regenerated jsvm types

Co-authored-by: Tobias Muehlberger <tobias@muehlberger.dev>

.github/workflows/release.yaml

@@ -16,12 +16,12 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: latest
+          node-version: 20.8.1
 
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '>=1.21.0'
+          go-version: '>=1.21.3'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

CONTRIBUTING.md

@@ -1,5 +1,4 @@
-Contributing to PocketBase
-======================================================================
+# Contributing to PocketBase
 
 Thanks for taking the time to improve PocketBase!
 
@@ -9,26 +8,26 @@ This document describes how to prepare a PR for a change in the main repository.
 - [Making changes in the Go code](#making-changes-in-the-go-code)
 - [Making changes in the Admin UI](#making-changes-in-the-admin-ui)
 
-
 ## Prerequisites
 
-- Go 1.18+ (for making changes in the Go code)
+- Go 1.19+ (for making changes in the Go code)
 - Node 16+ (for making changes in the Admin UI)
 
 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
+
 ```
 git clone https://github.com/your_username/pocketbase.git
 ```
 
+> [!IMPORTANT]
 > It is recommended to create a new branch from master for each of your bugfixes and features.
 > This is required if you are planning to submit multiple PRs in order to keep the changes separate for review until they eventually get merged.
 
-
 ## Making changes in the Go code
 
 PocketBase is distributed as a Go package, which means that in order to run the project you'll have to create a Go `main` program that imports the package.
 
-The repository already includes such program, located in `/examples/base`, that is also used for the prebuilt executables.
+The repository already includes such program, located in `examples/base`, that is also used for the prebuilt executables.
 
 So, let's assume that you already done some changes in the PocketBase Go code and you want now to run them:
 
@@ -41,20 +40,22 @@ This will start a web server on `http://localhost:8090` with the embedded prebui
 
 - Add unit/integration tests for your changes (we are using the standard `testing` go package).
   To run the tests, you could execute (while in the root project directory):
-    ```sh
-    go test ./...
 
-    # or using the Makefile
-    make test
-    ```
+  ```sh
+  go test ./...
+
+  # or using the Makefile
+  make test
+  ```
 
 - Run the linter - **golangci** ([see how to install](https://golangci-lint.run/usage/install/#local-installation)):
-    ```sh
-    golangci-lint run -c ./golangci.yml ./...
 
-    # or using the Makefile
-    make lint
-    ```
+  ```sh
+  golangci-lint run -c ./golangci.yml ./...
+
+  # or using the Makefile
+  make lint
+  ```
 
 ## Making changes in the Admin UI
 
@@ -65,14 +66,15 @@ To start the Admin UI:
 1. Navigate to the `ui` project directory
 2. Run `npm install` to install the node dependencies
 3. Start vite's dev server
-    ```sh
-    npm run dev
-    ```
+   ```sh
+   npm run dev
+   ```
 
 You could open the browser and access the running Admin UI at `http://localhost:3000`.
 
 Since the Admin UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
 
+> [!NOTE]
 > By default, the Admin UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
 
 Every change you make in the Admin UI should be automatically reflected in the browser at `http://localhost:3000` without reloading the page.

README.md

@@ -19,10 +19,10 @@
 
 **For documentation and examples, please visit https://pocketbase.io/docs.**
 
-> ⚠️ Please keep in mind that PocketBase is still under active development
+> [!WARNING]
+> Please keep in mind that PocketBase is still under active development
 > and therefore full backward compatibility is not guaranteed before reaching v1.0.0.
 
-
 ## API SDK clients
 
 The easiest way to interact with the API is to use one of the official SDK clients:
@@ -30,7 +30,6 @@ The easiest way to interact with the API is to use one of the official SDK clien
 - **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_browser and node_)
 - **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_web, mobile, desktop_)
 
-
 ## Overview
 
 PocketBase could be [downloaded directly as a standalone app](https://github.com/pocketbase/pocketbase/releases) or it could be used as a Go framework/toolkit which allows you to build
@@ -39,10 +38,9 @@ your own custom app specific business logic and still have a single portable exe
 ### Installation
 
 ```sh
-# go 1.18+
+# go 1.21+
 go get github.com/pocketbase/pocketbase
 ```
-> For Windows, you may have to use go 1.19+ due to an incorrect js mime type in the Windows Registry (see [issue#6](https://github.com/pocketbase/pocketbase/issues/6)).
 
 ### Example
 
@@ -95,14 +93,15 @@ Enable CGO only if you really need to squeeze the read/write query performance a
 
 To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:
 
-0. [Install Go 1.18+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
 1. Clone/download the repo
 2. Navigate to `examples/base`
 3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
-    (_https://go.dev/doc/install/source#environment_)
+   (_https://go.dev/doc/install/source#environment_)
 4. Start the created executable by running `./base serve`.
 
 The supported build targets by the non-cgo driver at the moment are:
+
 ```
 darwin  amd64
 darwin  arm64
@@ -114,6 +113,7 @@ linux   arm
 linux   arm64
 linux   ppc64le
 linux   riscv64
+linux   s390x
 windows amd64
 windows arm64
 ```
@@ -122,6 +122,7 @@ windows arm64
 
 PocketBase comes with mixed bag of unit and integration tests.
 To run them, use the default `go test` command:
+
 ```sh
 go test ./...
 ```
@@ -134,7 +135,6 @@ If you discover a security vulnerability within PocketBase, please send an e-mai
 
 All reports will be promptly addressed, and you'll be credited accordingly.
 
-
 ## Contributing
 
 PocketBase is free and open source project licensed under the [MIT License](LICENSE.md).
@@ -154,5 +154,6 @@ PocketBase has a [roadmap](https://github.com/orgs/pocketbase/projects/2) and I
 Don't get upset if I close your PR, even if it is well executed and tested. This doesn't mean that it will never be merged.
 Later we can always refer to it and/or take pieces of your implementation when the time comes to work on the issue (don't worry you'll be credited in the release notes).
 
-_Please also note that PocketBase was initially created to serve as a new backend for my other open source project - [Presentator](https://presentator.io) (see [#183](https://github.com/presentator/presentator/issues/183)),
-so all feature requests will be first aligned with what we need for Presentator v3._
+> [!NOTE]
+> PocketBase was initially created to serve as a new backend for my other open source project - [Presentator](https://presentator.io) (see [#183](https://github.com/presentator/presentator/issues/183)),
+> so all feature requests will be first aligned with what we need for Presentator v3.

apis/admin.go

@@ -1,7 +1,6 @@
 package apis
 
 import (
-	"log"
 	"net/http"
 
 	"github.com/labstack/echo/v5"
@@ -129,9 +128,8 @@ func (api *adminApi) requestPasswordReset(c echo.Context) error {
 			return api.app.OnAdminBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Admin); err != nil && api.app.IsDebug() {
-						// @todo replace after logs generalization
-						log.Println(err)
+					if err := next(e.Admin); err != nil {
+						api.app.Logger().Error("Failed to send admin password reset request.", "error", err)
 					}
 				})
 

apis/backup.go

@@ -2,7 +2,6 @@ package apis
 
 import (
 	"context"
-	"log"
 	"net/http"
 	"path/filepath"
 	"time"
@@ -69,7 +68,7 @@ func (api *backupApi) list(c echo.Context) error {
 }
 
 func (api *backupApi) create(c echo.Context) error {
-	if api.app.Cache().Has(core.CacheKeyActiveBackup) {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
 		return NewBadRequestError("Try again later - another backup/restore process has already been started", nil)
 	}
 
@@ -152,7 +151,7 @@ func (api *backupApi) download(c echo.Context) error {
 }
 
 func (api *backupApi) restore(c echo.Context) error {
-	if api.app.Cache().Has(core.CacheKeyActiveBackup) {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
 		return NewBadRequestError("Try again later - another backup/restore process has already been started.", nil)
 	}
 
@@ -181,8 +180,8 @@ func (api *backupApi) restore(c echo.Context) error {
 		// give some optimistic time to write the response
 		time.Sleep(1 * time.Second)
 
-		if err := api.app.RestoreBackup(ctx, key); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := api.app.RestoreBackup(ctx, key); err != nil {
+			api.app.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
 		}
 	}()
 
@@ -203,7 +202,7 @@ func (api *backupApi) delete(c echo.Context) error {
 
 	key := c.PathParam("key")
 
-	if key != "" && cast.ToString(api.app.Cache().Get(core.CacheKeyActiveBackup)) == key {
+	if key != "" && cast.ToString(api.app.Store().Get(core.StoreKeyActiveBackup)) == key {
 		return NewBadRequestError("The backup is currently being used and cannot be deleted.", nil)
 	}
 

apis/backup_test.go

@@ -116,7 +116,7 @@ func TestBackupsCreate(t *testing.T) {
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				app.Cache().Set(core.CacheKeyActiveBackup, "")
+				app.Store().Set(core.StoreKeyActiveBackup, "")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
@@ -562,7 +562,7 @@ func TestBackupsDelete(t *testing.T) {
 				}
 
 				// mock active backup with the same name to delete
-				app.Cache().Set(core.CacheKeyActiveBackup, "test1.zip")
+				app.Store().Set(core.StoreKeyActiveBackup, "test1.zip")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
@@ -583,7 +583,7 @@ func TestBackupsDelete(t *testing.T) {
 				}
 
 				// mock active backup with different name
-				app.Cache().Set(core.CacheKeyActiveBackup, "new.zip")
+				app.Store().Set(core.StoreKeyActiveBackup, "new.zip")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
@@ -700,7 +700,7 @@ func TestBackupsRestore(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				app.Cache().Set(core.CacheKeyActiveBackup, "")
+				app.Store().Set(core.StoreKeyActiveBackup, "")
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},

apis/base.go

@@ -6,11 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"log"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/labstack/echo/v5/middleware"
@@ -26,9 +27,9 @@ const trailedAdminPath = "/_/"
 // system and app specific routes and middlewares.
 func InitApi(app core.App) (*echo.Echo, error) {
 	e := echo.New()
-	e.Debug = app.IsDebug()
+	e.Debug = false
 	e.JSONSerializer = &rest.Serializer{
-		FieldsParam: "fields",
+		FieldsParam: fieldsQueryParam,
 	}
 
 	// configure a custom router
@@ -49,6 +50,13 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	e.Pre(LoadAuthContext(app))
 	e.Use(middleware.Recover())
 	e.Use(middleware.Secure())
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set(ContextExecStartKey, time.Now())
+
+			return next(c)
+		}
+	})
 
 	// custom error handler
 	e.HTTPErrorHandler = func(c echo.Context, err error) {
@@ -56,30 +64,14 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			return // no error
 		}
 
-		if c.Response().Committed {
-			if app.IsDebug() {
-				log.Println("HTTPErrorHandler response was already committed:", err)
-			}
-			return
-		}
-
 		var apiErr *ApiError
 
 		if errors.As(err, &apiErr) {
-			if app.IsDebug() && apiErr.RawData() != nil {
-				log.Println(apiErr.RawData())
-			}
+			// already an api error...
 		} else if v := new(echo.HTTPError); errors.As(err, &v) {
-			if v.Internal != nil && app.IsDebug() {
-				log.Println(v.Internal)
-			}
 			msg := fmt.Sprintf("%v", v.Message)
 			apiErr = NewApiError(v.Code, msg, v)
 		} else {
-			if app.IsDebug() {
-				log.Println(err)
-			}
-
 			if errors.Is(err, sql.ErrNoRows) {
 				apiErr = NewNotFoundError("", err)
 			} else {
@@ -87,13 +79,19 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			}
 		}
 
+		logRequest(app, c, apiErr)
+
+		if c.Response().Committed {
+			return // already commited
+		}
+
 		event := new(core.ApiErrorEvent)
 		event.HttpContext = c
 		event.Error = apiErr
 
 		// send error response
 		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {
-			if c.Response().Committed {
+			if e.HttpContext.Response().Committed {
 				return nil
 			}
 
@@ -106,12 +104,11 @@ func InitApi(app core.App) (*echo.Echo, error) {
 		})
 
 		if hookErr == nil {
-			if err := app.OnAfterApiError().Trigger(event); err != nil && app.IsDebug() {
-				log.Println(hookErr)
+			if err := app.OnAfterApiError().Trigger(event); err != nil {
+				app.Logger().Debug("OnAfterApiError failure", slog.String("error", hookErr.Error()))
 			}
-		} else if app.IsDebug() {
-			// truly rare case; eg. client already disconnected
-			log.Println(hookErr)
+		} else {
+			app.Logger().Debug("OnBeforeApiError error (truly rare case, eg. client already disconnected)", slog.String("error", hookErr.Error()))
 		}
 	}
 
@@ -215,7 +212,7 @@ func updateHasAdminsCache(app core.App) error {
 		return err
 	}
 
-	app.Cache().Set(hasAdminsCacheKey, total > 0)
+	app.Store().Set(hasAdminsCacheKey, total > 0)
 
 	return nil
 }
@@ -240,14 +237,14 @@ func installerRedirect(app core.App) echo.MiddlewareFunc {
 				return next(c)
 			}
 
-			hasAdmins := cast.ToBool(app.Cache().Get(hasAdminsCacheKey))
+			hasAdmins := cast.ToBool(app.Store().Get(hasAdminsCacheKey))
 
 			if !hasAdmins {
 				// update the cache to make sure that the admin wasn't created by another process
 				if err := updateHasAdminsCache(app); err != nil {
 					return err
 				}
-				hasAdmins = cast.ToBool(app.Cache().Get(hasAdminsCacheKey))
+				hasAdmins = cast.ToBool(app.Store().Get(hasAdminsCacheKey))
 			}
 
 			_, hasInstallerParam := c.Request().URL.Query()["installer"]

apis/collection_test.go

@@ -425,7 +425,7 @@ func TestCollectionCreate(t *testing.T) {
 				`"type":"auth"`,
 				`"system":false`,
 				`"schema":[{"system":false,"id":"12345789","name":"test","type":"text","required":false,"presentable":false,"unique":false,"options":{"min":null,"max":null,"pattern":""}}]`,
-				`"options":{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":0,"onlyEmailDomains":null,"requireEmail":false}`,
+				`"options":{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":0,"onlyEmailDomains":null,"onlyVerified":false,"requireEmail":false}`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeCreate":             1,
@@ -1141,7 +1141,7 @@ func TestCollectionsImport(t *testing.T) {
 			},
 			ExpectedEvents: map[string]int{
 				"OnCollectionsBeforeImportRequest": 1,
-				"OnModelBeforeDelete":              4,
+				"OnModelBeforeDelete":              1,
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				collections := []*models.Collection{}

apis/file.go

@@ -1,19 +1,26 @@
 package apis
 
 import (
+	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
+	"runtime"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
+	"golang.org/x/sync/singleflight"
 )
 
 var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif"}
@@ -21,7 +28,12 @@ var defaultThumbSizes = []string{"100x100"}
 
 // bindFileApi registers the file api endpoints and the corresponding handlers.
 func bindFileApi(app core.App, rg *echo.Group) {
-	api := fileApi{app: app}
+	api := fileApi{
+		app:             app,
+		thumbGenSem:     semaphore.NewWeighted(int64(runtime.NumCPU() + 1)), // the value is arbitrary chosen and may change in the future
+		thumbGenPending: new(singleflight.Group),
+		thumbGenMaxWait: 60 * time.Second,
+	}
 
 	subGroup := rg.Group("/files", ActivityLogger(app))
 	subGroup.POST("/token", api.fileToken)
@@ -31,6 +43,18 @@ func bindFileApi(app core.App, rg *echo.Group) {
 
 type fileApi struct {
 	app core.App
+
+	// thumbGenSem is a semaphore to prevent too much concurrent
+	// requests generating new thumbs at the same time.
+	thumbGenSem *semaphore.Weighted
+
+	// thumbGenPending represents a group of currently pending
+	// thumb generation processes.
+	thumbGenPending *singleflight.Group
+
+	// thumbGenMaxWait is the maximum waiting time for starting a new
+	// thumb generation process.
+	thumbGenMaxWait time.Duration
 }
 
 func (api *fileApi) fileToken(c echo.Context) error {
@@ -124,11 +148,11 @@ func (api *fileApi) download(c echo.Context) error {
 		baseFilesPath = fileRecord.BaseFilesPath()
 	}
 
-	fs, err := api.app.NewFilesystem()
+	fsys, err := api.app.NewFilesystem()
 	if err != nil {
 		return NewBadRequestError("Filesystem initialization failure.", err)
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	originalPath := baseFilesPath + "/" + filename
 	servedPath := originalPath
@@ -138,7 +162,7 @@ func (api *fileApi) download(c echo.Context) error {
 	thumbSize := c.QueryParam("thumb")
 	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, options.Thumbs)) {
 		// extract the original file meta attributes and check it existence
-		oAttrs, oAttrsErr := fs.Attributes(originalPath)
+		oAttrs, oAttrsErr := fsys.Attributes(originalPath)
 		if oAttrsErr != nil {
 			return NewNotFoundError("", err)
 		}
@@ -149,10 +173,19 @@ func (api *fileApi) download(c echo.Context) error {
 			servedName = thumbSize + "_" + filename
 			servedPath = baseFilesPath + "/thumbs_" + filename + "/" + servedName
 
-			// create a new thumb if it doesn exists
-			if exists, _ := fs.Exists(servedPath); !exists {
-				if err := fs.CreateThumb(originalPath, servedPath, thumbSize); err != nil {
-					servedPath = originalPath // fallback to the original
+			// create a new thumb if it doesn't exist
+			if exists, _ := fsys.Exists(servedPath); !exists {
+				if err := api.createThumb(c, fsys, originalPath, servedPath, thumbSize); err != nil {
+					api.app.Logger().Warn(
+						"Fallback to original - failed to create thumb "+servedName,
+						slog.Any("error", err),
+						slog.String("original", originalPath),
+						slog.String("thumb", servedPath),
+					)
+
+					// fallback to the original
+					servedName = filename
+					servedPath = originalPath
 				}
 			}
 		}
@@ -176,7 +209,7 @@ func (api *fileApi) download(c echo.Context) error {
 			return nil
 		}
 
-		if err := fs.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
+		if err := fsys.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
 			return NewNotFoundError("", err)
 		}
 
@@ -214,3 +247,29 @@ func (api *fileApi) findAdminOrAuthRecordByFileToken(fileToken string) (models.M
 
 	return nil, errors.New("missing or invalid file token")
 }
+
+func (api *fileApi) createThumb(
+	c echo.Context,
+	fsys *filesystem.System,
+	originalPath string,
+	thumbPath string,
+	thumbSize string,
+) error {
+	ch := api.thumbGenPending.DoChan(thumbPath, func() (any, error) {
+		ctx, cancel := context.WithTimeout(c.Request().Context(), api.thumbGenMaxWait)
+		defer cancel()
+
+		if err := api.thumbGenSem.Acquire(ctx, 1); err != nil {
+			return nil, err
+		}
+		defer api.thumbGenSem.Release(1)
+
+		return nil, fsys.CreateThumb(originalPath, thumbPath, thumbSize)
+	})
+
+	res := <-ch
+
+	api.thumbGenPending.Forget(thumbPath)
+
+	return res.Err
+}

apis/file_test.go

@@ -2,15 +2,19 @@ package apis_test
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path"
 	"path/filepath"
 	"runtime"
+	"sync"
 	"testing"
 
 	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
@@ -385,3 +389,80 @@ func TestFileDownload(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestConcurrentThumbsGeneration(t *testing.T) {
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	// create a dummy file field collection
+	demo1, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fileField := demo1.Schema.GetFieldByName("file_one")
+	fileField.Options = &schema.FileOptions{
+		Protected: false,
+		MaxSelect: 1,
+		MaxSize:   999999,
+		// new thumbs
+		Thumbs: []string{"111x111", "111x222", "111x333"},
+	}
+	demo1.Schema.AddField(fileField)
+	if err := app.Dao().SaveCollection(demo1); err != nil {
+		t.Fatal(err)
+	}
+
+	fileKey := "wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png"
+
+	e, err := apis.InitApi(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	urls := []string{
+		"/api/files/" + fileKey + "?thumb=111x111",
+		"/api/files/" + fileKey + "?thumb=111x111", // should still result in single thumb
+		"/api/files/" + fileKey + "?thumb=111x222",
+		"/api/files/" + fileKey + "?thumb=111x333",
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(len(urls))
+
+	for _, url := range urls {
+		url := url
+		go func() {
+			defer wg.Done()
+
+			recorder := httptest.NewRecorder()
+
+			req := httptest.NewRequest("GET", url, nil)
+
+			e.ServeHTTP(recorder, req)
+		}()
+	}
+
+	wg.Wait()
+
+	// ensure that all new requested thumbs were created
+	thumbKeys := []string{
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x111_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x222_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x333_" + filepath.Base(fileKey),
+	}
+	for _, k := range thumbKeys {
+		if exists, _ := fsys.Exists(k); !exists {
+			t.Fatalf("Missing thumb %q: %v", k, err)
+		}
+	}
+}

apis/health.go

@@ -32,7 +32,7 @@ func (api *healthApi) healthCheck(c echo.Context) error {
 	resp := new(healthCheckResponse)
 	resp.Code = http.StatusOK
 	resp.Message = "API is healthy."
-	resp.Data.CanBackup = !api.app.Cache().Has(core.CacheKeyActiveBackup)
+	resp.Data.CanBackup = !api.app.Store().Has(core.StoreKeyActiveBackup)
 
 	return c.JSON(http.StatusOK, resp)
 }

apis/logs.go

@@ -15,27 +15,27 @@ func bindLogsApi(app core.App, rg *echo.Group) {
 	api := logsApi{app: app}
 
 	subGroup := rg.Group("/logs", RequireAdminAuth())
-	subGroup.GET("/requests", api.requestsList)
-	subGroup.GET("/requests/stats", api.requestsStats)
-	subGroup.GET("/requests/:id", api.requestView)
+	subGroup.GET("", api.list)
+	subGroup.GET("/stats", api.stats)
+	subGroup.GET("/:id", api.view)
 }
 
 type logsApi struct {
 	app core.App
 }
 
-var requestFilterFields = []string{
+var logFilterFields = []string{
 	"rowid", "id", "created", "updated",
-	"url", "method", "status", "auth",
-	"remoteIp", "userIp", "referer", "userAgent",
+	"level", "message", "data",
+	`^data\.[\w\.\:]*\w+$`,
 }
 
-func (api *logsApi) requestsList(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) list(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	result, err := search.NewProvider(fieldResolver).
-		Query(api.app.LogsDao().RequestQuery()).
-		ParseAndExec(c.QueryParams().Encode(), &[]*models.Request{})
+		Query(api.app.LogsDao().LogQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &[]*models.Log{})
 
 	if err != nil {
 		return NewBadRequestError("", err)
@@ -44,8 +44,8 @@ func (api *logsApi) requestsList(c echo.Context) error {
 	return c.JSON(http.StatusOK, result)
 }
 
-func (api *logsApi) requestsStats(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) stats(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	filter := c.QueryParam(search.FilterQueryParam)
 
@@ -58,24 +58,24 @@ func (api *logsApi) requestsStats(c echo.Context) error {
 		}
 	}
 
-	stats, err := api.app.LogsDao().RequestsStats(expr)
+	stats, err := api.app.LogsDao().LogsStats(expr)
 	if err != nil {
-		return NewBadRequestError("Failed to generate requests stats.", err)
+		return NewBadRequestError("Failed to generate logs stats.", err)
 	}
 
 	return c.JSON(http.StatusOK, stats)
 }
 
-func (api *logsApi) requestView(c echo.Context) error {
+func (api *logsApi) view(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
 		return NewNotFoundError("", nil)
 	}
 
-	request, err := api.app.LogsDao().FindRequestById(id)
-	if err != nil || request == nil {
+	log, err := api.app.LogsDao().FindLogById(id)
+	if err != nil || log == nil {
 		return NewNotFoundError("", err)
 	}
 
-	return c.JSON(http.StatusOK, request)
+	return c.JSON(http.StatusOK, log)
 }

apis/logs_test.go

@@ -8,19 +8,19 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestRequestsList(t *testing.T) {
+func TestLogsList(t *testing.T) {
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests",
+			Url:             "/api/logs",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -30,12 +30,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -52,12 +52,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests?filter=status>200",
+			Url:    "/api/logs?filter=data.status>200",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -77,19 +77,19 @@ func TestRequestsList(t *testing.T) {
 	}
 }
 
-func TestRequestView(t *testing.T) {
+func TestLogView(t *testing.T) {
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -99,12 +99,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (nonexisting request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/missing1-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -114,12 +114,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (existing request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -135,19 +135,19 @@ func TestRequestView(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/stats",
+			Url:             "/api/logs/stats",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -157,12 +157,12 @@ func TestRequestsStats(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -174,12 +174,12 @@ func TestRequestsStats(t *testing.T) {
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats?filter=status>200",
+			Url:    "/api/logs/stats?filter=data.status>200",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},

apis/middlewares.go

@@ -2,9 +2,10 @@ package apis
 
 import (
 	"fmt"
-	"log"
+	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -15,7 +16,6 @@ import (
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )
 
@@ -24,6 +24,7 @@ const (
 	ContextAdminKey      string = "admin"
 	ContextAuthRecordKey string = "authRecord"
 	ContextCollectionKey string = "collection"
+	ContextExecStartKey  string = "execStart"
 )
 
 // RequireGuestOnly middleware requires a request to NOT have a valid
@@ -285,86 +286,92 @@ func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.Midd
 func ActivityLogger(app core.App) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			err := next(c)
-
-			logsMaxDays := app.Settings().Logs.MaxDays
-
-			// no logs retention
-			if logsMaxDays == 0 {
+			if err := next(c); err != nil {
 				return err
 			}
 
-			httpRequest := c.Request()
-			httpResponse := c.Response()
-			status := httpResponse.Status
-			meta := types.JsonMap{}
+			logRequest(app, c, nil)
 
-			if err != nil {
-				switch v := err.(type) {
-				case *echo.HTTPError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.Internal)
-				case *ApiError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.RawData())
-				default:
-					status = http.StatusBadRequest
-					meta["errorMessage"] = v.Error()
-				}
-			}
-
-			requestAuth := models.RequestAuthGuest
-			if c.Get(ContextAuthRecordKey) != nil {
-				requestAuth = models.RequestAuthRecord
-			} else if c.Get(ContextAdminKey) != nil {
-				requestAuth = models.RequestAuthAdmin
-			}
-
-			ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
-
-			model := &models.Request{
-				Url:       httpRequest.URL.RequestURI(),
-				Method:    strings.ToUpper(httpRequest.Method),
-				Status:    status,
-				Auth:      requestAuth,
-				UserIp:    realUserIp(httpRequest, ip),
-				RemoteIp:  ip,
-				Referer:   httpRequest.Referer(),
-				UserAgent: httpRequest.UserAgent(),
-				Meta:      meta,
-			}
-			// set timestamp fields before firing a new go routine
-			model.RefreshCreated()
-			model.RefreshUpdated()
-
-			routine.FireAndForget(func() {
-				if err := app.LogsDao().SaveRequest(model); err != nil && app.IsDebug() {
-					log.Println("Log save failed:", err)
-				}
-
-				// Delete old request logs
-				// ---
-				now := time.Now()
-				lastLogsDeletedAt := cast.ToTime(app.Cache().Get("lastLogsDeletedAt"))
-				daysDiff := now.Sub(lastLogsDeletedAt).Hours() * 24
-
-				if daysDiff > float64(logsMaxDays) {
-					deleteErr := app.LogsDao().DeleteOldRequests(now.AddDate(0, 0, -1*logsMaxDays))
-					if deleteErr == nil {
-						app.Cache().Set("lastLogsDeletedAt", now)
-					} else if app.IsDebug() {
-						log.Println("Logs delete failed:", deleteErr)
-					}
-				}
-			})
-
-			return err
+			return nil
 		}
 	}
 }
 
+func logRequest(app core.App, c echo.Context, err *ApiError) {
+	// no logs retention
+	if app.Settings().Logs.MaxDays == 0 {
+		return
+	}
+
+	attrs := make([]any, 0, 15)
+
+	attrs = append(attrs, slog.String("type", "request"))
+
+	started := cast.ToTime(c.Get(ContextExecStartKey))
+	if !started.IsZero() {
+		attrs = append(attrs, slog.Float64("execTime", float64(time.Since(started))/float64(time.Millisecond)))
+	}
+
+	httpRequest := c.Request()
+	httpResponse := c.Response()
+	method := strings.ToUpper(httpRequest.Method)
+	status := httpResponse.Status
+	requestUri := httpRequest.URL.RequestURI()
+
+	// parse the request error
+	if err != nil {
+		status = err.Code
+		attrs = append(
+			attrs,
+			slog.String("error", err.Message),
+			slog.Any("details", err.RawData()),
+		)
+	}
+
+	requestAuth := models.RequestAuthGuest
+	if c.Get(ContextAuthRecordKey) != nil {
+		requestAuth = models.RequestAuthRecord
+	} else if c.Get(ContextAdminKey) != nil {
+		requestAuth = models.RequestAuthAdmin
+	}
+
+	attrs = append(
+		attrs,
+		slog.String("url", requestUri),
+		slog.String("method", method),
+		slog.Int("status", status),
+		slog.String("auth", requestAuth),
+		slog.String("referer", httpRequest.Referer()),
+		slog.String("userAgent", httpRequest.UserAgent()),
+	)
+
+	if app.Settings().Logs.LogIp {
+		ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
+		attrs = append(
+			attrs,
+			slog.String("userIp", realUserIp(httpRequest, ip)),
+			slog.String("remoteIp", ip),
+		)
+	}
+
+	// don't block on logs write
+	routine.FireAndForget(func() {
+		message := method + " "
+
+		if escaped, err := url.PathUnescape(requestUri); err == nil {
+			message += escaped
+		} else {
+			message += requestUri
+		}
+
+		if err != nil {
+			app.Logger().Error(message, attrs...)
+		} else {
+			app.Logger().Info(message, attrs...)
+		}
+	})
+}
+
 // Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
 //
 // The returned IP value shouldn't be trusted if not behind a trusted reverse proxy!

apis/realtime.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"log"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -15,18 +15,20 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/spf13/cast"
 )
 
 // bindRealtimeApi registers the realtime api endpoints.
 func bindRealtimeApi(app core.App, rg *echo.Group) {
 	api := realtimeApi{app: app}
 
-	subGroup := rg.Group("/realtime", ActivityLogger(app))
+	subGroup := rg.Group("/realtime")
 	subGroup.GET("", api.connect)
-	subGroup.POST("", api.setSubscriptions)
+	subGroup.POST("", api.setSubscriptions, ActivityLogger(app))
 
 	api.bindEvents()
 }
@@ -49,16 +51,19 @@ func (api *realtimeApi) connect(c echo.Context) error {
 			Client:      client,
 		}
 
-		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil {
+			api.app.Logger().Debug(
+				"OnRealtimeDisconnectRequest error",
+				slog.String("clientId", client.Id()),
+				slog.String("error", err.Error()),
+			)
 		}
 
 		api.app.SubscriptionsBroker().Unregister(client.Id())
 	}()
 
-	c.Response().Header().Set("Content-Type", "text/event-stream; charset=UTF-8")
+	c.Response().Header().Set("Content-Type", "text/event-stream")
 	c.Response().Header().Set("Cache-Control", "no-store")
-	c.Response().Header().Set("Connection", "keep-alive")
 	// https://github.com/pocketbase/pocketbase/discussions/480#discussioncomment-3657640
 	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
 	c.Response().Header().Set("X-Accel-Buffering", "no")
@@ -73,9 +78,7 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		return err
 	}
 
-	if api.app.IsDebug() {
-		log.Printf("Realtime connection established: %s\n", client.Id())
-	}
+	api.app.Logger().Debug("Realtime connection established.", slog.String("clientId", client.Id()))
 
 	// signalize established connection (aka. fire "connect" message)
 	connectMsgEvent := &core.RealtimeMessageEvent{
@@ -97,9 +100,11 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		return api.app.OnRealtimeAfterMessageSend().Trigger(e)
 	})
 	if connectMsgErr != nil {
-		if api.app.IsDebug() {
-			log.Println("Realtime connection closed (failed to deliver PB_CONNECT):", client.Id(), connectMsgErr)
-		}
+		api.app.Logger().Debug(
+			"Realtime connection closed (failed to deliver PB_CONNECT)",
+			slog.String("clientId", client.Id()),
+			slog.String("error", connectMsgErr.Error()),
+		)
 		return nil
 	}
 
@@ -115,9 +120,10 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		case msg, ok := <-client.Channel():
 			if !ok {
 				// channel is closed
-				if api.app.IsDebug() {
-					log.Println("Realtime connection closed (closed channel):", client.Id())
-				}
+				api.app.Logger().Debug(
+					"Realtime connection closed (closed channel)",
+					slog.String("clientId", client.Id()),
+				)
 				return nil
 			}
 
@@ -137,9 +143,11 @@ func (api *realtimeApi) connect(c echo.Context) error {
 				return api.app.OnRealtimeAfterMessageSend().Trigger(msgEvent)
 			})
 			if msgErr != nil {
-				if api.app.IsDebug() {
-					log.Println("Realtime connection closed (failed to deliver message):", client.Id(), msgErr)
-				}
+				api.app.Logger().Debug(
+					"Realtime connection closed (failed to deliver message)",
+					slog.String("clientId", client.Id()),
+					slog.String("error", msgErr.Error()),
+				)
 				return nil
 			}
 
@@ -147,9 +155,10 @@ func (api *realtimeApi) connect(c echo.Context) error {
 			idleTimer.Reset(idleTimeout)
 		case <-c.Request().Context().Done():
 			// connection is closed
-			if api.app.IsDebug() {
-				log.Println("Realtime connection closed (cancelled request):", client.Id())
-			}
+			api.app.Logger().Debug(
+				"Realtime connection closed (cancelled request)",
+				slog.String("clientId", client.Id()),
+			)
 			return nil
 		}
 	}
@@ -199,6 +208,12 @@ func (api *realtimeApi) setSubscriptions(c echo.Context) error {
 		// subscribe to the new subscriptions
 		e.Client.Subscribe(e.Subscriptions...)
 
+		api.app.Logger().Debug(
+			"Realtime subscriptions updated.",
+			slog.String("clientId", e.Client.Id()),
+			slog.Any("subscriptions", e.Subscriptions),
+		)
+
 		return api.app.OnRealtimeAfterSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeEvent) error {
 			if e.HttpContext.Response().Committed {
 				return nil
@@ -266,8 +281,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterCreate().PreAdd(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("create", record, false); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("create", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record create",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -275,8 +295,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterUpdate().PreAdd(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("update", record, false); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("update", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record update",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -284,8 +309,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelBeforeDelete().Add(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("delete", record, true); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("delete", record, true); err != nil {
+				api.app.Logger().Debug(
+					"Failed to dry cache record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -293,8 +323,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterDelete().Add(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastDryCachedRecord("delete", record); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastDryCachedRecord("delete", record); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -327,58 +362,16 @@ func (api *realtimeApi) resolveRecordCollection(model models.Model) (collection
 	return collection
 }
 
-// canAccessRecord checks if the subscription client has access to the specified record model.
-func (api *realtimeApi) canAccessRecord(client subscriptions.Client, record *models.Record, accessRule *string) bool {
-	admin, _ := client.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		// admins can access everything
-		return true
-	}
-
-	if accessRule == nil {
-		// only admins can access this record
-		return false
-	}
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if *accessRule == "" {
-			return nil // empty public rule
-		}
-
-		// mock request data
-		requestInfo := &models.RequestInfo{
-			Method: "GET",
-		}
-		requestInfo.AuthRecord, _ = client.Get(ContextAuthRecordKey).(*models.Record)
-
-		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestInfo, true)
-		expr, err := search.FilterData(*accessRule).BuildExpr(resolver)
-		if err != nil {
-			return err
-		}
-		resolver.UpdateQuery(q)
-		q.AndWhere(expr)
-
-		return nil
-	}
-
-	foundRecord, err := api.app.Dao().FindRecordById(record.Collection().Id, record.Id, ruleFunc)
-	if err == nil && foundRecord != nil {
-		return true
-	}
-
-	return false
-}
-
+// recordData represents the broadcasted record subscrition message data.
 type recordData struct {
-	Action string         `json:"action"`
-	Record *models.Record `json:"record"`
+	Record any    `json:"record"` /* map or models.Record */
+	Action string `json:"action"`
 }
 
 func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dryCache bool) error {
 	collection := record.Collection()
 	if collection == nil {
-		return errors.New("Record collection not set.")
+		return errors.New("[broadcastRecord] Record collection not set.")
 	}
 
 	clients := api.app.SubscriptionsBroker().Clients()
@@ -386,67 +379,125 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dr
 		return nil // no subscribers
 	}
 
-	// create a clean record copy without expand and unknown fields
-	// because we don't know if the clients have permissions to view them
-	cleanRecord := record.CleanCopy()
-
 	subscriptionRuleMap := map[string]*string{
-		(collection.Name + "/" + cleanRecord.Id): collection.ViewRule,
-		(collection.Id + "/" + cleanRecord.Id):   collection.ViewRule,
-		(collection.Name + "/*"):                 collection.ListRule,
-		(collection.Id + "/*"):                   collection.ListRule,
-		// @deprecated: the same as the wildcard topic but kept for backward compatibility
-		collection.Name: collection.ListRule,
-		collection.Id:   collection.ListRule,
+		(collection.Name + "/" + record.Id + "?"): collection.ViewRule,
+		(collection.Id + "/" + record.Id + "?"):   collection.ViewRule,
+		(collection.Name + "/*?"):                 collection.ListRule,
+		(collection.Id + "/*?"):                   collection.ListRule,
+		// @deprecated: the same      as the wildcard topic but kept for backward compatibility
+		(collection.Name + "?"): collection.ListRule,
+		(collection.Id + "?"):   collection.ListRule,
 	}
 
-	data := &recordData{
-		Action: action,
-		Record: cleanRecord,
-	}
-
-	dataBytes, err := json.Marshal(data)
-	if err != nil {
-		return err
-	}
+	dryCacheKey := action + "/" + record.Id
 
 	for _, client := range clients {
 		client := client
 
-		for subscription, rule := range subscriptionRuleMap {
-			if !client.HasSubscription(subscription) {
+		// note: not executed concurrently to avoid races and to ensure
+		// that the access checks are applied for the current record db state
+		for prefix, rule := range subscriptionRuleMap {
+			subs := client.Subscriptions(prefix)
+			if len(subs) == 0 {
 				continue
 			}
 
-			if !api.canAccessRecord(client, data.Record, rule) {
-				continue
-			}
+			for sub, options := range subs {
+				// create a clean record copy without expand and unknown fields
+				// because we don't know yet which exact fields the client subscription has permissions to access
+				cleanRecord := record.CleanCopy()
 
-			msg := subscriptions.Message{
-				Name: subscription,
-				Data: dataBytes,
-			}
-
-			// ignore the auth record email visibility checks for
-			// auth owner, admin or manager
-			if collection.IsAuth() {
-				authId := extractAuthIdFromGetter(client)
-				if authId == data.Record.Id ||
-					api.canAccessRecord(client, data.Record, collection.AuthOptions().ManageRule) {
-					data.Record.IgnoreEmailVisibility(true) // ignore
-					if newData, err := json.Marshal(data); err == nil {
-						msg.Data = newData
-					}
-					data.Record.IgnoreEmailVisibility(false) // restore
+				// mock request data
+				requestInfo := &models.RequestInfo{
+					Method:  "GET",
+					Query:   options.Query,
+					Headers: options.Headers,
 				}
-			}
+				requestInfo.Admin, _ = client.Get(ContextAdminKey).(*models.Admin)
+				requestInfo.AuthRecord, _ = client.Get(ContextAuthRecordKey).(*models.Record)
 
-			if dryCache {
-				client.Set(action+"/"+data.Record.Id, msg)
-			} else {
-				routine.FireAndForget(func() {
-					client.Send(msg)
-				})
+				if !api.canAccessRecord(cleanRecord, requestInfo, rule) {
+					continue
+				}
+
+				rawExpand := cast.ToString(options.Query[expandQueryParam])
+				if rawExpand != "" {
+					expandErrs := api.app.Dao().ExpandRecord(cleanRecord, strings.Split(rawExpand, ","), expandFetch(api.app.Dao(), requestInfo))
+					if len(expandErrs) > 0 {
+						api.app.Logger().Debug(
+							"[broadcastRecord] expand errors",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("expand", rawExpand),
+							slog.Any("errors", expandErrs),
+						)
+					}
+				}
+
+				// ignore the auth record email visibility checks
+				// for auth owner, admin or manager
+				if collection.IsAuth() {
+					authId := extractAuthIdFromGetter(client)
+					if authId == cleanRecord.Id {
+						if api.canAccessRecord(cleanRecord, requestInfo, collection.AuthOptions().ManageRule) {
+							cleanRecord.IgnoreEmailVisibility(true)
+						}
+					}
+				}
+
+				data := &recordData{
+					Action: action,
+					Record: cleanRecord,
+				}
+
+				// check fields
+				rawFields := cast.ToString(options.Query[fieldsQueryParam])
+				if rawFields != "" {
+					decoded, err := rest.PickFields(cleanRecord, rawFields)
+					if err == nil {
+						data.Record = decoded
+					} else {
+						api.app.Logger().Debug(
+							"[broadcastRecord] pick fields error",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("fields", rawFields),
+							slog.String("error", err.Error()),
+						)
+					}
+				}
+
+				dataBytes, err := json.Marshal(data)
+				if err != nil {
+					api.app.Logger().Debug(
+						"[broadcastRecord] data marshal error",
+						slog.String("id", cleanRecord.Id),
+						slog.String("collectionName", cleanRecord.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+					continue
+				}
+
+				msg := subscriptions.Message{
+					Name: sub,
+					Data: dataBytes,
+				}
+
+				if dryCache {
+					messages, ok := client.Get(dryCacheKey).([]subscriptions.Message)
+					if !ok {
+						messages = []subscriptions.Message{msg}
+					} else {
+						messages = append(messages, msg)
+					}
+					client.Set(dryCacheKey, messages)
+				} else {
+					routine.FireAndForget(func() {
+						client.Send(msg)
+					})
+				}
 			}
 		}
 	}
@@ -454,14 +505,14 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dr
 	return nil
 }
 
-// broadcastDryCachedRecord broadcasts record if it is cached in the client context.
+// broadcastDryCachedRecord broadcasts all cached record related messages.
 func (api *realtimeApi) broadcastDryCachedRecord(action string, record *models.Record) error {
+	key := action + "/" + record.Id
+
 	clients := api.app.SubscriptionsBroker().Clients()
 
 	for _, client := range clients {
-		key := action + "/" + record.Id
-
-		msg, ok := client.Get(key).(subscriptions.Message)
+		messages, ok := client.Get(key).([]subscriptions.Message)
 		if !ok {
 			continue
 		}
@@ -471,9 +522,12 @@ func (api *realtimeApi) broadcastDryCachedRecord(action string, record *models.R
 		client := client
 
 		routine.FireAndForget(func() {
-			client.Send(msg)
+			for _, msg := range messages {
+				client.Send(msg)
+			}
 		})
 	}
+
 	return nil
 }
 
@@ -494,3 +548,45 @@ func extractAuthIdFromGetter(val getter) string {
 
 	return ""
 }
+
+// canAccessRecord checks if the subscription client has access to the specified record model.
+func (api *realtimeApi) canAccessRecord(
+	record *models.Record,
+	requestInfo *models.RequestInfo,
+	accessRule *string,
+) bool {
+	// check the access rule
+	// ---
+	if ok, _ := api.app.Dao().CanAccessRecord(record, requestInfo, accessRule); !ok {
+		return false
+	}
+
+	// check the subscription client-side filter (if any)
+	// ---
+	filter := cast.ToString(requestInfo.Query[search.FilterQueryParam])
+	if filter == "" {
+		return true // no further checks needed
+	}
+
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
+		return false
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestInfo, false)
+
+		expr, err := search.FilterData(filter).BuildExpr(resolver)
+		if err != nil {
+			return err
+		}
+		q.AndWhere(expr)
+
+		resolver.UpdateQuery(q)
+
+		return nil
+	}
+
+	_, err := api.app.Dao().FindRecordById(record.Collection().Id, record.Id, ruleFunc)
+
+	return err == nil
+}

apis/realtime_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -22,6 +23,7 @@ func TestRealtimeConnect(t *testing.T) {
 		{
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`id:`,
@@ -44,6 +46,7 @@ func TestRealtimeConnect(t *testing.T) {
 			Name:           "PB_CONNECT interrupt",
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeConnectRequest":    1,
@@ -68,6 +71,7 @@ func TestRealtimeConnect(t *testing.T) {
 			Name:           "Skipping/ignoring messages",
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeConnectRequest":    1,

apis/record_auth.go

@@ -4,8 +4,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
+	"sort"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -73,12 +74,15 @@ func (api *recordAuthApi) authRefresh(c echo.Context) error {
 }
 
 type providerInfo struct {
-	Name                string `json:"name"`
-	State               string `json:"state"`
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+	State       string `json:"state"`
+	AuthUrl     string `json:"authUrl"`
+	// technically could be omitted if the provider doesn't support PKCE,
+	// but to avoid breaking existing typed clients we'll return them as empty string
 	CodeVerifier        string `json:"codeVerifier"`
 	CodeChallenge       string `json:"codeChallenge"`
 	CodeChallengeMethod string `json:"codeChallengeMethod"`
-	AuthUrl             string `json:"authUrl"`
 }
 
 func (api *recordAuthApi) authMethods(c echo.Context) error {
@@ -90,12 +94,14 @@ func (api *recordAuthApi) authMethods(c echo.Context) error {
 	authOptions := collection.AuthOptions()
 
 	result := struct {
+		AuthProviders    []providerInfo `json:"authProviders"`
 		UsernamePassword bool           `json:"usernamePassword"`
 		EmailPassword    bool           `json:"emailPassword"`
-		AuthProviders    []providerInfo `json:"authProviders"`
+		OnlyVerified     bool           `json:"onlyVerified"`
 	}{
 		UsernamePassword: authOptions.AllowUsernameAuth,
 		EmailPassword:    authOptions.AllowEmailAuth,
+		OnlyVerified:     authOptions.OnlyVerified,
 		AuthProviders:    []providerInfo{},
 	}
 
@@ -111,51 +117,61 @@ func (api *recordAuthApi) authMethods(c echo.Context) error {
 
 		provider, err := auth.NewProviderByName(name)
 		if err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
+			api.app.Logger().Debug("Missing or invalid provier name", slog.String("name", name))
 			continue // skip provider
 		}
 
 		if err := config.SetupProvider(provider); err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
+			api.app.Logger().Debug(
+				"Failed to setup provider",
+				slog.String("name", name),
+				slog.String("error", err.Error()),
+			)
 			continue // skip provider
 		}
 
-		state := security.RandomString(30)
-		codeVerifier := security.RandomString(43)
-		codeChallenge := security.S256Challenge(codeVerifier)
-		codeChallengeMethod := "S256"
-		urlOpts := []oauth2.AuthCodeOption{
-			oauth2.SetAuthURLParam("code_challenge", codeChallenge),
-			oauth2.SetAuthURLParam("code_challenge_method", codeChallengeMethod),
+		info := providerInfo{
+			Name:        name,
+			DisplayName: provider.DisplayName(),
+			State:       security.RandomString(30),
 		}
 
+		if info.DisplayName == "" {
+			info.DisplayName = name
+		}
+
+		urlOpts := []oauth2.AuthCodeOption{}
+
 		// custom providers url options
 		switch name {
 		case auth.NameApple:
 			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
 			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "query"))
-		case auth.NameVK:
-			// vk currently doesn't support PKCE for server-side authorization
-			urlOpts = []oauth2.AuthCodeOption{}
 		}
 
-		result.AuthProviders = append(result.AuthProviders, providerInfo{
-			Name:                name,
-			State:               state,
-			CodeVerifier:        codeVerifier,
-			CodeChallenge:       codeChallenge,
-			CodeChallengeMethod: codeChallengeMethod,
-			AuthUrl: provider.BuildAuthUrl(
-				state,
-				urlOpts...,
-			) + "&redirect_uri=", // empty redirect_uri so that users can append their redirect url
-		})
+		if provider.PKCE() {
+			info.CodeVerifier = security.RandomString(43)
+			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
+			info.CodeChallengeMethod = "S256"
+			urlOpts = append(urlOpts,
+				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
+				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
+			)
+		}
+
+		info.AuthUrl = provider.BuildAuthUrl(
+			info.State,
+			urlOpts...,
+		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
+
+		result.AuthProviders = append(result.AuthProviders, info)
 	}
 
+	// sort providers
+	sort.SliceStable(result.AuthProviders, func(i, j int) bool {
+		return result.AuthProviders[i].Name < result.AuthProviders[j].Name
+	})
+
 	return c.JSON(http.StatusOK, result)
 }
 
@@ -327,8 +343,11 @@ func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
 			return api.app.OnRecordBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Record); err != nil && api.app.IsDebug() {
-						log.Println(err)
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send password reset email",
+							slog.String("error", err.Error()),
+						)
 					}
 				})
 
@@ -416,8 +435,11 @@ func (api *recordAuthApi) requestVerification(c echo.Context) error {
 			return api.app.OnRecordBeforeRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Record); err != nil && api.app.IsDebug() {
-						log.Println(err)
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send verification email",
+							slog.String("error", err.Error()),
+						)
 					}
 				})
 

apis/record_auth_test.go

@@ -40,6 +40,7 @@ func TestRecordAuthMethodsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"usernamePassword":true`,
 				`"emailPassword":true`,
+				`"onlyVerified":false`,
 				`"authProviders":[{`,
 				`"name":"gitlab"`,
 				`"state":`,
@@ -58,6 +59,7 @@ func TestRecordAuthMethodsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"usernamePassword":false`,
 				`"emailPassword":true`,
+				`"onlyVerified":true`,
 				`"authProviders":[]`,
 			},
 		},
@@ -212,7 +214,7 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			},
 		},
 		{
-			Name:   "valid email and valid password in allowed collection",
+			Name:   "valid email (unverified) and valid password in allowed collection",
 			Method: http.MethodPost,
 			Url:    "/api/collections/users/auth-with-password",
 			Body: strings.NewReader(`{
@@ -225,6 +227,48 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				`"token":"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"email":"test@example.com"`,
+				`"verified":false`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
+			},
+		},
+
+		// onlyVerified collection check
+		{
+			Name:   "unverified user in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test2@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 403,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+			},
+		},
+		{
+			Name:   "verified user in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"id":"gk390qegs4y47wn"`,
+				`"email":"test@example.com"`,
+				`"verified":true`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
@@ -377,6 +421,41 @@ func TestRecordAuthRefresh(t *testing.T) {
 				"OnRecordAfterAuthRefreshRequest":  1,
 			},
 		},
+		{
+			Name:   "unverified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im8xeTBkZDBzcGQ3ODZtZCIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.-JYlrz5DcGzvb0nYx-xqnSFMu9dupyKY7Vg_FUm0OaM",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthRefreshRequest": 1,
+				"OnRecordAfterAuthRefreshRequest":  1,
+			},
+		},
+		{
+			Name:   "verified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.q34IWXrRWsjLvbbVNRfAs_J4SoTHloNBfdGEiLmy-D8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":`,
+				`"record":`,
+				`"id":"gk390qegs4y47wn"`,
+				`"verified":true`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":              1,
+				"OnRecordAfterAuthRefreshRequest":  1,
+			},
+		},
 		{
 			Name:   "OnRecordAfterAuthRefreshRequest error response",
 			Method: http.MethodPost,
@@ -898,7 +977,7 @@ func TestRecordAuthRequestEmailChange(t *testing.T) {
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":`,
-				`"newEmail":{"code":"validation_record_email_exists"`,
+				`"newEmail":{"code":"validation_record_email_invalid"`,
 			},
 		},
 		{

apis/record_crud.go

@@ -2,9 +2,8 @@ package apis
 
 import (
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
-	"strings"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -16,8 +15,6 @@ import (
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
-const expandQueryParam = "expand"
-
 // bindRecordCrudApi registers the record crud api endpoints and
 // the corresponding handlers.
 func bindRecordCrudApi(app core.App, rg *echo.Group) {
@@ -45,13 +42,13 @@ func (api *recordApi) list(c echo.Context) error {
 		return NewNotFoundError("", "Missing collection context.")
 	}
 
+	requestInfo := RequestInfo(c)
+
 	// forbid users and guests to query special filter/sort fields
-	if err := api.checkForForbiddenQueryFields(c); err != nil {
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
 		return err
 	}
 
-	requestInfo := RequestInfo(c)
-
 	if requestInfo.Admin == nil && collection.ListRule == nil {
 		// only admins can access if the rule is nil
 		return NewForbiddenError("Only admins can perform this action.", nil)
@@ -76,7 +73,7 @@ func (api *recordApi) list(c echo.Context) error {
 
 	result, err := searchProvider.ParseAndExec(c.QueryParams().Encode(), &records)
 	if err != nil {
-		return NewBadRequestError("Invalid filter parameters.", err)
+		return NewBadRequestError("", err)
 	}
 
 	event := new(core.RecordsListEvent)
@@ -90,8 +87,8 @@ func (api *recordApi) list(c echo.Context) error {
 			return nil
 		}
 
-		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil {
+			api.app.Logger().Debug("Failed to enrich list records", slog.String("error", err.Error()))
 		}
 
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
@@ -144,8 +141,13 @@ func (api *recordApi) view(c echo.Context) error {
 			return nil
 		}
 
-		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+			api.app.Logger().Debug(
+				"Failed to enrich view record",
+				slog.String("id", e.Record.Id),
+				slog.String("collectionName", e.Record.Collection().Name),
+				slog.String("error", err.Error()),
+			)
 		}
 
 		return e.HttpContext.JSON(http.StatusOK, e.Record)
@@ -237,8 +239,13 @@ func (api *recordApi) create(c echo.Context) error {
 					return NewBadRequestError("Failed to create record.", err)
 				}
 
-				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-					log.Println(err)
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich create record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
 				}
 
 				return api.app.OnRecordAfterCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
@@ -324,8 +331,13 @@ func (api *recordApi) update(c echo.Context) error {
 					return NewBadRequestError("Failed to update record.", err)
 				}
 
-				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-					log.Println(err)
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich update record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
 				}
 
 				return api.app.OnRecordAfterUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
@@ -396,21 +408,3 @@ func (api *recordApi) delete(c echo.Context) error {
 		})
 	})
 }
-
-func (api *recordApi) checkForForbiddenQueryFields(c echo.Context) error {
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		return nil // admins are allowed to query everything
-	}
-
-	decodedQuery := c.QueryParam(search.FilterQueryParam) + c.QueryParam(search.SortQueryParam)
-	forbiddenFields := []string{"@collection.", "@request."}
-
-	for _, field := range forbiddenFields {
-		if strings.Contains(decodedQuery, field) {
-			return NewForbiddenError("Only admins can filter by @collection and @request query params", nil)
-		}
-	}
-
-	return nil
-}

apis/record_crud_test.go

@@ -43,9 +43,16 @@ func TestRecordCrudList(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:            "public collection but with admin only filter/sort (aka. @collection)",
+			Name:            "public collection but with admin only filter param (aka. @collection, @request, etc.)",
 			Method:          http.MethodGet,
-			Url:             "/api/collections/demo2/records?filter=@collection.demo2.title='test1'",
+			Url:             "/api/collections/demo2/records?filter=%40collection.demo2.title='test1'",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:            "public collection but with admin only sort param (aka. @collection, @request, etc.)",
+			Method:          http.MethodGet,
+			Url:             "/api/collections/demo2/records?sort=@request.auth.title",
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
 		},

apis/record_helpers.go

@@ -3,6 +3,7 @@ package apis
 import (
 	"fmt"
 	"log"
+	"log/slog"
 	"net/http"
 	"strings"
 
@@ -13,12 +14,16 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
 const ContextRequestInfoKey = "requestInfo"
 
+const expandQueryParam = "expand"
+const fieldsQueryParam = "fields"
+
 // Deprecated: Use RequestInfo instead.
 func RequestData(c echo.Context) *models.RequestInfo {
 	log.Println("RequestData(c) is deprecated and will be removed in the future! You can replace it with RequestInfo(c).")
@@ -49,7 +54,7 @@ func RequestInfo(c echo.Context) *models.RequestInfo {
 	// ("X-Token" is converted to "x_token")
 	for k, v := range c.Request().Header {
 		if len(v) > 0 {
-			result.Headers[strings.ToLower(strings.ReplaceAll(k, "-", "_"))] = v[0]
+			result.Headers[inflector.Snakecase(k)] = v[0]
 		}
 	}
 
@@ -72,6 +77,10 @@ func RecordAuthResponse(
 	meta any,
 	finalizers ...func(token string) error,
 ) error {
+	if !authRecord.Verified() && authRecord.Collection().AuthOptions().OnlyVerified {
+		return NewForbiddenError("Please verify your email first.", nil)
+	}
+
 	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
 	if tokenErr != nil {
 		return NewBadRequestError("Failed to create auth token.", tokenErr)
@@ -104,8 +113,8 @@ func RecordAuthResponse(
 				expands,
 				expandFetch(app.Dao(), &requestInfo),
 			)
-			if len(failed) > 0 && app.IsDebug() {
-				log.Println("Failed to expand relations: ", failed)
+			if len(failed) > 0 {
+				app.Logger().Debug("[RecordAuthResponse] Failed to expand relations", slog.Any("errors", failed))
 			}
 		}
 
@@ -305,3 +314,31 @@ func hasAuthManageAccess(
 
 	return findErr == nil
 }
+
+var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
+var adminOnlyRuleFields = []string{"@collection.", "@request."}
+
+// @todo consider moving the rules check to the RecordFieldResolver.
+//
+// checkForAdminOnlyRuleFields loosely checks and returns an error if
+// the provided RequestInfo contains rule fields that only the admin can use.
+func checkForAdminOnlyRuleFields(requestInfo *models.RequestInfo) error {
+	if requestInfo.Admin != nil || len(requestInfo.Query) == 0 {
+		return nil // admin or nothing to check
+	}
+
+	for _, param := range ruleQueryParams {
+		v, _ := requestInfo.Query[param].(string)
+		if v == "" {
+			continue
+		}
+
+		for _, field := range adminOnlyRuleFields {
+			if strings.Contains(v, field) {
+				return NewForbiddenError("Only admins can filter by "+field, nil)
+			}
+		}
+	}
+
+	return nil
+}

apis/record_helpers_test.go

@@ -83,6 +83,11 @@ func TestRecordAuthResponse(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	unverfiedAuthRecord, err := app.Dao().FindRecordById("clients", "o1y0dd0spd786md")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	scenarios := []struct {
 		name               string
 		record             *models.Record
@@ -97,6 +102,11 @@ func TestRecordAuthResponse(t *testing.T) {
 			record:      nonAuthRecord,
 			expectError: true,
 		},
+		{
+			name:        "valid auth record but with unverified email in onlyVerified collection",
+			record:      unverfiedAuthRecord,
+			expectError: true,
+		},
 		{
 			name:        "valid auth record - without meta",
 			record:      authRecord,

apis/serve.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/fatih/color"
@@ -52,11 +53,11 @@ type ServeConfig struct {
 //
 // Example:
 //
-// 	app.Bootstrap()
-// 	apis.Serve(app, apis.ServeConfig{
-// 		HttpAddr:        "127.0.0.1:8080",
-// 		ShowStartBanner: false,
-// 	})
+//	app.Bootstrap()
+//	apis.Serve(app, apis.ServeConfig{
+//		HttpAddr:        "127.0.0.1:8080",
+//		ShowStartBanner: false,
+//	})
 func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 	if len(config.AllowedOrigins) == 0 {
 		config.AllowedOrigins = []string{"*"}
@@ -139,6 +140,11 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		HostPolicy: autocert.HostWhitelist(hostNames...),
 	}
 
+	// base request context used for cancelling long running requests
+	// like the SSE connections
+	baseCtx, cancelBaseCtx := context.WithCancel(context.Background())
+	defer cancelBaseCtx()
+
 	server := &http.Server{
 		TLSConfig: &tls.Config{
 			MinVersion:     tls.VersionTLS12,
@@ -150,6 +156,9 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		// WriteTimeout: 60 * time.Second, // breaks sse!
 		Handler: router,
 		Addr:    mainAddr,
+		BaseContext: func(l net.Listener) context.Context {
+			return baseCtx
+		},
 	}
 
 	serveEvent := &core.ServeEvent{
@@ -189,14 +198,39 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		regular.Printf("└─ Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, addr))
 	}
 
+	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
+	// Note that the WaitGroup would not do anything if the app.OnTerminate() hook isn't triggered.
+	var wg sync.WaitGroup
+
 	// try to gracefully shutdown the server on app termination
 	app.OnTerminate().Add(func(e *core.TerminateEvent) error {
+		cancelBaseCtx()
+
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 		defer cancel()
+
+		wg.Add(1)
 		server.Shutdown(ctx)
+		if e.IsRestart {
+			// wait for execve and other handlers up to 5 seconds before exit
+			time.AfterFunc(5*time.Second, func() {
+				wg.Done()
+			})
+		} else {
+			wg.Done()
+		}
+
 		return nil
 	})
 
+	// wait for the graceful shutdown to complete before exit
+	defer wg.Wait()
+
+	// ---
+	// @todo consider removing the server return value because it is
+	// not really useful when combined with the blocking serve calls
+	// ---
+
 	// start HTTPS server
 	if config.HttpsAddr != "" {
 		// if httpAddr is set, start an HTTP server to redirect the traffic to the HTTPS version

apis/settings_test.go

@@ -80,6 +80,8 @@ func TestSettingsList(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 			},
@@ -161,6 +163,8 @@ func TestSettingsSet(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"acme_test"`,
@@ -231,6 +235,8 @@ func TestSettingsSet(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"update_test"`,

core/app.go

@@ -5,6 +5,7 @@ package core
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
@@ -48,6 +49,9 @@ type App interface {
 	// the users table from LogsDao will result in error.
 	LogsDao() *daos.Dao
 
+	// Logger returns the active app logger.
+	Logger() *slog.Logger
+
 	// DataDir returns the app data directory path.
 	DataDir() string
 
@@ -55,16 +59,18 @@ type App interface {
 	// (used for settings encryption).
 	EncryptionEnv() string
 
-	// IsDebug returns whether the app is in debug mode
-	// (showing more detailed error logs, executed sql statements, etc.).
-	IsDebug() bool
+	// IsDev returns whether the app is in dev mode.
+	IsDev() bool
 
 	// Settings returns the loaded app settings.
 	Settings() *settings.Settings
 
-	// Cache returns the app internal cache store.
+	// Deprecated: Use app.Store() instead.
 	Cache() *store.Store[any]
 
+	// Store returns the app runtime store.
+	Store() *store.Store[any]
+
 	// SubscriptionsBroker returns the app realtime subscriptions broker instance.
 	SubscriptionsBroker() *subscriptions.Broker
 

core/base.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"log"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -18,10 +19,14 @@ import (
 	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
 )
 
 const (
@@ -39,8 +44,10 @@ var _ App = (*BaseApp)(nil)
 
 // BaseApp implements core.App and defines the base PocketBase app structure.
 type BaseApp struct {
+	// @todo consider introducing a mutex to allow safe concurrent config changes during runtime
+
 	// configurable parameters
-	isDebug          bool
+	isDev            bool
 	dataDir          string
 	encryptionEnv    string
 	dataMaxOpenConns int
@@ -49,11 +56,12 @@ type BaseApp struct {
 	logsMaxIdleConns int
 
 	// internals
-	cache               *store.Store[any]
+	store               *store.Store[any]
 	settings            *settings.Settings
 	dao                 *daos.Dao
 	logsDao             *daos.Dao
 	subscriptionsBroker *subscriptions.Broker
+	logger              *slog.Logger
 
 	// app event hooks
 	onBeforeBootstrap *hook.Hook[*BootstrapEvent]
@@ -167,9 +175,9 @@ type BaseApp struct {
 
 // BaseAppConfig defines a BaseApp configuration option
 type BaseAppConfig struct {
+	IsDev            bool
 	DataDir          string
 	EncryptionEnv    string
-	IsDebug          bool
 	DataMaxOpenConns int // default to 500
 	DataMaxIdleConns int // default 20
 	LogsMaxOpenConns int // default to 100
@@ -182,14 +190,14 @@ type BaseAppConfig struct {
 // To initialize the app, you need to call `app.Bootstrap()`.
 func NewBaseApp(config BaseAppConfig) *BaseApp {
 	app := &BaseApp{
+		isDev:               config.IsDev,
 		dataDir:             config.DataDir,
-		isDebug:             config.IsDebug,
 		encryptionEnv:       config.EncryptionEnv,
 		dataMaxOpenConns:    config.DataMaxOpenConns,
 		dataMaxIdleConns:    config.DataMaxIdleConns,
 		logsMaxOpenConns:    config.LogsMaxOpenConns,
 		logsMaxIdleConns:    config.LogsMaxIdleConns,
-		cache:               store.New[any](nil),
+		store:               store.New[any](nil),
 		settings:            settings.New(),
 		subscriptionsBroker: subscriptions.NewBroker(),
 
@@ -314,6 +322,17 @@ func (app *BaseApp) IsBootstrapped() bool {
 	return app.dao != nil && app.logsDao != nil && app.settings != nil
 }
 
+// Logger returns the default app logger.
+//
+// If the application is not bootstrapped yet, fallbacks to slog.Default().
+func (app *BaseApp) Logger() *slog.Logger {
+	if app.logger == nil {
+		return slog.Default()
+	}
+
+	return app.logger
+}
+
 // Bootstrap initializes the application
 // (aka. create data dir, open db connections, load settings, etc.).
 //
@@ -343,6 +362,10 @@ func (app *BaseApp) Bootstrap() error {
 		return err
 	}
 
+	if err := app.initLogger(); err != nil {
+		return err
+	}
+
 	// we don't check for an error because the db migrations may have not been executed yet
 	app.RefreshSettings()
 
@@ -438,10 +461,11 @@ func (app *BaseApp) EncryptionEnv() string {
 	return app.encryptionEnv
 }
 
-// IsDebug returns whether the app is in debug mode
-// (showing more detailed error logs, executed sql statements, etc.).
-func (app *BaseApp) IsDebug() bool {
-	return app.isDebug
+// IsDev returns whether the app is in dev mode.
+//
+// When enabled logs, executed sql statements, etc. are printed to the stderr.
+func (app *BaseApp) IsDev() bool {
+	return app.isDev
 }
 
 // Settings returns the loaded app settings.
@@ -449,9 +473,15 @@ func (app *BaseApp) Settings() *settings.Settings {
 	return app.settings
 }
 
-// Cache returns the app internal cache store.
+// Deprecated: Use app.Store() instead.
 func (app *BaseApp) Cache() *store.Store[any] {
-	return app.cache
+	color.Yellow("app.Store() is soft-deprecated. Please replace it with app.Store().")
+	return app.Store()
+}
+
+// Store returns the app internal runtime store.
+func (app *BaseApp) Store() *store.Store[any] {
+	return app.store
 }
 
 // SubscriptionsBroker returns the app realtime subscriptions broker instance.
@@ -533,17 +563,17 @@ func (app *BaseApp) Restart() error {
 		return err
 	}
 
-	// optimistically reset the app bootstrap state
-	app.ResetBootstrapState()
+	return app.OnTerminate().Trigger(&TerminateEvent{
+		App:       app,
+		IsRestart: true,
+	}, func(e *TerminateEvent) error {
+		e.App.ResetBootstrapState()
 
-	if err := syscall.Exec(execPath, os.Args, os.Environ()); err != nil {
-		// restart the app bootstrap state
-		app.Bootstrap()
+		// attempt to restart the bootstrap process in case execve returns an error for some reason
+		defer e.App.Bootstrap()
 
-		return err
-	}
-
-	return nil
+		return syscall.Exec(execPath, os.Args, os.Environ())
+	})
 }
 
 // RefreshSettings reinitializes and reloads the stored application settings.
@@ -555,7 +585,7 @@ func (app *BaseApp) RefreshSettings() error {
 	encryptionKey := os.Getenv(app.EncryptionEnv())
 
 	storedSettings, err := app.Dao().FindSettings(encryptionKey)
-	if err != nil && err != sql.ErrNoRows {
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
 		return err
 	}
 
@@ -569,6 +599,13 @@ func (app *BaseApp) RefreshSettings() error {
 		return err
 	}
 
+	// reload handler level (if initialized and not in dev mode)
+	if !app.IsDev() && app.Logger() != nil {
+		if h, ok := app.Logger().Handler().(*logger.BatchHandler); ok {
+			h.SetLevel(slog.Level(app.settings.Logs.MinLevel))
+		}
+	}
+
 	return nil
 }
 
@@ -988,7 +1025,7 @@ func (app *BaseApp) initLogsDB() error {
 	}
 	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
 	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
-	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "logs.db"))
 	if err != nil {
@@ -996,7 +1033,7 @@ func (app *BaseApp) initLogsDB() error {
 	}
 	nonconcurrentDB.DB().SetMaxOpenConns(1)
 	nonconcurrentDB.DB().SetMaxIdleConns(1)
-	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	app.logsDao = daos.NewMultiDB(concurrentDB, nonconcurrentDB)
 
@@ -1019,7 +1056,7 @@ func (app *BaseApp) initDataDB() error {
 	}
 	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
 	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
-	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "data.db"))
 	if err != nil {
@@ -1027,17 +1064,16 @@ func (app *BaseApp) initDataDB() error {
 	}
 	nonconcurrentDB.DB().SetMaxOpenConns(1)
 	nonconcurrentDB.DB().SetMaxIdleConns(1)
-	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
-	if app.IsDebug() {
+	if app.IsDev() {
 		nonconcurrentDB.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
-		concurrentDB.QueryLogFunc = nonconcurrentDB.QueryLogFunc
-
 		nonconcurrentDB.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
+		concurrentDB.QueryLogFunc = nonconcurrentDB.QueryLogFunc
 		concurrentDB.ExecLogFunc = nonconcurrentDB.ExecLogFunc
 	}
 
@@ -1129,14 +1165,13 @@ func (app *BaseApp) registerDefaultHooks() {
 
 			// run in the background for "optimistic" delete to avoid
 			// blocking the delete transaction
-			//
-			// @todo consider creating a bg process queue so that the
-			// call could be "retried" in case of a failure.
 			routine.FireAndForget(func() {
-				if err := deletePrefix(prefix); err != nil && app.IsDebug() {
-					// non critical error - only log for debug
-					// (usually could happen because of S3 api limits)
-					log.Println(err)
+				if err := deletePrefix(prefix); err != nil {
+					app.Logger().Error(
+						"Failed to delete storage prefix (non critical error; usually could happen because of S3 api limits)",
+						slog.String("prefix", prefix),
+						slog.String("error", err.Error()),
+					)
 				}
 			})
 		}
@@ -1144,12 +1179,111 @@ func (app *BaseApp) registerDefaultHooks() {
 		return nil
 	})
 
-	app.OnTerminate().Add(func(e *TerminateEvent) error {
-		app.ResetBootstrapState()
+	if err := app.initAutobackupHooks(); err != nil {
+		app.Logger().Error("Failed to init auto backup hooks", slog.String("error", err.Error()))
+	}
+}
+
+func (app *BaseApp) initLogger() error {
+	duration := 3 * time.Second
+	ticker := time.NewTicker(duration)
+	done := make(chan bool)
+
+	// Apply the min level only if it is not in develop
+	// to allow printing the logs to the console.
+	//
+	// DB logs are still filtered but the checks for the min level are done
+	// in the BatchOptions.BeforeAddFunc instead of the slog.Handler.Enabled() method.
+	var minLevel slog.Level
+	if app.IsDev() {
+		minLevel = -9999
+	} else if app.Settings() != nil {
+		minLevel = slog.Level(app.Settings().Logs.MinLevel)
+	}
+
+	handler := logger.NewBatchHandler(logger.BatchOptions{
+		Level:     minLevel,
+		BatchSize: 200,
+		BeforeAddFunc: func(ctx context.Context, log *logger.Log) bool {
+			if app.IsDev() {
+				printLog(log)
+
+				// manually check the log level and skip if necessary
+				if log.Level < slog.Level(app.Settings().Logs.MinLevel) {
+					return false
+				}
+			}
+
+			ticker.Reset(duration)
+
+			return app.Settings().Logs.MaxDays > 0
+		},
+		WriteFunc: func(ctx context.Context, logs []*logger.Log) error {
+			if !app.IsBootstrapped() || app.Settings().Logs.MaxDays == 0 {
+				return nil
+			}
+
+			// write the accumulated logs
+			// (note: based on several local tests there is no significant performance difference between small number of separate write queries vs 1 big INSERT)
+			app.LogsDao().RunInTransaction(func(txDao *daos.Dao) error {
+				model := &models.Log{}
+				for _, l := range logs {
+					model.MarkAsNew()
+					// note: using pseudorandom for a slightly better performance
+					model.Id = security.PseudorandomStringWithAlphabet(models.DefaultIdLength, models.DefaultIdAlphabet)
+					model.Level = int(l.Level)
+					model.Message = l.Message
+					model.Data = l.Data
+					model.Created, _ = types.ParseDateTime(l.Time)
+					model.Updated = model.Created
+
+					if err := txDao.SaveLog(model); err != nil {
+						log.Println("Failed to write log", model, err)
+					}
+				}
+
+				return nil
+			})
+
+			// delete old logs
+			// ---
+			logsMaxDays := app.Settings().Logs.MaxDays
+			now := time.Now()
+			lastLogsDeletedAt := cast.ToTime(app.Store().Get("lastLogsDeletedAt"))
+			daysDiff := now.Sub(lastLogsDeletedAt).Hours() * 24
+			if daysDiff > float64(logsMaxDays) {
+				deleteErr := app.LogsDao().DeleteOldLogs(now.AddDate(0, 0, -1*logsMaxDays))
+				if deleteErr == nil {
+					app.Store().Set("lastLogsDeletedAt", now)
+				} else {
+					log.Println("Logs delete failed", deleteErr)
+				}
+			}
+
+			return nil
+		},
+	})
+
+	go func() {
+		ctx := context.Background()
+
+		for {
+			select {
+			case <-done:
+				handler.WriteAll(ctx)
+			case <-ticker.C:
+				handler.WriteAll(ctx)
+			}
+		}
+	}()
+
+	app.logger = slog.New(handler)
+
+	app.OnTerminate().PreAdd(func(e *TerminateEvent) error {
+		ticker.Stop()
+		done <- true
 		return nil
 	})
 
-	if err := app.initAutobackupHooks(); err != nil && app.IsDebug() {
-		log.Println(err)
-	}
+	return nil
 }

core/base_backup.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -22,8 +22,11 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+// Deprecated: Replaced with StoreKeyActiveBackup.
 const CacheKeyActiveBackup string = "@activeBackup"
 
+const StoreKeyActiveBackup string = "@activeBackup"
+
 // CreateBackup creates a new backup of the current app pb_data directory.
 //
 // If name is empty, it will be autogenerated.
@@ -43,7 +46,7 @@ const CacheKeyActiveBackup string = "@activeBackup"
 //
 // Backups can be stored on S3 if it is configured in app.Settings().Backups.
 func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
-	if app.Cache().Has(CacheKeyActiveBackup) {
+	if app.Store().Has(StoreKeyActiveBackup) {
 		return errors.New("try again later - another backup/restore operation has already been started")
 	}
 
@@ -51,8 +54,8 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 		name = app.generateBackupName("pb_backup_")
 	}
 
-	app.Cache().Set(CacheKeyActiveBackup, name)
-	defer app.Cache().Remove(CacheKeyActiveBackup)
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
 
 	// root dir entries to exclude from the backup generation
 	exclude := []string{LocalBackupsDirName, LocalTempDirName}
@@ -135,12 +138,12 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 		return errors.New("restore is not supported on windows")
 	}
 
-	if app.Cache().Has(CacheKeyActiveBackup) {
+	if app.Store().Has(StoreKeyActiveBackup) {
 		return errors.New("try again later - another backup/restore operation has already been started")
 	}
 
-	app.Cache().Set(CacheKeyActiveBackup, name)
-	defer app.Cache().Remove(CacheKeyActiveBackup)
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
 
 	fsys, err := app.NewBackupsFilesystem()
 	if err != nil {
@@ -189,8 +192,12 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 	// remove the extracted zip file since we no longer need it
 	// (this is in case the app restarts and the defer calls are not called)
-	if err := os.Remove(tempZip.Name()); err != nil && app.IsDebug() {
-		log.Println(err)
+	if err := os.Remove(tempZip.Name()); err != nil {
+		app.Logger().Debug(
+			"[RestoreBackup] Failed to remove the temp zip backup file",
+			slog.String("file", tempZip.Name()),
+			slog.String("error", err.Error()),
+		)
 	}
 
 	// root dir entries to exclude from the backup restore
@@ -223,8 +230,8 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 	// restart the app
 	if err := app.Restart(); err != nil {
-		if err := revertDataDirChanges(); err != nil {
-			panic(err)
+		if revertErr := revertDataDirChanges(); revertErr != nil {
+			panic(revertErr)
 		}
 
 		return fmt.Errorf("failed to restart the app process: %w", err)
@@ -251,9 +258,12 @@ func (app *BaseApp) initAutobackupHooks() error {
 
 			name := app.generateBackupName(autoPrefix)
 
-			if err := app.CreateBackup(context.Background(), name); err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err := app.CreateBackup(context.Background(), name); err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to create backup",
+					slog.String("name", name),
+					slog.String("error", err.Error()),
+				)
 			}
 
 			maxKeep := app.Settings().Backups.CronMaxKeep
@@ -263,17 +273,21 @@ func (app *BaseApp) initAutobackupHooks() error {
 			}
 
 			fsys, err := app.NewBackupsFilesystem()
-			if err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to initialize the backup filesystem",
+					slog.String("error", err.Error()),
+				)
 				return
 			}
 			defer fsys.Close()
 
 			files, err := fsys.List(autoPrefix)
-			if err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to list autogenerated backups",
+					slog.String("error", err.Error()),
+				)
 				return
 			}
 
@@ -290,9 +304,12 @@ func (app *BaseApp) initAutobackupHooks() error {
 			toRemove := files[maxKeep:]
 
 			for _, f := range toRemove {
-				if err := fsys.Delete(f.Key); err != nil && app.IsDebug() {
-					// @todo replace after logs generalization
-					log.Println(err)
+				if err := fsys.Delete(f.Key); err != nil {
+					app.Logger().Debug(
+						"[Backup cron] Failed to remove old autogenerated backup",
+						slog.String("key", f.Key),
+						slog.String("error", err.Error()),
+					)
 				}
 			}
 		})

core/base_backup_test.go

@@ -25,11 +25,11 @@ func TestCreateBackup(t *testing.T) {
 	expectedAppNamePrefix := "test_" + strings.Repeat("a", 45)
 
 	// test pending error
-	app.Cache().Set(core.CacheKeyActiveBackup, "")
+	app.Store().Set(core.StoreKeyActiveBackup, "")
 	if err := app.CreateBackup(context.Background(), "test.zip"); err == nil {
 		t.Fatal("Expected pending error, got nil")
 	}
-	app.Cache().Remove(core.CacheKeyActiveBackup)
+	app.Store().Remove(core.StoreKeyActiveBackup)
 
 	// create with auto generated name
 	if err := app.CreateBackup(context.Background(), ""); err != nil {
@@ -98,11 +98,11 @@ func TestRestoreBackup(t *testing.T) {
 	}
 
 	// test pending error
-	app.Cache().Set(core.CacheKeyActiveBackup, "")
+	app.Store().Set(core.StoreKeyActiveBackup, "")
 	if err := app.RestoreBackup(context.Background(), "test"); err == nil {
 		t.Fatal("Expected pending error, got nil")
 	}
-	app.Cache().Remove(core.CacheKeyActiveBackup)
+	app.Store().Remove(core.StoreKeyActiveBackup)
 
 	// missing backup
 	if err := app.RestoreBackup(context.Background(), "missing"); err == nil {

core/base_settings_test.go

@@ -20,7 +20,7 @@ func TestBaseAppRefreshSettings(t *testing.T) {
 	// check if the new settings are saved in the db
 	app.ResetEventCalls()
 	if err := app.RefreshSettings(); err != nil {
-		t.Fatal("Failed to refresh the settings after delete")
+		t.Fatalf("Failed to refresh the settings after delete: %v", err)
 	}
 	testEventCalls(t, app, map[string]int{
 		"OnModelBeforeCreate": 1,

core/base_test.go

@@ -1,10 +1,20 @@
 package core
 
 import (
+	"fmt"
+	"log/slog"
 	"os"
 	"testing"
+	"time"
 
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/migrate"
 )
 
 func TestNewBaseApp(t *testing.T) {
@@ -14,7 +24,7 @@ func TestNewBaseApp(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "test_env",
-		IsDebug:       true,
+		IsDev:         true,
 	})
 
 	if app.dataDir != testDataDir {
@@ -25,12 +35,12 @@ func TestNewBaseApp(t *testing.T) {
 		t.Fatalf("expected encryptionEnv test_env, got %q", app.dataDir)
 	}
 
-	if !app.isDebug {
-		t.Fatalf("expected isDebug true, got %v", app.isDebug)
+	if !app.isDev {
+		t.Fatalf("expected isDev true, got %v", app.isDev)
 	}
 
-	if app.cache == nil {
-		t.Fatal("expected cache to be set, got nil")
+	if app.store == nil {
+		t.Fatal("expected store to be set, got nil")
 	}
 
 	if app.settings == nil {
@@ -49,7 +59,6 @@ func TestBaseAppBootstrap(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
 	})
 	defer app.ResetBootstrapState()
 
@@ -57,7 +66,6 @@ func TestBaseAppBootstrap(t *testing.T) {
 		t.Fatal("Didn't expect the application to be bootstrapped.")
 	}
 
-	// bootstrap
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
@@ -106,6 +114,14 @@ func TestBaseAppBootstrap(t *testing.T) {
 		t.Fatal("Expected app.settings to be initialized, got nil.")
 	}
 
+	if app.logger == nil {
+		t.Fatal("Expected app.logger to be initialized, got nil.")
+	}
+
+	if _, ok := app.logger.Handler().(*logger.BatchHandler); !ok {
+		t.Fatal("Expected app.logger handler to be initialized.")
+	}
+
 	// reset
 	if err := app.ResetBootstrapState(); err != nil {
 		t.Fatal(err)
@@ -127,7 +143,7 @@ func TestBaseAppGetters(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
+		IsDev:         true,
 	})
 	defer app.ResetBootstrapState()
 
@@ -159,16 +175,20 @@ func TestBaseAppGetters(t *testing.T) {
 		t.Fatalf("Expected app.EncryptionEnv %v, got %v", app.EncryptionEnv(), app.encryptionEnv)
 	}
 
-	if app.isDebug != app.IsDebug() {
-		t.Fatalf("Expected app.IsDebug %v, got %v", app.IsDebug(), app.isDebug)
+	if app.isDev != app.IsDev() {
+		t.Fatalf("Expected app.IsDev %v, got %v", app.IsDev(), app.isDev)
 	}
 
 	if app.settings != app.Settings() {
 		t.Fatalf("Expected app.Settings %v, got %v", app.Settings(), app.settings)
 	}
 
-	if app.cache != app.Cache() {
-		t.Fatalf("Expected app.Cache %v, got %v", app.Cache(), app.cache)
+	if app.store != app.Store() {
+		t.Fatalf("Expected app.Store %v, got %v", app.Store(), app.store)
+	}
+
+	if app.logger != app.Logger() {
+		t.Fatalf("Expected app.Logger %v, got %v", app.Logger(), app.logger)
 	}
 
 	if app.subscriptionsBroker != app.SubscriptionsBroker() {
@@ -181,14 +201,11 @@ func TestBaseAppGetters(t *testing.T) {
 }
 
 func TestBaseAppNewMailClient(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	client1 := app.NewMailClient()
 	if val, ok := client1.(*mailer.Sendmail); !ok {
@@ -204,14 +221,11 @@ func TestBaseAppNewMailClient(t *testing.T) {
 }
 
 func TestBaseAppNewFilesystem(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	// local
 	local, localErr := app.NewFilesystem()
@@ -234,14 +248,11 @@ func TestBaseAppNewFilesystem(t *testing.T) {
 }
 
 func TestBaseAppNewBackupsFilesystem(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	// local
 	local, localErr := app.NewBackupsFilesystem()
@@ -262,3 +273,280 @@ func TestBaseAppNewBackupsFilesystem(t *testing.T) {
 		t.Fatalf("Expected nil s3 backups filesystem, got %v", s3)
 	}
 }
+
+func TestBaseAppLoggerWrites(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	threshold := 200
+
+	totalLogs := func(app App, t *testing.T) int {
+		var total int
+
+		err := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
+		if err != nil {
+			t.Fatalf("Failed to fetch total logs: %v", err)
+		}
+
+		return total
+	}
+
+	// disabled logs retention
+	{
+		app.Settings().Logs.MaxDays = 0
+
+		for i := 0; i < threshold+1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+	}
+
+	// test batch logs writes
+	{
+		app.Settings().Logs.MaxDays = 1
+
+		for i := 0; i < threshold-1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+
+		// should trigger batch write
+		app.Logger().Error("test")
+
+		// should be added for the next batch write
+		app.Logger().Error("test")
+
+		if total := totalLogs(app, t); total != threshold {
+			t.Fatalf("Expected %d logs, got %d", threshold, total)
+		}
+
+		// wait for ~3 secs to check the timer trigger
+		time.Sleep(3200 * time.Millisecond)
+		if total := totalLogs(app, t); total != threshold+1 {
+			t.Fatalf("Expected %d logs, got %d", threshold+1, total)
+		}
+	}
+}
+
+func TestBaseAppRefreshSettingsLoggerMinLevelEnabled(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+	if !ok {
+		t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+	}
+
+	scenarios := []struct {
+		name  string
+		isDev bool
+		level int
+		// level->enabled map
+		expectations map[int]bool
+	}{
+		{
+			"dev mode",
+			true,
+			4,
+			map[int]bool{
+				3: true,
+				4: true,
+				5: true,
+			},
+		},
+		{
+			"nondev mode",
+			false,
+			4,
+			map[int]bool{
+				3: false,
+				4: true,
+				5: true,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app.isDev = s.isDev
+
+			app.Settings().Logs.MinLevel = s.level
+
+			if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+				t.Fatalf("Failed to save settings: %v", err)
+			}
+
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatalf("Failed to refresh app settings: %v", err)
+			}
+
+			for level, enabled := range s.expectations {
+				if v := handler.Enabled(nil, slog.Level(level)); v != enabled {
+					t.Fatalf("Expected level %d Enabled() to be %v, got %v", level, enabled, v)
+				}
+			}
+		})
+	}
+}
+
+func TestBaseAppLoggerLevelDevPrint(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	testLogLevel := 4
+
+	app.Settings().Logs.MinLevel = testLogLevel
+	if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name            string
+		isDev           bool
+		levels          []int
+		printedLevels   []int
+		persistedLevels []int
+	}{
+		{
+			"dev mode",
+			true,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+		{
+			"nondev mode",
+			false,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			var printedLevels []int
+			var persistedLevels []int
+
+			app.isDev = s.isDev
+
+			// trigger slog handler min level refresh
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatal(err)
+			}
+
+			// track printed logs
+			originalPrintLog := printLog
+			defer func() {
+				printLog = originalPrintLog
+			}()
+			printLog = func(log *logger.Log) {
+				printedLevels = append(printedLevels, int(log.Level))
+			}
+
+			// track persisted logs
+			app.LogsDao().AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+				l, ok := m.(*models.Log)
+				if ok {
+					persistedLevels = append(persistedLevels, l.Level)
+				}
+				return nil
+			}
+
+			// write and persist logs
+			for _, l := range s.levels {
+				app.Logger().Log(nil, slog.Level(l), "test")
+			}
+			handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+			if !ok {
+				t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+			}
+			if err := handler.WriteAll(nil); err != nil {
+				t.Fatalf("Failed to write all logs: %v", err)
+			}
+
+			// check persisted log levels
+			if len(s.persistedLevels) != len(persistedLevels) {
+				t.Fatalf("Expected persisted levels \n%v\ngot\n%v", s.persistedLevels, persistedLevels)
+			}
+			for _, l := range persistedLevels {
+				if !list.ExistInSlice(l, s.persistedLevels) {
+					t.Fatalf("Missing expected persisted level %v in %v", l, persistedLevels)
+				}
+			}
+
+			// check printed log levels
+			if len(s.printedLevels) != len(printedLevels) {
+				t.Fatalf("Expected printed levels \n%v\ngot\n%v", s.printedLevels, printedLevels)
+			}
+			for _, l := range printedLevels {
+				if !list.ExistInSlice(l, s.printedLevels) {
+					t.Fatalf("Missing expected printed level %v in %v", l, printedLevels)
+				}
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+
+// note: make sure to call `defer cleanup()` when the app is no longer needed.
+func initTestBaseApp() (app *BaseApp, cleanup func(), err error) {
+	testDataDir, err := os.MkdirTemp("", "test_base_app")
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cleanup = func() {
+		os.RemoveAll(testDataDir)
+	}
+
+	app = NewBaseApp(BaseAppConfig{
+		DataDir: testDataDir,
+	})
+
+	initErr := func() error {
+		if err := app.Bootstrap(); err != nil {
+			return fmt.Errorf("bootstrap error: %w", err)
+		}
+
+		logsRunner, err := migrate.NewRunner(app.LogsDB(), logs.LogsMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := logsRunner.Up(); err != nil {
+			return fmt.Errorf("logsRunner migrations execution error: %w", err)
+		}
+
+		dataRunner, err := migrate.NewRunner(app.DB(), migrations.AppMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := dataRunner.Up(); err != nil {
+			return fmt.Errorf("dataRunner migrations execution error: %w", err)
+		}
+
+		return nil
+	}()
+	if initErr != nil {
+		cleanup()
+		return nil, nil, initErr
+	}
+
+	return app, cleanup, nil
+}

core/events.go

@@ -70,7 +70,8 @@ type BootstrapEvent struct {
 }
 
 type TerminateEvent struct {
-	App App
+	App       App
+	IsRestart bool
 }
 
 type ServeEvent struct {

core/log_printer.go

@@ -0,0 +1,67 @@
+package core
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+var cachedColors = store.New[*color.Color](nil)
+
+// getColor returns [color.Color] object and cache it (if not already).
+func getColor(attrs ...color.Attribute) (c *color.Color) {
+	cacheKey := fmt.Sprint(attrs)
+	if c = cachedColors.Get(cacheKey); c == nil {
+		c = color.New(attrs...)
+		cachedColors.Set(cacheKey, c)
+	}
+	return
+}
+
+// printLog prints the provided log to the stderr.
+// (note: defined as variable to overwriting in the tests)
+var printLog = func(log *logger.Log) {
+	var str strings.Builder
+
+	switch log.Level {
+	case slog.LevelDebug:
+		str.WriteString(getColor(color.Bold, color.FgHiBlack).Sprint("DEBUG "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelInfo:
+		str.WriteString(getColor(color.Bold, color.FgWhite).Sprint("INFO "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelWarn:
+		str.WriteString(getColor(color.Bold, color.FgYellow).Sprint("WARN "))
+		str.WriteString(getColor(color.FgYellow).Sprint(log.Message))
+	case slog.LevelError:
+		str.WriteString(getColor(color.Bold, color.FgRed).Sprint("ERROR "))
+		str.WriteString(getColor(color.FgRed).Sprint(log.Message))
+	default:
+		str.WriteString(getColor(color.Bold, color.FgCyan).Sprintf("[%d] ", log.Level))
+		str.WriteString(getColor(color.FgCyan).Sprint(log.Message))
+	}
+
+	str.WriteString("\n")
+
+	if v, ok := log.Data["type"]; ok && cast.ToString(v) == "request" {
+		padding := 0
+		keys := []string{"error", "details"}
+		for _, k := range keys {
+			if v := log.Data[k]; v != nil {
+				str.WriteString(getColor(color.FgHiRed).Sprintf("%s└─ %v", strings.Repeat(" ", padding), v))
+				str.WriteString("\n")
+				padding += 3
+			}
+		}
+	} else if len(log.Data) > 0 {
+		str.WriteString(getColor(color.FgHiBlack).Sprintf("└─ %v", log.Data))
+		str.WriteString("\n")
+	}
+
+	fmt.Print(str.String())
+}

daos/base.go

@@ -6,7 +6,6 @@ package daos
 import (
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/pocketbase/dbx"
@@ -212,13 +211,7 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 			}
 		}
 		if len(errs) > 0 {
-			// @todo after go 1.20+ upgrade consider replacing with errors.Join()
-			var errsMsg strings.Builder
-			for _, err := range errs {
-				errsMsg.WriteString(err.Error())
-				errsMsg.WriteString("; ")
-			}
-			return fmt.Errorf("after transaction errors: %s", errsMsg.String())
+			return fmt.Errorf("after transaction errors: %w", errors.Join(errs...))
 		}
 
 		return nil

daos/base_retry.go

@@ -2,6 +2,9 @@ package daos
 
 import (
 	"context"
+	"database/sql"
+	"errors"
+	"fmt"
 	"strings"
 	"time"
 
@@ -23,9 +26,14 @@ func execLockRetry(timeout time.Duration, maxRetries int) dbx.ExecHookFunc {
 			q.WithContext(cancelCtx)
 		}
 
-		return baseLockRetry(func(attempt int) error {
+		execErr := baseLockRetry(func(attempt int) error {
 			return op()
 		}, maxRetries)
+		if execErr != nil && !errors.Is(execErr, sql.ErrNoRows) {
+			execErr = fmt.Errorf("%w; failed query: %s", execErr, q.SQL())
+		}
+
+		return execErr
 	}
 }
 

daos/collection.go

@@ -402,6 +402,8 @@ func (dao *Dao) saveViewCollection(newCollection, oldCollection *models.Collecti
 // currently we don't support non-string model ids
 // (see https://github.com/pocketbase/pocketbase/issues/3110).
 func (dao *Dao) normalizeViewQueryId(query string) (string, error) {
+	query = strings.Trim(strings.TrimSpace(query), ";")
+
 	parsed, err := dao.parseQueryToFields(query)
 	if err != nil {
 		return "", err

daos/external_auth.go

@@ -32,27 +32,6 @@ func (dao *Dao) FindAllExternalAuthsByRecord(authRecord *models.Record) ([]*mode
 	return auths, nil
 }
 
-// FindExternalAuthByProvider returns the first available
-// ExternalAuth model for the specified provider and providerId.
-func (dao *Dao) FindExternalAuthByProvider(provider, providerId string) (*models.ExternalAuth, error) {
-	model := &models.ExternalAuth{}
-
-	err := dao.ExternalAuthQuery().
-		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
-		AndWhere(dbx.HashExp{
-			"provider":   provider,
-			"providerId": providerId,
-		}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return model, nil
-}
-
 // FindExternalAuthByRecordAndProvider returns the first available
 // ExternalAuth model for the specified record data and provider.
 func (dao *Dao) FindExternalAuthByRecordAndProvider(authRecord *models.Record, provider string) (*models.ExternalAuth, error) {
@@ -74,6 +53,24 @@ func (dao *Dao) FindExternalAuthByRecordAndProvider(authRecord *models.Record, p
 	return model, nil
 }
 
+// FindFirstExternalAuthByExpr returns the first available
+// ExternalAuth model that satisfies the non-nil expression.
+func (dao *Dao) FindFirstExternalAuthByExpr(expr dbx.Expression) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
+		AndWhere(expr).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
 // SaveExternalAuth upserts the provided ExternalAuth model.
 func (dao *Dao) SaveExternalAuth(model *models.ExternalAuth) error {
 	// extra check the model data in case the provider's API response

daos/external_auth_test.go

@@ -3,6 +3,7 @@ package daos_test
 import (
 	"testing"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
@@ -56,25 +57,23 @@ func TestFindAllExternalAuthsByRecord(t *testing.T) {
 	}
 }
 
-func TestFindExternalAuthByProvider(t *testing.T) {
+func TestFindFirstExternalAuthByExpr(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
 	scenarios := []struct {
-		provider   string
-		providerId string
+		expr       dbx.Expression
 		expectedId string
 	}{
-		{"", "", ""},
-		{"github", "", ""},
-		{"github", "id1", ""},
-		{"github", "id2", ""},
-		{"google", "test123", "clmflokuq1xl341"},
-		{"gitlab", "test123", "dlmflokuq1xl342"},
+		{dbx.HashExp{"provider": "github", "providerId": ""}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id1"}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id2"}, ""},
+		{dbx.HashExp{"provider": "google", "providerId": "test123"}, "clmflokuq1xl341"},
+		{dbx.HashExp{"provider": "gitlab", "providerId": "test123"}, "dlmflokuq1xl342"},
 	}
 
 	for i, s := range scenarios {
-		auth, err := app.Dao().FindExternalAuthByProvider(s.provider, s.providerId)
+		auth, err := app.Dao().FindFirstExternalAuthByExpr(s.expr)
 
 		hasErr := err != nil
 		expectErr := s.expectedId == ""
@@ -147,7 +146,11 @@ func TestSaveExternalAuth(t *testing.T) {
 	}
 
 	// check if it was really saved
-	foundAuth, err := app.Dao().FindExternalAuthByProvider("test", "test_id")
+	foundAuth, err := app.Dao().FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionId": "v851q4r790rhknl",
+		"provider":     "test",
+		"providerId":   "test_id",
+	})
 	if err != nil {
 		t.Fatal(err)
 	}

daos/log.go

@@ -0,0 +1,67 @@
+package daos
+
+import (
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// LogQuery returns a new Log select query.
+func (dao *Dao) LogQuery() *dbx.SelectQuery {
+	return dao.ModelQuery(&models.Log{})
+}
+
+// FindLogById finds a single Log entry by its id.
+func (dao *Dao) FindLogById(id string) (*models.Log, error) {
+	model := &models.Log{}
+
+	err := dao.LogQuery().
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+type LogsStatsItem struct {
+	Total int            `db:"total" json:"total"`
+	Date  types.DateTime `db:"date" json:"date"`
+}
+
+// LogsStats returns hourly grouped requests logs statistics.
+func (dao *Dao) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
+	result := []*LogsStatsItem{}
+
+	query := dao.LogQuery().
+		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
+		GroupBy("date")
+
+	if expr != nil {
+		query.AndWhere(expr)
+	}
+
+	err := query.All(&result)
+
+	return result, err
+}
+
+// DeleteOldLogs delete all requests that are created before createdBefore.
+func (dao *Dao) DeleteOldLogs(createdBefore time.Time) error {
+	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
+	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
+
+	_, err := dao.NonconcurrentDB().Delete((&models.Log{}).TableName(), expr).Execute()
+
+	return err
+}
+
+// SaveLog upserts the provided Log model.
+func (dao *Dao) SaveLog(log *models.Log) error {
+	return dao.Save(log)
+}

daos/log_test.go

@@ -11,23 +11,23 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-func TestRequestQuery(t *testing.T) {
+func TestLogQuery(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	expected := "SELECT {{_requests}}.* FROM `_requests`"
+	expected := "SELECT {{_logs}}.* FROM `_logs`"
 
-	sql := app.Dao().RequestQuery().Build().SQL()
+	sql := app.Dao().LogQuery().Build().SQL()
 	if sql != expected {
 		t.Errorf("Expected sql %s, got %s", expected, sql)
 	}
 }
 
-func TestFindRequestById(t *testing.T) {
+func TestFindLogById(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		id          string
@@ -40,7 +40,7 @@ func TestFindRequestById(t *testing.T) {
 	}
 
 	for i, scenario := range scenarios {
-		admin, err := app.LogsDao().FindRequestById(scenario.id)
+		admin, err := app.LogsDao().FindLogById(scenario.id)
 
 		hasErr := err != nil
 		if hasErr != scenario.expectError {
@@ -53,17 +53,17 @@ func TestFindRequestById(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	expected := `[{"total":1,"date":"2022-05-01 10:00:00.000Z"},{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`
 
 	now := time.Now().UTC().Format(types.DefaultDateLayout)
 	exp := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": now})
-	result, err := app.LogsDao().RequestsStats(exp)
+	result, err := app.LogsDao().LogsStats(exp)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -74,20 +74,20 @@ func TestRequestsStats(t *testing.T) {
 	}
 }
 
-func TestDeleteOldRequests(t *testing.T) {
+func TestDeleteOldLogs(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		date          string
 		expectedTotal int
 	}{
-		{"2022-01-01 10:00:00.000Z", 2}, // no requests to delete before that time
-		{"2022-05-01 11:00:00.000Z", 1}, // only 1 request should have left
-		{"2022-05-03 11:00:00.000Z", 0}, // no more requests should have left
-		{"2022-05-04 11:00:00.000Z", 0}, // no more requests should have left
+		{"2022-01-01 10:00:00.000Z", 2}, // no logs to delete before that time
+		{"2022-05-01 11:00:00.000Z", 1}, // only 1 log should have left
+		{"2022-05-03 11:00:00.000Z", 0}, // no more logs should have left
+		{"2022-05-04 11:00:00.000Z", 0}, // no more logs should have left
 	}
 
 	for i, scenario := range scenarios {
@@ -96,53 +96,53 @@ func TestDeleteOldRequests(t *testing.T) {
 			t.Errorf("(%d) Date error %v", i, dateErr)
 		}
 
-		deleteErr := app.LogsDao().DeleteOldRequests(date)
+		deleteErr := app.LogsDao().DeleteOldLogs(date)
 		if deleteErr != nil {
 			t.Errorf("(%d) Delete error %v", i, deleteErr)
 		}
 
-		// check total remaining requests
+		// check total remaining logs
 		var total int
-		countErr := app.LogsDao().RequestQuery().Select("count(*)").Row(&total)
+		countErr := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
 		if countErr != nil {
 			t.Errorf("(%d) Count error %v", i, countErr)
 		}
 
 		if total != scenario.expectedTotal {
-			t.Errorf("(%d) Expected %d remaining requests, got %d", i, scenario.expectedTotal, total)
+			t.Errorf("(%d) Expected %d remaining logs, got %d", i, scenario.expectedTotal, total)
 		}
 	}
 }
 
-func TestSaveRequest(t *testing.T) {
+func TestSaveLog(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
-	// create new request
-	newRequest := &models.Request{}
-	newRequest.Method = "get"
-	newRequest.Meta = types.JsonMap{}
-	createErr := app.LogsDao().SaveRequest(newRequest)
+	// create new log
+	newLog := &models.Log{}
+	newLog.Level = -4
+	newLog.Data = types.JsonMap{}
+	createErr := app.LogsDao().SaveLog(newLog)
 	if createErr != nil {
 		t.Fatal(createErr)
 	}
 
 	// check if it was really created
-	existingRequest, fetchErr := app.LogsDao().FindRequestById(newRequest.Id)
+	existingLog, fetchErr := app.LogsDao().FindLogById(newLog.Id)
 	if fetchErr != nil {
 		t.Fatal(fetchErr)
 	}
 
-	existingRequest.Method = "post"
-	updateErr := app.LogsDao().SaveRequest(existingRequest)
+	existingLog.Level = 4
+	updateErr := app.LogsDao().SaveLog(existingLog)
 	if updateErr != nil {
 		t.Fatal(updateErr)
 	}
 	// refresh instance to check if it was really updated
-	existingRequest, _ = app.LogsDao().FindRequestById(existingRequest.Id)
-	if existingRequest.Method != "post" {
-		t.Fatalf("Expected request method to be %s, got %s", "post", existingRequest.Method)
+	existingLog, _ = app.LogsDao().FindLogById(existingLog.Id)
+	if existingLog.Level != 4 {
+		t.Fatalf("Expected log level to be %d, got %d", 4, existingLog.Level)
 	}
 }

daos/request.go

@@ -1,70 +0,0 @@
-package daos
-
-import (
-	"time"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-// RequestQuery returns a new Request logs select query.
-func (dao *Dao) RequestQuery() *dbx.SelectQuery {
-	return dao.ModelQuery(&models.Request{})
-}
-
-// FindRequestById finds a single Request log by its id.
-func (dao *Dao) FindRequestById(id string) (*models.Request, error) {
-	model := &models.Request{}
-
-	err := dao.RequestQuery().
-		AndWhere(dbx.HashExp{"id": id}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return model, nil
-}
-
-type RequestsStatsItem struct {
-	Total int            `db:"total" json:"total"`
-	Date  types.DateTime `db:"date" json:"date"`
-}
-
-// RequestsStats returns hourly grouped requests logs statistics.
-func (dao *Dao) RequestsStats(expr dbx.Expression) ([]*RequestsStatsItem, error) {
-	result := []*RequestsStatsItem{}
-
-	query := dao.RequestQuery().
-		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
-		GroupBy("date")
-
-	if expr != nil {
-		query.AndWhere(expr)
-	}
-
-	err := query.All(&result)
-
-	return result, err
-}
-
-// DeleteOldRequests delete all requests that are created before createdBefore.
-func (dao *Dao) DeleteOldRequests(createdBefore time.Time) error {
-	m := models.Request{}
-	tableName := m.TableName()
-
-	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
-	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
-
-	_, err := dao.NonconcurrentDB().Delete(tableName, expr).Execute()
-
-	return err
-}
-
-// SaveRequest upserts the provided Request model.
-func (dao *Dao) SaveRequest(request *models.Request) error {
-	return dao.Save(request)
-}

daos/view.go

@@ -43,10 +43,10 @@ func (dao *Dao) SaveView(name string, selectQuery string) error {
 			return err
 		}
 
-		trimmed := strings.Trim(selectQuery, ";")
+		selectQuery = strings.Trim(strings.TrimSpace(selectQuery), ";")
 
 		// try to eagerly detect multiple inline statements
-		tk := tokenizer.NewFromString(trimmed)
+		tk := tokenizer.NewFromString(selectQuery)
 		tk.Separators(';')
 		if queryParts, _ := tk.ScanAll(); len(queryParts) > 1 {
 			return errors.New("multiple statements are not supported")
@@ -56,7 +56,7 @@ func (dao *Dao) SaveView(name string, selectQuery string) error {
 		//
 		// note: the query is wrapped in a secondary SELECT as a rudimentary
 		// measure to discourage multiple inline sql statements execution.
-		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, trimmed)
+		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, selectQuery)
 		if _, err := txDao.DB().NewQuery(viewQuery).Execute(); err != nil {
 			return err
 		}
@@ -232,6 +232,9 @@ func defaultViewField(name string) *schema.SchemaField {
 	return &schema.SchemaField{
 		Name: name,
 		Type: schema.FieldTypeJson,
+		Options: &schema.JsonOptions{
+			MaxSize: 1, // the size doesn't matter in this case
+		},
 	}
 }
 
@@ -458,7 +461,7 @@ type identifiersParser struct {
 }
 
 func (p *identifiersParser) parse(selectQuery string) error {
-	str := strings.Trim(selectQuery, ";")
+	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
 	str = joinReplaceRegex.ReplaceAllString(str, " _join_ ")
 	str = discardReplaceRegex.ReplaceAllString(str, " _discard_ ")
 	str = commentsReplaceRegex.ReplaceAllString(str, "")
@@ -599,13 +602,20 @@ func identifierFromParts(parts []string) (identifier, error) {
 	}
 
 	result.original = trimRawIdentifier(result.original)
-	result.alias = trimRawIdentifier(result.alias)
+
+	// we trim the single quote even though it is not a valid column quote character
+	// because SQLite allows it if the context expects an identifier and not string literal
+	// (https://www.sqlite.org/lang_keywords.html)
+	result.alias = trimRawIdentifier(result.alias, "'")
 
 	return result, nil
 }
 
-func trimRawIdentifier(rawIdentifier string) string {
-	const trimChars = "`\"[];"
+func trimRawIdentifier(rawIdentifier string, extraTrimChars ...string) string {
+	trimChars := "`\"[];"
+	if len(extraTrimChars) > 0 {
+		trimChars += strings.Join(extraTrimChars, "")
+	}
 
 	parts := strings.Split(rawIdentifier, ".")
 

daos/view_test.go

@@ -147,34 +147,33 @@ func TestSaveView(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		err := app.Dao().SaveView(s.viewName, s.query)
+		t.Run(s.scenarioName, func(t *testing.T) {
+			err := app.Dao().SaveView(s.viewName, s.query)
 
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.scenarioName, s.expectError, hasErr, err)
-			continue
-		}
-
-		if hasErr {
-			continue
-		}
-
-		infoRows, err := app.Dao().TableInfo(s.viewName)
-		if err != nil {
-			t.Errorf("[%s] Failed to fetch table info for %s: %v", s.scenarioName, s.viewName, err)
-			continue
-		}
-
-		if len(s.expectColumns) != len(infoRows) {
-			t.Errorf("[%s] Expected %d columns, got %d", s.scenarioName, len(s.expectColumns), len(infoRows))
-			continue
-		}
-
-		for _, row := range infoRows {
-			if !list.ExistInSlice(row.Name, s.expectColumns) {
-				t.Errorf("[%s] Missing %q column in %v", s.scenarioName, row.Name, s.expectColumns)
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
 			}
-		}
+
+			if hasErr {
+				return
+			}
+
+			infoRows, err := app.Dao().TableInfo(s.viewName)
+			if err != nil {
+				t.Fatalf("Failed to fetch table info for %s: %v", s.viewName, err)
+			}
+
+			if len(s.expectColumns) != len(infoRows) {
+				t.Fatalf("Expected %d columns, got %d", len(s.expectColumns), len(infoRows))
+			}
+
+			for _, row := range infoRows {
+				if !list.ExistInSlice(row.Name, s.expectColumns) {
+					t.Fatalf("Missing %q column in %v", row.Name, s.expectColumns)
+				}
+			}
+		})
 	}
 
 	ensureNoTempViews(app, t)
@@ -272,24 +271,26 @@ func TestCreateViewSchema(t *testing.T) {
 					"datetime",
 					"json",
 					"rel_one",
-					"rel_many"
+					"rel_many",
+					'single_quoted_custom_literal' as 'single_quoted_column'
 				from demo1
 			`,
 			false,
 			map[string]string{
-				"text":         schema.FieldTypeText,
-				"bool":         schema.FieldTypeBool,
-				"url":          schema.FieldTypeUrl,
-				"select_one":   schema.FieldTypeSelect,
-				"select_many":  schema.FieldTypeSelect,
-				"file_one":     schema.FieldTypeFile,
-				"file_many":    schema.FieldTypeFile,
-				"number_alias": schema.FieldTypeNumber,
-				"email":        schema.FieldTypeEmail,
-				"datetime":     schema.FieldTypeDate,
-				"json":         schema.FieldTypeJson,
-				"rel_one":      schema.FieldTypeRelation,
-				"rel_many":     schema.FieldTypeRelation,
+				"text":                 schema.FieldTypeText,
+				"bool":                 schema.FieldTypeBool,
+				"url":                  schema.FieldTypeUrl,
+				"select_one":           schema.FieldTypeSelect,
+				"select_many":          schema.FieldTypeSelect,
+				"file_one":             schema.FieldTypeFile,
+				"file_many":            schema.FieldTypeFile,
+				"number_alias":         schema.FieldTypeNumber,
+				"email":                schema.FieldTypeEmail,
+				"datetime":             schema.FieldTypeDate,
+				"json":                 schema.FieldTypeJson,
+				"rel_one":              schema.FieldTypeRelation,
+				"rel_many":             schema.FieldTypeRelation,
+				"single_quoted_column": schema.FieldTypeJson,
 			},
 		},
 		{

examples/base/main.go

@@ -110,7 +110,7 @@ func main() {
 	// GitHub selfupdate
 	ghupdate.MustRegister(app, app.RootCmd, ghupdate.Config{})
 
-	app.OnAfterBootstrap().Add(func(e *core.BootstrapEvent) error {
+	app.OnAfterBootstrap().PreAdd(func(e *core.BootstrapEvent) error {
 		app.Dao().ModelQueryTimeout = time.Duration(queryTimeout) * time.Second
 		return nil
 	})

forms/admin_password_reset_request.go

@@ -2,6 +2,7 @@ package forms
 
 import (
 	"errors"
+	"fmt"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -66,7 +67,7 @@ func (form *AdminPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*m
 
 	admin, err := form.dao.FindAdminByEmail(form.Email)
 	if err != nil {
-		return err
+		return fmt.Errorf("Failed to fetch admin with email %s: %w", form.Email, err)
 	}
 
 	now := time.Now().UTC()

forms/collection_upsert.go

@@ -370,7 +370,7 @@ func (form *CollectionUpsert) checkRule(value any) error {
 
 	_, err := search.FilterData(*v).BuildExpr(r)
 	if err != nil {
-		return validation.NewError("validation_invalid_rule", "Invalid filter rule.")
+		return validation.NewError("validation_invalid_rule", "Invalid filter rule. Raw error: "+err.Error())
 	}
 
 	return nil

forms/collections_import.go

@@ -3,7 +3,6 @@ package forms
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
@@ -78,12 +77,9 @@ func (form *CollectionsImport) Submit(interceptors ...InterceptorFunc[[]*models.
 			}
 
 			// generic/db failure
-			if form.app.IsDebug() {
-				log.Println("Internal import failure:", importErr)
-			}
 			return validation.Errors{"collections": validation.NewError(
 				"collections_import_failure",
-				"Failed to import the collections configuration.",
+				"Failed to import the collections configuration. Raw error:\n"+importErr.Error(),
 			)}
 		})
 	}, interceptors...)

forms/collections_import_test.go

@@ -206,7 +206,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 			expectError:            true,
 			expectCollectionsCount: totalCollections,
 			expectEvents: map[string]int{
-				"OnModelBeforeDelete": 4,
+				"OnModelBeforeDelete": 1,
 			},
 		},
 		{
@@ -418,44 +418,45 @@ func TestCollectionsImportSubmit(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		testApp, _ := tests.NewTestApp()
-		defer testApp.Cleanup()
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
 
-		form := forms.NewCollectionsImport(testApp)
+			form := forms.NewCollectionsImport(testApp)
 
-		// load data
-		loadErr := json.Unmarshal([]byte(s.jsonData), form)
-		if loadErr != nil {
-			t.Errorf("[%s] Failed to load form data: %v", s.name, loadErr)
-			continue
-		}
-
-		err := form.Submit()
-
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", s.name, s.expectError, hasErr, err)
-		}
-
-		// check collections count
-		collections := []*models.Collection{}
-		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
-			t.Fatal(err)
-		}
-		if len(collections) != s.expectCollectionsCount {
-			t.Errorf("[%s] Expected %d collections, got %d", s.name, s.expectCollectionsCount, len(collections))
-		}
-
-		// check events
-		if len(testApp.EventCalls) > len(s.expectEvents) {
-			t.Errorf("[%s] Expected events %v, got %v", s.name, s.expectEvents, testApp.EventCalls)
-		}
-		for event, expectedCalls := range s.expectEvents {
-			actualCalls := testApp.EventCalls[event]
-			if actualCalls != expectedCalls {
-				t.Errorf("[%s] Expected event %s to be called %d, got %d", s.name, event, expectedCalls, actualCalls)
+			// load data
+			loadErr := json.Unmarshal([]byte(s.jsonData), form)
+			if loadErr != nil {
+				t.Fatalf("Failed to load form data: %v", loadErr)
 			}
-		}
+
+			err := form.Submit()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			// check collections count
+			collections := []*models.Collection{}
+			if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
+
+			// check events
+			if len(testApp.EventCalls) > len(s.expectEvents) {
+				t.Fatalf("Expected events %v, got %v", s.expectEvents, testApp.EventCalls)
+			}
+			for event, expectedCalls := range s.expectEvents {
+				actualCalls := testApp.EventCalls[event]
+				if actualCalls != expectedCalls {
+					t.Fatalf("Expected event %s to be called %d, got %d", event, expectedCalls, actualCalls)
+				}
+			}
+		})
 	}
 }
 

forms/record_email_change_confirm.go

@@ -128,6 +128,8 @@ func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorFunc[*mo
 
 	authRecord.SetEmail(newEmail)
 	authRecord.SetVerified(true)
+
+	// @todo consider removing if not necessary anymore
 	authRecord.RefreshTokenKey() // invalidate old tokens
 
 	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {

forms/record_email_change_request.go

@@ -54,7 +54,7 @@ func (form *RecordEmailChangeRequest) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
 	if !form.dao.IsRecordValueUnique(form.record.Collection().Id, schema.FieldNameEmail, v) {
-		return validation.NewError("validation_record_email_exists", "User email already exists.")
+		return validation.NewError("validation_record_email_invalid", "User email already exists or it is invalid.")
 	}
 
 	return nil

forms/record_oauth2_login.go

@@ -7,7 +7,7 @@ import (
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
@@ -46,7 +46,7 @@ type RecordOAuth2Login struct {
 	// The authorization code returned from the initial request.
 	Code string `form:"code" json:"code"`
 
-	// The code verifier sent with the initial request as part of the code_challenge.
+	// The optional PKCE code verifier as part of the code_challenge sent with the initial request.
 	CodeVerifier string `form:"codeVerifier" json:"codeVerifier"`
 
 	// The redirect url sent with the initial request.
@@ -88,8 +88,7 @@ func (form *RecordOAuth2Login) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.Provider, validation.Required, validation.By(form.checkProviderName)),
 		validation.Field(&form.Code, validation.Required),
-		validation.Field(&form.CodeVerifier, validation.Required),
-		validation.Field(&form.RedirectUrl, validation.Required, is.URL),
+		validation.Field(&form.RedirectUrl, validation.Required),
 	)
 }
 
@@ -143,11 +142,14 @@ func (form *RecordOAuth2Login) Submit(
 
 	provider.SetRedirectUrl(form.RedirectUrl)
 
+	var opts []oauth2.AuthCodeOption
+
+	if provider.PKCE() {
+		opts = append(opts, oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier))
+	}
+
 	// fetch token
-	token, err := provider.FetchToken(
-		form.Code,
-		oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier),
-	)
+	token, err := provider.FetchToken(form.Code, opts...)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -161,7 +163,11 @@ func (form *RecordOAuth2Login) Submit(
 	var authRecord *models.Record
 
 	// check for existing relation with the auth record
-	rel, _ := form.dao.FindExternalAuthByProvider(form.Provider, authUser.Id)
+	rel, _ := form.dao.FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionId": form.collection.Id,
+		"provider":     form.Provider,
+		"providerId":   authUser.Id,
+	})
 	switch {
 	case rel != nil:
 		authRecord, err = form.dao.FindRecordById(form.collection.Id, rel.RecordId)

forms/record_oauth2_login_test.go

@@ -23,13 +23,13 @@ func TestUserOauth2LoginValidate(t *testing.T) {
 			"empty payload",
 			"users",
 			"{}",
-			[]string{"provider", "code", "codeVerifier", "redirectUrl"},
+			[]string{"provider", "code", "redirectUrl"},
 		},
 		{
 			"empty data",
 			"users",
 			`{"provider":"","code":"","codeVerifier":"","redirectUrl":""}`,
-			[]string{"provider", "code", "codeVerifier", "redirectUrl"},
+			[]string{"provider", "code", "redirectUrl"},
 		},
 		{
 			"missing provider",
@@ -49,6 +49,12 @@ func TestUserOauth2LoginValidate(t *testing.T) {
 			`{"provider":"gitlab","code":"123","codeVerifier":"123","redirectUrl":"https://example.com"}`,
 			[]string{},
 		},
+		{
+			"[#3689] any redirectUrl value",
+			"users",
+			`{"provider":"gitlab","code":"123","codeVerifier":"123","redirectUrl":"something"}`,
+			[]string{},
+		},
 	}
 
 	for _, s := range scenarios {

forms/record_password_reset_request.go

@@ -2,6 +2,7 @@ package forms
 
 import (
 	"errors"
+	"fmt"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -69,7 +70,7 @@ func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*
 
 	authRecord, err := form.dao.FindAuthRecordByEmail(form.collection.Id, form.Email)
 	if err != nil {
-		return err
+		return fmt.Errorf("Failed to fetch %s record with email %s: %w", form.collection.Id, form.Email, err)
 	}
 
 	now := time.Now().UTC()

forms/record_upsert.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
 	"regexp"
 	"strings"
@@ -25,7 +25,7 @@ import (
 )
 
 // username value regex pattern
-var usernameRegex = regexp.MustCompile(`^[\w][\w\.]*$`)
+var usernameRegex = regexp.MustCompile(`^[\w][\w\.\-]*$`)
 
 // RecordUpsert is a [models.Record] upsert (create/update) form.
 type RecordUpsert struct {
@@ -117,7 +117,7 @@ func (form *RecordUpsert) getContentType(r *http.Request) string {
 	return t
 }
 
-func (form *RecordUpsert) extractRequestInfo(
+func (form *RecordUpsert) extractRequestData(
 	r *http.Request,
 	keyPrefix string,
 ) (map[string]any, map[string][]*filesystem.File, error) {
@@ -200,8 +200,12 @@ func (form *RecordUpsert) extractMultipartFormData(
 
 		files, err := rest.FindUploadedFiles(r, fullKey)
 		if err != nil || len(files) == 0 {
-			if err != nil && err != http.ErrMissingFile && form.app.IsDebug() {
-				log.Printf("%q uploaded file error: %v\n", fullKey, err)
+			if err != nil && err != http.ErrMissingFile {
+				form.app.Logger().Debug(
+					"Uploaded file error",
+					slog.String("key", fullKey),
+					slog.String("error", err.Error()),
+				)
 			}
 
 			// skip invalid or missing file(s)
@@ -219,12 +223,12 @@ func (form *RecordUpsert) extractMultipartFormData(
 //
 // File upload is supported only via multipart/form-data.
 func (form *RecordUpsert) LoadRequest(r *http.Request, keyPrefix string) error {
-	requestInfo, uploadedFiles, err := form.extractRequestInfo(r, keyPrefix)
+	requestData, uploadedFiles, err := form.extractRequestData(r, keyPrefix)
 	if err != nil {
 		return err
 	}
 
-	if err := form.LoadData(requestInfo); err != nil {
+	if err := form.LoadData(requestData); err != nil {
 		return err
 	}
 
@@ -349,39 +353,39 @@ func (form *RecordUpsert) RemoveFiles(key string, toDelete ...string) error {
 }
 
 // LoadData loads and normalizes the provided regular record data fields into the form.
-func (form *RecordUpsert) LoadData(requestInfo map[string]any) error {
+func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 	// load base system fields
-	if v, ok := requestInfo[schema.FieldNameId]; ok {
+	if v, ok := requestData[schema.FieldNameId]; ok {
 		form.Id = cast.ToString(v)
 	}
 
 	// load auth system fields
 	if form.record.Collection().IsAuth() {
-		if v, ok := requestInfo[schema.FieldNameUsername]; ok {
+		if v, ok := requestData[schema.FieldNameUsername]; ok {
 			form.Username = cast.ToString(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameEmail]; ok {
+		if v, ok := requestData[schema.FieldNameEmail]; ok {
 			form.Email = cast.ToString(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameEmailVisibility]; ok {
+		if v, ok := requestData[schema.FieldNameEmailVisibility]; ok {
 			form.EmailVisibility = cast.ToBool(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameVerified]; ok {
+		if v, ok := requestData[schema.FieldNameVerified]; ok {
 			form.Verified = cast.ToBool(v)
 		}
-		if v, ok := requestInfo["password"]; ok {
+		if v, ok := requestData["password"]; ok {
 			form.Password = cast.ToString(v)
 		}
-		if v, ok := requestInfo["passwordConfirm"]; ok {
+		if v, ok := requestData["passwordConfirm"]; ok {
 			form.PasswordConfirm = cast.ToString(v)
 		}
-		if v, ok := requestInfo["oldPassword"]; ok {
+		if v, ok := requestData["oldPassword"]; ok {
 			form.OldPassword = cast.ToString(v)
 		}
 	}
 
 	// replace modifiers (if any)
-	requestInfo = form.record.ReplaceModifers(requestInfo)
+	requestData = form.record.ReplaceModifers(requestData)
 
 	// create a shallow copy of form.data
 	var extendedData = make(map[string]any, len(form.data))
@@ -390,7 +394,7 @@ func (form *RecordUpsert) LoadData(requestInfo map[string]any) error {
 	}
 
 	// extend form.data with the request data
-	rawData, err := json.Marshal(requestInfo)
+	rawData, err := json.Marshal(requestData)
 	if err != nil {
 		return err
 	}
@@ -794,8 +798,11 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		//
 		// for now fail silently to avoid reupload when `form.Submit()`
 		// is called manually (aka. not from an api request)...
-		if err := form.processFilesToDelete(); err != nil && form.app.IsDebug() {
-			log.Println(err)
+		if err := form.processFilesToDelete(); err != nil {
+			form.app.Logger().Debug(
+				"Failed to delete old files",
+				slog.String("error", err.Error()),
+			)
 		}
 
 		return nil

forms/record_upsert_test.go

@@ -753,7 +753,7 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 			"create with all allowed auth fields",
 			"",
 			map[string]any{
-				"username":        "test_new",
+				"username":        "test_new-a.b",
 				"email":           "test_new@example.com",
 				"emailVisibility": true,
 				"password":        "12345678",

forms/settings_upsert.go

@@ -4,9 +4,12 @@ import (
 	"os"
 	"time"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/settings"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 // SettingsUpsert is a [settings.Settings] upsert (create/update) form.
@@ -58,32 +61,27 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc[*settings.Set
 	return runInterceptors(form.Settings, func(s *settings.Settings) error {
 		form.Settings = s
 
-		oldSettings, err := form.app.Settings().Clone()
-		if err != nil {
-			return err
-		}
-
-		// eagerly merge the application settings with the form ones
-		if err := form.app.Settings().Merge(form.Settings); err != nil {
-			return err
-		}
-
 		// persists settings change
 		encryptionKey := os.Getenv(form.app.EncryptionEnv())
 		if err := form.dao.SaveSettings(form.Settings, encryptionKey); err != nil {
-			// try to revert app settings
-			form.app.Settings().Merge(oldSettings)
-
 			return err
 		}
 
-		// explicitly trigger old logs deletion
-		form.app.LogsDao().DeleteOldRequests(
-			time.Now().AddDate(0, 0, -1*form.Settings.Logs.MaxDays),
-		)
+		// reload app settings
+		if err := form.app.RefreshSettings(); err != nil {
+			return err
+		}
 
+		// try to clear old logs not matching the new settings
+		createdBefore := time.Now().AddDate(0, 0, -1*form.Settings.Logs.MaxDays).UTC().Format(types.DefaultDateLayout)
+		expr := dbx.NewExp("[[created]] <= {:date} OR [[level]] < {:level}", dbx.Params{
+			"date":  createdBefore,
+			"level": form.Settings.Logs.MinLevel,
+		})
+		form.app.LogsDao().NonconcurrentDB().Delete((&models.Log{}).TableName(), expr).Execute()
+
+		// no logs are allowed -> try to reclaim preserved disk space after the previous delete operation
 		if form.Settings.Logs.MaxDays == 0 {
-			// no logs are allowed -> reclaim preserved disk space after the previous delete operation
 			form.app.LogsDao().Vacuum()
 		}
 

forms/validators/record_data.go

@@ -132,11 +132,14 @@ func (validator *RecordDataValidator) checkTextValue(field *schema.SchemaField,
 
 	options, _ := field.Options.(*schema.TextOptions)
 
-	if options.Min != nil && len(val) < *options.Min {
+	// note: casted to []rune to count multi-byte chars as one
+	length := len([]rune(val))
+
+	if options.Min != nil && length < *options.Min {
 		return validation.NewError("validation_min_text_constraint", fmt.Sprintf("Must be at least %d character(s)", *options.Min))
 	}
 
-	if options.Max != nil && len(val) > *options.Max {
+	if options.Max != nil && length > *options.Max {
 		return validation.NewError("validation_max_text_constraint", fmt.Sprintf("Must be less than %d character(s)", *options.Max))
 	}
 
@@ -298,8 +301,14 @@ func (validator *RecordDataValidator) checkJsonValue(field *schema.SchemaField,
 	}
 
 	raw, _ := types.ParseJsonRaw(value)
-	rawStr := strings.TrimSpace(raw.String())
 
+	options, _ := field.Options.(*schema.JsonOptions)
+
+	if len(raw) > options.MaxSize {
+		return validation.NewError("validation_json_size_limit", fmt.Sprintf("The maximum allowed JSON size is %v bytes", options.MaxSize))
+	}
+
+	rawStr := strings.TrimSpace(raw.String())
 	if field.Required && list.ExistInSlice(rawStr, emptyJsonValues) {
 		return requiredErr
 	}
@@ -376,7 +385,7 @@ func (validator *RecordDataValidator) checkRelationValue(field *schema.SchemaFie
 		AndWhere(dbx.In("id", list.ToInterfaceSlice(ids)...)).
 		Row(&total)
 	if total != len(ids) {
-		return validation.NewError("validation_missing_rel_records", "Failed to fetch all relation records with the provided ids")
+		return validation.NewError("validation_missing_rel_records", "Failed to find all relation records with the provided ids")
 	}
 	// ---
 

forms/validators/record_data_test.go

@@ -63,15 +63,17 @@ func TestRecordDataValidatorValidateText(t *testing.T) {
 			Name:     "field2",
 			Required: true,
 			Type:     schema.FieldTypeText,
+			Options: &schema.TextOptions{
+				Pattern: pattern,
+			},
 		},
 		&schema.SchemaField{
 			Name:   "field3",
 			Unique: true,
 			Type:   schema.FieldTypeText,
 			Options: &schema.TextOptions{
-				Min:     &min,
-				Max:     &max,
-				Pattern: pattern,
+				Min: &min,
+				Max: &max,
 			},
 		},
 	)
@@ -109,6 +111,16 @@ func TestRecordDataValidatorValidateText(t *testing.T) {
 			nil,
 			[]string{"field3"},
 		},
+		{
+			"(text) check min constraint with multi-bytes char",
+			map[string]any{
+				"field1": "test",
+				"field2": "test",
+				"field3": "𝌆", // 4 bytes should be counted as 1 char
+			},
+			nil,
+			[]string{"field3"},
+		},
 		{
 			"(text) check max constraint",
 			map[string]any{
@@ -119,15 +131,25 @@ func TestRecordDataValidatorValidateText(t *testing.T) {
 			nil,
 			[]string{"field3"},
 		},
+		{
+			"(text) check max constraint with multi-bytes chars",
+			map[string]any{
+				"field1": "test",
+				"field2": "test",
+				"field3": strings.Repeat("𝌆", max), // shouldn't exceed the max limit even though max*4bytes chars are used
+			},
+			nil,
+			[]string{},
+		},
 		{
 			"(text) check pattern constraint",
 			map[string]any{
 				"field1": nil,
-				"field2": "test",
-				"field3": "test!",
+				"field2": "test!",
+				"field3": "test",
 			},
 			nil,
-			[]string{"field3"},
+			[]string{"field2"},
 		},
 		{
 			"(text) valid data (only required)",
@@ -840,16 +862,25 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 		&schema.SchemaField{
 			Name: "field1",
 			Type: schema.FieldTypeJson,
+			Options: &schema.JsonOptions{
+				MaxSize: 10,
+			},
 		},
 		&schema.SchemaField{
 			Name:     "field2",
 			Required: true,
 			Type:     schema.FieldTypeJson,
+			Options: &schema.JsonOptions{
+				MaxSize: 9999,
+			},
 		},
 		&schema.SchemaField{
 			Name:   "field3",
 			Unique: true,
 			Type:   schema.FieldTypeJson,
+			Options: &schema.JsonOptions{
+				MaxSize: 9999,
+			},
 		},
 	)
 	if err := app.Dao().SaveCollection(collection); err != nil {
@@ -916,6 +947,15 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 			nil,
 			[]string{"field2"},
 		},
+		{
+			"(json) check MaxSize constraint",
+			map[string]any{
+				"field1": `"123456789"`, // max 10bytes
+				"field2": 123,
+			},
+			nil,
+			[]string{"field1"},
+		},
 		{
 			"(json) check json text invalid obj, array and number normalizations",
 			map[string]any{
@@ -947,9 +987,9 @@ func TestRecordDataValidatorValidateJson(t *testing.T) {
 		{
 			"(json) valid data - all fields with normalizations",
 			map[string]any{
-				"field1": []string{"a", "b", "c"},
+				"field1": `"12345678"`,
 				"field2": 123,
-				"field3": `"test"`,
+				"field3": []string{"a", "b", "c"},
 			},
 			nil,
 			[]string{},
@@ -1251,29 +1291,30 @@ func TestRecordDataValidatorValidateRelation(t *testing.T) {
 
 func checkValidatorErrors(t *testing.T, dao *daos.Dao, record *models.Record, scenarios []testDataFieldScenario) {
 	for i, s := range scenarios {
-		validator := validators.NewRecordDataValidator(dao, record, s.files)
-		result := validator.Validate(s.data)
-
-		prefix := fmt.Sprintf("%d", i)
-		if s.name != "" {
-			prefix = s.name
+		prefix := s.name
+		if prefix == "" {
+			prefix = fmt.Sprintf("%d", i)
 		}
 
-		// parse errors
-		errs, ok := result.(validation.Errors)
-		if !ok && result != nil {
-			t.Errorf("[%s] Failed to parse errors %v", prefix, result)
-			continue
-		}
+		t.Run(prefix, func(t *testing.T) {
+			validator := validators.NewRecordDataValidator(dao, record, s.files)
+			result := validator.Validate(s.data)
 
-		// check errors
-		if len(errs) > len(s.expectedErrors) {
-			t.Errorf("[%s] Expected error keys %v, got %v", prefix, s.expectedErrors, errs)
-		}
-		for _, k := range s.expectedErrors {
-			if _, ok := errs[k]; !ok {
-				t.Errorf("[%s] Missing expected error key %q in %v", prefix, k, errs)
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
 			}
-		}
+
+			// check errors
+			if len(errs) > len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got %v", s.expectedErrors, errs)
+			}
+			for _, k := range s.expectedErrors {
+				if _, ok := errs[k]; !ok {
+					t.Fatalf("Missing expected error key %q in %v", k, errs)
+				}
+			}
+		})
 	}
 }

go.mod

@@ -1,94 +1,95 @@
 module github.com/pocketbase/pocketbase
 
-go 1.18
+go 1.21
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/aws/aws-sdk-go v1.45.3
+	github.com/aws/aws-sdk-go v1.48.16
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.6.2
-	github.com/dop251/goja v0.0.0-20230707174833-636fdf960de1
-	github.com/dop251/goja_nodejs v0.0.0-20230821135201-94e508132562
-	github.com/fatih/color v1.15.0
-	github.com/fsnotify/fsnotify v1.6.0
-	github.com/gabriel-vasile/mimetype v1.4.2
-	github.com/ganigeorgiev/fexpr v0.3.0
+	github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d
+	github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c
+	github.com/fatih/color v1.16.0
+	github.com/fsnotify/fsnotify v1.7.0
+	github.com/gabriel-vasile/mimetype v1.4.3
+	github.com/ganigeorgiev/fexpr v0.4.0
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
+	github.com/goccy/go-json v0.10.2
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/labstack/echo/v5 v5.0.0-20230722203903-ec5b858dab61
-	github.com/mattn/go-sqlite3 v1.14.17
+	github.com/mattn/go-sqlite3 v1.14.18
 	github.com/pocketbase/dbx v1.10.1
-	github.com/pocketbase/tygoja v0.0.0-20230618203136-2f8d57768be1
-	github.com/spf13/cast v1.5.1
-	github.com/spf13/cobra v1.7.0
-	gocloud.dev v0.34.0
-	golang.org/x/crypto v0.13.0
-	golang.org/x/net v0.15.0
-	golang.org/x/oauth2 v0.12.0
-	golang.org/x/sync v0.3.0
-	modernc.org/sqlite v1.25.0
+	github.com/pocketbase/tygoja v0.0.0-20231111102932-5420517293f4
+	github.com/spf13/cast v1.6.0
+	github.com/spf13/cobra v1.8.0
+	gocloud.dev v0.35.0
+	golang.org/x/crypto v0.16.0
+	golang.org/x/net v0.19.0
+	golang.org/x/oauth2 v0.15.0
+	golang.org/x/sync v0.5.0
+	modernc.org/sqlite v1.27.0
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.21.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.39 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.37 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.83 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.13.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.21.5 // indirect
-	github.com/aws/smithy-go v1.14.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.24.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/dlclark/regexp2 v1.10.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 // indirect
-	github.com/google/uuid v1.3.1 // indirect
+	github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect
+	github.com/google/uuid v1.4.0 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/image v0.12.0 // indirect
-	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/sys v0.12.0 // indirect
-	golang.org/x/term v0.12.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.13.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.138.0 // indirect
+	golang.org/x/image v0.14.0 // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.16.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/api v0.153.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 // indirect
+	google.golang.org/grpc v1.59.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	lukechampine.com/uint128 v1.3.0 // indirect
 	modernc.org/cc/v3 v3.41.0 // indirect
 	modernc.org/ccgo/v3 v3.16.15 // indirect
-	modernc.org/libc v1.24.1 // indirect
+	modernc.org/libc v1.37.0 // indirect
 	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.7.1 // indirect
+	modernc.org/memory v1.7.2 // indirect
 	modernc.org/opt v0.1.3 // indirect
 	modernc.org/strutil v1.2.0 // indirect
 	modernc.org/token v1.1.0 // indirect

go.sum

@@ -1,9 +1,14 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.110.7 h1:rJyC7nWRg2jWGZ4wSJ5nY65GTdYJkg0cd/uXb+ACI6o=
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
+cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
+cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/iam v1.1.1 h1:lW7fzj15aVIXYHREOqjRBV9PsH0Z6u8Y46a1YGvQP4Y=
-cloud.google.com/go/storage v1.31.0 h1:+S3LjjEN2zZ+L5hOwj4+1OkGCsLVe0NzpXKQ1pSdTCI=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/storage v1.35.1 h1:B59ahL//eDfx2IIKFBeT5Atm9wnNmj3+8xG/W4WB//w=
+cloud.google.com/go/storage v1.35.1/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -12,53 +17,53 @@ github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDe
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.45.3 h1:Q8BksXg2ZUu2dCbA62+UCEtfvqsW8EO4tzt2IVeYAws=
-github.com/aws/aws-sdk-go v1.45.3/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go-v2 v1.21.0 h1:gMT0IW+03wtYJhRqTVYn0wLzwdnK9sRMcxmtfGzRdJc=
-github.com/aws/aws-sdk-go-v2 v1.21.0/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 h1:OPLEkmhXf6xFPiz0bLeDArZIDx1NNS4oJyG4nv3Gct0=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13/go.mod h1:gpAbvyDGQFozTEmlTFO8XcQKHzubdq0LzRyJpG6MiXM=
-github.com/aws/aws-sdk-go-v2/config v1.18.39 h1:oPVyh6fuu/u4OiW4qcuQyEtk7U7uuNBmHmJSLg1AJsQ=
-github.com/aws/aws-sdk-go-v2/config v1.18.39/go.mod h1:+NH/ZigdPckFpgB1TRcRuWCB/Kbbvkxc/iNAKTq5RhE=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.37 h1:BvEdm09+ZEh2XtN+PVHPcYwKY3wIeB6pw7vPRM4M9/U=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.37/go.mod h1:ACLrdkd4CLZyXOghZ8IYumQbcooAcp2jo/s2xsFH8IM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 h1:uDZJF1hu0EVT/4bogChk8DyjSF6fof6uL/0Y26Ma7Fg=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11/go.mod h1:TEPP4tENqBGO99KwVpV9MlOX4NSrSLP8u3KRy2CDwA8=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.83 h1:wcluDLIQ0uYaxv0fCWQRimbXkPdTgWHUD21j1CzXEwc=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.83/go.mod h1:nGCBuon134gW67yAtxHKV73x+tAcY/xG4ZPNPDB1h/I=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 h1:22dGT7PneFMx4+b3pz7lMTRyN8ZKH7M2cW4GP9yUS2g=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41/go.mod h1:CrObHAuPneJBlfEJ5T3szXOUkLEThaGfvnhTf33buas=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 h1:SijA0mgjV8E+8G45ltVHs0fvKpTj8xmZJ3VwhGKtUSI=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35/go.mod h1:SJC1nEVVva1g3pHAIdCp7QsRIkMmLAgoDquQ9Rr8kYw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42 h1:GPUcE/Yq7Ur8YSUk6lVkoIMWnJNO0HT18GUzCWCgCI0=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.42/go.mod h1:rzfdUlfA+jdgLDmPKjd3Chq9V7LVLYo1Nz++Wb91aRo=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 h1:6lJvvkQ9HmbHZ4h/IEwclwv2mrTW8Uq1SOB/kXy0mfw=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4/go.mod h1:1PrKYwxTM+zjpw9Y41KFtoJCQrJ34Z47Y4VgVbfndjo=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 h1:m0QTSI6pZYJTk5WSKx3fm5cNW/DCicVzULBgU/6IyD0=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14/go.mod h1:dDilntgHy9WnHXsh7dDtUPgHKEfTJIBUTHM8OWm0f/0=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 h1:eev2yZX7esGRjqRbnVk1UxMLw4CyVZDpZXRCcy75oQk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36/go.mod h1:lGnOkH9NJATw0XEPcAknFBj3zzNTEGRHtSw+CwC1YTg=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 h1:CdzPW9kKitgIiLV1+MHobfR5Xg25iYnyzWZhyQuSlDI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35/go.mod h1:QGF2Rs33W5MaN9gYdEQOBBFPLwTZkEhRwI33f7KIG0o=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 h1:v0jkRigbSD6uOdwcaUQmgEwG1BkPfAPDqaeNt/29ghg=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4/go.mod h1:LhTyt8J04LL+9cIt7pYJ5lbS/U98ZmXovLOR/4LUsk8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5 h1:A42xdtStObqy7NGvzZKpnyNXvoOmm+FENobZ0/ssHWk=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5/go.mod h1:rDGMZA7f4pbmTtPOk5v5UM2lmX6UAbRnMDJeDvnH7AM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.13.6 h1:2PylFCfKCEDv6PeSN09pC/VUiRd10wi1VfHG5FrW0/g=
-github.com/aws/aws-sdk-go-v2/service/sso v1.13.6/go.mod h1:fIAwKQKBFu90pBxx07BFOMJLpRUGu8VOzLJakeY+0K4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.6 h1:pSB560BbVj9ZlJZF4WYj5zsytWHWKxg+NgyGV4B2L58=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.6/go.mod h1:yygr8ACQRY2PrEcy3xsUI357stq2AxnFM6DIsR9lij4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.21.5 h1:CQBFElb0LS8RojMJlxRSo/HXipvTZW2S44Lt9Mk2aYQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.21.5/go.mod h1:VC7JDqsqiwXukYEDjoHh9U0fOJtNWh04FPQz4ct4GGU=
-github.com/aws/smithy-go v1.14.2 h1:MJU9hqBGbvWZdApzpvoF2WAIJDbtjK2NDJSiJP7HblQ=
-github.com/aws/smithy-go v1.14.2/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/aws-sdk-go v1.48.16 h1:mcj2/9J/MJ55Dov+ocMevhR8Jv6jW/fAxbrn4a1JFc8=
+github.com/aws/aws-sdk-go v1.48.16/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/aws/aws-sdk-go-v2 v1.24.0 h1:890+mqQ+hTpNuw0gGP6/4akolQkSToDJgHfQE7AwGuk=
+github.com/aws/aws-sdk-go-v2 v1.24.0/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 h1:OCs21ST2LrepDfD3lwlQiOqIGp6JiEUqG84GzTDoyJs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4/go.mod h1:usURWEKSNNAcAZuzRn/9ZYPT8aZQkR7xcCtunK/LkJo=
+github.com/aws/aws-sdk-go-v2/config v1.26.1 h1:z6DqMxclFGL3Zfo+4Q0rLnAZ6yVkzCRxhRMsiRQnD1o=
+github.com/aws/aws-sdk-go-v2/config v1.26.1/go.mod h1:ZB+CuKHRbb5v5F0oJtGdhFTelmrxd4iWO1lf0rQwSAg=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12 h1:v/WgB8NxprNvr5inKIiVVrXPuuTegM+K8nncFkr1usU=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12/go.mod h1:X21k0FjEJe+/pauud82HYiQbEr9jRKY3kXEIQ4hXeTQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 h1:w98BT5w+ao1/r5sUuiH6JkVzjowOKeOJRHERyy1vh58=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10/go.mod h1:K2WGI7vUvkIv1HoNbfBA1bvIZ+9kL3YVmWxeKuLQsiw=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7 h1:FnLf60PtjXp8ZOzQfhJVsqF0OtYKQZWQfqOLshh8YXg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7/go.mod h1:tDVvl8hyU6E9B8TrnNrZQEVkQlB8hjJwcgpPhgtlnNg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 h1:v+HbZaCGmOwnTTVS86Fleq0vPzOd7tnJGbFhP0stNLs=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9/go.mod h1:Xjqy+Nyj7VDLBtCMkQYOw1QYfAEZCVLrfI0ezve8wd4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 h1:N94sVhRACtXyVcjXxrwK1SKFIJrA9pOJ5yu2eSHnmls=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9/go.mod h1:hqamLz7g1/4EJP+GH5NBhcUMLjW+gKLQabgyz6/7WAU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 h1:ugD6qzjYtB7zM5PN/ZIeaAIyefPaD82G8+SJopgvUpw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9/go.mod h1:YD0aYBWCrPENpHolhKw2XDlTIWae2GKXT1T4o6N6hiM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 h1:/90OR2XbSYfXucBMJ4U14wrjlfleq/0SB6dZDPncgmo=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9/go.mod h1:dN/Of9/fNZet7UrQQ6kTDo/VSwKPIq94vjlU16bRARc=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 h1:Nf2sHxjMJR8CSImIVCONRi4g0Su3J+TSTbS7G0pUeMU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9/go.mod h1:idky4TER38YIjr2cADF1/ugFMKvZV7p//pVeV5LZbF0=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 h1:iEAeF6YC3l4FzlJPP9H3Ko1TXpdjdqWffxXjp8SY6uk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9/go.mod h1:kjsXoK23q9Z/tLBrckZLLyvjhZoS+AGrzqzUfEClvMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5 h1:Keso8lIOS+IzI2MkPZyK6G0LYcK3My2LQ+T5bxghEAY=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5/go.mod h1:vADO6Jn+Rq4nDtfwNjhgR84qkZwiC6FqCaXdw/kYwjA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 h1:ldSFWz9tEHAwHNmjx2Cvy1MjP5/L9kNoR0skc6wyOOM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5/go.mod h1:CaFfXLYL376jgbP7VKC96uFcU8Rlavak0UlAwk1Dlhc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 h1:2k9KmFawS63euAkY4/ixVNsYYwrwnd5fIvgEKkfZFNM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5/go.mod h1:W+nd4wWDVkSUIox9bacmkBP5NMFQeTJ/xqNabpzSR38=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 h1:5UYvv8JUvllZsRnfrcMQ+hJ9jNICmcgKPAO1CER25Wg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5/go.mod h1:XX5gh4CB7wAs4KhcF46G6C8a2i7eupU19dcAAE+EydU=
+github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
+github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/chzyer/logex v1.2.0/go.mod h1:9+9sk7u7pGNWYMkh0hdiL++6OeibzJccyQU4p4MedaY=
 github.com/chzyer/readline v1.5.0/go.mod h1:x22KAscuvRqlLoK9CsoYsmxoXZMMFVyOl86cAH8qUic=
 github.com/chzyer/test v0.0.0-20210722231415-061457976a23/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
@@ -74,34 +79,37 @@ github.com/dlclark/regexp2 v1.10.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cn
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dop251/goja v0.0.0-20211022113120-dc8c55024d06/go.mod h1:R9ET47fwRVRPZnOGvHxxhuZcbrMCuiqOz3Rlrh4KSnk=
-github.com/dop251/goja v0.0.0-20230531210528-d7324b2d74f7/go.mod h1:QMWlm50DNe14hD7t24KEqZuUdC9sOTy8W6XbCU1mlw4=
-github.com/dop251/goja v0.0.0-20230707174833-636fdf960de1 h1:sC/DYk3eEi5cKkpJX1vl+CpAM138dmuW7rutje9Eo4E=
-github.com/dop251/goja v0.0.0-20230707174833-636fdf960de1/go.mod h1:QMWlm50DNe14hD7t24KEqZuUdC9sOTy8W6XbCU1mlw4=
+github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d h1:wi6jN5LVt/ljaBG4ue79Ekzb12QfJ52L9Q98tl8SWhw=
+github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d/go.mod h1:QMWlm50DNe14hD7t24KEqZuUdC9sOTy8W6XbCU1mlw4=
 github.com/dop251/goja_nodejs v0.0.0-20210225215109-d91c329300e7/go.mod h1:hn7BA7c8pLvoGndExHudxTDKZ84Pyvv+90pbBjbTz0Y=
 github.com/dop251/goja_nodejs v0.0.0-20211022123610-8dd9abb0616d/go.mod h1:DngW8aVqWbuLRMHItjPUyqdj+HWPvnQe8V8y1nDpIbM=
-github.com/dop251/goja_nodejs v0.0.0-20230821135201-94e508132562 h1:ObbB2tzHWWAxzsG5futqeq2Ual2zYlo/+eMkSc5sn8w=
-github.com/dop251/goja_nodejs v0.0.0-20230821135201-94e508132562/go.mod h1:X2TOTJ+Uamd454RFp7ig2tmP3hQg0Z2Qk8gbVQmU0mk=
+github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c h1:hLoodLRD4KLWIH8eyAQCLcH8EqIrjac7fCkp/fHnvuQ=
+github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c/go.mod h1:bhGPmCgCCTSRfiMYWjpS46IDo9EUZXlsuUaPXSWGbv0=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
-github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
-github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
-github.com/ganigeorgiev/fexpr v0.3.0 h1:RwSyJBME+g/XdzlUW0paH/4VXhLHPg+rErtLeC7K8Ew=
-github.com/ganigeorgiev/fexpr v0.3.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/ganigeorgiev/fexpr v0.4.0 h1:ojitI+VMNZX/odeNL1x3RzTTE8qAIVvnSSYPNAnQFDI=
+github.com/ganigeorgiev/fexpr v0.4.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -130,22 +138,27 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-replayers/grpcreplay v1.1.0 h1:S5+I3zYyZ+GQz68OfbURDdt/+cSMqCK1wrvNx7WBzTE=
+github.com/google/go-replayers/grpcreplay v1.1.0/go.mod h1:qzAvJ8/wi57zq7gWqaE6AwLM6miiXUQwP1S+I9icmhk=
 github.com/google/go-replayers/httpreplay v1.2.0 h1:VM1wEyyjaoU53BwrOnaf9VhAyQQEEioJvFYxYcLRKzk=
+github.com/google/go-replayers/httpreplay v1.2.0/go.mod h1:WahEFFZZ7a1P4VM1qEeHy+tME4bwyqPcwWbNlUI1Mcg=
 github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
+github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20230207041349-798e818bf904/go.mod h1:uglQLonpP8qtYCYyzA+8c/9qtqgA3qsXGYqCPKARAFg=
-github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 h1:n6vlPhxsA+BW/XsS5+uqi7GyzaLa5MH7qlSLBZtRdiA=
-github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
-github.com/google/s2a-go v0.1.5 h1:8IYp3w9nysqv3JH+NJgXJzGbDHzLOTj43BmSkp+O7qg=
+github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ=
+github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
+github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.5.0 h1:I7ELFeVBr3yfPIcc8+MWvrjk+3VjbcSzoXm3JVa+jD8=
 github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
@@ -163,6 +176,7 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -174,30 +188,30 @@ github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxec
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
-github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.18 h1:JL0eqdCOq6DJVNPSvArO/bIV9/P7fbGrV00LZHc+5aI=
+github.com/mattn/go-sqlite3 v1.14.18/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.10.1 h1:cw+vsyfCJD8YObOVeqb93YErnlxwYMkNZ4rwN0G0AaA=
 github.com/pocketbase/dbx v1.10.1/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/tygoja v0.0.0-20230618203136-2f8d57768be1 h1:0FQXnhUhBeF/z6UDj9Zm8GQHFHJSUtqLr1h4/YXf3vc=
-github.com/pocketbase/tygoja v0.0.0-20230618203136-2f8d57768be1/go.mod h1:dOJ+pCyqm/jRn5kO/TX598J0e5xGDcJAZerK5atCrKI=
+github.com/pocketbase/tygoja v0.0.0-20231111102932-5420517293f4 h1:85kAYIKrKEeau7WgXg8B7Km8etrVavJAyH7XcR5MkFw=
+github.com/pocketbase/tygoja v0.0.0-20231111102932-5420517293f4/go.mod h1:dOJ+pCyqm/jRn5kO/TX598J0e5xGDcJAZerK5atCrKI=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
-github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
-github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
-github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -209,6 +223,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
@@ -216,24 +231,23 @@ github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-gocloud.dev v0.34.0 h1:LzlQY+4l2cMtuNfwT2ht4+fiXwWf/NmPTnXUlLmGif4=
-gocloud.dev v0.34.0/go.mod h1:psKOachbnvY3DAOPbsFVmLIErwsbWPUG2H5i65D38vE=
+gocloud.dev v0.35.0 h1:x/Gtt5OJdT4j+ir1AXAIXb7bBnFawXAAaJptCUGk3HU=
+gocloud.dev v0.35.0/go.mod h1:wbyF+BhfdtLWyUtVEWRW13hFLb1vXnV2ovEhYGQe3ck=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.12.0 h1:w13vZbU4o5rKOFFR8y7M+c4A5jXDC0uXTdHYRP8X2DQ=
-golang.org/x/image v0.12.0/go.mod h1:Lu90jvHG7GfemOIcldsh9A2hS01ocl6oNO7ype5mEnk=
+golang.org/x/image v0.14.0 h1:tNgSxAFe3jC4uYqvZdTr84SZoM1KfwdC9SKIFrLjFn4=
+golang.org/x/image v0.14.0/go.mod h1:HUYqC05R2ZcZ3ejNQsIHQDQiwWM4JBqmm6MKANTp4LE=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -244,21 +258,17 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
-golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -270,20 +280,13 @@ golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -291,12 +294,10 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -305,15 +306,14 @@ golang.org/x/tools v0.0.0-20190422233926-fe54fb35175b/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
+golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/api v0.138.0 h1:K/tVp05MxNVbHShRw9m7e9VJGdagNeTdMzqPH7AUqr0=
-google.golang.org/api v0.138.0/go.mod h1:4xyob8CxC+0GChNBvEUAk8VBKNvYOTWM9T3v3UfRxuY=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+google.golang.org/api v0.153.0 h1:N1AwGhielyKFaUqH07/ZSIQR3uNPcV7NVw0vj+j4iR4=
+google.golang.org/api v0.153.0/go.mod h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
@@ -322,17 +322,19 @@ google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJ
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 h1:L6iMMGrtzgHsWofoFcihmDEMYeDR9KN/ThbPWGrh++g=
-google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 h1:nIgk/EEq3/YlnmVVXVnm14rC2oxgs1o0ong4sD/rd44=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f h1:Vn+VyHU5guc9KjB5KrjI2q0wCOWEOIh0OEsleqakHJg=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f/go.mod h1:nWSwAFPb+qfNJXsoeO3Io7zf4tMSfN8EA8RlDA04GhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f/go.mod h1:Uy9bTZJqmfrw2rIBxgGLnamc78euZULUBrLZ9XTITKI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 h1:DC7wcm+i+P1rN3Ff07vL+OndGg5OhNddHyTA+ocPqYE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4/go.mod h1:eJVxU6o+4G1PSczBr85xmyvSNYAKvAYgkub40YGomFM=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -366,20 +368,24 @@ modernc.org/cc/v3 v3.41.0/go.mod h1:Ni4zjJYJ04CDOhG7dn640WGfwBzfE0ecX8TyMB0Fv0Y=
 modernc.org/ccgo/v3 v3.16.15 h1:KbDR3ZAVU+wiLyMESPtbtE/Add4elztFyfsWoNTgxS0=
 modernc.org/ccgo/v3 v3.16.15/go.mod h1:yT7B+/E2m43tmMOT51GMoM98/MtHIcQQSleGnddkUNI=
 modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
+modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
-modernc.org/libc v1.24.1 h1:uvJSeCKL/AgzBo2yYIPPTy82v21KgGnizcGYfBHaNuM=
-modernc.org/libc v1.24.1/go.mod h1:FmfO1RLrU3MHJfyi9eYYmZBfi/R+tqZ6+hQ3yQQUkak=
+modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
+modernc.org/libc v1.37.0 h1:WerjebcsP6A7Jy+f2lCnHAkiSTLf7IaSftBYUtoswak=
+modernc.org/libc v1.37.0/go.mod h1:YAXkAZ8ktnkCKaN9sw/UDeUVkGYJ/YquGO4FTi5nmHE=
 modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
 modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.7.1 h1:9J+2/GKTlV503mk3yv8QJ6oEpRCUrRy0ad8TXEPoV8M=
-modernc.org/memory v1.7.1/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
+modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
+modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.25.0 h1:AFweiwPNd/b3BoKnBOfFm+Y260guGMF+0UFk0savqeA=
-modernc.org/sqlite v1.25.0/go.mod h1:FL3pVXie73rg3Rii6V/u5BoHlSoyeZeIgKZEgHARyCU=
+modernc.org/sqlite v1.27.0 h1:MpKAHoyYB7xqcwnUwkuD+npwEa0fojF0B5QRbN+auJ8=
+modernc.org/sqlite v1.27.0/go.mod h1:Qxpazz0zH8Z1xCFyi5GSL3FzbtZ3fvbjmywNogldEW0=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
 modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
+modernc.org/tcl v1.15.2/go.mod h1:3+k/ZaEbKrC8ePv8zJWPtBSW0V7Gg9g8rkmhI1Kfs3c=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
+modernc.org/z v1.7.3/go.mod h1:Ipv4tsdxZRbQyLq9Q1M6gdbkxYzdlrciF2Hi/lS7nWE=

golangci.yml

@@ -1,5 +1,5 @@
 run:
-  go: 1.18
+  go: 1.21
   concurrency: 4
   timeout: 10m
 

migrations/1640988000_init.go

@@ -85,7 +85,7 @@ func init() {
 			);
 
 			CREATE UNIQUE INDEX _externalAuths_record_provider_idx on {{_externalAuths}} ([[collectionId]], [[recordId]], [[provider]]);
-			CREATE UNIQUE INDEX _externalAuths_provider_providerId_idx on {{_externalAuths}} ([[provider]], [[providerId]]);
+			CREATE UNIQUE INDEX _externalAuths_collection_provider_idx on {{_externalAuths}} ([[collectionId]], [[provider]], [[providerId]]);
 		`).Execute()
 		if tablesErr != nil {
 			return tablesErr
@@ -100,7 +100,7 @@ func init() {
 			return err
 		}
 
-		// inserts the system profiles collection
+		// inserts the system users collection
 		// -----------------------------------------------------------
 		usersCollection := &models.Collection{}
 		usersCollection.MarkAsNew()

migrations/1701496825_allow_single_oauth2_provider_in_multiple_auth_collections.go

@@ -0,0 +1,23 @@
+package migrations
+
+import (
+	"github.com/pocketbase/dbx"
+)
+
+// Fixes the unique _externalAuths constraint for old installations
+// to allow a single OAuth2 provider to be registered for different auth collections.
+func init() {
+	AppMigrations.Register(func(db dbx.Builder) error {
+		_, createErr := db.NewQuery("CREATE UNIQUE INDEX IF NOT EXISTS _externalAuths_collection_provider_idx on {{_externalAuths}} ([[collectionId]], [[provider]], [[providerId]])").Execute()
+		if createErr != nil {
+			return createErr
+		}
+
+		_, dropErr := db.NewQuery("DROP INDEX IF EXISTS _externalAuths_provider_providerId_idx").Execute()
+		if dropErr != nil {
+			return dropErr
+		}
+
+		return nil
+	}, nil)
+}

migrations/1702134272_set_default_json_max_size.go

@@ -0,0 +1,51 @@
+package migrations
+
+import (
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+)
+
+// Update all collections with json fields to have a default MaxSize json field option.
+func init() {
+	AppMigrations.Register(func(db dbx.Builder) error {
+		dao := daos.New(db)
+
+		// note: update even the view collections to prevent
+		// unnecessary change detections during the automigrate
+		collections := []*models.Collection{}
+		if err := dao.CollectionQuery().All(&collections); err != nil {
+			return err
+		}
+
+		for _, collection := range collections {
+			var needSave bool
+
+			for _, f := range collection.Schema.Fields() {
+				if f.Type != schema.FieldTypeJson {
+					continue
+				}
+
+				options, _ := f.Options.(*schema.JsonOptions)
+				if options != nil {
+					options = &schema.JsonOptions{}
+				}
+				options.MaxSize = 2000000 // 2mb
+				f.Options = options
+				needSave = true
+			}
+
+			if !needSave {
+				continue
+			}
+
+			// save only the collection model without updating its records table
+			if err := dao.Save(collection); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, nil)
+}

migrations/logs/1640988000_init.go

@@ -8,8 +8,8 @@ import (
 var LogsMigrations migrate.MigrationsList
 
 func init() {
-	LogsMigrations.Register(func(db dbx.Builder) (err error) {
-		_, err = db.NewQuery(`
+	LogsMigrations.Register(func(db dbx.Builder) error {
+		_, err := db.NewQuery(`
 			CREATE TABLE {{_requests}} (
 				[[id]]        TEXT PRIMARY KEY NOT NULL,
 				[[url]]       TEXT DEFAULT "" NOT NULL,

migrations/logs/1699187560_logs_generalization.go

@@ -0,0 +1,57 @@
+package logs
+
+import (
+	"github.com/pocketbase/dbx"
+)
+
+func init() {
+	LogsMigrations.Register(func(db dbx.Builder) error {
+		if _, err := db.DropTable("_requests").Execute(); err != nil {
+			return err
+		}
+
+		_, err := db.NewQuery(`
+			CREATE TABLE {{_logs}} (
+				[[id]]      TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+				[[level]]   INTEGER DEFAULT 0 NOT NULL,
+				[[message]] TEXT DEFAULT "" NOT NULL,
+				[[data]]    JSON DEFAULT "{}" NOT NULL,
+				[[created]] TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL,
+				[[updated]] TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+			);
+
+			CREATE INDEX _logs_level_idx on {{_logs}} ([[level]]);
+			CREATE INDEX _logs_message_idx on {{_logs}} ([[message]]);
+			CREATE INDEX _logs_created_hour_idx on {{_logs}} (strftime('%Y-%m-%d %H:00:00', [[created]]));
+		`).Execute()
+
+		return err
+	}, func(db dbx.Builder) error {
+		if _, err := db.DropTable("_logs").Execute(); err != nil {
+			return err
+		}
+
+		_, err := db.NewQuery(`
+			CREATE TABLE {{_requests}} (
+				[[id]]        TEXT PRIMARY KEY NOT NULL,
+				[[url]]       TEXT DEFAULT "" NOT NULL,
+				[[method]]    TEXT DEFAULT "get" NOT NULL,
+				[[status]]    INTEGER DEFAULT 200 NOT NULL,
+				[[auth]]      TEXT DEFAULT "guest" NOT NULL,
+				[[ip]]        TEXT DEFAULT "127.0.0.1" NOT NULL,
+				[[referer]]   TEXT DEFAULT "" NOT NULL,
+				[[userAgent]] TEXT DEFAULT "" NOT NULL,
+				[[meta]]      JSON DEFAULT "{}" NOT NULL,
+				[[created]]   TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL,
+				[[updated]]   TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+			);
+
+			CREATE INDEX _request_status_idx on {{_requests}} ([[status]]);
+			CREATE INDEX _request_auth_idx on {{_requests}} ([[auth]]);
+			CREATE INDEX _request_ip_idx on {{_requests}} ([[ip]]);
+			CREATE INDEX _request_created_hour_idx on {{_requests}} (strftime('%Y-%m-%d %H:00:00', [[created]]));
+		`).Execute()
+
+		return err
+	})
+}

models/collection.go

@@ -179,6 +179,7 @@ type CollectionAuthOptions struct {
 	AllowEmailAuth     bool     `form:"allowEmailAuth" json:"allowEmailAuth"`
 	RequireEmail       bool     `form:"requireEmail" json:"requireEmail"`
 	ExceptEmailDomains []string `form:"exceptEmailDomains" json:"exceptEmailDomains"`
+	OnlyVerified       bool     `form:"onlyVerified" json:"onlyVerified"`
 	OnlyEmailDomains   []string `form:"onlyEmailDomains" json:"onlyEmailDomains"`
 	MinPasswordLength  int      `form:"minPasswordLength" json:"minPasswordLength"`
 }

models/collection_test.go

@@ -89,20 +89,22 @@ func TestCollectionMarshalJSON(t *testing.T) {
 		},
 		{
 			"auth type + non empty options",
-			models.Collection{BaseModel: models.BaseModel{Id: "test"}, Type: models.CollectionTypeAuth, Options: types.JsonMap{"test": 123, "allowOAuth2Auth": true, "minPasswordLength": 4}},
-			`{"id":"test","created":"","updated":"","name":"","type":"auth","system":false,"schema":[],"indexes":[],"listRule":null,"viewRule":null,"createRule":null,"updateRule":null,"deleteRule":null,"options":{"allowEmailAuth":false,"allowOAuth2Auth":true,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"requireEmail":false}}`,
+			models.Collection{BaseModel: models.BaseModel{Id: "test"}, Type: models.CollectionTypeAuth, Options: types.JsonMap{"test": 123, "allowOAuth2Auth": true, "minPasswordLength": 4, "onlyVerified": true}},
+			`{"id":"test","created":"","updated":"","name":"","type":"auth","system":false,"schema":[],"indexes":[],"listRule":null,"viewRule":null,"createRule":null,"updateRule":null,"deleteRule":null,"options":{"allowEmailAuth":false,"allowOAuth2Auth":true,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"onlyVerified":true,"requireEmail":false}}`,
 		},
 	}
 
 	for _, s := range scenarios {
-		result, err := s.collection.MarshalJSON()
-		if err != nil {
-			t.Errorf("[%s] Unexpected error %v", s.name, err)
-			continue
-		}
-		if string(result) != s.expected {
-			t.Errorf("[%s] Expected\n%v \ngot \n%v", s.name, s.expected, string(result))
-		}
+		t.Run(s.name, func(t *testing.T) {
+			result, err := s.collection.MarshalJSON()
+			if err != nil {
+				t.Fatalf("Unexpected error %v", err)
+			}
+
+			if string(result) != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, string(result))
+			}
+		})
 	}
 }
 
@@ -135,22 +137,24 @@ func TestCollectionBaseOptions(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		result := s.collection.BaseOptions()
+		t.Run(s.name, func(t *testing.T) {
+			result := s.collection.BaseOptions()
 
-		encoded, err := json.Marshal(result)
-		if err != nil {
-			t.Fatal(err)
-		}
+			encoded, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if strEncoded := string(encoded); strEncoded != s.expected {
-			t.Errorf("[%s] Expected \n%v \ngot \n%v", s.name, s.expected, strEncoded)
-		}
+			if strEncoded := string(encoded); strEncoded != s.expected {
+				t.Fatalf("Expected \n%v \ngot \n%v", s.expected, strEncoded)
+			}
+		})
 	}
 }
 
 func TestCollectionAuthOptions(t *testing.T) {
 	options := types.JsonMap{"test": 123, "minPasswordLength": 4}
-	expectedSerialization := `{"manageRule":null,"allowOAuth2Auth":false,"allowUsernameAuth":false,"allowEmailAuth":false,"requireEmail":false,"exceptEmailDomains":null,"onlyEmailDomains":null,"minPasswordLength":4}`
+	expectedSerialization := `{"manageRule":null,"allowOAuth2Auth":false,"allowUsernameAuth":false,"allowEmailAuth":false,"requireEmail":false,"exceptEmailDomains":null,"onlyVerified":false,"onlyEmailDomains":null,"minPasswordLength":4}`
 
 	scenarios := []struct {
 		name       string
@@ -180,16 +184,18 @@ func TestCollectionAuthOptions(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		result := s.collection.AuthOptions()
+		t.Run(s.name, func(t *testing.T) {
+			result := s.collection.AuthOptions()
 
-		encoded, err := json.Marshal(result)
-		if err != nil {
-			t.Fatal(err)
-		}
+			encoded, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if strEncoded := string(encoded); strEncoded != s.expected {
-			t.Errorf("[%s] Expected \n%v \ngot \n%v", s.name, s.expected, strEncoded)
-		}
+			if strEncoded := string(encoded); strEncoded != s.expected {
+				t.Fatalf("Expected \n%v \ngot \n%v", s.expected, strEncoded)
+			}
+		})
 	}
 }
 
@@ -225,16 +231,18 @@ func TestCollectionViewOptions(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		result := s.collection.ViewOptions()
+		t.Run(s.name, func(t *testing.T) {
+			result := s.collection.ViewOptions()
 
-		encoded, err := json.Marshal(result)
-		if err != nil {
-			t.Fatal(err)
-		}
+			encoded, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if strEncoded := string(encoded); strEncoded != s.expected {
-			t.Errorf("[%s] Expected \n%v \ngot \n%v", s.name, s.expected, strEncoded)
-		}
+			if strEncoded := string(encoded); strEncoded != s.expected {
+				t.Fatalf("Expected \n%v \ngot \n%v", s.expected, strEncoded)
+			}
+		})
 	}
 }
 
@@ -257,24 +265,25 @@ func TestNormalizeOptions(t *testing.T) {
 		{
 			"auth type",
 			models.Collection{Type: models.CollectionTypeAuth, Options: types.JsonMap{"test": 123, "minPasswordLength": 4}},
-			`{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"requireEmail":false}`,
+			`{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"onlyVerified":false,"requireEmail":false}`,
 		},
 	}
 
 	for _, s := range scenarios {
-		if err := s.collection.NormalizeOptions(); err != nil {
-			t.Errorf("[%s] Unexpected error %v", s.name, err)
-			continue
-		}
+		t.Run(s.name, func(t *testing.T) {
+			if err := s.collection.NormalizeOptions(); err != nil {
+				t.Fatalf("Unexpected error %v", err)
+			}
 
-		encoded, err := json.Marshal(s.collection.Options)
-		if err != nil {
-			t.Fatal(err)
-		}
+			encoded, err := json.Marshal(s.collection.Options)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if strEncoded := string(encoded); strEncoded != s.expected {
-			t.Errorf("[%s] Expected \n%v \ngot \n%v", s.name, s.expected, strEncoded)
-		}
+			if strEncoded := string(encoded); strEncoded != s.expected {
+				t.Fatalf("Expected \n%v \ngot \n%v", s.expected, strEncoded)
+			}
+		})
 	}
 }
 
@@ -325,24 +334,25 @@ func TestSetOptions(t *testing.T) {
 			"auth type",
 			models.Collection{Type: models.CollectionTypeAuth, Options: types.JsonMap{"test": 123}},
 			map[string]any{"test": 456, "minPasswordLength": 4},
-			`{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"requireEmail":false}`,
+			`{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":4,"onlyEmailDomains":null,"onlyVerified":false,"requireEmail":false}`,
 		},
 	}
 
 	for _, s := range scenarios {
-		if err := s.collection.SetOptions(s.options); err != nil {
-			t.Errorf("[%s] Unexpected error %v", s.name, err)
-			continue
-		}
+		t.Run(s.name, func(t *testing.T) {
+			if err := s.collection.SetOptions(s.options); err != nil {
+				t.Fatalf("Unexpected error %v", err)
+			}
 
-		encoded, err := json.Marshal(s.collection.Options)
-		if err != nil {
-			t.Fatal(err)
-		}
+			encoded, err := json.Marshal(s.collection.Options)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if strEncoded := string(encoded); strEncoded != s.expected {
-			t.Errorf("[%s] Expected \n%v \ngot \n%v", s.name, s.expected, strEncoded)
-		}
+			if strEncoded := string(encoded); strEncoded != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, strEncoded)
+			}
+		})
 	}
 }
 
@@ -418,25 +428,25 @@ func TestCollectionAuthOptionsValidate(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		result := s.options.Validate()
+		t.Run(s.name, func(t *testing.T) {
+			result := s.options.Validate()
 
-		// parse errors
-		errs, ok := result.(validation.Errors)
-		if !ok && result != nil {
-			t.Errorf("[%s] Failed to parse errors %v", s.name, result)
-			continue
-		}
-
-		if len(errs) != len(s.expectedErrors) {
-			t.Errorf("[%s] Expected error keys %v, got errors \n%v", s.name, s.expectedErrors, result)
-			continue
-		}
-
-		for key := range errs {
-			if !list.ExistInSlice(key, s.expectedErrors) {
-				t.Errorf("[%s] Unexpected error key %q in \n%v", s.name, key, errs)
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
 			}
-		}
+
+			if len(errs) != len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got errors \n%v", s.expectedErrors, result)
+			}
+
+			for key := range errs {
+				if !list.ExistInSlice(key, s.expectedErrors) {
+					t.Fatalf("Unexpected error key %q in \n%v", key, errs)
+				}
+			}
+		})
 	}
 }
 
@@ -461,24 +471,24 @@ func TestCollectionViewOptionsValidate(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		result := s.options.Validate()
+		t.Run(s.name, func(t *testing.T) {
+			result := s.options.Validate()
 
-		// parse errors
-		errs, ok := result.(validation.Errors)
-		if !ok && result != nil {
-			t.Errorf("[%s] Failed to parse errors %v", s.name, result)
-			continue
-		}
-
-		if len(errs) != len(s.expectedErrors) {
-			t.Errorf("[%s] Expected error keys %v, got errors \n%v", s.name, s.expectedErrors, result)
-			continue
-		}
-
-		for key := range errs {
-			if !list.ExistInSlice(key, s.expectedErrors) {
-				t.Errorf("[%s] Unexpected error key %q in \n%v", s.name, key, errs)
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
 			}
-		}
+
+			if len(errs) != len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got errors \n%v", s.expectedErrors, result)
+			}
+
+			for key := range errs {
+				if !list.ExistInSlice(key, s.expectedErrors) {
+					t.Fatalf("Unexpected error key %q in \n%v", key, errs)
+				}
+			}
+		})
 	}
 }

models/log.go

@@ -0,0 +1,19 @@
+package models
+
+import (
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+var _ Model = (*Log)(nil)
+
+type Log struct {
+	BaseModel
+
+	Data    types.JsonMap `db:"data" json:"data"`
+	Message string        `db:"message" json:"message"`
+	Level   int           `db:"level" json:"level"`
+}
+
+func (m *Log) TableName() string {
+	return "_logs"
+}

models/request.go

@@ -8,7 +8,7 @@ var _ Model = (*Request)(nil)
 const (
 	RequestAuthGuest  = "guest"
 	RequestAuthAdmin  = "admin"
-	RequestAuthRecord = "auth_record"
+	RequestAuthRecord = "authRecord"
 )
 
 type Request struct {

models/request_info.go

@@ -9,12 +9,12 @@ import (
 // RequestInfo defines a HTTP request data struct, usually used
 // as part of the `@request.*` filter resolver.
 type RequestInfo struct {
-	Method     string         `json:"method"`
 	Query      map[string]any `json:"query"`
 	Data       map[string]any `json:"data"`
 	Headers    map[string]any `json:"headers"`
 	AuthRecord *Record        `json:"authRecord"`
 	Admin      *Admin         `json:"admin"`
+	Method     string         `json:"method"`
 }
 
 // HasModifierDataKeys loosely checks if the current struct has any modifier Data keys.

models/schema/schema_field.go

@@ -310,6 +310,7 @@ func (f *SchemaField) PrepareValue(value any) any {
 			} else if str == "null" || str == "true" || str == "false" {
 				val = str
 			} else if ((str[0] >= '0' && str[0] <= '9') ||
+				str[0] == '-' ||
 				str[0] == '"' ||
 				str[0] == '[' ||
 				str[0] == '{') &&
@@ -611,10 +612,13 @@ func (o SelectOptions) IsMultiple() bool {
 // -------------------------------------------------------------------
 
 type JsonOptions struct {
+	MaxSize int `form:"maxSize" json:"maxSize"`
 }
 
 func (o JsonOptions) Validate() error {
-	return nil
+	return validation.ValidateStruct(&o,
+		validation.Field(&o.MaxSize, validation.Required, validation.Min(1)),
+	)
 }
 
 // -------------------------------------------------------------------
@@ -622,10 +626,10 @@ func (o JsonOptions) Validate() error {
 var _ MultiValuer = (*FileOptions)(nil)
 
 type FileOptions struct {
-	MaxSelect int      `form:"maxSelect" json:"maxSelect"`
-	MaxSize   int      `form:"maxSize" json:"maxSize"` // in bytes
 	MimeTypes []string `form:"mimeTypes" json:"mimeTypes"`
 	Thumbs    []string `form:"thumbs" json:"thumbs"`
+	MaxSelect int      `form:"maxSelect" json:"maxSelect"`
+	MaxSize   int      `form:"maxSize" json:"maxSize"`
 	Protected bool     `form:"protected" json:"protected"`
 }
 

models/schema/schema_field_test.go

@@ -520,12 +520,12 @@ func TestSchemaFieldInitOptions(t *testing.T) {
 		{
 			schema.SchemaField{Type: schema.FieldTypeJson},
 			false,
-			`{"system":false,"id":"","name":"","type":"json","required":false,"presentable":false,"unique":false,"options":{}}`,
+			`{"system":false,"id":"","name":"","type":"json","required":false,"presentable":false,"unique":false,"options":{"maxSize":0}}`,
 		},
 		{
 			schema.SchemaField{Type: schema.FieldTypeFile},
 			false,
-			`{"system":false,"id":"","name":"","type":"file","required":false,"presentable":false,"unique":false,"options":{"maxSelect":0,"maxSize":0,"mimeTypes":null,"thumbs":null,"protected":false}}`,
+			`{"system":false,"id":"","name":"","type":"file","required":false,"presentable":false,"unique":false,"options":{"mimeTypes":null,"thumbs":null,"maxSelect":0,"maxSize":0,"protected":false}}`,
 		},
 		{
 			schema.SchemaField{Type: schema.FieldTypeRelation},
@@ -548,16 +548,18 @@ func TestSchemaFieldInitOptions(t *testing.T) {
 	}
 
 	for i, s := range scenarios {
-		err := s.field.InitOptions()
+		t.Run(fmt.Sprintf("s%d_%s", i, s.field.Type), func(t *testing.T) {
+			err := s.field.InitOptions()
 
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected %v, got %v (%v)", i, s.expectError, hasErr, err)
-		}
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected %v, got %v (%v)", s.expectError, hasErr, err)
+			}
 
-		if s.field.String() != s.expectJson {
-			t.Errorf("(%d), Expected %v, got %v", i, s.expectJson, s.field.String())
-		}
+			if s.field.String() != s.expectJson {
+				t.Fatalf(" Expected\n%v\ngot\n%v", s.expectJson, s.field.String())
+			}
+		})
 	}
 }
 
@@ -603,10 +605,15 @@ func TestSchemaFieldPrepareValue(t *testing.T) {
 		{schema.SchemaField{Type: schema.FieldTypeJson}, nil, "null"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, "null", "null"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, 123, "123"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, -123, "-123"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, "123", "123"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "-123", "-123"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, 123.456, "123.456"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, -123.456, "-123.456"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, "123.456", "123.456"},
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "-123.456", "-123.456"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, "123.456 abc", `"123.456 abc"`}, // invalid numeric string
+		{schema.SchemaField{Type: schema.FieldTypeJson}, "-a123", `"-a123"`},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, true, "true"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, "true", "true"},
 		{schema.SchemaField{Type: schema.FieldTypeJson}, false, "false"},
@@ -2053,6 +2060,16 @@ func TestJsonOptionsValidate(t *testing.T) {
 		{
 			"empty",
 			schema.JsonOptions{},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSize < 0",
+			schema.JsonOptions{MaxSize: -1},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSize > 0",
+			schema.JsonOptions{MaxSize: 1},
 			[]string{},
 		},
 	}

models/settings/settings.go

@@ -63,6 +63,8 @@ type Settings struct {
 	InstagramAuth AuthProviderConfig `form:"instagramAuth" json:"instagramAuth"`
 	VKAuth        AuthProviderConfig `form:"vkAuth" json:"vkAuth"`
 	YandexAuth    AuthProviderConfig `form:"yandexAuth" json:"yandexAuth"`
+	PatreonAuth   AuthProviderConfig `form:"patreonAuth" json:"patreonAuth"`
+	MailcowAuth   AuthProviderConfig `form:"mailcowAuth" json:"mailcowAuth"`
 }
 
 // New creates and returns a new default Settings instance.
@@ -80,6 +82,7 @@ func New() *Settings {
 		},
 		Logs: LogsConfig{
 			MaxDays: 5,
+			LogIp:   true,
 		},
 		Smtp: SmtpConfig{
 			Enabled:  false,
@@ -187,6 +190,12 @@ func New() *Settings {
 		YandexAuth: AuthProviderConfig{
 			Enabled: false,
 		},
+		PatreonAuth: AuthProviderConfig{
+			Enabled: false,
+		},
+		MailcowAuth: AuthProviderConfig{
+			Enabled: false,
+		},
 	}
 }
 
@@ -230,6 +239,8 @@ func (s *Settings) Validate() error {
 		validation.Field(&s.InstagramAuth),
 		validation.Field(&s.VKAuth),
 		validation.Field(&s.YandexAuth),
+		validation.Field(&s.PatreonAuth),
+		validation.Field(&s.MailcowAuth),
 	)
 }
 
@@ -296,6 +307,8 @@ func (s *Settings) RedactClone() (*Settings, error) {
 		&clone.InstagramAuth.ClientSecret,
 		&clone.VKAuth.ClientSecret,
 		&clone.YandexAuth.ClientSecret,
+		&clone.PatreonAuth.ClientSecret,
+		&clone.MailcowAuth.ClientSecret,
 	}
 
 	// mask all sensitive fields
@@ -336,6 +349,8 @@ func (s *Settings) NamedAuthProviderConfigs() map[string]AuthProviderConfig {
 		auth.NameInstagram:  s.InstagramAuth,
 		auth.NameVK:         s.VKAuth,
 		auth.NameYandex:     s.YandexAuth,
+		auth.NamePatreon:    s.PatreonAuth,
+		auth.NameMailcow:    s.MailcowAuth,
 	}
 }
 
@@ -584,7 +599,9 @@ func (t EmailTemplate) Resolve(
 // -------------------------------------------------------------------
 
 type LogsConfig struct {
-	MaxDays int `form:"maxDays" json:"maxDays"`
+	MaxDays  int  `form:"maxDays" json:"maxDays"`
+	MinLevel int  `form:"minLevel" json:"minLevel"`
+	LogIp    bool `form:"logIp" json:"logIp"`
 }
 
 // Validate makes LogsConfig validatable by implementing [validation.Validatable] interface.
@@ -603,6 +620,8 @@ type AuthProviderConfig struct {
 	AuthUrl      string `form:"authUrl" json:"authUrl"`
 	TokenUrl     string `form:"tokenUrl" json:"tokenUrl"`
 	UserApiUrl   string `form:"userApiUrl" json:"userApiUrl"`
+	DisplayName  string `form:"displayName" json:"displayName"`
+	PKCE         *bool  `form:"pkce" json:"pkce"`
 }
 
 // Validate makes `ProviderConfig` validatable by implementing [validation.Validatable] interface.
@@ -642,6 +661,14 @@ func (c AuthProviderConfig) SetupProvider(provider auth.Provider) error {
 		provider.SetTokenUrl(c.TokenUrl)
 	}
 
+	if c.DisplayName != "" {
+		provider.SetDisplayName(c.DisplayName)
+	}
+
+	if c.PKCE != nil {
+		provider.SetPKCE(*c.PKCE)
+	}
+
 	return nil
 }
 

models/settings/settings_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestSettingsValidate(t *testing.T) {
@@ -73,6 +74,10 @@ func TestSettingsValidate(t *testing.T) {
 	s.VKAuth.ClientId = ""
 	s.YandexAuth.Enabled = true
 	s.YandexAuth.ClientId = ""
+	s.PatreonAuth.Enabled = true
+	s.PatreonAuth.ClientId = ""
+	s.MailcowAuth.Enabled = true
+	s.MailcowAuth.ClientId = ""
 
 	// check if Validate() is triggering the members validate methods.
 	err := s.Validate()
@@ -114,6 +119,8 @@ func TestSettingsValidate(t *testing.T) {
 		`"instagramAuth":{`,
 		`"vkAuth":{`,
 		`"yandexAuth":{`,
+		`"patreonAuth":{`,
+		`"mailcowAuth":{`,
 	}
 
 	errBytes, _ := json.Marshal(err)
@@ -187,6 +194,10 @@ func TestSettingsMerge(t *testing.T) {
 	s2.VKAuth.ClientId = "vk_test"
 	s2.YandexAuth.Enabled = true
 	s2.YandexAuth.ClientId = "yandex_test"
+	s2.PatreonAuth.Enabled = true
+	s2.PatreonAuth.ClientId = "patreon_test"
+	s2.MailcowAuth.Enabled = true
+	s2.MailcowAuth.ClientId = "mailcow_test"
 
 	if err := s1.Merge(s2); err != nil {
 		t.Fatal(err)
@@ -277,6 +288,8 @@ func TestSettingsRedactClone(t *testing.T) {
 	s1.InstagramAuth.ClientSecret = testSecret
 	s1.VKAuth.ClientSecret = testSecret
 	s1.YandexAuth.ClientSecret = testSecret
+	s1.PatreonAuth.ClientSecret = testSecret
+	s1.MailcowAuth.ClientSecret = testSecret
 
 	s1Bytes, err := json.Marshal(s1)
 	if err != nil {
@@ -335,6 +348,8 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 	s.InstagramAuth.ClientId = "instagram_test"
 	s.VKAuth.ClientId = "vk_test"
 	s.YandexAuth.ClientId = "yandex_test"
+	s.PatreonAuth.ClientId = "patreon_test"
+	s.MailcowAuth.ClientId = "mailcow_test"
 
 	result := s.NamedAuthProviderConfigs()
 
@@ -366,6 +381,8 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 		`"instagram":{"enabled":false,"clientId":"instagram_test"`,
 		`"vk":{"enabled":false,"clientId":"vk_test"`,
 		`"yandex":{"enabled":false,"clientId":"yandex_test"`,
+		`"patreon":{"enabled":false,"clientId":"patreon_test"`,
+		`"mailcow":{"enabled":false,"clientId":"mailcow_test"`,
 	}
 	for _, p := range expectedParts {
 		if !strings.Contains(encodedStr, p) {
@@ -925,6 +942,8 @@ func TestAuthProviderConfigValidate(t *testing.T) {
 				Enabled:      true,
 				ClientId:     "test",
 				ClientSecret: "test",
+				DisplayName:  "test",
+				PKCE:         types.Pointer(true),
 				AuthUrl:      "https://example.com",
 				TokenUrl:     "https://example.com",
 				UserApiUrl:   "https://example.com",
@@ -962,6 +981,8 @@ func TestAuthProviderConfigSetupProvider(t *testing.T) {
 		AuthUrl:      "test_AuthUrl",
 		UserApiUrl:   "test_UserApiUrl",
 		TokenUrl:     "test_TokenUrl",
+		DisplayName:  "test_DisplayName",
+		PKCE:         types.Pointer(true),
 	}
 	if err := c2.SetupProvider(provider); err != nil {
 		t.Error(err)
@@ -986,4 +1007,12 @@ func TestAuthProviderConfigSetupProvider(t *testing.T) {
 	if provider.TokenUrl() != c2.TokenUrl {
 		t.Fatalf("Expected TokenUrl %s, got %s", c2.TokenUrl, provider.TokenUrl())
 	}
+
+	if provider.DisplayName() != c2.DisplayName {
+		t.Fatalf("Expected DisplayName %s, got %s", c2.DisplayName, provider.DisplayName())
+	}
+
+	if provider.PKCE() != *c2.PKCE {
+		t.Fatalf("Expected PKCE %v, got %v", *c2.PKCE, provider.PKCE())
+	}
 }

plugins/ghupdate/ghupdate.go

@@ -12,7 +12,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
+	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -105,12 +105,9 @@ func (p *plugin) updateCmd() *cobra.Command {
 	var withBackup bool
 
 	command := &cobra.Command{
-		Use:   "update",
-		Short: "Automatically updates the current PocketBase executable with the latest available version",
-		// @todo remove after logs generalization
-		// prevents printing the error log twice
-		SilenceErrors: true,
-		SilenceUsage:  true,
+		Use:          "update",
+		Short:        "Automatically updates the current PocketBase executable with the latest available version",
+		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			var needConfirm bool
 			if isMaybeRunningInDocker() {
@@ -221,8 +218,13 @@ func (p *plugin) update(withBackup bool) error {
 	}
 
 	tryToRevertExecChanges := func() {
-		if revertErr := os.Rename(renamedOldExec, oldExec); revertErr != nil && p.app.IsDebug() {
-			log.Println(revertErr)
+		if revertErr := os.Rename(renamedOldExec, oldExec); revertErr != nil {
+			p.app.Logger().Debug(
+				"Failed to revert executable",
+				slog.String("old", renamedOldExec),
+				slog.String("new", oldExec),
+				slog.String("error", revertErr.Error()),
+			)
 		}
 	}
 
@@ -245,6 +247,16 @@ func (p *plugin) update(withBackup bool) error {
 	color.HiBlack("---")
 	color.Green("Update completed successfully! You can start the executable as usual.")
 
+	// print the release notes
+	if latest.Body != "" {
+		fmt.Print("\n")
+		color.Cyan("Here is a list with some of the %s changes:", latest.Tag)
+		// remove the update command note to avoid "stuttering"
+		releaseNotes := strings.TrimSpace(strings.Replace(latest.Body, "> _To update the prebuilt executable you can run `./pocketbase update`._", "", 1))
+		color.Cyan(releaseNotes)
+		fmt.Print("\n")
+	}
+
 	return nil
 }
 

plugins/ghupdate/release.go

@@ -6,19 +6,20 @@ import (
 )
 
 type releaseAsset struct {
-	Id          int    `json:"id"`
 	Name        string `json:"name"`
-	Size        int    `json:"size"`
 	DownloadUrl string `json:"browser_download_url"`
+	Id          int    `json:"id"`
+	Size        int    `json:"size"`
 }
 
 type release struct {
-	Id        int             `json:"id"`
 	Name      string          `json:"name"`
 	Tag       string          `json:"tag_name"`
 	Published string          `json:"published_at"`
 	Url       string          `json:"html_url"`
+	Body      string          `json:"body"`
 	Assets    []*releaseAsset `json:"assets"`
+	Id        int             `json:"id"`
 }
 
 // findAssetBySuffix returns the first available asset containing the specified suffix.

plugins/jsvm/binds.go

@@ -5,8 +5,8 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/exec"
@@ -33,7 +33,9 @@ import (
 	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cobra"
 )
@@ -118,8 +120,12 @@ func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 				return err
 			})
 
-			if err != nil && app.IsDebug() {
-				fmt.Println("[cronAdd] failed to execute cron job " + jobId + ": " + err.Error())
+			if err != nil {
+				app.Logger().Debug(
+					"[cronAdd] failed to execute cron job",
+					slog.String("jobId", jobId),
+					slog.String("error", err.Error()),
+				)
 			}
 		})
 		if err != nil {
@@ -278,6 +284,21 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]echo.M
 func baseBinds(vm *goja.Runtime) {
 	vm.SetFieldNameMapper(FieldMapper{})
 
+	vm.Set("readerToString", func(r io.Reader, maxBytes int) (string, error) {
+		if maxBytes == 0 {
+			maxBytes = rest.DefaultMaxMemory
+		}
+
+		limitReader := io.LimitReader(r, int64(maxBytes))
+
+		bodyBytes, readErr := io.ReadAll(limitReader)
+		if readErr != nil {
+			return "", readErr
+		}
+
+		return string(bodyBytes), nil
+	})
+
 	vm.Set("arrayOf", func(model any) any {
 		mt := reflect.TypeOf(model)
 		st := reflect.SliceOf(mt)
@@ -396,6 +417,16 @@ func baseBinds(vm *goja.Runtime) {
 
 		return instanceValue
 	})
+
+	vm.Set("Cookie", func(call goja.ConstructorCall) *goja.Object {
+		instance := &http.Cookie{}
+		return structConstructor(vm, call, instance)
+	})
+
+	vm.Set("SubscriptionMessage", func(call goja.ConstructorCall) *goja.Object {
+		instance := &subscriptions.Message{}
+		return structConstructor(vm, call, instance)
+	})
 }
 
 func dbxBinds(vm *goja.Runtime) {
@@ -470,8 +501,12 @@ func securityBinds(vm *goja.Runtime) {
 	obj.Set("pseudorandomStringWithAlphabet", security.PseudorandomStringWithAlphabet)
 
 	// jwt
-	obj.Set("parseUnverifiedJWT", security.ParseUnverifiedJWT)
-	obj.Set("parseJWT", security.ParseJWT)
+	obj.Set("parseUnverifiedJWT", func(token string) (map[string]any, error) {
+		return security.ParseUnverifiedJWT(token)
+	})
+	obj.Set("parseJWT", func(token string, verificationKey string) (map[string]any, error) {
+		return security.ParseJWT(token, verificationKey)
+	})
 	obj.Set("createJWT", security.NewJWT)
 
 	// encryption
@@ -522,7 +557,8 @@ func osBinds(vm *goja.Runtime) {
 	vm.Set("$os", obj)
 
 	obj.Set("args", os.Args)
-	obj.Set("exec", exec.Command)
+	obj.Set("exec", exec.Command) // @deprecated
+	obj.Set("cmd", exec.Command)
 	obj.Set("exit", os.Exit)
 	obj.Set("getenv", os.Getenv)
 	obj.Set("dirFS", os.DirFS)
@@ -571,6 +607,7 @@ func apisBinds(vm *goja.Runtime) {
 	})
 
 	// middlewares
+	obj.Set("requireGuestOnly", apis.RequireGuestOnly)
 	obj.Set("requireRecordAuth", apis.RequireRecordAuth)
 	obj.Set("requireAdminAuth", apis.RequireAdminAuth)
 	obj.Set("requireAdminAuthOnlyIfAny", apis.RequireAdminAuthOnlyIfAny)
@@ -597,9 +634,11 @@ func httpClientBinds(vm *goja.Runtime) {
 	vm.Set("$http", obj)
 
 	type sendResult struct {
-		StatusCode int
-		Raw        string
-		Json       any
+		StatusCode int                     `json:"statusCode"`
+		Headers    map[string][]string     `json:"headers"`
+		Cookies    map[string]*http.Cookie `json:"cookies"`
+		Raw        string                  `json:"raw"`
+		Json       any                     `json:"json"`
 	}
 
 	type sendConfig struct {
@@ -670,9 +709,19 @@ func httpClientBinds(vm *goja.Runtime) {
 
 		result := &sendResult{
 			StatusCode: res.StatusCode,
+			Headers:    map[string][]string{},
+			Cookies:    map[string]*http.Cookie{},
 			Raw:        string(bodyRaw),
 		}
 
+		for k, v := range res.Header {
+			result.Headers[k] = v
+		}
+
+		for _, v := range res.Cookies() {
+			result.Cookies[v.Name] = v
+		}
+
 		if len(result.Raw) != 0 {
 			// try as map
 			result.Json = map[string]any{}

plugins/jsvm/binds_test.go

@@ -46,7 +46,90 @@ func TestBaseBindsCount(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 
-	testBindsCount(vm, "this", 13, t)
+	testBindsCount(vm, "this", 16, t)
+}
+
+func TestBaseBindsReaderToString(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("reader", strings.NewReader("test"))
+
+	_, err := vm.RunString(`
+		let result = readerToString(reader)
+
+		if (result != "test") {
+			throw new Error('Expected "test", got ' + result);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsCookie(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const cookie = new Cookie({
+			name:     "example_name",
+			value:    "example_value",
+			path:     "/example_path",
+			domain:   "example.com",
+			maxAge:   10,
+			secure:   true,
+			httpOnly: true,
+			sameSite: 3,
+		});
+
+		const result = cookie.string();
+
+		const expected = "example_name=example_value; Path=/example_path; Domain=example.com; Max-Age=10; HttpOnly; Secure; SameSite=Strict";
+
+		if (expected != result) {
+			throw new("Expected \n" + expected + "\ngot\n" + result);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsSubscriptionMessage(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("bytesToString", func(b []byte) string {
+		return string(b)
+	})
+
+	_, err := vm.RunString(`
+		const payload = {
+			name: "test",
+			data: '{"test":123}'
+		}
+
+		const result = new SubscriptionMessage(payload);
+
+		if (result.name != payload.name) {
+			throw new("Expected name " + payload.name + ", got " + result.name);
+		}
+
+		if (bytesToString(result.data) != payload.data) {
+			throw new("Expected data '" + payload.data + "', got '" + bytesToString(result.data) + "'");
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
 }
 
 func TestBaseBindsRecord(t *testing.T) {
@@ -701,40 +784,58 @@ func TestSecurityJWTBinds(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	vm := goja.New()
-	baseBinds(vm)
-	securityBinds(vm)
-
 	sceneraios := []struct {
-		js       string
-		expected string
+		name string
+		js   string
 	}{
 		{
-			`$security.parseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY")`,
-			`{"name":"John Doe","sub":"1234567890"}`,
+			"$security.parseUnverifiedJWT",
+			`
+				const result = $security.parseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY")
+				if (result.name != "John Doe") {
+					throw new Error("Expected result.name 'John Doe', got " + result.name)
+				}
+				if (result.sub != "1234567890") {
+					throw new Error("Expected result.sub '1234567890', got " + result.sub)
+				}
+			`,
 		},
 		{
-			`$security.parseJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY", "test")`,
-			`{"name":"John Doe","sub":"1234567890"}`,
+			"$security.parseJWT",
+			`
+				const result = $security.parseJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY", "test")
+				if (result.name != "John Doe") {
+					throw new Error("Expected result.name 'John Doe', got " + result.name)
+				}
+				if (result.sub != "1234567890") {
+					throw new Error("Expected result.sub '1234567890', got " + result.sub)
+				}
+			`,
 		},
 		{
-			`$security.createJWT({"exp": 123}, "test", 0)`, // overwrite the exp claim for static token
-			`"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjEyM30.7gbv7w672gApdBRASI6OniCtKwkKjhieSxsr6vxSrtw"`,
+			"$security.createJWT",
+			`
+				// overwrite the exp claim for static token
+				const result = $security.createJWT({"exp": 123}, "test", 0)
+
+				const expected = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjEyM30.7gbv7w672gApdBRASI6OniCtKwkKjhieSxsr6vxSrtw";
+				if (result != expected) {
+					throw new Error("Expected token \n" + expected + ", got \n" + result)
+				}
+			`,
 		},
 	}
 
 	for _, s := range sceneraios {
-		t.Run(s.js, func(t *testing.T) {
-			result, err := vm.RunString(s.js)
+		t.Run(s.name, func(t *testing.T) {
+			vm := goja.New()
+			baseBinds(vm)
+			securityBinds(vm)
+
+			_, err := vm.RunString(s.js)
 			if err != nil {
 				t.Fatalf("Failed to execute js script, got %v", err)
 			}
-
-			raw, _ := json.Marshal(result.Export())
-
-			if string(raw) != s.expected {
-				t.Fatalf("Expected \n%s, \ngot \n%s", s.expected, raw)
-			}
 		})
 	}
 }
@@ -833,7 +934,7 @@ func TestApisBindsCount(t *testing.T) {
 	apisBinds(vm)
 
 	testBindsCount(vm, "this", 6, t)
-	testBindsCount(vm, "$apis", 11, t)
+	testBindsCount(vm, "$apis", 12, t)
 }
 
 func TestApisBindsApiError(t *testing.T) {
@@ -1003,9 +1104,9 @@ func TestHttpClientBindsCount(t *testing.T) {
 
 func TestHttpClientBindsSend(t *testing.T) {
 	// start a test server
-	server := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
 		if req.URL.Query().Get("testError") != "" {
-			rw.WriteHeader(400)
+			res.WriteHeader(400)
 			return
 		}
 
@@ -1032,10 +1133,14 @@ func TestHttpClientBindsSend(t *testing.T) {
 			"body":    string(bodyRaw),
 		}
 
+		// add custom headers and cookies
+		res.Header().Add("X-Custom", "custom_header")
+		res.Header().Add("Set-Cookie", "sessionId=123456")
+
 		infoRaw, _ := json.Marshal(info)
 
 		// write back the submitted request
-		rw.Write(infoRaw)
+		res.Write(infoRaw)
 	}))
 	defer server.Close()
 
@@ -1102,6 +1207,8 @@ func TestHttpClientBindsSend(t *testing.T) {
 			}],
 			[test1, {
 				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
 				"json.method":               "POST",
 				"json.headers.header1":      "123",
 				"json.headers.header2":      "456",
@@ -1110,6 +1217,8 @@ func TestHttpClientBindsSend(t *testing.T) {
 			}],
 			[test2, {
 				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
 				"json.method":               "GET",
 				"json.headers.content_type": "text/plain",
 			}],
@@ -1344,5 +1453,5 @@ func TestOsBindsCount(t *testing.T) {
 	vm := goja.New()
 	osBinds(vm)
 
-	testBindsCount(vm, "$os", 16, t)
+	testBindsCount(vm, "$os", 17, t)
 }

plugins/jsvm/internal/types/types.go

@@ -1,12 +1,14 @@
 package main
 
 import (
+	"fmt"
 	"log"
 	"os"
 	"path/filepath"
 	"reflect"
 	"runtime"
 	"strings"
+	"time"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/plugins/jsvm"
@@ -144,8 +146,19 @@ declare function routerPre(...middlewares: Array<string|echo.MiddlewareFunc>): v
  */
 declare var __hooks: string
 
-// skip on* hook methods as they are registered via the global on* method
-type appWithoutHooks = Omit<pocketbase.PocketBase, ` + "`on${string}`" + `>
+// Utility type to exclude the on* hook methods from a type
+// (hooks are separately generated as global methods).
+//
+// See https://www.typescriptlang.org/docs/handbook/2/mapped-types.html#key-remapping-via-as
+type excludeHooks<Type> = {
+    [Property in keyof Type as Exclude<Property, ` + "`on${string}`" + `>]: Type[Property]
+};
+
+// core.App without the on* hook methods
+type CoreApp = excludeHooks<ORIGINAL_CORE_APP>
+
+// pocketbase.PocketBase without the on* hook methods
+type PocketBase = excludeHooks<ORIGINAL_POCKETBASE>
 
 /**
  * ` + "`$app`" + ` is the current running PocketBase instance that is globally
@@ -156,7 +169,7 @@ type appWithoutHooks = Omit<pocketbase.PocketBase, ` + "`on${string}`" + `>
  * @namespace
  * @group PocketBase
  */
-declare var $app: appWithoutHooks
+declare var $app: PocketBase
 
 /**
  * ` + "`$template`" + ` is a global helper to load and cache HTML templates on the fly.
@@ -180,6 +193,24 @@ declare var $app: appWithoutHooks
  */
 declare var $template: template.Registry
 
+/**
+ * readerToString reads the content of the specified io.Reader until
+ * EOF or maxBytes are reached.
+ *
+ * If maxBytes is not specified it will read up to 32MB.
+ *
+ * Note that after this call the reader can't be used anymore.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const rawBody = readerToString(c.request().body)
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function readerToString(reader: any, maxBytes?: number): string;
+
 /**
  * arrayOf creates a placeholder array of the specified models.
  * Usually used to populate DB result into an array of models.
@@ -400,7 +431,7 @@ declare class DateTime implements types.DateTime {
 interface ValidationError extends ozzo_validation.Error{} // merge
 /**
  * ValidationError defines a single formatted data validation error,
- * usually used as part of a error response.
+ * usually used as part of an error response.
  *
  * ` + "```" + `js
  * new ValidationError("invalid_title", "Title is not valid")
@@ -421,6 +452,57 @@ declare class Dao implements daos.Dao {
   constructor(concurrentDB?: dbx.Builder, nonconcurrentDB?: dbx.Builder)
 }
 
+interface Cookie extends http.Cookie{} // merge
+/**
+ * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+ * HTTP response.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * routerAdd("POST", "/example", (c) => {
+ *     c.setCookie(new Cookie({
+ *         name:     "example_name",
+ *         value:    "example_value",
+ *         path:     "/",
+ *         domain:   "example.com",
+ *         maxAge:   10,
+ *         secure:   true,
+ *         httpOnly: true,
+ *         sameSite: 3,
+ *     }))
+ *
+ *     return c.redirect(200, "/");
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Cookie implements http.Cookie {
+  constructor(options?: Partial<http.Cookie>)
+}
+
+interface SubscriptionMessage extends subscriptions.Message{} // merge
+/**
+ * SubscriptionMessage defines a realtime subscription payload.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * onRealtimeConnectRequest((e) => {
+ *     e.client.send(new SubscriptionMessage({
+ *         name: "example",
+ *         data: '{"greeting": "Hello world"}'
+ *     }))
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class SubscriptionMessage implements subscriptions.Message {
+  constructor(options?: Partial<subscriptions.Message>)
+}
+
 // -------------------------------------------------------------------
 // dbxBinds
 // -------------------------------------------------------------------
@@ -478,6 +560,23 @@ declare namespace $tokens {
   let recordFileToken:          tokens.newRecordFileToken
 }
 
+// -------------------------------------------------------------------
+// mailsBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`" + `$mails` + "`" + ` defines helpers to send common
+ * admins and auth records emails like verification, password reset, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $mails {
+  let sendAdminPasswordReset:  mails.sendAdminPasswordReset
+  let sendRecordPasswordReset: mails.sendRecordPasswordReset
+  let sendRecordVerification:  mails.sendRecordVerification
+  let sendRecordChangeEmail:   mails.sendRecordChangeEmail
+}
+
 // -------------------------------------------------------------------
 // securityBinds
 // -------------------------------------------------------------------
@@ -493,9 +592,6 @@ declare namespace $security {
   let randomStringWithAlphabet:       security.randomStringWithAlphabet
   let pseudorandomString:             security.pseudorandomString
   let pseudorandomStringWithAlphabet: security.pseudorandomStringWithAlphabet
-  let parseUnverifiedJWT:             security.parseUnverifiedJWT
-  let parseJWT:                       security.parseJWT
-  let createJWT:                      security.newJWT
   let encrypt:                        security.encrypt
   let decrypt:                        security.decrypt
   let hs256:                          security.hs256
@@ -504,6 +600,17 @@ declare namespace $security {
   let md5:                            security.md5
   let sha256:                         security.sha256
   let sha512:                         security.sha512
+  let createJWT:                      security.newJWT
+
+  /**
+   * {@inheritDoc security.parseUnverifiedJWT}
+   */
+  export function parseUnverifiedJWT(token: string): _TygojaDict
+
+  /**
+   * {@inheritDoc security.parseJWT}
+   */
+  export function parseJWT(token: string, verificationKey: string): _TygojaDict
 }
 
 // -------------------------------------------------------------------
@@ -561,7 +668,26 @@ declare namespace $filepath {
  * @group PocketBase
  */
 declare namespace $os {
-  export let exec:      exec.command
+  /**
+   * Legacy alias for $os.cmd().
+   */
+  export let exec: exec.command
+
+  /**
+   * Prepares an external OS command.
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * // prepare the command to execute
+   * const cmd = $os.cmd('ls', '-sl')
+   *
+   * // execute the command and return its standard output as string
+   * const output = String.fromCharCode(...cmd.output());
+   * ` + "```" + `
+   */
+  export let cmd: exec.command
+
   export let args:      os.args
   export let exit:      os.exit
   export let getenv:    os.getenv
@@ -589,7 +715,7 @@ interface AdminLoginForm extends forms.AdminLogin{} // merge
  * @group PocketBase
  */
 declare class AdminLoginForm implements forms.AdminLogin {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface AdminPasswordResetConfirmForm extends forms.AdminPasswordResetConfirm{} // merge
@@ -598,7 +724,7 @@ interface AdminPasswordResetConfirmForm extends forms.AdminPasswordResetConfirm{
  * @group PocketBase
  */
 declare class AdminPasswordResetConfirmForm implements forms.AdminPasswordResetConfirm {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface AdminPasswordResetRequestForm extends forms.AdminPasswordResetRequest{} // merge
@@ -607,7 +733,7 @@ interface AdminPasswordResetRequestForm extends forms.AdminPasswordResetRequest{
  * @group PocketBase
  */
 declare class AdminPasswordResetRequestForm implements forms.AdminPasswordResetRequest {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface AdminUpsertForm extends forms.AdminUpsert{} // merge
@@ -616,7 +742,7 @@ interface AdminUpsertForm extends forms.AdminUpsert{} // merge
  * @group PocketBase
  */
 declare class AdminUpsertForm implements forms.AdminUpsert {
-  constructor(app: core.App, admin: models.Admin)
+  constructor(app: CoreApp, admin: models.Admin)
 }
 
 interface AppleClientSecretCreateForm extends forms.AppleClientSecretCreate{} // merge
@@ -625,7 +751,7 @@ interface AppleClientSecretCreateForm extends forms.AppleClientSecretCreate{} //
  * @group PocketBase
  */
 declare class AppleClientSecretCreateForm implements forms.AppleClientSecretCreate {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface CollectionUpsertForm extends forms.CollectionUpsert{} // merge
@@ -634,7 +760,7 @@ interface CollectionUpsertForm extends forms.CollectionUpsert{} // merge
  * @group PocketBase
  */
 declare class CollectionUpsertForm implements forms.CollectionUpsert {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface CollectionsImportForm extends forms.CollectionsImport{} // merge
@@ -643,7 +769,7 @@ interface CollectionsImportForm extends forms.CollectionsImport{} // merge
  * @group PocketBase
  */
 declare class CollectionsImportForm implements forms.CollectionsImport {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface RealtimeSubscribeForm extends forms.RealtimeSubscribe{} // merge
@@ -659,7 +785,7 @@ interface RecordEmailChangeConfirmForm extends forms.RecordEmailChangeConfirm{}
  * @group PocketBase
  */
 declare class RecordEmailChangeConfirmForm implements forms.RecordEmailChangeConfirm {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface RecordEmailChangeRequestForm extends forms.RecordEmailChangeRequest{} // merge
@@ -668,7 +794,7 @@ interface RecordEmailChangeRequestForm extends forms.RecordEmailChangeRequest{}
  * @group PocketBase
  */
 declare class RecordEmailChangeRequestForm implements forms.RecordEmailChangeRequest {
-  constructor(app: core.App, record: models.Record)
+  constructor(app: CoreApp, record: models.Record)
 }
 
 interface RecordOAuth2LoginForm extends forms.RecordOAuth2Login{} // merge
@@ -677,7 +803,7 @@ interface RecordOAuth2LoginForm extends forms.RecordOAuth2Login{} // merge
  * @group PocketBase
  */
 declare class RecordOAuth2LoginForm implements forms.RecordOAuth2Login {
-  constructor(app: core.App, collection: models.Collection, optAuthRecord?: models.Record)
+  constructor(app: CoreApp, collection: models.Collection, optAuthRecord?: models.Record)
 }
 
 interface RecordPasswordLoginForm extends forms.RecordPasswordLogin{} // merge
@@ -686,7 +812,7 @@ interface RecordPasswordLoginForm extends forms.RecordPasswordLogin{} // merge
  * @group PocketBase
  */
 declare class RecordPasswordLoginForm implements forms.RecordPasswordLogin {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface RecordPasswordResetConfirmForm extends forms.RecordPasswordResetConfirm{} // merge
@@ -695,7 +821,7 @@ interface RecordPasswordResetConfirmForm extends forms.RecordPasswordResetConfir
  * @group PocketBase
  */
 declare class RecordPasswordResetConfirmForm implements forms.RecordPasswordResetConfirm {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface RecordPasswordResetRequestForm extends forms.RecordPasswordResetRequest{} // merge
@@ -704,7 +830,7 @@ interface RecordPasswordResetRequestForm extends forms.RecordPasswordResetReques
  * @group PocketBase
  */
 declare class RecordPasswordResetRequestForm implements forms.RecordPasswordResetRequest {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface RecordUpsertForm extends forms.RecordUpsert{} // merge
@@ -713,7 +839,7 @@ interface RecordUpsertForm extends forms.RecordUpsert{} // merge
  * @group PocketBase
  */
 declare class RecordUpsertForm implements forms.RecordUpsert {
-  constructor(app: core.App, record: models.Record)
+  constructor(app: CoreApp, record: models.Record)
 }
 
 interface RecordVerificationConfirmForm extends forms.RecordVerificationConfirm{} // merge
@@ -722,7 +848,7 @@ interface RecordVerificationConfirmForm extends forms.RecordVerificationConfirm{
  * @group PocketBase
  */
 declare class RecordVerificationConfirmForm implements forms.RecordVerificationConfirm {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface RecordVerificationRequestForm extends forms.RecordVerificationRequest{} // merge
@@ -731,7 +857,7 @@ interface RecordVerificationRequestForm extends forms.RecordVerificationRequest{
  * @group PocketBase
  */
 declare class RecordVerificationRequestForm implements forms.RecordVerificationRequest {
-  constructor(app: core.App, collection: models.Collection)
+  constructor(app: CoreApp, collection: models.Collection)
 }
 
 interface SettingsUpsertForm extends forms.SettingsUpsert{} // merge
@@ -740,7 +866,7 @@ interface SettingsUpsertForm extends forms.SettingsUpsert{} // merge
  * @group PocketBase
  */
 declare class SettingsUpsertForm implements forms.SettingsUpsert {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface TestEmailSendForm extends forms.TestEmailSend{} // merge
@@ -749,7 +875,7 @@ interface TestEmailSendForm extends forms.TestEmailSend{} // merge
  * @group PocketBase
  */
 declare class TestEmailSendForm implements forms.TestEmailSend {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 interface TestS3FilesystemForm extends forms.TestS3Filesystem{} // merge
@@ -758,7 +884,7 @@ interface TestS3FilesystemForm extends forms.TestS3Filesystem{} // merge
  * @group PocketBase
  */
 declare class TestS3FilesystemForm implements forms.TestS3Filesystem {
-  constructor(app: core.App)
+  constructor(app: CoreApp)
 }
 
 // -------------------------------------------------------------------
@@ -829,6 +955,7 @@ declare namespace $apis {
    */
   export function staticDirectoryHandler(dir: string, indexFallback: boolean): echo.HandlerFunc
 
+  let requireGuestOnly:          apis.requireGuestOnly
   let requireRecordAuth:         apis.requireRecordAuth
   let requireAdminAuth:          apis.requireAdminAuth
   let requireAdminAuthOnlyIfAny: apis.requireAdminAuthOnlyIfAny
@@ -863,9 +990,11 @@ declare namespace $http {
    *     method: "post",
    * })
    *
-   * console.log(res.statusCode)
-   * console.log(res.raw)
-   * console.log(res.json)
+   * console.log(res.statusCode) // the response HTTP status code
+   * console.log(res.headers)    // the response headers (eg. res.headers['X-Custom'][0])
+   * console.log(res.cookies)    // the response cookies (eg. res.cookies.sessionId.value)
+   * console.log(res.raw)        // the response body as plain text
+   * console.log(res.json)       // the response body as parsed json array or map
    * ` + "```" + `
    */
   function send(config: {
@@ -878,9 +1007,11 @@ declare namespace $http {
     // deprecated, please use body instead
     data?: { [key:string]: any },
   }): {
-    statusCode: number
-    raw:        string
-    json:       any
+    statusCode: number,
+    headers:    { [key:string]: Array<string> },
+    cookies:    { [key:string]: http.Cookie },
+    raw:        string,
+    json:       any,
   };
 }
 
@@ -914,6 +1045,7 @@ func main() {
 			"github.com/pocketbase/pocketbase/tools/filesystem": {"*"},
 			"github.com/pocketbase/pocketbase/tools/template":   {"*"},
 			"github.com/pocketbase/pocketbase/tokens":           {"*"},
+			"github.com/pocketbase/pocketbase/mails":            {"*"},
 			"github.com/pocketbase/pocketbase/apis":             {"*"},
 			"github.com/pocketbase/pocketbase/forms":            {"*"},
 			"github.com/pocketbase/pocketbase":                  {"*"},
@@ -959,6 +1091,16 @@ func main() {
 		log.Fatal("Failed to get the current docs directory")
 	}
 
+	// replace the original app interfaces with their non-"on*"" hooks equivalents
+	result = strings.ReplaceAll(result, "core.App", "CoreApp")
+	result = strings.ReplaceAll(result, "pocketbase.PocketBase", "PocketBase")
+	result = strings.ReplaceAll(result, "ORIGINAL_CORE_APP", "core.App")
+	result = strings.ReplaceAll(result, "ORIGINAL_POCKETBASE", "pocketbase.PocketBase")
+
+	// prepend a timestamp with the generation time
+	// so that it can be compared without reading the entire file
+	result = fmt.Sprintf("// %d\n%s", time.Now().Unix(), result)
+
 	parentDir := filepath.Dir(filename)
 	typesFile := filepath.Join(parentDir, "generated", "types.d.ts")
 

plugins/jsvm/jsvm.go

@@ -9,8 +9,10 @@
 package jsvm
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -77,6 +79,9 @@ type Config struct {
 	// TypeScript declarations file.
 	//
 	// If not set it fallbacks to "pb_data".
+	//
+	// Note: Avoid using the same directory as the HooksDir when HooksWatch is enabled
+	// to prevent unnecessary app restarts when the types file is initially created.
 	TypesDir string
 }
 
@@ -117,10 +122,9 @@ func Register(app core.App, config Config) error {
 	}
 
 	p.app.OnAfterBootstrap().Add(func(e *core.BootstrapEvent) error {
-		// always update the app types on start to ensure that
-		// the user has the latest generated declarations
-		if err := p.saveTypesFile(); err != nil {
-			color.Yellow("Unable to save app types file: %v", err)
+		// ensure that the user has the latest types declaration
+		if err := p.refreshTypesFile(); err != nil {
+			color.Yellow("Unable to refresh app types file: %v", err)
 		}
 
 		return nil
@@ -423,8 +427,8 @@ func (p *plugin) relativeTypesPath(basepath string) string {
 	return rel
 }
 
-// saveTypesFile saves the embedded TS declarations as a file on the disk.
-func (p *plugin) saveTypesFile() error {
+// refreshTypesFile saves the embedded TS declarations as a file on the disk.
+func (p *plugin) refreshTypesFile() error {
 	fullPath := p.fullTypesPath()
 
 	// ensure that the types directory exists
@@ -439,11 +443,20 @@ func (p *plugin) saveTypesFile() error {
 		return err
 	}
 
-	if err := os.WriteFile(fullPath, data, 0644); err != nil {
-		return err
+	// read the first timestamp line of the old file (if exists) and compare it to the embedded one
+	// (note: ignore errors to allow always overwriting the file if it is invalid)
+	existingFile, err := os.Open(fullPath)
+	if err == nil {
+		timestamp := make([]byte, 13)
+		io.ReadFull(existingFile, timestamp)
+		existingFile.Close()
+
+		if len(data) >= len(timestamp) && bytes.Equal(data[:13], timestamp) {
+			return nil // nothing new to save
+		}
 	}
 
-	return nil
+	return os.WriteFile(fullPath, data, 0644)
 }
 
 // prependToEmptyFile prepends the specified text to an empty file.

plugins/migratecmd/automigrate.go

@@ -15,7 +15,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/migrate"
 )
 
-const collectionsCacheKey = "migratecmd_collections"
+const collectionsStoreKey = "migratecmd_collections"
 
 // onCollectionChange handles the automigration snapshot generation on
 // collection change event (create/update/delete).
@@ -94,7 +94,7 @@ func (p *plugin) afterCollectionChange() func(*core.ModelEvent) error {
 }
 
 func (p *plugin) updateSingleCachedCollection(new, old *models.Collection) {
-	cached, _ := p.app.Cache().Get(collectionsCacheKey).(map[string]*models.Collection)
+	cached, _ := p.app.Store().Get(collectionsStoreKey).(map[string]*models.Collection)
 
 	switch {
 	case new == nil:
@@ -103,7 +103,7 @@ func (p *plugin) updateSingleCachedCollection(new, old *models.Collection) {
 		cached[new.Id] = new
 	}
 
-	p.app.Cache().Set(collectionsCacheKey, cached)
+	p.app.Store().Set(collectionsStoreKey, cached)
 }
 
 func (p *plugin) refreshCachedCollections() error {
@@ -121,19 +121,19 @@ func (p *plugin) refreshCachedCollections() error {
 		cached[c.Id] = c
 	}
 
-	p.app.Cache().Set(collectionsCacheKey, cached)
+	p.app.Store().Set(collectionsStoreKey, cached)
 
 	return nil
 }
 
 func (p *plugin) getCachedCollections() (map[string]*models.Collection, error) {
-	if !p.app.Cache().Has(collectionsCacheKey) {
+	if !p.app.Store().Has(collectionsStoreKey) {
 		if err := p.refreshCachedCollections(); err != nil {
 			return nil, err
 		}
 	}
 
-	result, _ := p.app.Cache().Get(collectionsCacheKey).(map[string]*models.Collection)
+	result, _ := p.app.Store().Get(collectionsStoreKey).(map[string]*models.Collection)
 
 	return result, nil
 }

plugins/migratecmd/migratecmd.go

@@ -118,13 +118,11 @@ func (p *plugin) createCommand() *cobra.Command {
 `
 
 	command := &cobra.Command{
-		Use:       "migrate",
-		Short:     "Executes app DB migration scripts",
-		Long:      cmdDesc,
-		ValidArgs: []string{"up", "down", "create", "collections"},
-		// prevents printing the error log twice
-		SilenceErrors: true,
-		SilenceUsage:  true,
+		Use:          "migrate",
+		Short:        "Executes app DB migration scripts",
+		Long:         cmdDesc,
+		ValidArgs:    []string{"up", "down", "create", "collections"},
+		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			cmd := ""
 			if len(args) > 0 {

plugins/migratecmd/migratecmd_test.go

@@ -1,6 +1,7 @@
 package migratecmd_test
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -48,6 +49,7 @@ migrate((db) => {
       "manageRule": "created > 0",
       "minPasswordLength": 20,
       "onlyEmailDomains": null,
+      "onlyVerified": false,
       "requireEmail": false
     }
   });
@@ -101,6 +103,7 @@ func init() {
 				"manageRule": "created > 0",
 				"minPasswordLength": 20,
 				"onlyEmailDomains": null,
+				"onlyVerified": false,
 				"requireEmail": false
 			}
 		}` + "`" + `
@@ -127,63 +130,65 @@ func init() {
 	}
 
 	for i, s := range scenarios {
-		app, _ := tests.NewTestApp()
-		defer app.Cleanup()
+		t.Run(fmt.Sprintf("s%d", i), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
 
-		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
 
-		migratecmd.MustRegister(app, nil, migratecmd.Config{
-			TemplateLang: s.lang,
-			Automigrate:  true,
-			Dir:          migrationsDir,
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+
+			// @todo remove after collections cache is replaced
+			app.Bootstrap()
+
+			collection := &models.Collection{}
+			collection.Id = "new_id"
+			collection.Name = "new_name"
+			collection.Type = models.CollectionTypeAuth
+			collection.System = true
+			collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+			collection.Updated = collection.Created
+			collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.Indexes = types.JsonArray[string]{"create index test on new_name (id)"}
+			collection.SetOptions(models.CollectionAuthOptions{
+				ManageRule:        types.Pointer("created > 0"),
+				MinPasswordLength: 20,
+			})
+			collection.MarkAsNew()
+
+			if err := app.Dao().SaveCollection(collection); err != nil {
+				t.Fatalf("Failed to save collection, got %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d: %v", total, files)
+			}
+
+			expectedName := "_created_new_name." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+
+			if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, v)
+			}
 		})
-
-		// @todo remove after collections cache is replaced
-		app.Bootstrap()
-
-		collection := &models.Collection{}
-		collection.Id = "new_id"
-		collection.Name = "new_name"
-		collection.Type = models.CollectionTypeAuth
-		collection.System = true
-		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
-		collection.Updated = collection.Created
-		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
-		collection.ViewRule = types.Pointer(`id = "1"`)
-		collection.Indexes = types.JsonArray[string]{"create index test on new_name (id)"}
-		collection.SetOptions(models.CollectionAuthOptions{
-			ManageRule:        types.Pointer("created > 0"),
-			MinPasswordLength: 20,
-		})
-		collection.MarkAsNew()
-
-		if err := app.Dao().SaveCollection(collection); err != nil {
-			t.Fatalf("[%d] Failed to save collection, got %v", i, err)
-		}
-
-		files, err := os.ReadDir(migrationsDir)
-		if err != nil {
-			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
-		}
-
-		if total := len(files); total != 1 {
-			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
-		}
-
-		expectedName := "_created_new_name." + s.lang
-		if !strings.Contains(files[0].Name(), expectedName) {
-			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
-		}
-
-		fullPath := filepath.Join(migrationsDir, files[0].Name())
-		content, err := os.ReadFile(fullPath)
-		if err != nil {
-			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
-		}
-
-		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
-			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
-		}
 	}
 }
 
@@ -226,6 +231,7 @@ migrate((db) => {
       "manageRule": "created > 0",
       "minPasswordLength": 20,
       "onlyEmailDomains": null,
+      "onlyVerified": false,
       "requireEmail": false
     }
   });
@@ -283,6 +289,7 @@ func init() {
 				"manageRule": "created > 0",
 				"minPasswordLength": 20,
 				"onlyEmailDomains": null,
+				"onlyVerified": false,
 				"requireEmail": false
 			}
 		}` + "`" + `
@@ -300,69 +307,71 @@ func init() {
 	}
 
 	for i, s := range scenarios {
-		app, _ := tests.NewTestApp()
-		defer app.Cleanup()
+		t.Run(fmt.Sprintf("s%d", i), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
 
-		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
 
-		migratecmd.MustRegister(app, nil, migratecmd.Config{
-			TemplateLang: s.lang,
-			Automigrate:  true,
-			Dir:          migrationsDir,
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+
+			// create dummy collection
+			collection := &models.Collection{}
+			collection.Id = "test123"
+			collection.Name = "test456"
+			collection.Type = models.CollectionTypeAuth
+			collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+			collection.Updated = collection.Created
+			collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.Indexes = types.JsonArray[string]{"create index test on test456 (id)"}
+			collection.SetOptions(models.CollectionAuthOptions{
+				ManageRule:        types.Pointer("created > 0"),
+				MinPasswordLength: 20,
+			})
+			collection.MarkAsNew()
+
+			// use different dao to avoid triggering automigrate while saving the dummy collection
+			if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection, got %v", err)
+			}
+
+			// @todo remove after collections cache is replaced
+			app.Bootstrap()
+
+			// delete the newly created dummy collection
+			if err := app.Dao().DeleteCollection(collection); err != nil {
+				t.Fatalf("Failed to delete dummy collection, got %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got: %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d", total)
+			}
+
+			expectedName := "_deleted_test456." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+
+			if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, v)
+			}
 		})
-
-		// create dummy collection
-		collection := &models.Collection{}
-		collection.Id = "test123"
-		collection.Name = "test456"
-		collection.Type = models.CollectionTypeAuth
-		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
-		collection.Updated = collection.Created
-		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
-		collection.ViewRule = types.Pointer(`id = "1"`)
-		collection.Indexes = types.JsonArray[string]{"create index test on test456 (id)"}
-		collection.SetOptions(models.CollectionAuthOptions{
-			ManageRule:        types.Pointer("created > 0"),
-			MinPasswordLength: 20,
-		})
-		collection.MarkAsNew()
-
-		// use different dao to avoid triggering automigrate while saving the dummy collection
-		if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
-			t.Fatalf("[%d] Failed to save dummy collection, got %v", i, err)
-		}
-
-		// @todo remove after collections cache is replaced
-		app.Bootstrap()
-
-		// delete the newly created dummy collection
-		if err := app.Dao().DeleteCollection(collection); err != nil {
-			t.Fatalf("[%d] Failed to delete dummy collection, got %v", i, err)
-		}
-
-		files, err := os.ReadDir(migrationsDir)
-		if err != nil {
-			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
-		}
-
-		if total := len(files); total != 1 {
-			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
-		}
-
-		expectedName := "_deleted_test456." + s.lang
-		if !strings.Contains(files[0].Name(), expectedName) {
-			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
-		}
-
-		fullPath := filepath.Join(migrationsDir, files[0].Name())
-		content, err := os.ReadFile(fullPath)
-		if err != nil {
-			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
-		}
-
-		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
-			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
-		}
 	}
 }
 
@@ -444,6 +453,7 @@ migrate((db) => {
     "manageRule": "created > 0",
     "minPasswordLength": 20,
     "onlyEmailDomains": null,
+    "onlyVerified": false,
     "requireEmail": false
   }
   collection.indexes = [
@@ -598,6 +608,7 @@ func init() {
 			"manageRule": "created > 0",
 			"minPasswordLength": 20,
 			"onlyEmailDomains": null,
+			"onlyVerified": false,
 			"requireEmail": false
 		}` + "`" + `), &options)
 		collection.SetOptions(options)
@@ -649,116 +660,118 @@ func init() {
 	}
 
 	for i, s := range scenarios {
-		app, _ := tests.NewTestApp()
-		defer app.Cleanup()
+		t.Run(fmt.Sprintf("s%d", i), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
 
-		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
 
-		migratecmd.MustRegister(app, nil, migratecmd.Config{
-			TemplateLang: s.lang,
-			Automigrate:  true,
-			Dir:          migrationsDir,
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+
+			// create dummy collection
+			collection := &models.Collection{}
+			collection.Id = "test123"
+			collection.Name = "test456"
+			collection.Type = models.CollectionTypeAuth
+			collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+			collection.Updated = collection.Created
+			collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.UpdateRule = types.Pointer(`id = "2"`)
+			collection.CreateRule = nil
+			collection.DeleteRule = types.Pointer(`id = "3"`)
+			collection.Indexes = types.JsonArray[string]{"create index test1 on test456 (f1_name)"}
+			collection.SetOptions(models.CollectionAuthOptions{
+				ManageRule:        types.Pointer("created > 0"),
+				MinPasswordLength: 20,
+			})
+			collection.MarkAsNew()
+			collection.Schema.AddField(&schema.SchemaField{
+				Id:       "f1_id",
+				Name:     "f1_name",
+				Type:     schema.FieldTypeText,
+				Required: true,
+			})
+			collection.Schema.AddField(&schema.SchemaField{
+				Id:     "f2_id",
+				Name:   "f2_name",
+				Type:   schema.FieldTypeNumber,
+				Unique: true,
+				Options: &schema.NumberOptions{
+					Min: types.Pointer(10.0),
+				},
+			})
+			collection.Schema.AddField(&schema.SchemaField{
+				Id:   "f3_id",
+				Name: "f3_name",
+				Type: schema.FieldTypeBool,
+			})
+
+			// use different dao to avoid triggering automigrate while saving the dummy collection
+			if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection, got %v", err)
+			}
+
+			// @todo remove after collections cache is replaced
+			app.Bootstrap()
+
+			collection.Name = "test456_update"
+			collection.Type = models.CollectionTypeBase
+			collection.DeleteRule = types.Pointer(`updated > 0 && @request.auth.id != ''`)
+			collection.ListRule = types.Pointer("@request.auth.id != ''")
+			collection.ViewRule = types.Pointer(`id = "1"`) // no change
+			collection.UpdateRule = types.Pointer(`id = "2_update"`)
+			collection.CreateRule = types.Pointer(`id = "nil_update"`)
+			collection.DeleteRule = nil
+			collection.Indexes = types.JsonArray[string]{
+				"create index test1 on test456_update (f1_name)",
+			}
+			collection.NormalizeOptions()
+			collection.Schema.RemoveField("f3_id")
+			collection.Schema.AddField(&schema.SchemaField{
+				Id:   "f4_id",
+				Name: "f4_name",
+				Type: schema.FieldTypeText,
+				Options: &schema.TextOptions{
+					Pattern: "`test backtick`123",
+				},
+			})
+			f := collection.Schema.GetFieldById("f2_id")
+			f.Name = "f2_name_new"
+
+			// save the changes and trigger automigrate
+			if err := app.Dao().SaveCollection(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection changes, got %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got: %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d", total)
+			}
+
+			expectedName := "_updated_test456." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+
+			if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, v)
+			}
 		})
-
-		// create dummy collection
-		collection := &models.Collection{}
-		collection.Id = "test123"
-		collection.Name = "test456"
-		collection.Type = models.CollectionTypeAuth
-		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
-		collection.Updated = collection.Created
-		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0")
-		collection.ViewRule = types.Pointer(`id = "1"`)
-		collection.UpdateRule = types.Pointer(`id = "2"`)
-		collection.CreateRule = nil
-		collection.DeleteRule = types.Pointer(`id = "3"`)
-		collection.Indexes = types.JsonArray[string]{"create index test1 on test456 (f1_name)"}
-		collection.SetOptions(models.CollectionAuthOptions{
-			ManageRule:        types.Pointer("created > 0"),
-			MinPasswordLength: 20,
-		})
-		collection.MarkAsNew()
-		collection.Schema.AddField(&schema.SchemaField{
-			Id:       "f1_id",
-			Name:     "f1_name",
-			Type:     schema.FieldTypeText,
-			Required: true,
-		})
-		collection.Schema.AddField(&schema.SchemaField{
-			Id:     "f2_id",
-			Name:   "f2_name",
-			Type:   schema.FieldTypeNumber,
-			Unique: true,
-			Options: &schema.NumberOptions{
-				Min: types.Pointer(10.0),
-			},
-		})
-		collection.Schema.AddField(&schema.SchemaField{
-			Id:   "f3_id",
-			Name: "f3_name",
-			Type: schema.FieldTypeBool,
-		})
-
-		// use different dao to avoid triggering automigrate while saving the dummy collection
-		if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
-			t.Fatalf("[%d] Failed to save dummy collection, got %v", i, err)
-		}
-
-		// @todo remove after collections cache is replaced
-		app.Bootstrap()
-
-		collection.Name = "test456_update"
-		collection.Type = models.CollectionTypeBase
-		collection.DeleteRule = types.Pointer(`updated > 0 && @request.auth.id != ''`)
-		collection.ListRule = types.Pointer("@request.auth.id != ''")
-		collection.ViewRule = types.Pointer(`id = "1"`) // no change
-		collection.UpdateRule = types.Pointer(`id = "2_update"`)
-		collection.CreateRule = types.Pointer(`id = "nil_update"`)
-		collection.DeleteRule = nil
-		collection.Indexes = types.JsonArray[string]{
-			"create index test1 on test456_update (f1_name)",
-		}
-		collection.NormalizeOptions()
-		collection.Schema.RemoveField("f3_id")
-		collection.Schema.AddField(&schema.SchemaField{
-			Id:   "f4_id",
-			Name: "f4_name",
-			Type: schema.FieldTypeText,
-			Options: &schema.TextOptions{
-				Pattern: "`test backtick`123",
-			},
-		})
-		f := collection.Schema.GetFieldById("f2_id")
-		f.Name = "f2_name_new"
-
-		// save the changes and trigger automigrate
-		if err := app.Dao().SaveCollection(collection); err != nil {
-			t.Fatalf("[%d] Failed to save dummy collection changes, got %v", i, err)
-		}
-
-		files, err := os.ReadDir(migrationsDir)
-		if err != nil {
-			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
-		}
-
-		if total := len(files); total != 1 {
-			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
-		}
-
-		expectedName := "_updated_test456." + s.lang
-		if !strings.Contains(files[0].Name(), expectedName) {
-			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
-		}
-
-		fullPath := filepath.Join(migrationsDir, files[0].Name())
-		content, err := os.ReadFile(fullPath)
-		if err != nil {
-			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
-		}
-
-		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
-			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
-		}
 	}
 }
 

pocketbase.go

@@ -1,6 +1,7 @@
 package pocketbase
 
 import (
+	"io"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -31,7 +32,7 @@ type appWrapper struct {
 type PocketBase struct {
 	*appWrapper
 
-	debugFlag         bool
+	devFlag           bool
 	dataDirFlag       string
 	encryptionEnvFlag string
 	hideStartBanner   bool
@@ -43,7 +44,7 @@ type PocketBase struct {
 // Config is the PocketBase initialization config struct.
 type Config struct {
 	// optional default values for the console flags
-	DefaultDebug         bool
+	DefaultDev           bool
 	DefaultDataDir       string // if not set, it will fallback to "./pb_data"
 	DefaultEncryptionEnv string
 
@@ -69,7 +70,7 @@ func New() *PocketBase {
 	_, isUsingGoRun := inspectRuntime()
 
 	return NewWithConfig(Config{
-		DefaultDebug: isUsingGoRun,
+		DefaultDev: isUsingGoRun,
 	})
 }
 
@@ -100,21 +101,24 @@ func NewWithConfig(config Config) *PocketBase {
 				DisableDefaultCmd: true,
 			},
 		},
-		debugFlag:         config.DefaultDebug,
+		devFlag:           config.DefaultDev,
 		dataDirFlag:       config.DefaultDataDir,
 		encryptionEnvFlag: config.DefaultEncryptionEnv,
 		hideStartBanner:   config.HideStartBanner,
 	}
 
+	// replace with a colored stderr writer
+	pb.RootCmd.SetErr(newErrWriter())
+
 	// parse base flags
 	// (errors are ignored, since the full flags parsing happens on Execute())
 	pb.eagerParseFlags(&config)
 
 	// initialize the app instance
 	pb.appWrapper = &appWrapper{core.NewBaseApp(core.BaseAppConfig{
+		IsDev:            pb.devFlag,
 		DataDir:          pb.dataDirFlag,
 		EncryptionEnv:    pb.encryptionEnvFlag,
-		IsDebug:          pb.debugFlag,
 		DataMaxOpenConns: config.DataMaxOpenConns,
 		DataMaxIdleConns: config.DataMaxIdleConns,
 		LogsMaxOpenConns: config.LogsMaxOpenConns,
@@ -156,26 +160,25 @@ func (pb *PocketBase) Execute() error {
 		sigch := make(chan os.Signal, 1)
 		signal.Notify(sigch, os.Interrupt, syscall.SIGTERM)
 		<-sigch
+
 		done <- true
 	}()
 
 	// execute the root command
 	go func() {
-		if err := pb.RootCmd.Execute(); err != nil {
-			// @todo replace with db log once generalized logs are added
-			// and maybe consider reorganizing the code to return os.Exit(1)
-			// (note may need to update the existing commands to not silence errors)
-			color.Red(err.Error())
-		}
+		// note: leave to the commands to decide whether to print their error
+		pb.RootCmd.Execute()
 
 		done <- true
 	}()
 
 	<-done
 
-	// trigger app cleanups
+	// trigger cleanups
 	return pb.OnTerminate().Trigger(&core.TerminateEvent{
 		App: pb,
+	}, func(e *core.TerminateEvent) error {
+		return e.App.ResetBootstrapState()
 	})
 }
 
@@ -197,10 +200,10 @@ func (pb *PocketBase) eagerParseFlags(config *Config) error {
 	)
 
 	pb.RootCmd.PersistentFlags().BoolVar(
-		&pb.debugFlag,
-		"debug",
-		config.DefaultDebug,
-		"enable debug mode, aka. showing more detailed logs",
+		&pb.devFlag,
+		"dev",
+		config.DefaultDev,
+		"enable dev mode, aka. printing logs and sql statements to the console",
 	)
 
 	return pb.RootCmd.ParseFlags(os.Args[1:])
@@ -262,3 +265,25 @@ func inspectRuntime() (baseDir string, withGoRun bool) {
 	}
 	return
 }
+
+// newErrWriter returns a red colored stderr writter.
+func newErrWriter() *coloredWriter {
+	return &coloredWriter{
+		w: os.Stderr,
+		c: color.New(color.FgRed),
+	}
+}
+
+// coloredWriter is a small wrapper struct to construct a [color.Color] writter.
+type coloredWriter struct {
+	w io.Writer
+	c *color.Color
+}
+
+// Write writes the p bytes using the colored writer.
+func (colored *coloredWriter) Write(p []byte) (n int, err error) {
+	colored.c.SetWriter(colored.w)
+	defer colored.c.UnsetWriter(colored.w)
+
+	return colored.c.Print(string(p))
+}

pocketbase_test.go

@@ -45,17 +45,12 @@ func TestNew(t *testing.T) {
 	}
 
 	if app.EncryptionEnv() != "test_encryption_env" {
-		t.Fatalf("Expected app.DataDir() test_encryption_env, got %q", app.EncryptionEnv())
-	}
-
-	if app.IsDebug() != true {
-		t.Fatal("Expected app.IsDebug() true, got false")
+		t.Fatalf("Expected app.EncryptionEnv() test_encryption_env, got %q", app.EncryptionEnv())
 	}
 }
 
 func TestNewWithConfig(t *testing.T) {
 	app := NewWithConfig(Config{
-		DefaultDebug:         true,
 		DefaultDataDir:       "test_dir",
 		DefaultEncryptionEnv: "test_encryption_env",
 		HideStartBanner:      true,
@@ -82,11 +77,7 @@ func TestNewWithConfig(t *testing.T) {
 	}
 
 	if app.EncryptionEnv() != "test_encryption_env" {
-		t.Fatalf("Expected app.DataDir() %q, got %q", "test_encryption_env", app.EncryptionEnv())
-	}
-
-	if app.IsDebug() != true {
-		t.Fatal("Expected app.IsDebug() true, got false")
+		t.Fatalf("Expected app.EncryptionEnv() %q, got %q", "test_encryption_env", app.EncryptionEnv())
 	}
 }
 
@@ -109,7 +100,6 @@ func TestNewWithConfigAndFlags(t *testing.T) {
 	)
 
 	app := NewWithConfig(Config{
-		DefaultDebug:         true,
 		DefaultDataDir:       "test_dir",
 		DefaultEncryptionEnv: "test_encryption_env",
 		HideStartBanner:      true,
@@ -136,11 +126,7 @@ func TestNewWithConfigAndFlags(t *testing.T) {
 	}
 
 	if app.EncryptionEnv() != "test_encryption_env_flag" {
-		t.Fatalf("Expected app.DataDir() %q, got %q", "test_encryption_env_flag", app.EncryptionEnv())
-	}
-
-	if app.IsDebug() != false {
-		t.Fatal("Expected app.IsDebug() false, got true")
+		t.Fatalf("Expected app.EncryptionEnv() %q, got %q", "test_encryption_env_flag", app.EncryptionEnv())
 	}
 }
 

resolvers/record_field_resolve_runner.go

@@ -141,13 +141,21 @@ func (r *runner) processCollectionField() (*search.ResolverResult, error) {
 		return nil, fmt.Errorf("invalid @collection field path in %q", r.fieldName)
 	}
 
-	collection, err := r.resolver.loadCollection(r.activeProps[1])
+	// nameOrId or nameOrId:alias
+	collectionParts := strings.SplitN(r.activeProps[1], ":", 2)
+
+	collection, err := r.resolver.loadCollection(collectionParts[0])
 	if err != nil {
 		return nil, fmt.Errorf("failed to load collection %q from field path %q", r.activeProps[1], r.fieldName)
 	}
 
 	r.activeCollectionName = collection.Name
-	r.activeTableAlias = inflector.Columnify("__collection_" + r.activeCollectionName)
+
+	if len(collectionParts) == 2 && collectionParts[1] != "" {
+		r.activeTableAlias = inflector.Columnify("__collection_alias_" + collectionParts[1])
+	} else {
+		r.activeTableAlias = inflector.Columnify("__collection_" + r.activeCollectionName)
+	}
 
 	r.withMultiMatch = true
 

resolvers/record_field_resolver.go

@@ -64,12 +64,12 @@ type CollectionsFinder interface {
 type RecordFieldResolver struct {
 	dao               CollectionsFinder
 	baseCollection    *models.Collection
-	allowHiddenFields bool
-	allowedFields     []string
-	loadedCollections []*models.Collection
-	joins             []*join // we cannot use a map because the insertion order is not preserved
 	requestInfo       *models.RequestInfo
 	staticRequestInfo map[string]any
+	allowedFields     []string
+	loadedCollections []*models.Collection
+	joins             []*join
+	allowHiddenFields bool
 }
 
 // NewRecordFieldResolver creates and initializes a new `RecordFieldResolver`.
@@ -77,6 +77,7 @@ func NewRecordFieldResolver(
 	dao CollectionsFinder,
 	baseCollection *models.Collection,
 	requestInfo *models.RequestInfo,
+	// @todo consider moving per filter basis
 	allowHiddenFields bool,
 ) *RecordFieldResolver {
 	r := &RecordFieldResolver{
@@ -93,7 +94,7 @@ func NewRecordFieldResolver(
 			`^\@request\.data\.[\w\.\:]*\w+$`,
 			`^\@request\.query\.[\w\.\:]*\w+$`,
 			`^\@request\.headers\.\w+$`,
-			`^\@collection\.\w+\.[\w\.\:]*\w+$`,
+			`^\@collection\.\w+(\:\w+)?\.[\w\.\:]*\w+$`,
 		},
 	}
 

resolvers/record_field_resolver_test.go

@@ -59,14 +59,14 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 			"demo4",
 			"title = true || title != 'test' || title ~ 'test1' || title !~ '%test2' || title > 1 || title >= 2 || title < 3 || title <= 4",
 			false,
-			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] != {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
+			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] IS NOT {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
 		},
 		{
 			"non relation field (with all opt/any operators)",
 			"demo4",
 			"title ?= true || title ?!= 'test' || title ?~ 'test1' || title ?!~ '%test2' || title ?> 1 || title ?>= 2 || title ?< 3 || title ?<= 4",
 			false,
-			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] != {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
+			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] IS NOT {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
 		},
 		{
 			"incomplete rel",
@@ -155,9 +155,9 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 		{
 			"@collection join (opt/any operators)",
 			"demo4",
-			"@collection.demo1.text ?> true || @collection.demo2.active ?> true || @collection.demo1.file_one ?> true",
+			"@collection.demo1.text ?> true || @collection.demo2.active ?> true || @collection.demo1:demo1_alias.file_one ?> true",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` WHERE ([[__collection_demo1.text]] > 1 OR [[__collection_demo2.active]] > 1 OR [[__collection_demo1.file_one]] > 1)",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `demo1` `__collection_alias_demo1_alias` WHERE ([[__collection_demo1.text]] > 1 OR [[__collection_demo2.active]] > 1 OR [[__collection_alias_demo1_alias.file_one]] > 1)",
 		},
 		{
 			"@collection join (multi-match operators)",
@@ -216,7 +216,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"@request.data.rel_many.url ?= 'test' &&" +
 				"@request.data.rel_many.avatar ~ 'test'",
 			false,
-			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN `demo1` `__data_demo1` ON [[__data_demo1.id]]={:TEST} LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE ({:TEST} > 1 AND [[__data_demo1.text]] > 1 AND {:TEST} > 1 AND (([[__data_users.email]] != {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] != {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND '' = {:TEST} AND (([[__data_users.avatar]] LIKE {:TEST} ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.avatar]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE {:TEST} ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))))",
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN `demo1` `__data_demo1` ON [[__data_demo1.id]]={:TEST} LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE ({:TEST} > 1 AND [[__data_demo1.text]] > 1 AND {:TEST} > 1 AND (([[__data_users.email]] IS NOT {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] IS NOT {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND '' = {:TEST} AND (([[__data_users.avatar]] LIKE {:TEST} ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__data_mm_users.avatar]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE {:TEST} ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))))",
 		},
 		{
 			"@request.data.select:each fields",
@@ -228,7 +228,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"@request.data.select_many:each = 'test' &&" +
 				"@request.data.select_many:each ?< true",
 			false,
-			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each({:TEST}) `__dataSelect_select_one_je` LEFT JOIN json_each({:TEST}) `__dataSelect_select_many_je` WHERE ('' = {:TEST} AND [[__dataSelect_select_one_je.value]] != {:TEST} AND [[__dataSelect_select_one_je.value]] = {:TEST} AND {:TEST} LIKE {:TEST} ESCAPE '\\' AND (([[__dataSelect_select_many_je.value]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:TEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) AND [[__dataSelect_select_many_je.value]] < 1)",
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each({:TEST}) `__dataSelect_select_one_je` LEFT JOIN json_each({:TEST}) `__dataSelect_select_many_je` WHERE ('' = {:TEST} AND [[__dataSelect_select_one_je.value]] IS NOT {:TEST} AND [[__dataSelect_select_one_je.value]] = {:TEST} AND {:TEST} LIKE {:TEST} ESCAPE '\\' AND (([[__dataSelect_select_many_je.value]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:TEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) AND [[__dataSelect_select_many_je.value]] < 1)",
 		},
 		{
 			"regular select:each fields",
@@ -240,7 +240,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"select_many:each = 'test' &&" +
 				"select_many:each ?> true",
 			false,
-			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` WHERE ([[demo1.select_one]] = {:TEST} AND [[demo1_select_one_je.value]] != {:TEST} AND [[demo1_select_one_je.value]] > 1 AND [[demo1.select_many]] LIKE {:TEST} ESCAPE '\\' AND (([[demo1_select_many_je.value]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) AND [[demo1_select_many_je.value]] > 1)",
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` WHERE ([[demo1.select_one]] = {:TEST} AND [[demo1_select_one_je.value]] IS NOT {:TEST} AND [[demo1_select_one_je.value]] > 1 AND [[demo1.select_many]] LIKE {:TEST} ESCAPE '\\' AND (([[demo1_select_many_je.value]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) AND [[demo1_select_many_je.value]] > 1)",
 		},
 		{
 			"select:each vs select:each",
@@ -250,7 +250,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"select_many:each ?< select_one:each &&" +
 				"select_many:each = @request.data.select_many:each",
 			false,
-			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` LEFT JOIN json_each({:dataSelectTEST}) `__dataSelect_select_many_je` WHERE (((COALESCE([[demo1_select_one_je.value]], '') != COALESCE([[demo1_select_many_je.value]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT (COALESCE([[demo1_select_one_je.value]], '') != COALESCE([[__smTEST.multiMatchValue]], ''))) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND (([[demo1_select_many_je.value]] > [[demo1_select_one_je.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] > [[demo1_select_one_je.value]])) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND [[demo1_select_many_je.value]] < [[demo1_select_one_je.value]] AND (([[demo1_select_many_je.value]] = [[__dataSelect_select_many_je.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataSelectTEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))))",
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_one]]) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `demo1_select_one_je` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.select_many]]) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `demo1_select_many_je` LEFT JOIN json_each({:dataSelectTEST}) `__dataSelect_select_many_je` WHERE (((COALESCE([[demo1_select_one_je.value]], '') IS NOT COALESCE([[demo1_select_many_je.value]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT (COALESCE([[demo1_select_one_je.value]], '') IS NOT COALESCE([[__smTEST.multiMatchValue]], ''))) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND (([[demo1_select_many_je.value]] > [[demo1_select_one_je.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] > [[demo1_select_one_je.value]])) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND [[demo1_select_many_je.value]] < [[demo1_select_one_je.value]] AND (([[demo1_select_many_je.value]] = [[__dataSelect_select_many_je.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.select_many]]) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__mm_demo1_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm__dataSelect_select_many_je.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataSelectTEST}) `__mm__dataSelect_select_many_je` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))))",
 		},
 		{
 			"mixed multi-match vs multi-match",
@@ -262,7 +262,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"@collection.demo2.active ?= rel_many.rel.active &&" +
 				"rel_many.email > @request.data.rel_many.email",
 			false,
-			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `demo1_rel_many_je` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[demo1_rel_many_je.value]] LEFT JOIN `demo2` `demo1_rel_many_rel` ON [[demo1_rel_many_rel.id]] = [[demo1_rel_many.rel]] LEFT JOIN `demo1` `demo1_rel_one` ON [[demo1_rel_one.id]] = [[demo1.rel_one]] LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE (((COALESCE([[demo1_rel_many_rel.active]], '') != COALESCE([[demo1_rel_many.name]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many.name]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE ((NOT (COALESCE([[__mlTEST.multiMatchValue]], '') != COALESCE([[__mrTEST.multiMatchValue]], ''))) OR ([[__mlTEST.multiMatchValue]] IS NULL) OR ([[__mrTEST.multiMatchValue]] IS NULL))))) AND COALESCE([[demo1_rel_many_rel.active]], '') = COALESCE([[demo1_rel_many.name]], '') AND (([[demo1_rel_many_rel.title]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.title]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND ((COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo2.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `demo2` `__mm__collection_demo2` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))) AND COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '') AND (((([[demo1_rel_many.email]] > [[__data_users.email]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__data_mm_users.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE ((NOT ([[__mlTEST.multiMatchValue]] > [[__mrTEST.multiMatchValue]])) OR ([[__mlTEST.multiMatchValue]] IS NULL) OR ([[__mrTEST.multiMatchValue]] IS NULL)))))) AND ([[demo1_rel_many.emailVisibility]] = TRUE)))",
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `demo1_rel_many_je` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[demo1_rel_many_je.value]] LEFT JOIN `demo2` `demo1_rel_many_rel` ON [[demo1_rel_many_rel.id]] = [[demo1_rel_many.rel]] LEFT JOIN `demo1` `demo1_rel_one` ON [[demo1_rel_one.id]] = [[demo1.rel_one]] LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `users` `__data_users` ON [[__data_users.id]] IN ({:TEST}, {:TEST}) WHERE (((COALESCE([[demo1_rel_many_rel.active]], '') IS NOT COALESCE([[demo1_rel_many.name]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many.name]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE ((NOT (COALESCE([[__mlTEST.multiMatchValue]], '') IS NOT COALESCE([[__mrTEST.multiMatchValue]], ''))) OR ([[__mlTEST.multiMatchValue]] IS NULL) OR ([[__mrTEST.multiMatchValue]] IS NULL))))) AND COALESCE([[demo1_rel_many_rel.active]], '') = COALESCE([[demo1_rel_many.name]], '') AND (([[demo1_rel_many_rel.title]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.title]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\')) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND ((COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm__collection_demo2.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `demo2` `__mm__collection_demo2` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))) AND COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '') AND (((([[demo1_rel_many.email]] > [[__data_users.email]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo1.rel_many]]) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__data_mm_users.email]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__data_mm_users` ON `__data_mm_users`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE ((NOT ([[__mlTEST.multiMatchValue]] > [[__mrTEST.multiMatchValue]])) OR ([[__mlTEST.multiMatchValue]] IS NULL) OR ([[__mrTEST.multiMatchValue]] IS NULL)))))) AND ([[demo1_rel_many.emailVisibility]] = TRUE)))",
 		},
 		{
 			"@request.data.arrayable:length fields",
@@ -280,7 +280,7 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"@request.data.file_many:length != 1 &&" +
 				"@request.data.file_many:length ?!= 2",
 			false,
-			"SELECT `demo1`.* FROM `demo1` WHERE (0 > {:TEST} AND 0 > {:TEST} AND 2 < {:TEST} AND 2 > {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 2 != {:TEST} AND 2 != {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 3 != {:TEST} AND 3 != {:TEST})",
+			"SELECT `demo1`.* FROM `demo1` WHERE (0 > {:TEST} AND 0 > {:TEST} AND 2 < {:TEST} AND 2 > {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 2 IS NOT {:TEST} AND 2 IS NOT {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 3 IS NOT {:TEST} AND 3 IS NOT {:TEST})",
 		},
 		{
 			"regular arrayable:length fields",
@@ -294,48 +294,50 @@ func TestRecordFieldResolverUpdateQuery(t *testing.T) {
 				"self_rel_one.rel_many_cascade.files:length != 7 &&" +
 				"self_rel_one.rel_many_cascade.files:length ?!= 8",
 			false,
-			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `__data_demo4` ON [[__data_demo4.id]]={:TEST} LEFT JOIN `demo3` `__data_demo3` ON [[__data_demo3.id]] IN ({:TEST}, {:TEST}) LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_one.rel_many_cascade]]) THEN [[demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[demo4_self_rel_one.rel_many_cascade]]) END) `demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `demo4_self_rel_one_rel_many_cascade` ON [[demo4_self_rel_one_rel_many_cascade.id]] = [[demo4_self_rel_one_rel_many_cascade_je.value]] WHERE (json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE (CASE WHEN [[__data_demo4.self_rel_many]] = '' OR [[__data_demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE (CASE WHEN [[__data_demo4.self_rel_many]] = '' OR [[__data_demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE (CASE WHEN [[__data_demo3.files]] = '' OR [[__data_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3.files]]) END) END) < {:TEST} AND ((json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE (CASE WHEN [[__data_demo3.files]] = '' OR [[__data_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3.files]]) END) END) < {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__data_mm_demo3.files]]) THEN [[__data_mm_demo3.files]] ELSE (CASE WHEN [[__data_mm_demo3.files]] = '' OR [[__data_mm_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_mm_demo3.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__data_mm_demo3` ON `__data_mm_demo3`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] < {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND ((json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) != {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) THEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[__mm_demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo4` `__mm_demo4_self_rel_one` ON [[__mm_demo4_self_rel_one.id]] = [[__mm_demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_one.rel_many_cascade]]) THEN [[__mm_demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[__mm_demo4_self_rel_one.rel_many_cascade]]) END) `__mm_demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `__mm_demo4_self_rel_one_rel_many_cascade` ON [[__mm_demo4_self_rel_one_rel_many_cascade.id]] = [[__mm_demo4_self_rel_one_rel_many_cascade_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] != {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) != {:TEST})",
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `__data_demo4` ON [[__data_demo4.id]]={:TEST} LEFT JOIN `demo3` `__data_demo3` ON [[__data_demo3.id]] IN ({:TEST}, {:TEST}) LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN json_valid([[demo4_self_rel_one.rel_many_cascade]]) THEN [[demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[demo4_self_rel_one.rel_many_cascade]]) END) `demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `demo4_self_rel_one_rel_many_cascade` ON [[demo4_self_rel_one_rel_many_cascade.id]] = [[demo4_self_rel_one_rel_many_cascade_je.value]] WHERE (json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE (CASE WHEN [[__data_demo4.self_rel_many]] = '' OR [[__data_demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo4.self_rel_many]]) THEN [[__data_demo4.self_rel_many]] ELSE (CASE WHEN [[__data_demo4.self_rel_many]] = '' OR [[__data_demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE (CASE WHEN [[__data_demo3.files]] = '' OR [[__data_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3.files]]) END) END) < {:TEST} AND ((json_array_length(CASE WHEN json_valid([[__data_demo3.files]]) THEN [[__data_demo3.files]] ELSE (CASE WHEN [[__data_demo3.files]] = '' OR [[__data_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3.files]]) END) END) < {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__data_mm_demo3.files]]) THEN [[__data_mm_demo3.files]] ELSE (CASE WHEN [[__data_mm_demo3.files]] = '' OR [[__data_mm_demo3.files]] IS NULL THEN json_array() ELSE json_array([[__data_mm_demo3.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__data_mm_demo3` ON `__data_mm_demo3`.`id` IN ({:TEST}, {:TEST}) WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] < {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one.self_rel_many]]) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND ((json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) IS NOT {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN json_valid([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) THEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[__mm_demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo4` `__mm_demo4_self_rel_one` ON [[__mm_demo4_self_rel_one.id]] = [[__mm_demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN json_valid([[__mm_demo4_self_rel_one.rel_many_cascade]]) THEN [[__mm_demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[__mm_demo4_self_rel_one.rel_many_cascade]]) END) `__mm_demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `__mm_demo4_self_rel_one_rel_many_cascade` ON [[__mm_demo4_self_rel_one_rel_many_cascade.id]] = [[__mm_demo4_self_rel_one_rel_many_cascade_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE ((NOT ([[__smTEST.multiMatchValue]] IS NOT {:TEST})) OR ([[__smTEST.multiMatchValue]] IS NULL))))) AND json_array_length(CASE WHEN json_valid([[demo4_self_rel_one_rel_many_cascade.files]]) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) IS NOT {:TEST})",
 		},
 		{
 			"json_extract and json_array_length COALESCE equal normalizations",
 			"demo4",
 			"json_object.a.b = '' && self_rel_many:length != 2 && json_object.a.b > 3 && self_rel_many:length <= 4",
 			false,
-			"SELECT `demo4`.* FROM `demo4` WHERE ((JSON_EXTRACT([[demo4.json_object]], '$.a.b') = '' OR JSON_EXTRACT([[demo4.json_object]], '$.a.b') IS NULL) AND json_array_length(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) != {:TEST} AND JSON_EXTRACT([[demo4.json_object]], '$.a.b') > {:TEST} AND json_array_length(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) <= {:TEST})",
+			"SELECT `demo4`.* FROM `demo4` WHERE ((JSON_EXTRACT([[demo4.json_object]], '$.a.b') = '' OR JSON_EXTRACT([[demo4.json_object]], '$.a.b') IS NULL) AND json_array_length(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) IS NOT {:TEST} AND JSON_EXTRACT([[demo4.json_object]], '$.a.b') > {:TEST} AND json_array_length(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) <= {:TEST})",
 		},
 	}
 
 	for _, s := range scenarios {
-		collection, err := app.Dao().FindCollectionByNameOrId(s.collectionIdOrName)
-		if err != nil {
-			t.Fatalf("[%s] Failed to load collection %s: %v", s.name, s.collectionIdOrName, err)
-		}
+		t.Run(s.name, func(t *testing.T) {
+			collection, err := app.Dao().FindCollectionByNameOrId(s.collectionIdOrName)
+			if err != nil {
+				t.Fatalf("[%s] Failed to load collection %s: %v", s.name, s.collectionIdOrName, err)
+			}
 
-		query := app.Dao().RecordQuery(collection)
+			query := app.Dao().RecordQuery(collection)
 
-		r := resolvers.NewRecordFieldResolver(app.Dao(), collection, requestInfo, s.allowHiddenFields)
+			r := resolvers.NewRecordFieldResolver(app.Dao(), collection, requestInfo, s.allowHiddenFields)
 
-		expr, err := search.FilterData(s.rule).BuildExpr(r)
-		if err != nil {
-			t.Fatalf("[%s] BuildExpr failed with error %v", s.name, err)
-		}
+			expr, err := search.FilterData(s.rule).BuildExpr(r)
+			if err != nil {
+				t.Fatalf("[%s] BuildExpr failed with error %v", s.name, err)
+			}
 
-		if err := r.UpdateQuery(query); err != nil {
-			t.Fatalf("[%s] UpdateQuery failed with error %v", s.name, err)
-		}
+			if err := r.UpdateQuery(query); err != nil {
+				t.Fatalf("[%s] UpdateQuery failed with error %v", s.name, err)
+			}
 
-		rawQuery := query.AndWhere(expr).Build().SQL()
+			rawQuery := query.AndWhere(expr).Build().SQL()
 
-		// replace TEST placeholder with .+ regex pattern
-		expectQuery := strings.ReplaceAll(
-			"^"+regexp.QuoteMeta(s.expectQuery)+"$",
-			"TEST",
-			`\w+`,
-		)
+			// replace TEST placeholder with .+ regex pattern
+			expectQuery := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(s.expectQuery)+"$",
+				"TEST",
+				`\w+`,
+			)
 
-		if !list.ExistInSliceWithRegex(rawQuery, []string{expectQuery}) {
-			t.Fatalf("[%s] Expected query\n %v \ngot:\n %v", s.name, expectQuery, rawQuery)
-		}
+			if !list.ExistInSliceWithRegex(rawQuery, []string{expectQuery}) {
+				t.Fatalf("[%s] Expected query\n %v \ngot:\n %v", s.name, expectQuery, rawQuery)
+			}
+		})
 	}
 }
 
@@ -391,8 +393,10 @@ func TestRecordFieldResolverResolveSchemaFields(t *testing.T) {
 		{"@collection.unknown", true, ""},
 		{"@collection.demo2", true, ""},
 		{"@collection.demo2.", true, ""},
+		{"@collection.demo2:someAlias", true, ""},
+		{"@collection.demo2:someAlias.", true, ""},
 		{"@collection.demo2.title", false, "[[__collection_demo2.title]]"},
-		{"@collection.demo4.title", false, "[[__collection_demo4.title]]"},
+		{"@collection.demo2:someAlias.title", false, "[[__collection_alias_someAlias.title]]"},
 		{"@collection.demo4.id", false, "[[__collection_demo4.id]]"},
 		{"@collection.demo4.created", false, "[[__collection_demo4.created]]"},
 		{"@collection.demo4.updated", false, "[[__collection_demo4.updated]]"},

tests/api.go

@@ -29,6 +29,11 @@ type ApiScenario struct {
 	// to ensure that all fired non-awaited go routines have finished
 	Delay time.Duration
 
+	// Timeout specifies how long to wait before cancelling the request context.
+	//
+	// A zero or negative value means that there will be no timeout.
+	Timeout time.Duration
+
 	// expectations
 	// ---
 	ExpectedStatus     int
@@ -90,9 +95,17 @@ func (scenario *ApiScenario) test(t *testing.T) {
 	// add middleware to timeout long-running requests (eg. keep-alive routes)
 	e.Pre(func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			ctx, cancelFunc := context.WithTimeout(c.Request().Context(), 100*time.Millisecond)
-			defer cancelFunc()
-			c.SetRequest(c.Request().Clone(ctx))
+			slowTimer := time.AfterFunc(3*time.Second, func() {
+				t.Logf("[WARN] Long running test %q", scenario.Name)
+			})
+			defer slowTimer.Stop()
+
+			if scenario.Timeout > 0 {
+				ctx, cancelFunc := context.WithTimeout(c.Request().Context(), scenario.Timeout)
+				defer cancelFunc()
+				c.SetRequest(c.Request().Clone(ctx))
+			}
+
 			return next(c)
 		}
 	})

tests/app.go

@@ -97,7 +97,6 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 	app := core.NewBaseApp(core.BaseAppConfig{
 		DataDir:       tempDir,
 		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
 	})
 
 	// load data dir and db connections

tests/logs.go

@@ -1,49 +1,31 @@
 package tests
 
-func MockRequestLogsData(app *TestApp) error {
+func MockLogsData(app *TestApp) error {
 	_, err := app.LogsDB().NewQuery(`
-		delete from {{_requests}};
+		delete from {{_logs}};
 
-		insert into {{_requests}} (
+		insert into {{_logs}} (
 			[[id]],
-			[[url]],
-			[[method]],
-			[[status]],
-			[[auth]],
-			[[userIp]],
-			[[remoteIp]],
-			[[referer]],
-			[[userAgent]],
-			[[meta]],
+			[[level]],
+			[[message]],
+			[[data]],
 			[[created]],
 			[[updated]]
 		)
 		values
 		(
 			"873f2133-9f38-44fb-bf82-c8f53b310d91",
-			"/test1",
-			"get",
-			200,
-			"guest",
-			"127.0.0.1",
-			"127.0.0.1",
-			"",
-			"",
-			"{}",
+			0,
+			"test_message1",
+			'{"status":200}',
 			"2022-05-01 10:00:00.123Z",
 			"2022-05-01 10:00:00.123Z"
 		),
 		(
 			"f2133873-44fb-9f38-bf82-c918f53b310d",
-			"/test2",
-			"post",
-			400,
-			"admin",
-			"127.0.0.1",
-			"127.0.0.1",
-			"",
-			"",
-			'{"errorDetails":"error_details..."}',
+			8,
+			"test_message2",
+			'{"status":400}',
 			"2022-05-02 10:00:00.123Z",
 			"2022-05-02 10:00:00.123Z"
 		);

tools/auth/apple.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"github.com/golang-jwt/jwt/v4"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 	"golang.org/x/oauth2"
 )
@@ -35,10 +36,12 @@ type Apple struct {
 func NewAppleProvider() *Apple {
 	return &Apple{
 		baseProvider: &baseProvider{
-			scopes:   nil, // custom scopes are currently not supported since they require a POST redirect
-			ctx:      context.Background(),
-			authUrl:  "https://appleid.apple.com/auth/authorize",
-			tokenUrl: "https://appleid.apple.com/auth/token",
+			ctx:         context.Background(),
+			displayName: "Apple",
+			pkce:        true,
+			scopes:      nil, // custom scopes are currently not supported since they require a POST redirect
+			authUrl:     "https://appleid.apple.com/auth/authorize",
+			tokenUrl:    "https://appleid.apple.com/auth/token",
 		},
 		jwksUrl: "https://appleid.apple.com/auth/keys",
 	}
@@ -74,6 +77,8 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		RefreshToken: token.RefreshToken,
 	}
 
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
 	if cast.ToBool(extracted.EmailVerified) {
 		user.Email = extracted.Email
 	}

tools/auth/auth.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net/http"
 
+	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/oauth2"
 )
 
@@ -15,9 +16,10 @@ type AuthUser struct {
 	Username     string         `json:"username"`
 	Email        string         `json:"email"`
 	AvatarUrl    string         `json:"avatarUrl"`
-	RawUser      map[string]any `json:"rawUser"`
 	AccessToken  string         `json:"accessToken"`
 	RefreshToken string         `json:"refreshToken"`
+	Expiry       types.DateTime `json:"expiry"`
+	RawUser      map[string]any `json:"rawUser"`
 }
 
 // Provider defines a common interface for an OAuth2 client.
@@ -28,6 +30,19 @@ type Provider interface {
 	// SetContext assigns the specified context to the current provider.
 	SetContext(ctx context.Context)
 
+	// PKCE indicates whether the provider can use the PKCE flow.
+	PKCE() bool
+
+	// SetPKCE toggles the state whether the provider can use the PKCE flow or not.
+	SetPKCE(enable bool)
+
+	// DisplayName usually returns provider name as it is officially written
+	// and it could be used directly in the UI.
+	DisplayName() string
+
+	// SetDisplayName sets the provider's display name.
+	SetDisplayName(displayName string)
+
 	// Scopes returns the provider access permissions that will be requested.
 	Scopes() []string
 
@@ -135,6 +150,10 @@ func NewProviderByName(name string) (Provider, error) {
 		return NewVKProvider(), nil
 	case NameYandex:
 		return NewYandexProvider(), nil
+	case NamePatreon:
+		return NewPatreonProvider(), nil
+	case NameMailcow:
+		return NewMailcowProvider(), nil
 	default:
 		return nil, errors.New("Missing provider " + name)
 	}

tools/auth/auth_test.go

@@ -205,6 +205,24 @@ func TestNewProviderByName(t *testing.T) {
 		t.Errorf("Expected nil, got error %v", err)
 	}
 	if _, ok := p.(*auth.Yandex); !ok {
-		t.Error("Expected to be instance of *auth.yandex")
+		t.Error("Expected to be instance of *auth.Yandex")
+	}
+
+	// patreon
+	p, err = auth.NewProviderByName(auth.NamePatreon)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Patreon); !ok {
+		t.Error("Expected to be instance of *auth.Patreon")
+	}
+
+	// mailcow
+	p, err = auth.NewProviderByName(auth.NameMailcow)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Mailcow); !ok {
+		t.Error("Expected to be instance of *auth.Mailcow")
 	}
 }

tools/auth/base_provider.go

@@ -12,13 +12,15 @@ import (
 // baseProvider defines common fields and methods used by OAuth2 client providers.
 type baseProvider struct {
 	ctx          context.Context
-	scopes       []string
 	clientId     string
 	clientSecret string
+	displayName  string
 	redirectUrl  string
 	authUrl      string
 	tokenUrl     string
 	userApiUrl   string
+	scopes       []string
+	pkce         bool
 }
 
 // Context implements Provider.Context() interface method.
@@ -31,6 +33,26 @@ func (p *baseProvider) SetContext(ctx context.Context) {
 	p.ctx = ctx
 }
 
+// PKCE implements Provider.PKCE() interface method.
+func (p *baseProvider) PKCE() bool {
+	return p.pkce
+}
+
+// SetPKCE implements Provider.SetPKCE() interface method.
+func (p *baseProvider) SetPKCE(enable bool) {
+	p.pkce = enable
+}
+
+// DisplayName implements Provider.DisplayName() interface method.
+func (p *baseProvider) DisplayName() string {
+	return p.displayName
+}
+
+// SetDisplayName implements Provider.SetDisplayName() interface method.
+func (p *baseProvider) SetDisplayName(displayName string) {
+	p.displayName = displayName
+}
+
 // Scopes implements Provider.Scopes() interface method.
 func (p *baseProvider) Scopes() []string {
 	return p.scopes