth.someRelation.name
+//  @request.data.someRelation.name
+//  @request.data.someField
+//  @request.data.someSelect:each
+//  @request.data.someField:isset
+//  @collection.product.name
+func (r *RecordFieldResolver) Resolve(fieldName string) (*search.ResolverResult, error) {
+	return parseAndRun(fieldName, r)
 }
 
-func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (resultName string, placeholderParams dbx.Params, err error) {
-	// ignore error because requestData is dynamic and some of the
-	// lookup keys may not be defined for the request
-	resultVal, _ := extractNestedMapVal(r.staticRequestData, path...)
+func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (*search.ResolverResult, error) {
+	if len(path) == 0 {
+		return nil, fmt.Errorf("at least one path key should be provided")
+	}
+
+	lastProp, modifier, err := splitModifier(path[len(path)-1])
+	if err != nil {
+		return nil, err
+	}
+
+	path[len(path)-1] = lastProp
+
+	// extract value
+	resultVal, err := extractNestedMapVal(r.staticRequestData, path...)
+
+	if modifier == issetModifier {
+		if err != nil {
+			return &search.ResolverResult{Identifier: "FALSE"}, nil
+		}
+		return &search.ResolverResult{Identifier: "TRUE"}, nil
+	}
+
+	// note: we are ignoring the error because requestData is dynamic
+	// and some of the lookup keys may not be defined for the request
 
 	switch v := resultVal.(type) {
 	case nil:
-		return "NULL", nil, nil
-	case string, bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64:
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	case string:
+		// check if it is a number field and explicitly try to cast to
+		// float in case of a numeric string value was used
+		// (this usually the case when the data is from a multipart/form-data request)
+		field := r.baseCollection.Schema.GetFieldByName(path[len(path)-1])
+		if field != nil && field.Type == schema.FieldTypeNumber {
+			if nv, err := strconv.ParseFloat(v, 64); err == nil {
+				resultVal = nv
+			}
+		}
+		// otherwise - no further processing is needed...
+	case bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64:
 		// no further processing is needed...
 	default:
 		// non-plain value
@@ -367,33 +198,11 @@ func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (resultN
 	}
 
 	placeholder := "f" + security.PseudorandomString(5)
-	name := fmt.Sprintf("{:%s}", placeholder)
-	params := dbx.Params{placeholder: resultVal}
 
-	return name, params, nil
-}
-
-func extractNestedMapVal(m map[string]any, keys ...string) (result any, err error) {
-	var ok bool
-
-	if len(keys) == 0 {
-		return nil, fmt.Errorf("At least one key should be provided.")
-	}
-
-	if result, ok = m[keys[0]]; !ok {
-		return nil, fmt.Errorf("Invalid key path - missing key %q.", keys[0])
-	}
-
-	// end key reached
-	if len(keys) == 1 {
-		return result, nil
-	}
-
-	if m, ok = result.(map[string]any); !ok {
-		return nil, fmt.Errorf("Expected map structure, got %#v.", result)
-	}
-
-	return extractNestedMapVal(m, keys[1:]...)
+	return &search.ResolverResult{
+		Identifier: "{:" + placeholder + "}",
+		Params:     dbx.Params{placeholder: resultVal},
+	}, nil
 }
 
 func (r *RecordFieldResolver) loadCollection(collectionNameOrId string) (*models.Collection, error) {
@@ -415,17 +224,15 @@ func (r *RecordFieldResolver) loadCollection(collectionNameOrId string) (*models
 }
 
 func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string, on dbx.Expression) {
-	tableExpr := (tableName + " " + tableAlias)
-
-	join := join{
-		id:    tableAlias,
-		table: tableExpr,
-		on:    on,
+	join := &join{
+		tableName:  tableName,
+		tableAlias: tableAlias,
+		on:         on,
 	}
 
 	// replace existing join
 	for i, j := range r.joins {
-		if j.id == join.id {
+		if j.tableAlias == join.tableAlias {
 			r.joins[i] = join
 			return
 		}
@@ -435,6 +242,44 @@ func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string,
 	r.joins = append(r.joins, join)
 }
 
-func (r *RecordFieldResolver) registerExpr(expr dbx.Expression) {
-	r.exprs = append(r.exprs, expr)
+func extractNestedMapVal(m map[string]any, keys ...string) (any, error) {
+	if len(keys) == 0 {
+		return nil, fmt.Errorf("at least one key should be provided")
+	}
+
+	var result any
+	var ok bool
+
+	if result, ok = m[keys[0]]; !ok {
+		return nil, fmt.Errorf("invalid key path - missing key %q", keys[0])
+	}
+
+	// end key reached
+	if len(keys) == 1 {
+		return result, nil
+	}
+
+	if m, ok = result.(map[string]any); !ok {
+		return nil, fmt.Errorf("expected map, got %#v", result)
+	}
+
+	return extractNestedMapVal(m, keys[1:]...)
+}
+
+func splitModifier(combined string) (string, string, error) {
+	parts := strings.Split(combined, ":")
+
+	if len(parts) != 2 {
+		return combined, "", nil
+	}
+
+	// validate modifier
+	switch parts[1] {
+	case issetModifier,
+		eachModifier,
+		lengthModifier:
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unknown modifier in %q", combined)
 }

resolvers/record_field_resolver_test.go

@@ -3,12 +3,14 @@ package resolvers_test
 import (
 	"encoding/json"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
 )
 
 func TestRecordFieldResolverUpdateQuery(t *testing.T) {
@@ -21,149 +23,307 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 	}
 
 	requestData := &models.RequestData{
+		Query: map[string]any{
+			"a": nil,
+			"b": 123,
+		},
+		Data: map[string]any{
+			"a":                nil,
+			"b":                123,
+			"number":           10,
+			"select_many":      []string{"optionA", "optionC"},
+			"rel_one":          "test",
+			"rel_many":         []string{"test1", "test2"},
+			"file_one":         "test",
+			"file_many":        []string{"test1", "test2", "test3"},
+			"self_rel_one":     "test",
+			"self_rel_many":    []string{"test1"},
+			"rel_many_cascade": []string{"test1", "test2"},
+		},
 		AuthRecord: authRecord,
 	}
 
 	scenarios := []struct {
 		name               string
 		collectionIdOrName string
-		fields             []string
+		rule               string
 		allowHiddenFields  bool
 		expectQuery        string
 	}{
 		{
-			"missing field",
+			"non relation field (with all default operators)",
 			"demo4",
-			[]string{""},
+			"title = true || title != 'test' || title ~ 'test1' || title !~ '%test2' || title > 1 || title >= 2 || title < 3 || title <= 4",
 			false,
-			"SELECT `demo4`.* FROM `demo4`",
+			"SELECT `demo4`.* FROM `demo4` WHERE (COALESCE([[demo4.title]], '') = COALESCE(1, '') OR COALESCE([[demo4.title]], '') != COALESCE({:TEST}, '') OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
 		},
 		{
-			"non relation field",
+			"non relation field (with all opt/any operators)",
 			"demo4",
-			[]string{"title"},
+			"title ?= true || title ?!= 'test' || title ?~ 'test1' || title ?!~ '%test2' || title ?> 1 || title ?>= 2 || title ?< 3 || title ?<= 4",
 			false,
-			"SELECT `demo4`.* FROM `demo4`",
+			"SELECT `demo4`.* FROM `demo4` WHERE (COALESCE([[demo4.title]], '') = COALESCE(1, '') OR COALESCE([[demo4.title]], '') != COALESCE({:TEST}, '') OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
 		},
 		{
 			"incomplete rel",
 			"demo4",
-			[]string{"self_rel_one"},
+			"self_rel_one > true",
 			false,
-			"SELECT `demo4`.* FROM `demo4`",
+			"SELECT `demo4`.* FROM `demo4` WHERE [[demo4.self_rel_one]] > 1",
 		},
 		{
 			"single rel (self rel)",
 			"demo4",
-			[]string{"self_rel_one.title"},
+			"self_rel_one.title > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]] WHERE [[demo4_self_rel_one.title]] > 1",
 		},
 		{
 			"single rel (other collection)",
 			"demo4",
-			[]string{"rel_one_cascade.title"},
+			"rel_one_cascade.title > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.rel_one_cascade]]) THEN [[demo4.rel_one_cascade]] ELSE json_array([[demo4.rel_one_cascade]]) END) `demo4_rel_one_cascade_je` LEFT JOIN `demo3` `demo4_rel_one_cascade` ON [[demo4_rel_one_cascade.id]] = [[demo4_rel_one_cascade_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.rel_one_cascade]]) THEN [[demo4.rel_one_cascade]] ELSE json_array([[demo4.rel_one_cascade]]) END) `demo4_rel_one_cascade_je` LEFT JOIN `demo3` `demo4_rel_one_cascade` ON [[demo4_rel_one_cascade.id]] = [[demo4_rel_one_cascade_je.value]] WHERE [[demo4_rel_one_cascade.title]] > 1",
 		},
 		{
 			"non-relation field + single rel",
 			"demo4",
-			[]string{"title", "self_rel_one.title"},
+			"title > true || self_rel_one.title > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]] WHERE ([[demo4.title]] > 1 OR [[demo4_self_rel_one.title]] > 1)",
 		},
 		{
-			"nested incomplete rels",
+			"nested incomplete rels (opt/any operator)",
 			"demo4",
-			[]string{"self_rel_many.self_rel_one"},
+			"self_rel_many.self_rel_one ?> true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] WHERE [[demo4_self_rel_many.self_rel_one]] > 1",
 		},
 		{
-			"nested complete rels",
+			"nested incomplete rels (multi-match operator)",
 			"demo4",
-			[]string{"self_rel_many.self_rel_one.title"},
+			"self_rel_many.self_rel_one > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] WHERE ((([[demo4_self_rel_many.self_rel_one]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.self_rel_one]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4.self_rel_many]]) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))))",
 		},
 		{
-			"repeated nested rels",
+			"nested complete rels (opt/any operator)",
 			"demo4",
-			[]string{"self_rel_many.self_rel_one.self_rel_many.self_rel_one.title"},
+			"self_rel_many.self_rel_one.title ?> true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many` ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]] WHERE [[demo4_self_rel_many_self_rel_one.title]] > 1",
 		},
 		{
-			"multiple rels",
+			"nested complete rels (multi-match operator)",
 			"demo4",
-			[]string{"self_rel_many.title", "self_rel_one.onefile"},
+			"self_rel_many.self_rel_one.title > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]]",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]] WHERE ((([[demo4_self_rel_many_self_rel_one.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4.self_rel_many]]) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_many.self_rel_one]]) THEN [[__mm_demo4_self_rel_many.self_rel_one]] ELSE json_array([[__mm_demo4_self_rel_many.self_rel_one]]) END) `__mm_demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many_self_rel_one_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))))",
 		},
 		{
-			"@collection join",
+			"repeated nested rels (opt/any operator)",
 			"demo4",
-			[]string{"@collection.demo1.text", "@collection.demo2.active", "@collection.demo1.file_one"},
+			"self_rel_many.self_rel_one.self_rel_many.self_rel_one.title ?> true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2`",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many` ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je.value]] WHERE [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > 1",
+		},
+		{
+			"repeated nested rels (multi-match operator)",
+			"demo4",
+			"self_rel_many.self_rel_one.self_rel_many.self_rel_one.title > true",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many` ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) THEN [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] ELSE json_array([[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) END) `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je.value]] WHERE ((([[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4.self_rel_many]]) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_many.self_rel_one]]) THEN [[__mm_demo4_self_rel_many.self_rel_one]] ELSE json_array([[__mm_demo4_self_rel_many.self_rel_one]]) END) `__mm_demo4_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]) THEN [[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one_self_rel_many` ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) THEN [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] ELSE json_array([[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]]) END) `__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))))",
+		},
+		{
+			"multiple rels (opt/any operators)",
+			"demo4",
+			"self_rel_many.title ?= 'test' || self_rel_one.json_object.a ?> true",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]] WHERE (COALESCE([[demo4_self_rel_many.title]], '') = COALESCE({:TEST}, '') OR JSON_EXTRACT([[demo4_self_rel_one.json_object]], '$.a') > 1)",
+		},
+		{
+			"multiple rels (multi-match operators)",
+			"demo4",
+			"self_rel_many.title = 'test' || self_rel_one.json_object.a > true",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]] WHERE (((COALESCE([[demo4_self_rel_many.title]], '') = COALESCE({:TEST}, '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4.self_rel_many]]) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__TEST}} WHERE NOT (COALESCE([[__TEST.multiMatchValue]], '') = COALESCE({:TEST}, ''))))) OR JSON_EXTRACT([[demo4_self_rel_one.json_object]], '$.a') > 1)",
+		},
+		{
+			"@collection join (opt/any operators)",
+			"demo4",
+			"@collection.demo1.text ?> true || @collection.demo2.active ?> true || @collection.demo1.file_one ?> true",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` WHERE ([[__collection_demo1.text]] > 1 OR [[__collection_demo2.active]] > 1 OR [[__collection_demo1.file_one]] > 1)",
+		},
+		{
+			"@collection join (multi-match operators)",
+			"demo4",
+			"@collection.demo1.text > true || @collection.demo2.active > true || @collection.demo1.file_one > true",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` WHERE ((([[__collection_demo1.text]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo1.text]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo1` `__mm__collection_demo1` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))) OR (([[__collection_demo2.active]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo2.active]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo2` `__mm__collection_demo2` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))) OR (([[__collection_demo1.file_one]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo1.file_one]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo1` `__mm__collection_demo1` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{TEST}} WHERE ((NOT ([[TEST.multiMatchValue]] > 1)) OR ([[TEST.multiMatchValue]] IS NULL))))))",
 		},
 		{
 			"@request.auth fields",
 			"demo4",
-			[]string{"@request.auth.id", "@request.auth.username", "@request.auth.rel.title", "@request.data.demo"},
+			"@request.auth.id > true || @request.auth.username > true || @request.auth.rel.title > true || @request.data.demo > true",
 			false,
-			"^" +
-				regexp.QuoteMeta("SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__auth_users` ON [[__auth_users.id]] =") +
-				" {:.*} " +
-				regexp.QuoteMeta("LEFT JOIN json_each(CASE WHEN json_valid([[__auth_users.rel]]) THEN [[__auth_users.rel]] ELSE json_array([[__auth_users.rel]]) END) `__auth_users_rel_je` LEFT JOIN `demo2` `__auth_users_rel` ON [[__auth_users_rel.id]] = [[__auth_users_rel_je.value]]") +
-				"$",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__auth_users` ON `__auth_users`.`id`={:TEST} LEFT JOIN json_each(CASE WHEN json_valid([[__auth_users.rel]]) THEN [[__auth_users.rel]] ELSE json_array([[__auth_users.rel]]) END) `__auth_users_rel_je` LEFT JOIN `demo2` `__auth_users_rel` ON [[__auth_users_rel.id]] = [[__auth_users_rel_je.value]] WHERE ({:TEST} > 1 OR {:TEST} > 1 OR [[__auth_users_rel.title]] > 1 OR NULL > 1)",
 		},
 		{
-			"hidden field with system filters (ignore emailVisibility)",
+			"hidden field with system filters (multi-match and ignore emailVisibility)",
 			"demo4",
-			[]string{"@collection.users.email", "@request.auth.email"},
+			"@collection.users.email > true || @request.auth.email > true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__collection_users`",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__collection_users` WHERE ((([[__collection_users.email]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_users.email]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `users` `__mm__collection_users` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] > 1)) OR ([[__smTEST.multiMatchValue]] IS NULL))))) OR {:TEST} > 1)",
 		},
 		{
 			"hidden field (add emailVisibility)",
 			"users",
-			[]string{"email"},
+			"id > true || email > true",
 			false,
-			"SELECT `users`.* FROM `users` WHERE [[users.emailVisibility]] = TRUE",
+			"SELECT `users`.* FROM `users` WHERE ([[users.id]] > 1 OR (([[users.email]] > 1) AND ([[users.emailVisibility]] = TRUE)))",
 		},
 		{
 			"hidden field (force ignore emailVisibility)",
 			"users",
-			[]string{"email"},
+			"email > true",
 			true,
-			"SELECT `users`.* FROM `users`",
+			"SELECT `users`.* FROM `users` WHERE [[users.email]] > 1",
+		},
+		{
+			"isset key",
+			"demo1",
+			"@request.data.a:isset > true ||" +
+				"@request.data.b:isset > true ||" +
+				"@request.data.c:isset > true ||" +
+				"@request.query.a:isset > true ||" +
+				"@request.query.b:isset > true ||" +
+				"@request.query.c:isset > true",
+			false,
+			"SELECT `demo1`.* FROM `demo1` WHERE (TRUE > 1 OR TRUE > 1 OR FALSE > 1 OR TRUE > 1 OR TRUE > 1 OR FALSE > 1)",
+		},
+		{
+			"@request.data.rel.* fields",
+			"demo1",
+			"@request.data.rel_one > true &&" +
+				"@request.data.rel_one.text > true &&" +
+				"@request.data.rel_many > true &&" +
+				"@request.data.rel_many.email != 'test' &&" +
+				"@request.data.rel_many.url ?= 'test' &&" +
+				"@request.data.rel_many.avatar ~ 'test'",
+			false,
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN `demo1` `__data_demo1` ON [[__data_demo1.id]]={:TEST} LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE ({:TEST} > 1 AND [[__data_demo1.text]] > 1 AND {:TEST} > 1 AND ((COALESCE([[__data_users.email]], '') != COALESCE({:TEST}, '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT (COALESCE([[__smTEST.multiMatchValue]], '') != COALESCE({:TEST}, ''))) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND COALESCE(NULL, '') = COALESCE({:TEST}, '') AND (([[__data_users.avatar]] LIKE {:TEST} ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.avatar]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE {:TEST} ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))))",
+		},
+		{
+			"@request.data.select:each fields",
+			"demo1",
+			"@request.data.select_one = 'test' &&" +
+				"@request.data.select_one:each != 'test' &&" +
+				"@request.data.select_one:each ?= 'test' &&" +
+				"@request.data.select_many ~ 'test' &&" +
+				"@request.data.select_many:each = 'test' &&" +
+				"@request.data.select_many:each ?< true",
+			false,
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each({:TEST}) `__dataSelect_select_one_je` LEFT JOIN json_each({:TEST}) `__dataSelect_select_many_je` WHERE (COALESCE(NULL, '') = COALESCE({:TEST}, '') AND COALESCE([[__dataSelect_select_one_je.value]], '') != COALESCE({:TEST}, '') AND COALESCE([[__dataSelect_select_one_je.value]], '') = COALESCE({:TEST}, '') AND {:TEST} LIKE {:TEST} ESCAPE '\\' AND ((COALESCE([[__dataSelect_select_many_je.value]], '') = COALESCE({:TEST}, '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:TEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT (COALESCE([[__smTEST.multiMatchValue]], '') = COALESCE({:TEST}, ''))))) AND [[__dataSelect_select_many_je.value]] < 1)",
+		},
+		{
+			"regular select:each fields",
+			"demo1",
+			"select_one = 'test' &&" +
+				"select_one:each != 'test' &&" +
+				"select_one:each ?> true &&" +
+				"select_many ~ 'test' &&" +
+				"select_many:each = 'test' &&" +
+				"select_many:each ?> true",
+			false,
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` WHERE (COALESCE([[demo1.select_one]], '') = COALESCE({:TEST}, '') AND COALESCE([[demo1_select_one_je.value]], '') != COALESCE({:TEST}, '') AND [[demo1_select_one_je.value]] > 1 AND [[demo1.select_many]] LIKE {:TEST} ESCAPE '\\' AND ((COALESCE([[demo1_select_many_je.value]], '') = COALESCE({:TEST}, '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT (COALESCE([[__smTEST.multiMatchValue]], '') = COALESCE({:TEST}, ''))))) AND [[demo1_select_many_je.value]] > 1)",
+		},
+		{
+			"select:each vs select:each",
+			"demo1",
+			"select_one:each != select_many:each &&" +
+				"select_many:each > select_one:each &&" +
+				"select_many:each ?< select_one:each &&" +
+				"select_many:each = @request.data.select_many:each",
+			false,
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` LEFT JOIN json_each({:TEST}) `__dataSelect_select_many_je` WHERE (((COALESCE([[demo1_select_one_je.value]], '') != COALESCE([[demo1_select_many_je.value]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT (COALESCE([[demo1_select_one_je.value]], '') != COALESCE([[__smTEST.multiMatchValue]], ''))) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND (([[demo1_select_many_je.value]] > [[demo1_select_one_je.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] > [[demo1_select_one_je.value]])) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND [[demo1_select_many_je.value]] < [[demo1_select_one_je.value]] AND ((COALESCE([[demo1_select_many_je.value]], '') = COALESCE([[__dataSelect_select_many_je.value]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:TEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))))",
+		},
+		{
+			"mixed multi-match vs multi-match",
+			"demo1",
+			"rel_many.rel.active != rel_many.name &&" +
+				"rel_many.rel.active ?= rel_many.name &&" +
+				"rel_many.rel.title ~ rel_one.email &&" +
+				"@collection.demo2.active = rel_many.rel.active &&" +
+				"@collection.demo2.active ?= rel_many.rel.active &&" +
+				"rel_many.email > @request.data.rel_many.email",
+			false,
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `demo1_rel_many_je` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[demo1_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo1_rel_many.rel]]) THEN [[demo1_rel_many.rel]] ELSE json_array([[demo1_rel_many.rel]]) END) `demo1_rel_many_rel_je` LEFT JOIN `demo2` `demo1_rel_many_rel` ON [[demo1_rel_many_rel.id]] = [[demo1_rel_many_rel_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_one]]) THEN [[demo1.rel_one]] ELSE json_array([[demo1.rel_one]]) END) `demo1_rel_one_je` LEFT JOIN `demo1` `demo1_rel_one` ON [[demo1_rel_one.id]] = [[demo1_rel_one_je.value]] LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE (((COALESCE([[demo1_rel_many_rel.active]], '') != COALESCE([[demo1_rel_many.name]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1_rel_many.rel]]) THEN [[__mm_demo1_rel_many.rel]] ELSE json_array([[__mm_demo1_rel_many.rel]]) END) `__mm_demo1_rel_many_rel_je` LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many_rel_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many.name]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE ((NOT (COALESCE([[__mlTEST.multiMatchValue]], '') != COALESCE([[__mrTEST.multiMatchValue]], ''))) OR ([[__mlTEST.multiMatchValue]] IS NULL) OR ([[__mrTEST.multiMatchValue]] IS NULL))))) AND COALESCE([[demo1_rel_many_rel.active]], '') = COALESCE([[demo1_rel_many.name]], '') AND (([[demo1_rel_many_rel.title]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.title]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1_rel_many.rel]]) THEN [[__mm_demo1_rel_many.rel]] ELSE json_array([[__mm_demo1_rel_many.rel]]) END) `__mm_demo1_rel_many_rel_je` LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many_rel_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND ((COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo2.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `demo2` `__mm__collection_demo2` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1_rel_many.rel]]) THEN [[__mm_demo1_rel_many.rel]] ELSE json_array([[__mm_demo1_rel_many.rel]]) END) `__mm_demo1_rel_many_rel_je` LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many_rel_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))) AND COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '') AND (((([[demo1_rel_many.email]] > [[__data_users.email]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFTLine truncated
+		},
+		{
+			"@request.data.arrayable:length fields",
+			"demo1",
+			"@request.data.select_one:length > 1 &&" +
+				"@request.data.select_one:length ?> 2 &&" +
+				"@request.data.select_many:length < 3 &&" +
+				"@request.data.select_many:length ?> 4 &&" +
+				"@request.data.rel_one:length = 5 &&" +
+				"@request.data.rel_one:length ?= 6 &&" +
+				"@request.data.rel_many:length != 7 &&" +
+				"@request.data.rel_many:length ?!= 8 &&" +
+				"@request.data.file_one:length = 9 &&" +
+				"@request.data.file_one:length ?= 0 &&" +
+				"@request.data.file_many:length != 1 &&" +
+				"@request.data.file_many:length ?!= 2",
+			false,
+			"SELECT `demo1`.* FROM `demo1` WHERE (0 > {:TEST} AND 0 > {:TEST} AND 2 < {:TEST} AND 2 > {:TEST} AND COALESCE(1, '') = COALESCE({:TEST}, '') AND COALESCE(1, '') = COALESCE({:TEST}, '') AND COALESCE(2, '') != COALESCE({:TEST}, '') AND COALESCE(2, '') != COALESCE({:TEST}, '') AND COALESCE(1, '') = COALESCE({:TEST}, '') AND COALESCE(1, '') = COALESCE({:TEST}, '') AND COALESCE(3, '') != COALESCE({:TEST}, '') AND COALESCE(3, '') != COALESCE({:TEST}, ''))",
+		},
+		{
+			"regular arrayable:length fields",
+			"demo4",
+			"@request.data.self_rel_one.self_rel_many:length > 1 &&" +
+				"@request.data.self_rel_one.self_rel_many:length ?> 2 &&" +
+				"@request.data.rel_many_cascade.files:length ?< 3 &&" +
+				"@request.data.rel_many_cascade.files:length < 4 &&" +
+				"self_rel_one.self_rel_many:length = 5 &&" +
+				"self_rel_one.self_rel_many:length ?= 6 &&" +
+				"self_rel_one.rel_many_cascade.files:length != 7 &&" +
+				"self_rel_one.rel_many_cascade.files:length ?!= 8",
+			false,
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `__data_demo4` ON [[__data_demo4.id]]={:TEST} LEFT JOIN `demo3` `__data_demo3` ON [[__data_demo3.id]] IN ({:TEST}, {:TEST}) LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_one]]) THEN [[demo4.self_rel_one]] ELSE json_array([[demo4.self_rel_one]]) END) `demo4_self_rel_one_je` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_one.rel_many_cascade]]) THEN [[demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[demo4_self_rel_one.rel_many_cascade]]) END) `demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `demo4_self_rel_one_rel_many_cascade` ON [[demo4_self_rel_one_rel_many_cascade.id]] = [[demo4_self_rel_one_rel_many_cascade_je.value]] WHERE (json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE json_array([[__data_demo4.self_rel_many]]) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE json_array([[__data_demo4.self_rel_many]]) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE json_array([[__data_demo3.files]]) END) < {:TEST} AND ((json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE json_array([[__data_demo3.files]]) END) < {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__data_mm_demo3.files]]) THEN [[__data_mm_demo3.files]] ELSE json_array([[__data_mm_demo3.files]]) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__data_mm_demo3` ON `__data_mm_demo3`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] < {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND COALESCE(json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END), '') = COALESCE({:TEST}, '') AND COALESCE(json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END), '') = COALESCE({:TEST}, '') AND ((COALESCE(json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END), '') != COALESCE({:TEST}, '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) THEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] ELSE json_array([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4.self_rel_one]]) THEN [[__mm_demo4.self_rel_one]] ELSE json_array([[__mm_demo4.self_rel_one]]) END) `__mm_demo4_self_rel_one_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_one` ON [[__mm_demo4_self_rel_one.id]] = [[__mm_demo4_self_rel_one_je.value]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_one.rel_many_cascade]]) THEN [[__mm_demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[__mm_demo4_self_rel_one.rel_many_cascade]]) END) `__mm_demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `__mm_demo4_self_rel_one_rel_many_cascade` ON [[__mm_demo4_self_rel_one_rel_many_cascade.id]] = [[__mm_demo4_self_rel_one_rel_many_cascade_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT (COALESCE([[__smTEST.multiMatchValue]], '') != COALESCE({:TEST}, ''))) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND COALESCE(json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END), '') != COALESCE({:TEST}, ''))",
 		},
 	}
 
 	for _, s := range scenarios {
 		collection, err := app.Dao().FindCollectionByNameOrId(s.collectionIdOrName)
 		if err != nil {
-			t.Errorf("[%s] Failed to load collection %s: %v", s.name, s.collectionIdOrName, err)
+			t.Fatalf("[%s] Failed to load collection %s: %v", s.name, s.collectionIdOrName, err)
 		}
 
 		query := app.Dao().RecordQuery(collection)
 
 		r := resolvers.NewRecordFieldResolver(app.Dao(), collection, requestData, s.allowHiddenFields)
-		for _, field := range s.fields {
-			r.Resolve(field)
+
+		expr, err := search.FilterData(s.rule).BuildExpr(r)
+		if err != nil {
+			t.Fatalf("[%s] BuildExpr failed with error %v", s.name, err)
 		}
 
 		if err := r.UpdateQuery(query); err != nil {
-			t.Errorf("[%s] UpdateQuery failed with error %v", s.name, err)
-			continue
+			t.Fatalf("[%s] UpdateQuery failed with error %v", s.name, err)
 		}
 
-		rawQuery := query.Build().SQL()
+		rawQuery := query.AndWhere(expr).Build().SQL()
 
-		if !list.ExistInSliceWithRegex(rawQuery, []string{s.expectQuery}) {
-			t.Errorf("[%s] Expected query\n %v \ngot:\n %v", s.name, s.expectQuery, rawQuery)
+		// replace TEST placeholder with .+ regex pattern
+		expectQuery := strings.ReplaceAll(
+			"^"+regexp.QuoteMeta(s.expectQuery)+"$",
+			"TEST",
+			`\w+`,
+		)
+
+		if !list.ExistInSliceWithRegex(rawQuery, []string{expectQuery}) {
+			t.Fatalf("[%s] Expected query\n %v \ngot:\n %v", s.name, expectQuery, rawQuery)
 		}
 	}
 }
@@ -230,7 +390,7 @@ func TestRecordFieldResolverResolveSchemaFields(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		name, params, err := r.Resolve(s.fieldName)
+		r, err := r.Resolve(s.fieldName)
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -238,13 +398,17 @@ func TestRecordFieldResolverResolveSchemaFields(t *testing.T) {
 			continue
 		}
 
-		if name != s.expectName {
-			t.Errorf("(%q) Expected name %q, got %q", s.fieldName, s.expectName, name)
+		if hasErr {
+			continue
+		}
+
+		if r.Identifier != s.expectName {
+			t.Errorf("(%q) Expected r.Identifier %q, got %q", s.fieldName, s.expectName, r.Identifier)
 		}
 
 		// params should be empty for non @request fields
-		if len(params) != 0 {
-			t.Errorf("(%q) Expected 0 params, got %v", s.fieldName, params)
+		if len(r.Params) != 0 {
+			t.Errorf("(%q) Expected 0 r.Params, got %v", s.fieldName, r.Params)
 		}
 	}
 }
@@ -253,7 +417,7 @@ func TestRecordFieldResolverResolveStaticRequestDataFields(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	collection, err := app.Dao().FindCollectionByNameOrId("demo4")
+	collection, err := app.Dao().FindCollectionByNameOrId("demo1")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -269,8 +433,10 @@ func TestRecordFieldResolverResolveStaticRequestDataFields(t *testing.T) {
 			"a": 123,
 		},
 		Data: map[string]any{
-			"b": 456,
-			"c": map[string]int{"sub": 1},
+			"number":         "10",
+			"number_unknown": "20",
+			"b":              456,
+			"c":              map[string]int{"sub": 1},
 		},
 		AuthRecord: authRecord,
 	}
@@ -292,6 +458,8 @@ func TestRecordFieldResolverResolveStaticRequestDataFields(t *testing.T) {
 		{"@request.query.a.missing", false, ``},
 		{"@request.data", true, ``},
 		{"@request.data.b", false, `456`},
+		{"@request.data.number", false, `10`},           // number field normalization
+		{"@request.data.number_unknown", false, `"20"`}, // no numeric normalizations for unknown fields
 		{"@request.data.b.missing", false, ``},
 		{"@request.data.c", false, `"{\"sub\":1}"`},
 		{"@request.auth", true, ""},
@@ -304,7 +472,7 @@ func TestRecordFieldResolverResolveStaticRequestDataFields(t *testing.T) {
 	}
 
 	for i, s := range scenarios {
-		name, params, err := r.Resolve(s.fieldName)
+		r, err := r.Resolve(s.fieldName)
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -318,34 +486,34 @@ func TestRecordFieldResolverResolveStaticRequestDataFields(t *testing.T) {
 
 		// missing key
 		// ---
-		if len(params) == 0 {
-			if name != "NULL" {
-				t.Errorf("(%d) Expected 0 placeholder parameters for %v, got %v", i, name, params)
+		if len(r.Params) == 0 {
+			if r.Identifier != "NULL" {
+				t.Errorf("(%d) Expected 0 placeholder parameters for %v, got %v", i, r.Identifier, r.Params)
 			}
 			continue
 		}
 
 		// existing key
 		// ---
-		if len(params) != 1 {
-			t.Errorf("(%d) Expected 1 placeholder parameter for %v, got %v", i, name, params)
+		if len(r.Params) != 1 {
+			t.Errorf("(%d) Expected 1 placeholder parameter for %v, got %v", i, r.Identifier, r.Params)
 			continue
 		}
 
 		var paramName string
 		var paramValue any
-		for k, v := range params {
+		for k, v := range r.Params {
 			paramName = k
 			paramValue = v
 		}
 
-		if name != ("{:" + paramName + "}") {
-			t.Errorf("(%d) Expected parameter name %q, got %q", i, paramName, name)
+		if r.Identifier != ("{:" + paramName + "}") {
+			t.Errorf("(%d) Expected parameter r.Identifier %q, got %q", i, paramName, r.Identifier)
 		}
 
 		encodedParamValue, _ := json.Marshal(paramValue)
 		if string(encodedParamValue) != s.expectParamValue {
-			t.Errorf("(%d) Expected params %v for %v, got %v", i, s.expectParamValue, name, string(encodedParamValue))
+			t.Errorf("(%d) Expected r.Params %v for %v, got %v", i, s.expectParamValue, r.Identifier, string(encodedParamValue))
 		}
 	}
 }

tests/app.go

@@ -182,6 +182,30 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 		return t.registerEventCall("OnRecordAuthRequest")
 	})
 
+	t.OnRecordBeforeAuthWithPasswordRequest().Add(func(e *core.RecordAuthWithPasswordEvent) error {
+		return t.registerEventCall("OnRecordBeforeAuthWithPasswordRequest")
+	})
+
+	t.OnRecordAfterAuthWithPasswordRequest().Add(func(e *core.RecordAuthWithPasswordEvent) error {
+		return t.registerEventCall("OnRecordAfterAuthWithPasswordRequest")
+	})
+
+	t.OnRecordBeforeAuthWithOAuth2Request().Add(func(e *core.RecordAuthWithOAuth2Event) error {
+		return t.registerEventCall("OnRecordBeforeAuthWithOAuth2Request")
+	})
+
+	t.OnRecordAfterAuthWithOAuth2Request().Add(func(e *core.RecordAuthWithOAuth2Event) error {
+		return t.registerEventCall("OnRecordAfterAuthWithOAuth2Request")
+	})
+
+	t.OnRecordBeforeAuthRefreshRequest().Add(func(e *core.RecordAuthRefreshEvent) error {
+		return t.registerEventCall("OnRecordBeforeAuthRefreshRequest")
+	})
+
+	t.OnRecordAfterAuthRefreshRequest().Add(func(e *core.RecordAuthRefreshEvent) error {
+		return t.registerEventCall("OnRecordAfterAuthRefreshRequest")
+	})
+
 	t.OnRecordBeforeRequestPasswordResetRequest().Add(func(e *core.RecordRequestPasswordResetEvent) error {
 		return t.registerEventCall("OnRecordBeforeRequestPasswordResetRequest")
 	})
@@ -386,6 +410,38 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 		return t.registerEventCall("OnAdminAuthRequest")
 	})
 
+	t.OnAdminBeforeAuthWithPasswordRequest().Add(func(e *core.AdminAuthWithPasswordEvent) error {
+		return t.registerEventCall("OnAdminBeforeAuthWithPasswordRequest")
+	})
+
+	t.OnAdminAfterAuthWithPasswordRequest().Add(func(e *core.AdminAuthWithPasswordEvent) error {
+		return t.registerEventCall("OnAdminAfterAuthWithPasswordRequest")
+	})
+
+	t.OnAdminBeforeAuthRefreshRequest().Add(func(e *core.AdminAuthRefreshEvent) error {
+		return t.registerEventCall("OnAdminBeforeAuthRefreshRequest")
+	})
+
+	t.OnAdminAfterAuthRefreshRequest().Add(func(e *core.AdminAuthRefreshEvent) error {
+		return t.registerEventCall("OnAdminAfterAuthRefreshRequest")
+	})
+
+	t.OnAdminBeforeRequestPasswordResetRequest().Add(func(e *core.AdminRequestPasswordResetEvent) error {
+		return t.registerEventCall("OnAdminBeforeRequestPasswordResetRequest")
+	})
+
+	t.OnAdminAfterRequestPasswordResetRequest().Add(func(e *core.AdminRequestPasswordResetEvent) error {
+		return t.registerEventCall("OnAdminAfterRequestPasswordResetRequest")
+	})
+
+	t.OnAdminBeforeConfirmPasswordResetRequest().Add(func(e *core.AdminConfirmPasswordResetEvent) error {
+		return t.registerEventCall("OnAdminBeforeConfirmPasswordResetRequest")
+	})
+
+	t.OnAdminAfterConfirmPasswordResetRequest().Add(func(e *core.AdminConfirmPasswordResetEvent) error {
+		return t.registerEventCall("OnAdminAfterConfirmPasswordResetRequest")
+	})
+
 	t.OnFileDownloadRequest().Add(func(e *core.FileDownloadEvent) error {
 		return t.registerEventCall("OnFileDownloadRequest")
 	})

tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt

@@ -0,0 +1 @@
+test

tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt.attrs

@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":{"original-filename":"test.txt"},"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}

tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt

@@ -0,0 +1 @@
+test

tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt.attrs

@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":{"original-filename":"test.txt"},"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}

tools/auth/auth.go

@@ -9,13 +9,14 @@ import (
 
 // AuthUser defines a standardized oauth2 user data structure.
 type AuthUser struct {
-	Id          string         `json:"id"`
-	Name        string         `json:"name"`
-	Username    string         `json:"username"`
-	Email       string         `json:"email"`
-	AvatarUrl   string         `json:"avatarUrl"`
-	RawUser     map[string]any `json:"rawUser"`
-	AccessToken string         `json:"accessToken"`
+	Id           string         `json:"id"`
+	Name         string         `json:"name"`
+	Username     string         `json:"username"`
+	Email        string         `json:"email"`
+	AvatarUrl    string         `json:"avatarUrl"`
+	RawUser      map[string]any `json:"rawUser"`
+	AccessToken  string         `json:"accessToken"`
+	RefreshToken string         `json:"refreshToken"`
 }
 
 // Provider defines a common interface for an OAuth2 client.
@@ -105,6 +106,16 @@ func NewProviderByName(name string) (Provider, error) {
 		return NewKakaoProvider(), nil
 	case NameTwitch:
 		return NewTwitchProvider(), nil
+	case NameStrava:
+		return NewStravaProvider(), nil
+	case NameGitee:
+		return NewGiteeProvider(), nil
+	case NameLivechat:
+		return NewLivechatProvider(), nil
+	case NameAuthentik:
+		return NewAuthentikProvider(), nil
+	case NameGitea:
+		return NewGiteaProvider(), nil
 	default:
 		return nil, errors.New("Missing provider " + name)
 	}

tools/auth/auth_test.go

@@ -108,4 +108,49 @@ func TestNewProviderByName(t *testing.T) {
 	if _, ok := p.(*auth.Twitch); !ok {
 		t.Error("Expected to be instance of *auth.Twitch")
 	}
+
+	// strava
+	p, err = auth.NewProviderByName(auth.NameStrava)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Strava); !ok {
+		t.Error("Expected to be instance of *auth.Strava")
+	}
+
+	// gitee
+	p, err = auth.NewProviderByName(auth.NameGitee)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Gitee); !ok {
+		t.Error("Expected to be instance of *auth.Gitee")
+	}
+
+	// livechat
+	p, err = auth.NewProviderByName(auth.NameLivechat)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Livechat); !ok {
+		t.Error("Expected to be instance of *auth.Livechat")
+	}
+
+	// authentik
+	p, err = auth.NewProviderByName(auth.NameAuthentik)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Authentik); !ok {
+		t.Error("Expected to be instance of *auth.Authentik")
+	}
+
+	// gitea
+	p, err = auth.NewProviderByName(auth.NameGitea)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Gitea); !ok {
+		t.Error("Expected to be instance of *auth.Gitea")
+	}
 }

tools/auth/authentik.go

@@ -0,0 +1,71 @@
+package auth
+
+import (
+	"encoding/json"
+
+	"golang.org/x/oauth2"
+)
+
+var _ Provider = (*Authentik)(nil)
+
+// NameAuthentik is the unique name of the Authentik provider.
+const NameAuthentik string = "authentik"
+
+// Authentik allows authentication via Authentik OAuth2.
+type Authentik struct {
+	*baseProvider
+}
+
+// NewAuthentikProvider creates new Authentik provider instance with some defaults.
+func NewAuthentikProvider() *Authentik {
+	return &Authentik{&baseProvider{
+		scopes: []string{
+			"openid", // minimal requirement to return the id
+			"email",
+			"profile",
+		},
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Authentik's user api.
+//
+// API reference: https://goauthentik.io/docs/providers/oauth2/
+func (p *Authentik) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserData(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"sub"`
+		Name          string `json:"name"`
+		Username      string `json:"preferred_username"`
+		Picture       string `json:"picture"`
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		Username:     extracted.Username,
+		AvatarUrl:    extracted.Picture,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	if extracted.EmailVerified {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}

tools/auth/discord.go

@@ -63,12 +63,13 @@ func (p *Discord) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	username := fmt.Sprintf("%s#%s", extracted.Username, extracted.Discriminator)
 
 	user := &AuthUser{
-		Id:          extracted.Id,
-		Name:        username,
-		Username:    extracted.Username,
-		AvatarUrl:   avatarUrl,
-		RawUser:     rawUser,
-		AccessToken: token.AccessToken,
+		Id:           extracted.Id,
+		Name:         username,
+		Username:     extracted.Username,
+		AvatarUrl:    avatarUrl,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
 	}
 	if extracted.Verified {
 		user.Email = extracted.Email