(backported) upgraded default modernc.org driver to fix arm64 disk io error

Co-authored-by: alxjsn <alxjsn@sameorigin.org>

.github/FUNDING.yaml

@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: pocketbase
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-custom: ['https://www.paypal.com/donate/?hosted_button_id=4DVXNL4B8WT98']

.github/workflows/release.yaml

@@ -9,19 +9,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: latest
+          node-version: 20.11.0
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.0'
+          go-version: '>=1.22.8'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

.goreleaser.yaml

@@ -51,8 +51,8 @@ archives:
     builds: [build_noncgo]
     format: zip
     files:
-      - LICENSE*
-      - CHANGELOG*
+      - LICENSE.md
+      - CHANGELOG.md
 
 checksum:
   name_template: 'checksums.txt'

CONTRIBUTING.md

@@ -1,5 +1,4 @@
-Contributing to PocketBase
-======================================================================
+# Contributing to PocketBase
 
 Thanks for taking the time to improve PocketBase!
 
@@ -9,26 +8,26 @@ This document describes how to prepare a PR for a change in the main repository.
 - [Making changes in the Go code](#making-changes-in-the-go-code)
 - [Making changes in the Admin UI](#making-changes-in-the-admin-ui)
 
-
 ## Prerequisites
 
-- Go 1.18+ (for making changes in the Go code)
-- Node 16+ (for making changes in the Admin UI)
+- Go 1.22+ (for making changes in the Go code)
+- Node 18+ (for making changes in the Admin UI)
 
 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
+
 ```
 git clone https://github.com/your_username/pocketbase.git
 ```
 
+> [!IMPORTANT]
 > It is recommended to create a new branch from master for each of your bugfixes and features.
 > This is required if you are planning to submit multiple PRs in order to keep the changes separate for review until they eventually get merged.
 
-
 ## Making changes in the Go code
 
 PocketBase is distributed as a Go package, which means that in order to run the project you'll have to create a Go `main` program that imports the package.
 
-The repository already includes such program, located in `/examples/base`, that is also used for the prebuilt executables.
+The repository already includes such program, located in `examples/base`, that is also used for the prebuilt executables.
 
 So, let's assume that you already done some changes in the PocketBase Go code and you want now to run them:
 
@@ -41,20 +40,22 @@ This will start a web server on `http://localhost:8090` with the embedded prebui
 
 - Add unit/integration tests for your changes (we are using the standard `testing` go package).
   To run the tests, you could execute (while in the root project directory):
-    ```sh
-    go test ./...
 
-    # or using the Makefile
-    make test
-    ```
+  ```sh
+  go test ./...
+
+  # or using the Makefile
+  make test
+  ```
 
 - Run the linter - **golangci** ([see how to install](https://golangci-lint.run/usage/install/#local-installation)):
-    ```sh
-    golangci-lint run -c ./golangci.yml ./...
 
-    # or using the Makefile
-    make lint
-    ```
+  ```sh
+  golangci-lint run -c ./golangci.yml ./...
+
+  # or using the Makefile
+  make lint
+  ```
 
 ## Making changes in the Admin UI
 
@@ -65,14 +66,15 @@ To start the Admin UI:
 1. Navigate to the `ui` project directory
 2. Run `npm install` to install the node dependencies
 3. Start vite's dev server
-    ```sh
-    npm run dev
-    ```
+   ```sh
+   npm run dev
+   ```
 
 You could open the browser and access the running Admin UI at `http://localhost:3000`.
 
 Since the Admin UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
 
+> [!NOTE]
 > By default, the Admin UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
 
 Every change you make in the Admin UI should be automatically reflected in the browser at `http://localhost:3000` without reloading the page.

README.md

@@ -7,7 +7,7 @@
 <p align="center">
     <a href="https://github.com/pocketbase/pocketbase/actions/workflows/release.yaml" target="_blank" rel="noopener"><img src="https://github.com/pocketbase/pocketbase/actions/workflows/release.yaml/badge.svg" alt="build" /></a>
     <a href="https://github.com/pocketbase/pocketbase/releases" target="_blank" rel="noopener"><img src="https://img.shields.io/github/release/pocketbase/pocketbase.svg" alt="Latest releases" /></a>
-    <a href="https://pkg.go.dev/github.com/pocketbase/pocketbase" target="_blank" rel="noopener"><img src="https://godoc.org/github.com/ganigeorgiev/fexpr?status.svg" alt="Go package documentation" /></a>
+    <a href="https://pkg.go.dev/github.com/pocketbase/pocketbase" target="_blank" rel="noopener"><img src="https://godoc.org/github.com/pocketbase/pocketbase?status.svg" alt="Go package documentation" /></a>
 </p>
 
 [PocketBase](https://pocketbase.io) is an open source Go backend, consisting of:
@@ -19,10 +19,10 @@
 
 **For documentation and examples, please visit https://pocketbase.io/docs.**
 
-> ⚠️ Please keep in mind that PocketBase is still under active development
+> [!WARNING]
+> Please keep in mind that PocketBase is still under active development
 > and therefore full backward compatibility is not guaranteed before reaching v1.0.0.
 
-
 ## API SDK clients
 
 The easiest way to interact with the API is to use one of the official SDK clients:
@@ -30,79 +30,90 @@ The easiest way to interact with the API is to use one of the official SDK clien
 - **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_browser and node_)
 - **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_web, mobile, desktop_)
 
-
 ## Overview
 
-PocketBase could be [downloaded directly as a standalone app](https://github.com/pocketbase/pocketbase/releases) or it could be used as a Go framework/toolkit which allows you to build
+### Use as standalone app
+
+You could download the prebuilt executable for your platform from the [Releases page](https://github.com/pocketbase/pocketbase/releases).
+Once downloaded, extract the archive and run `./pocketbase serve` in the extracted directory.
+
+The prebuilt executables are based on the [`examples/base/main.go` file](https://github.com/pocketbase/pocketbase/blob/master/examples/base/main.go) and comes with the JS VM plugin enabled by default which allows to extend PocketBase with JavaScript (_for more details please refer to [Extend with JavaScript](https://pocketbase.io/docs/js-overview/)_).
+
+### Use as a Go framework/toolkit
+
+PocketBase is distributed as a regular Go library package which allows you to build
 your own custom app specific business logic and still have a single portable executable at the end.
 
-### Installation
+Here is a minimal example:
 
-```sh
-# go 1.18+
-go get github.com/pocketbase/pocketbase
-```
-> For Windows, you may have to use go 1.19+ due to an incorrect js mime type in the Windows Registry (see [issue#6](https://github.com/pocketbase/pocketbase/issues/6)).
+0. [Install Go 1.22+](https://go.dev/doc/install) (_if you haven't already_)
 
-### Example
+1. Create a new project directory with the following `main.go` file inside it:
+    ```go
+    package main
 
-```go
-package main
+    import (
+        "log"
+        "net/http"
 
-import (
-    "log"
-    "net/http"
+        "github.com/labstack/echo/v5"
+        "github.com/pocketbase/pocketbase"
+        "github.com/pocketbase/pocketbase/apis"
+        "github.com/pocketbase/pocketbase/core"
+    )
 
-    "github.com/labstack/echo/v5"
-    "github.com/pocketbase/pocketbase"
-    "github.com/pocketbase/pocketbase/apis"
-    "github.com/pocketbase/pocketbase/core"
-)
+    func main() {
+        app := pocketbase.New()
 
-func main() {
-    app := pocketbase.New()
+        app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
+            // add new "GET /hello" route to the app router (echo)
+            e.Router.AddRoute(echo.Route{
+                Method: http.MethodGet,
+                Path:   "/hello",
+                Handler: func(c echo.Context) error {
+                    return c.String(200, "Hello world!")
+                },
+                Middlewares: []echo.MiddlewareFunc{
+                    apis.ActivityLogger(app),
+                },
+            })
 
-    app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
-        // add new "GET /hello" route to the app router (echo)
-        e.Router.AddRoute(echo.Route{
-            Method: http.MethodGet,
-            Path:   "/hello",
-            Handler: func(c echo.Context) error {
-                return c.String(200, "Hello world!")
-            },
-            Middlewares: []echo.MiddlewareFunc{
-                apis.ActivityLogger(app),
-            },
+            return nil
         })
 
-        return nil
-    })
-
-    if err := app.Start(); err != nil {
-        log.Fatal(err)
+        if err := app.Start(); err != nil {
+            log.Fatal(err)
+        }
     }
-}
-```
+    ```
 
-### Running and building
+2. To init the dependencies, run `go mod init myapp && go mod tidy`.
 
-Running/building the application is the same as for any other Go program, aka. just `go run` and `go build`.
+3. To start the application, run `go run main.go serve`.
 
-**PocketBase embeds SQLite, but doesn't require CGO.**
+4. To build a statically linked executable, you can run `CGO_ENABLED=0 go build` and then start the created executable with `./myapp serve`.
 
-If CGO is enabled (aka. `CGO_ENABLED=1`), it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite).
-Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
+> [!NOTE]
+> PocketBase embeds SQLite, but doesn't require CGO.
+>
+> If CGO is enabled (aka. `CGO_ENABLED=1`), it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite).
+> Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
+
+_For more details please refer to [Extend with Go](https://pocketbase.io/docs/go-overview/)._
+
+### Building and running the repo main.go example
 
 To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:
 
-0. [Install Go 1.18+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
 1. Clone/download the repo
 2. Navigate to `examples/base`
 3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
-    (_https://go.dev/doc/install/source#environment_)
+   (_https://go.dev/doc/install/source#environment_)
 4. Start the created executable by running `./base serve`.
 
-The supported build targets by the non-cgo driver at the moment are:
+Note that the supported build targets by the pure Go SQLite driver at the moment are:
+
 ```
 darwin  amd64
 darwin  arm64
@@ -114,6 +125,7 @@ linux   arm
 linux   arm64
 linux   ppc64le
 linux   riscv64
+linux   s390x
 windows amd64
 windows arm64
 ```
@@ -121,7 +133,8 @@ windows arm64
 ### Testing
 
 PocketBase comes with mixed bag of unit and integration tests.
-To run them, use the default `go test` command:
+To run them, use the standard `go test` command:
+
 ```sh
 go test ./...
 ```
@@ -134,7 +147,6 @@ If you discover a security vulnerability within PocketBase, please send an e-mai
 
 All reports will be promptly addressed, and you'll be credited accordingly.
 
-
 ## Contributing
 
 PocketBase is free and open source project licensed under the [MIT License](LICENSE.md).
@@ -144,7 +156,6 @@ You could help continuing its development by:
 
 - [Contribute to the source code](CONTRIBUTING.md)
 - [Suggest new features and report issues](https://github.com/pocketbase/pocketbase/issues)
-- [Donate a small amount](https://pocketbase.io/support-us)
 
 PRs for new OAuth2 providers, bug fixes, code optimizations and documentation improvements are more than welcome.
 
@@ -153,6 +164,3 @@ PocketBase has a [roadmap](https://github.com/orgs/pocketbase/projects/2) and I
 
 Don't get upset if I close your PR, even if it is well executed and tested. This doesn't mean that it will never be merged.
 Later we can always refer to it and/or take pieces of your implementation when the time comes to work on the issue (don't worry you'll be credited in the release notes).
-
-_Please also note that PocketBase was initially created to serve as a new backend for my other open source project - [Presentator](https://presentator.io) (see [#183](https://github.com/presentator/presentator/issues/183)),
-so all feature requests will be first aligned with what we need for Presentator v3._

apis/admin.go

@@ -1,7 +1,6 @@
 package apis
 
 import (
-	"log"
 	"net/http"
 
 	"github.com/labstack/echo/v5"
@@ -129,9 +128,8 @@ func (api *adminApi) requestPasswordReset(c echo.Context) error {
 			return api.app.OnAdminBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Admin); err != nil && api.app.IsDebug() {
-						// @todo replace after logs generalization
-						log.Println(err)
+					if err := next(e.Admin); err != nil {
+						api.app.Logger().Error("Failed to send admin password reset request.", "error", err)
 					}
 				})
 

apis/admin_test.go

@@ -17,6 +17,8 @@ import (
 )
 
 func TestAdminAuthWithPassword(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -119,6 +121,8 @@ func TestAdminAuthWithPassword(t *testing.T) {
 }
 
 func TestAdminRequestPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -188,6 +192,8 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 }
 
 func TestAdminConfirmPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -277,6 +283,8 @@ func TestAdminConfirmPasswordReset(t *testing.T) {
 }
 
 func TestAdminRefresh(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -350,6 +358,8 @@ func TestAdminRefresh(t *testing.T) {
 }
 
 func TestAdminsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -453,6 +463,8 @@ func TestAdminsList(t *testing.T) {
 }
 
 func TestAdminView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -508,6 +520,8 @@ func TestAdminView(t *testing.T) {
 }
 
 func TestAdminDelete(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -603,6 +617,8 @@ func TestAdminDelete(t *testing.T) {
 }
 
 func TestAdminCreate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized (while having at least 1 existing admin)",
@@ -757,6 +773,8 @@ func TestAdminCreate(t *testing.T) {
 }
 
 func TestAdminUpdate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",

apis/api_error_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestNewApiErrorWithRawData(t *testing.T) {
+	t.Parallel()
+
 	e := apis.NewApiError(
 		300,
 		"message_test",
@@ -33,6 +35,8 @@ func TestNewApiErrorWithRawData(t *testing.T) {
 }
 
 func TestNewApiErrorWithValidationData(t *testing.T) {
+	t.Parallel()
+
 	e := apis.NewApiError(
 		300,
 		"message_test",
@@ -66,6 +70,8 @@ func TestNewApiErrorWithValidationData(t *testing.T) {
 }
 
 func TestNewNotFoundError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -87,6 +93,8 @@ func TestNewNotFoundError(t *testing.T) {
 }
 
 func TestNewBadRequestError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -108,6 +116,8 @@ func TestNewBadRequestError(t *testing.T) {
 }
 
 func TestNewForbiddenError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -129,6 +139,8 @@ func TestNewForbiddenError(t *testing.T) {
 }
 
 func TestNewUnauthorizedError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any

apis/backup.go

@@ -2,7 +2,6 @@ package apis
 
 import (
 	"context"
-	"log"
 	"net/http"
 	"path/filepath"
 	"time"
@@ -69,7 +68,7 @@ func (api *backupApi) list(c echo.Context) error {
 }
 
 func (api *backupApi) create(c echo.Context) error {
-	if api.app.Cache().Has(core.CacheKeyActiveBackup) {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
 		return NewBadRequestError("Try again later - another backup/restore process has already been started", nil)
 	}
 
@@ -152,7 +151,7 @@ func (api *backupApi) download(c echo.Context) error {
 }
 
 func (api *backupApi) restore(c echo.Context) error {
-	if api.app.Cache().Has(core.CacheKeyActiveBackup) {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
 		return NewBadRequestError("Try again later - another backup/restore process has already been started.", nil)
 	}
 
@@ -181,8 +180,8 @@ func (api *backupApi) restore(c echo.Context) error {
 		// give some optimistic time to write the response
 		time.Sleep(1 * time.Second)
 
-		if err := api.app.RestoreBackup(ctx, key); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := api.app.RestoreBackup(ctx, key); err != nil {
+			api.app.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
 		}
 	}()
 
@@ -203,7 +202,7 @@ func (api *backupApi) delete(c echo.Context) error {
 
 	key := c.PathParam("key")
 
-	if key != "" && cast.ToString(api.app.Cache().Get(core.CacheKeyActiveBackup)) == key {
+	if key != "" && cast.ToString(api.app.Store().Get(core.StoreKeyActiveBackup)) == key {
 		return NewBadRequestError("The backup is currently being used and cannot be deleted.", nil)
 	}
 

apis/backup_test.go

@@ -17,6 +17,8 @@ import (
 )
 
 func TestBackupsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "unauthorized",
@@ -84,6 +86,8 @@ func TestBackupsList(t *testing.T) {
 }
 
 func TestBackupsCreate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "unauthorized",
@@ -116,7 +120,7 @@ func TestBackupsCreate(t *testing.T) {
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				app.Cache().Set(core.CacheKeyActiveBackup, "")
+				app.Store().Set(core.StoreKeyActiveBackup, "")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				ensureNoBackups(t, app)
@@ -198,6 +202,8 @@ func TestBackupsCreate(t *testing.T) {
 }
 
 func TestBackupsUpload(t *testing.T) {
+	t.Parallel()
+
 	// create dummy form data bodies
 	type body struct {
 		buffer      io.Reader
@@ -330,6 +336,8 @@ func TestBackupsUpload(t *testing.T) {
 }
 
 func TestBackupsDownload(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "unauthorized",
@@ -485,6 +493,8 @@ func TestBackupsDownload(t *testing.T) {
 }
 
 func TestBackupsDelete(t *testing.T) {
+	t.Parallel()
+
 	noTestBackupFilesChanges := func(t *testing.T, app *tests.TestApp) {
 		files, err := getBackupFiles(app)
 		if err != nil {
@@ -562,7 +572,7 @@ func TestBackupsDelete(t *testing.T) {
 				}
 
 				// mock active backup with the same name to delete
-				app.Cache().Set(core.CacheKeyActiveBackup, "test1.zip")
+				app.Store().Set(core.StoreKeyActiveBackup, "test1.zip")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				noTestBackupFilesChanges(t, app)
@@ -583,7 +593,7 @@ func TestBackupsDelete(t *testing.T) {
 				}
 
 				// mock active backup with different name
-				app.Cache().Set(core.CacheKeyActiveBackup, "new.zip")
+				app.Store().Set(core.StoreKeyActiveBackup, "new.zip")
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				files, err := getBackupFiles(app)
@@ -645,6 +655,8 @@ func TestBackupsDelete(t *testing.T) {
 }
 
 func TestBackupsRestore(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "unauthorized",
@@ -700,7 +712,7 @@ func TestBackupsRestore(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				app.Cache().Set(core.CacheKeyActiveBackup, "")
+				app.Store().Set(core.StoreKeyActiveBackup, "")
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},

apis/base.go

@@ -6,11 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"log"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/labstack/echo/v5/middleware"
@@ -26,9 +27,10 @@ const trailedAdminPath = "/_/"
 // system and app specific routes and middlewares.
 func InitApi(app core.App) (*echo.Echo, error) {
 	e := echo.New()
-	e.Debug = app.IsDebug()
+	e.Debug = false
+	e.Binder = &rest.MultiBinder{}
 	e.JSONSerializer = &rest.Serializer{
-		FieldsParam: "fields",
+		FieldsParam: fieldsQueryParam,
 	}
 
 	// configure a custom router
@@ -49,6 +51,13 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	e.Pre(LoadAuthContext(app))
 	e.Use(middleware.Recover())
 	e.Use(middleware.Secure())
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set(ContextExecStartKey, time.Now())
+
+			return next(c)
+		}
+	})
 
 	// custom error handler
 	e.HTTPErrorHandler = func(c echo.Context, err error) {
@@ -56,30 +65,14 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			return // no error
 		}
 
-		if c.Response().Committed {
-			if app.IsDebug() {
-				log.Println("HTTPErrorHandler response was already committed:", err)
-			}
-			return
-		}
-
 		var apiErr *ApiError
 
 		if errors.As(err, &apiErr) {
-			if app.IsDebug() && apiErr.RawData() != nil {
-				log.Println(apiErr.RawData())
-			}
+			// already an api error...
 		} else if v := new(echo.HTTPError); errors.As(err, &v) {
-			if v.Internal != nil && app.IsDebug() {
-				log.Println(v.Internal)
-			}
 			msg := fmt.Sprintf("%v", v.Message)
 			apiErr = NewApiError(v.Code, msg, v)
 		} else {
-			if app.IsDebug() {
-				log.Println(err)
-			}
-
 			if errors.Is(err, sql.ErrNoRows) {
 				apiErr = NewNotFoundError("", err)
 			} else {
@@ -87,13 +80,19 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			}
 		}
 
+		logRequest(app, c, apiErr)
+
+		if c.Response().Committed {
+			return // already committed
+		}
+
 		event := new(core.ApiErrorEvent)
 		event.HttpContext = c
 		event.Error = apiErr
 
 		// send error response
 		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {
-			if c.Response().Committed {
+			if e.HttpContext.Response().Committed {
 				return nil
 			}
 
@@ -106,12 +105,11 @@ func InitApi(app core.App) (*echo.Echo, error) {
 		})
 
 		if hookErr == nil {
-			if err := app.OnAfterApiError().Trigger(event); err != nil && app.IsDebug() {
-				log.Println(hookErr)
+			if err := app.OnAfterApiError().Trigger(event); err != nil {
+				app.Logger().Debug("OnAfterApiError failure", slog.String("error", err.Error()))
 			}
-		} else if app.IsDebug() {
-			// truly rare case; eg. client already disconnected
-			log.Println(hookErr)
+		} else {
+			app.Logger().Debug("OnBeforeApiError error (truly rare case, eg. client already disconnected)", slog.String("error", hookErr.Error()))
 		}
 	}
 
@@ -215,7 +213,7 @@ func updateHasAdminsCache(app core.App) error {
 		return err
 	}
 
-	app.Cache().Set(hasAdminsCacheKey, total > 0)
+	app.Store().Set(hasAdminsCacheKey, total > 0)
 
 	return nil
 }
@@ -240,14 +238,14 @@ func installerRedirect(app core.App) echo.MiddlewareFunc {
 				return next(c)
 			}
 
-			hasAdmins := cast.ToBool(app.Cache().Get(hasAdminsCacheKey))
+			hasAdmins := cast.ToBool(app.Store().Get(hasAdminsCacheKey))
 
 			if !hasAdmins {
 				// update the cache to make sure that the admin wasn't created by another process
 				if err := updateHasAdminsCache(app); err != nil {
 					return err
 				}
-				hasAdmins = cast.ToBool(app.Cache().Get(hasAdminsCacheKey))
+				hasAdmins = cast.ToBool(app.Store().Get(hasAdminsCacheKey))
 			}
 
 			_, hasInstallerParam := c.Request().URL.Query()["installer"]

apis/base_test.go

@@ -11,10 +11,13 @@ import (
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/spf13/cast"
 )
 
 func Test404(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Method:          http.MethodGet,
@@ -53,6 +56,8 @@ func Test404(t *testing.T) {
 }
 
 func TestCustomRoutesAndErrorsHandling(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "custom route",
@@ -142,6 +147,8 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 }
 
 func TestRemoveTrailingSlashMiddleware(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "non /api/* route (exact match)",
@@ -214,13 +221,24 @@ func TestRemoveTrailingSlashMiddleware(t *testing.T) {
 	}
 }
 
-func TestEagerRequestInfoCache(t *testing.T) {
+func TestMultiBinder(t *testing.T) {
+	t.Parallel()
+
+	rawJson := `{"name":"test123"}`
+
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: rawJson,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	scenarios := []tests.ApiScenario{
 		{
-			Name:   "custom non-api group route",
+			Name:   "non-api group route",
 			Method: "POST",
 			Url:    "/custom",
-			Body:   strings.NewReader(`{"name":"test123"}`),
+			Body:   strings.NewReader(rawJson),
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: "POST",
@@ -234,11 +252,10 @@ func TestEagerRequestInfoCache(t *testing.T) {
 							return err
 						}
 
-						// since the unknown method is not eager cache support
-						// it should fail reading the json body twice
+						// try to read the body again
 						r := apis.RequestInfo(c)
-						if v := cast.ToString(r.Data["name"]); v != "" {
-							t.Fatalf("Expected empty request data body, got, %v", r.Data)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
 						}
 
 						return c.NoContent(200)
@@ -248,41 +265,10 @@ func TestEagerRequestInfoCache(t *testing.T) {
 			ExpectedStatus: 200,
 		},
 		{
-			Name:   "api group route with unsupported eager cache request method",
+			Name:   "api group route",
 			Method: "GET",
 			Url:    "/api/admins",
-			Body:   strings.NewReader(`{"name":"test123"}`),
-			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
-					return func(c echo.Context) error {
-						// it is not important whether the route handler return an error since
-						// we just need to ensure that the eagerRequestInfoCache was registered
-						next(c)
-
-						// ensure that the body was read at least once
-						data := &struct {
-							Name string `json:"name"`
-						}{}
-						c.Bind(data)
-
-						// since the unknown method is not eager cache support
-						// it should fail reading the json body twice
-						r := apis.RequestInfo(c)
-						if v := cast.ToString(r.Data["name"]); v != "" {
-							t.Fatalf("Expected empty request data body, got, %v", r.Data)
-						}
-
-						return nil
-					}
-				})
-			},
-			ExpectedStatus: 200,
-		},
-		{
-			Name:   "api group route with supported eager cache request method",
-			Method: "POST",
-			Url:    "/api/admins",
-			Body:   strings.NewReader(`{"name":"test123"}`),
+			Body:   strings.NewReader(rawJson),
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
 					return func(c echo.Context) error {
@@ -308,6 +294,39 @@ func TestEagerRequestInfoCache(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 		},
+		{
+			Name:   "custom route with @jsonPayload as multipart body",
+			Method: "POST",
+			Url:    "/custom",
+			Body:   formData,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: "POST",
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+
+						if err := c.Bind(data); err != nil {
+							return err
+						}
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return c.NoContent(200)
+					},
+				})
+			},
+			ExpectedStatus: 200,
+		},
 	}
 
 	for _, scenario := range scenarios {
@@ -316,6 +335,8 @@ func TestEagerRequestInfoCache(t *testing.T) {
 }
 
 func TestErrorHandler(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "apis.ApiError",

apis/collection_test.go

@@ -17,6 +17,8 @@ import (
 )
 
 func TestCollectionsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -125,6 +127,8 @@ func TestCollectionsList(t *testing.T) {
 }
 
 func TestCollectionView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -193,6 +197,8 @@ func TestCollectionView(t *testing.T) {
 }
 
 func TestCollectionDelete(t *testing.T) {
+	t.Parallel()
+
 	ensureDeletedFiles := func(app *tests.TestApp, collectionId string) {
 		storageDir := filepath.Join(app.DataDir(), "storage", collectionId)
 
@@ -338,6 +344,8 @@ func TestCollectionDelete(t *testing.T) {
 }
 
 func TestCollectionCreate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -425,7 +433,7 @@ func TestCollectionCreate(t *testing.T) {
 				`"type":"auth"`,
 				`"system":false`,
 				`"schema":[{"system":false,"id":"12345789","name":"test","type":"text","required":false,"presentable":false,"unique":false,"options":{"min":null,"max":null,"pattern":""}}]`,
-				`"options":{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":0,"onlyEmailDomains":null,"requireEmail":false}`,
+				`"options":{"allowEmailAuth":false,"allowOAuth2Auth":false,"allowUsernameAuth":false,"exceptEmailDomains":null,"manageRule":null,"minPasswordLength":0,"onlyEmailDomains":null,"onlyVerified":false,"requireEmail":false}`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeCreate":             1,
@@ -715,6 +723,8 @@ func TestCollectionCreate(t *testing.T) {
 }
 
 func TestCollectionUpdate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -883,7 +893,8 @@ func TestCollectionUpdate(t *testing.T) {
 					{"type":"text","name":"password"},
 					{"type":"text","name":"passwordConfirm"},
 					{"type":"text","name":"oldPassword"}
-				]
+				],
+				"indexes": []
 			}`),
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
@@ -1082,6 +1093,8 @@ func TestCollectionUpdate(t *testing.T) {
 }
 
 func TestCollectionsImport(t *testing.T) {
+	t.Parallel()
+
 	totalCollections := 11
 
 	scenarios := []tests.ApiScenario{
@@ -1141,7 +1154,7 @@ func TestCollectionsImport(t *testing.T) {
 			},
 			ExpectedEvents: map[string]int{
 				"OnCollectionsBeforeImportRequest": 1,
-				"OnModelBeforeDelete":              4,
+				"OnModelBeforeDelete":              1,
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				collections := []*models.Collection{}

apis/file.go

@@ -1,19 +1,26 @@
 package apis
 
 import (
+	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
+	"runtime"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
+	"golang.org/x/sync/singleflight"
 )
 
 var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif"}
@@ -21,7 +28,12 @@ var defaultThumbSizes = []string{"100x100"}
 
 // bindFileApi registers the file api endpoints and the corresponding handlers.
 func bindFileApi(app core.App, rg *echo.Group) {
-	api := fileApi{app: app}
+	api := fileApi{
+		app:             app,
+		thumbGenSem:     semaphore.NewWeighted(int64(runtime.NumCPU() + 2)), // the value is arbitrary chosen and may change in the future
+		thumbGenPending: new(singleflight.Group),
+		thumbGenMaxWait: 60 * time.Second,
+	}
 
 	subGroup := rg.Group("/files", ActivityLogger(app))
 	subGroup.POST("/token", api.fileToken)
@@ -31,6 +43,18 @@ func bindFileApi(app core.App, rg *echo.Group) {
 
 type fileApi struct {
 	app core.App
+
+	// thumbGenSem is a semaphore to prevent too much concurrent
+	// requests generating new thumbs at the same time.
+	thumbGenSem *semaphore.Weighted
+
+	// thumbGenPending represents a group of currently pending
+	// thumb generation processes.
+	thumbGenPending *singleflight.Group
+
+	// thumbGenMaxWait is the maximum waiting time for starting a new
+	// thumb generation process.
+	thumbGenMaxWait time.Duration
 }
 
 func (api *fileApi) fileToken(c echo.Context) error {
@@ -87,7 +111,7 @@ func (api *fileApi) download(c echo.Context) error {
 
 	options, ok := fileField.Options.(*schema.FileOptions)
 	if !ok {
-		return NewBadRequestError("", errors.New("Failed to load file options."))
+		return NewBadRequestError("", errors.New("failed to load file options"))
 	}
 
 	// check whether the request is authorized to view the protected file
@@ -98,6 +122,7 @@ func (api *fileApi) download(c echo.Context) error {
 
 		// create a copy of the cached request data and adjust it for the current auth model
 		requestInfo := *RequestInfo(c)
+		requestInfo.Context = models.RequestInfoContextProtectedFile
 		requestInfo.Admin = nil
 		requestInfo.AuthRecord = nil
 		if adminOrAuthRecord != nil {
@@ -124,11 +149,11 @@ func (api *fileApi) download(c echo.Context) error {
 		baseFilesPath = fileRecord.BaseFilesPath()
 	}
 
-	fs, err := api.app.NewFilesystem()
+	fsys, err := api.app.NewFilesystem()
 	if err != nil {
 		return NewBadRequestError("Filesystem initialization failure.", err)
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	originalPath := baseFilesPath + "/" + filename
 	servedPath := originalPath
@@ -138,7 +163,7 @@ func (api *fileApi) download(c echo.Context) error {
 	thumbSize := c.QueryParam("thumb")
 	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, options.Thumbs)) {
 		// extract the original file meta attributes and check it existence
-		oAttrs, oAttrsErr := fs.Attributes(originalPath)
+		oAttrs, oAttrsErr := fsys.Attributes(originalPath)
 		if oAttrsErr != nil {
 			return NewNotFoundError("", err)
 		}
@@ -149,10 +174,19 @@ func (api *fileApi) download(c echo.Context) error {
 			servedName = thumbSize + "_" + filename
 			servedPath = baseFilesPath + "/thumbs_" + filename + "/" + servedName
 
-			// create a new thumb if it doesn exists
-			if exists, _ := fs.Exists(servedPath); !exists {
-				if err := fs.CreateThumb(originalPath, servedPath, thumbSize); err != nil {
-					servedPath = originalPath // fallback to the original
+			// create a new thumb if it doesn't exist
+			if exists, _ := fsys.Exists(servedPath); !exists {
+				if err := api.createThumb(c, fsys, originalPath, servedPath, thumbSize); err != nil {
+					api.app.Logger().Warn(
+						"Fallback to original - failed to create thumb "+servedName,
+						slog.Any("error", err),
+						slog.String("original", originalPath),
+						slog.String("thumb", servedPath),
+					)
+
+					// fallback to the original
+					servedName = filename
+					servedPath = originalPath
 				}
 			}
 		}
@@ -176,7 +210,7 @@ func (api *fileApi) download(c echo.Context) error {
 			return nil
 		}
 
-		if err := fs.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
+		if err := fsys.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
 			return NewNotFoundError("", err)
 		}
 
@@ -214,3 +248,29 @@ func (api *fileApi) findAdminOrAuthRecordByFileToken(fileToken string) (models.M
 
 	return nil, errors.New("missing or invalid file token")
 }
+
+func (api *fileApi) createThumb(
+	c echo.Context,
+	fsys *filesystem.System,
+	originalPath string,
+	thumbPath string,
+	thumbSize string,
+) error {
+	ch := api.thumbGenPending.DoChan(thumbPath, func() (any, error) {
+		ctx, cancel := context.WithTimeout(c.Request().Context(), api.thumbGenMaxWait)
+		defer cancel()
+
+		if err := api.thumbGenSem.Acquire(ctx, 1); err != nil {
+			return nil, err
+		}
+		defer api.thumbGenSem.Release(1)
+
+		return nil, fsys.CreateThumb(originalPath, thumbPath, thumbSize)
+	})
+
+	res := <-ch
+
+	api.thumbGenPending.Forget(thumbPath)
+
+	return res.Err
+}

apis/file_test.go

@@ -2,20 +2,26 @@ package apis_test
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path"
 	"path/filepath"
 	"runtime"
+	"sync"
 	"testing"
 
 	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestFileToken(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -88,6 +94,8 @@ func TestFileToken(t *testing.T) {
 }
 
 func TestFileDownload(t *testing.T) {
+	t.Parallel()
+
 	_, currentFile, _, _ := runtime.Caller(0)
 	dataDirRelPath := "../tests/data/"
 
@@ -385,3 +393,82 @@ func TestFileDownload(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestConcurrentThumbsGeneration(t *testing.T) {
+	t.Parallel()
+
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	// create a dummy file field collection
+	demo1, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fileField := demo1.Schema.GetFieldByName("file_one")
+	fileField.Options = &schema.FileOptions{
+		Protected: false,
+		MaxSelect: 1,
+		MaxSize:   999999,
+		// new thumbs
+		Thumbs: []string{"111x111", "111x222", "111x333"},
+	}
+	demo1.Schema.AddField(fileField)
+	if err := app.Dao().SaveCollection(demo1); err != nil {
+		t.Fatal(err)
+	}
+
+	fileKey := "wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png"
+
+	e, err := apis.InitApi(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	urls := []string{
+		"/api/files/" + fileKey + "?thumb=111x111",
+		"/api/files/" + fileKey + "?thumb=111x111", // should still result in single thumb
+		"/api/files/" + fileKey + "?thumb=111x222",
+		"/api/files/" + fileKey + "?thumb=111x333",
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(len(urls))
+
+	for _, url := range urls {
+		url := url
+		go func() {
+			defer wg.Done()
+
+			recorder := httptest.NewRecorder()
+
+			req := httptest.NewRequest("GET", url, nil)
+
+			e.ServeHTTP(recorder, req)
+		}()
+	}
+
+	wg.Wait()
+
+	// ensure that all new requested thumbs were created
+	thumbKeys := []string{
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x111_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x222_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x333_" + filepath.Base(fileKey),
+	}
+	for _, k := range thumbKeys {
+		if exists, _ := fsys.Exists(k); !exists {
+			t.Fatalf("Missing thumb %q: %v", k, err)
+		}
+	}
+}

apis/health.go

@@ -12,6 +12,7 @@ func bindHealthApi(app core.App, rg *echo.Group) {
 	api := healthApi{app: app}
 
 	subGroup := rg.Group("/health")
+	subGroup.HEAD("", api.healthCheck)
 	subGroup.GET("", api.healthCheck)
 }
 
@@ -20,8 +21,8 @@ type healthApi struct {
 }
 
 type healthCheckResponse struct {
-	Code    int    `json:"code"`
 	Message string `json:"message"`
+	Code    int    `json:"code"`
 	Data    struct {
 		CanBackup bool `json:"canBackup"`
 	} `json:"data"`
@@ -29,10 +30,14 @@ type healthCheckResponse struct {
 
 // healthCheck returns a 200 OK response if the server is healthy.
 func (api *healthApi) healthCheck(c echo.Context) error {
+	if c.Request().Method == http.MethodHead {
+		return c.NoContent(http.StatusOK)
+	}
+
 	resp := new(healthCheckResponse)
 	resp.Code = http.StatusOK
 	resp.Message = "API is healthy."
-	resp.Data.CanBackup = !api.app.Cache().Has(core.CacheKeyActiveBackup)
+	resp.Data.CanBackup = !api.app.Store().Has(core.StoreKeyActiveBackup)
 
 	return c.JSON(http.StatusOK, resp)
 }

apis/health_test.go

@@ -8,9 +8,17 @@ import (
 )
 
 func TestHealthAPI(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
-			Name:           "health status returns 200",
+			Name:           "HEAD health status",
+			Method:         http.MethodHead,
+			Url:            "/api/health",
+			ExpectedStatus: 200,
+		},
+		{
+			Name:           "GET health status",
 			Method:         http.MethodGet,
 			Url:            "/api/health",
 			ExpectedStatus: 200,

apis/logs.go

@@ -15,27 +15,27 @@ func bindLogsApi(app core.App, rg *echo.Group) {
 	api := logsApi{app: app}
 
 	subGroup := rg.Group("/logs", RequireAdminAuth())
-	subGroup.GET("/requests", api.requestsList)
-	subGroup.GET("/requests/stats", api.requestsStats)
-	subGroup.GET("/requests/:id", api.requestView)
+	subGroup.GET("", api.list)
+	subGroup.GET("/stats", api.stats)
+	subGroup.GET("/:id", api.view)
 }
 
 type logsApi struct {
 	app core.App
 }
 
-var requestFilterFields = []string{
+var logFilterFields = []string{
 	"rowid", "id", "created", "updated",
-	"url", "method", "status", "auth",
-	"remoteIp", "userIp", "referer", "userAgent",
+	"level", "message", "data",
+	`^data\.[\w\.\:]*\w+$`,
 }
 
-func (api *logsApi) requestsList(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) list(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	result, err := search.NewProvider(fieldResolver).
-		Query(api.app.LogsDao().RequestQuery()).
-		ParseAndExec(c.QueryParams().Encode(), &[]*models.Request{})
+		Query(api.app.LogsDao().LogQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &[]*models.Log{})
 
 	if err != nil {
 		return NewBadRequestError("", err)
@@ -44,8 +44,8 @@ func (api *logsApi) requestsList(c echo.Context) error {
 	return c.JSON(http.StatusOK, result)
 }
 
-func (api *logsApi) requestsStats(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) stats(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	filter := c.QueryParam(search.FilterQueryParam)
 
@@ -58,24 +58,24 @@ func (api *logsApi) requestsStats(c echo.Context) error {
 		}
 	}
 
-	stats, err := api.app.LogsDao().RequestsStats(expr)
+	stats, err := api.app.LogsDao().LogsStats(expr)
 	if err != nil {
-		return NewBadRequestError("Failed to generate requests stats.", err)
+		return NewBadRequestError("Failed to generate logs stats.", err)
 	}
 
 	return c.JSON(http.StatusOK, stats)
 }
 
-func (api *logsApi) requestView(c echo.Context) error {
+func (api *logsApi) view(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
 		return NewNotFoundError("", nil)
 	}
 
-	request, err := api.app.LogsDao().FindRequestById(id)
-	if err != nil || request == nil {
+	log, err := api.app.LogsDao().FindLogById(id)
+	if err != nil || log == nil {
 		return NewNotFoundError("", err)
 	}
 
-	return c.JSON(http.StatusOK, request)
+	return c.JSON(http.StatusOK, log)
 }

apis/logs_test.go

@@ -8,19 +8,21 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestRequestsList(t *testing.T) {
+func TestLogsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests",
+			Url:             "/api/logs",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -30,12 +32,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -52,12 +54,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests?filter=status>200",
+			Url:    "/api/logs?filter=data.status>200",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -77,19 +79,21 @@ func TestRequestsList(t *testing.T) {
 	}
 }
 
-func TestRequestView(t *testing.T) {
+func TestLogView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -99,12 +103,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (nonexisting request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/missing1-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -114,12 +118,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (existing request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -135,19 +139,21 @@ func TestRequestView(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/stats",
+			Url:             "/api/logs/stats",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
@@ -157,12 +163,12 @@ func TestRequestsStats(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -174,12 +180,12 @@ func TestRequestsStats(t *testing.T) {
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats?filter=status>200",
+			Url:    "/api/logs/stats?filter=data.status>200",
 			RequestHeaders: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},

apis/middlewares.go

@@ -2,9 +2,10 @@ package apis
 
 import (
 	"fmt"
-	"log"
+	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -15,7 +16,6 @@ import (
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/security"
-	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )
 
@@ -24,6 +24,7 @@ const (
 	ContextAdminKey      string = "admin"
 	ContextAuthRecordKey string = "authRecord"
 	ContextCollectionKey string = "collection"
+	ContextExecStartKey  string = "execStart"
 )
 
 // RequireGuestOnly middleware requires a request to NOT have a valid
@@ -260,7 +261,7 @@ func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.Midd
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			if param := c.PathParam("collection"); param != "" {
-				collection, err := app.Dao().FindCollectionByNameOrId(param)
+				collection, err := core.FindCachedCollectionByNameOrId(app, param)
 				if err != nil || collection == nil {
 					return NewNotFoundError("", err)
 				}
@@ -285,86 +286,92 @@ func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.Midd
 func ActivityLogger(app core.App) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			err := next(c)
-
-			logsMaxDays := app.Settings().Logs.MaxDays
-
-			// no logs retention
-			if logsMaxDays == 0 {
+			if err := next(c); err != nil {
 				return err
 			}
 
-			httpRequest := c.Request()
-			httpResponse := c.Response()
-			status := httpResponse.Status
-			meta := types.JsonMap{}
+			logRequest(app, c, nil)
 
-			if err != nil {
-				switch v := err.(type) {
-				case *echo.HTTPError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.Internal)
-				case *ApiError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.RawData())
-				default:
-					status = http.StatusBadRequest
-					meta["errorMessage"] = v.Error()
-				}
-			}
-
-			requestAuth := models.RequestAuthGuest
-			if c.Get(ContextAuthRecordKey) != nil {
-				requestAuth = models.RequestAuthRecord
-			} else if c.Get(ContextAdminKey) != nil {
-				requestAuth = models.RequestAuthAdmin
-			}
-
-			ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
-
-			model := &models.Request{
-				Url:       httpRequest.URL.RequestURI(),
-				Method:    strings.ToUpper(httpRequest.Method),
-				Status:    status,
-				Auth:      requestAuth,
-				UserIp:    realUserIp(httpRequest, ip),
-				RemoteIp:  ip,
-				Referer:   httpRequest.Referer(),
-				UserAgent: httpRequest.UserAgent(),
-				Meta:      meta,
-			}
-			// set timestamp fields before firing a new go routine
-			model.RefreshCreated()
-			model.RefreshUpdated()
-
-			routine.FireAndForget(func() {
-				if err := app.LogsDao().SaveRequest(model); err != nil && app.IsDebug() {
-					log.Println("Log save failed:", err)
-				}
-
-				// Delete old request logs
-				// ---
-				now := time.Now()
-				lastLogsDeletedAt := cast.ToTime(app.Cache().Get("lastLogsDeletedAt"))
-				daysDiff := now.Sub(lastLogsDeletedAt).Hours() * 24
-
-				if daysDiff > float64(logsMaxDays) {
-					deleteErr := app.LogsDao().DeleteOldRequests(now.AddDate(0, 0, -1*logsMaxDays))
-					if deleteErr == nil {
-						app.Cache().Set("lastLogsDeletedAt", now)
-					} else if app.IsDebug() {
-						log.Println("Logs delete failed:", deleteErr)
-					}
-				}
-			})
-
-			return err
+			return nil
 		}
 	}
 }
 
+func logRequest(app core.App, c echo.Context, err *ApiError) {
+	// no logs retention
+	if app.Settings().Logs.MaxDays == 0 {
+		return
+	}
+
+	attrs := make([]any, 0, 15)
+
+	attrs = append(attrs, slog.String("type", "request"))
+
+	started := cast.ToTime(c.Get(ContextExecStartKey))
+	if !started.IsZero() {
+		attrs = append(attrs, slog.Float64("execTime", float64(time.Since(started))/float64(time.Millisecond)))
+	}
+
+	httpRequest := c.Request()
+	httpResponse := c.Response()
+	method := strings.ToUpper(httpRequest.Method)
+	status := httpResponse.Status
+	requestUri := httpRequest.URL.RequestURI()
+
+	// parse the request error
+	if err != nil {
+		status = err.Code
+		attrs = append(
+			attrs,
+			slog.String("error", err.Message),
+			slog.Any("details", err.RawData()),
+		)
+	}
+
+	requestAuth := models.RequestAuthGuest
+	if c.Get(ContextAuthRecordKey) != nil {
+		requestAuth = models.RequestAuthRecord
+	} else if c.Get(ContextAdminKey) != nil {
+		requestAuth = models.RequestAuthAdmin
+	}
+
+	attrs = append(
+		attrs,
+		slog.String("url", requestUri),
+		slog.String("method", method),
+		slog.Int("status", status),
+		slog.String("auth", requestAuth),
+		slog.String("referer", httpRequest.Referer()),
+		slog.String("userAgent", httpRequest.UserAgent()),
+	)
+
+	if app.Settings().Logs.LogIp {
+		ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
+		attrs = append(
+			attrs,
+			slog.String("userIp", realUserIp(httpRequest, ip)),
+			slog.String("remoteIp", ip),
+		)
+	}
+
+	// don't block on logs write
+	routine.FireAndForget(func() {
+		message := method + " "
+
+		if escaped, err := url.PathUnescape(requestUri); err == nil {
+			message += escaped
+		} else {
+			message += requestUri
+		}
+
+		if err != nil {
+			app.Logger().Error(message, attrs...)
+		} else {
+			app.Logger().Info(message, attrs...)
+		}
+	})
+}
+
 // Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
 //
 // The returned IP value shouldn't be trusted if not behind a trusted reverse proxy!
@@ -395,6 +402,8 @@ func realUserIp(r *http.Request, fallbackIp string) string {
 	return fallbackIp
 }
 
+// @todo consider removing as this may no longer be needed due to the custom rest.MultiBinder.
+//
 // eagerRequestInfoCache ensures that the request data is cached in the request
 // context to allow reading for example the json request body data more than once.
 func eagerRequestInfoCache(app core.App) echo.MiddlewareFunc {

apis/middlewares_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestRequireGuestOnly(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "valid record token",
@@ -104,6 +106,8 @@ func TestRequireGuestOnly(t *testing.T) {
 }
 
 func TestRequireRecordAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
@@ -242,6 +246,8 @@ func TestRequireRecordAuth(t *testing.T) {
 }
 
 func TestRequireSameContextRecordAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
@@ -358,6 +364,8 @@ func TestRequireSameContextRecordAuth(t *testing.T) {
 }
 
 func TestRequireAdminAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
@@ -452,6 +460,8 @@ func TestRequireAdminAuth(t *testing.T) {
 }
 
 func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest (while having at least 1 existing admin)",
@@ -571,6 +581,8 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 }
 
 func TestRequireAdminOrRecordAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
@@ -731,6 +743,8 @@ func TestRequireAdminOrRecordAuth(t *testing.T) {
 }
 
 func TestRequireAdminOrOwnerAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
@@ -869,6 +883,8 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 }
 
 func TestLoadCollectionContext(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "missing collection",

apis/realtime.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"log"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -15,18 +15,20 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/spf13/cast"
 )
 
 // bindRealtimeApi registers the realtime api endpoints.
 func bindRealtimeApi(app core.App, rg *echo.Group) {
 	api := realtimeApi{app: app}
 
-	subGroup := rg.Group("/realtime", ActivityLogger(app))
+	subGroup := rg.Group("/realtime")
 	subGroup.GET("", api.connect)
-	subGroup.POST("", api.setSubscriptions)
+	subGroup.POST("", api.setSubscriptions, ActivityLogger(app))
 
 	api.bindEvents()
 }
@@ -49,16 +51,19 @@ func (api *realtimeApi) connect(c echo.Context) error {
 			Client:      client,
 		}
 
-		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil {
+			api.app.Logger().Debug(
+				"OnRealtimeDisconnectRequest error",
+				slog.String("clientId", client.Id()),
+				slog.String("error", err.Error()),
+			)
 		}
 
 		api.app.SubscriptionsBroker().Unregister(client.Id())
 	}()
 
-	c.Response().Header().Set("Content-Type", "text/event-stream; charset=UTF-8")
+	c.Response().Header().Set("Content-Type", "text/event-stream")
 	c.Response().Header().Set("Cache-Control", "no-store")
-	c.Response().Header().Set("Connection", "keep-alive")
 	// https://github.com/pocketbase/pocketbase/discussions/480#discussioncomment-3657640
 	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
 	c.Response().Header().Set("X-Accel-Buffering", "no")
@@ -73,9 +78,7 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		return err
 	}
 
-	if api.app.IsDebug() {
-		log.Printf("Realtime connection established: %s\n", client.Id())
-	}
+	api.app.Logger().Debug("Realtime connection established.", slog.String("clientId", client.Id()))
 
 	// signalize established connection (aka. fire "connect" message)
 	connectMsgEvent := &core.RealtimeMessageEvent{
@@ -97,9 +100,11 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		return api.app.OnRealtimeAfterMessageSend().Trigger(e)
 	})
 	if connectMsgErr != nil {
-		if api.app.IsDebug() {
-			log.Println("Realtime connection closed (failed to deliver PB_CONNECT):", client.Id(), connectMsgErr)
-		}
+		api.app.Logger().Debug(
+			"Realtime connection closed (failed to deliver PB_CONNECT)",
+			slog.String("clientId", client.Id()),
+			slog.String("error", connectMsgErr.Error()),
+		)
 		return nil
 	}
 
@@ -115,9 +120,10 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		case msg, ok := <-client.Channel():
 			if !ok {
 				// channel is closed
-				if api.app.IsDebug() {
-					log.Println("Realtime connection closed (closed channel):", client.Id())
-				}
+				api.app.Logger().Debug(
+					"Realtime connection closed (closed channel)",
+					slog.String("clientId", client.Id()),
+				)
 				return nil
 			}
 
@@ -137,9 +143,11 @@ func (api *realtimeApi) connect(c echo.Context) error {
 				return api.app.OnRealtimeAfterMessageSend().Trigger(msgEvent)
 			})
 			if msgErr != nil {
-				if api.app.IsDebug() {
-					log.Println("Realtime connection closed (failed to deliver message):", client.Id(), msgErr)
-				}
+				api.app.Logger().Debug(
+					"Realtime connection closed (failed to deliver message)",
+					slog.String("clientId", client.Id()),
+					slog.String("error", msgErr.Error()),
+				)
 				return nil
 			}
 
@@ -147,9 +155,10 @@ func (api *realtimeApi) connect(c echo.Context) error {
 			idleTimer.Reset(idleTimeout)
 		case <-c.Request().Context().Done():
 			// connection is closed
-			if api.app.IsDebug() {
-				log.Println("Realtime connection closed (cancelled request):", client.Id())
-			}
+			api.app.Logger().Debug(
+				"Realtime connection closed (cancelled request)",
+				slog.String("clientId", client.Id()),
+			)
 			return nil
 		}
 	}
@@ -199,6 +208,12 @@ func (api *realtimeApi) setSubscriptions(c echo.Context) error {
 		// subscribe to the new subscriptions
 		e.Client.Subscribe(e.Subscriptions...)
 
+		api.app.Logger().Debug(
+			"Realtime subscriptions updated.",
+			slog.String("clientId", e.Client.Id()),
+			slog.Any("subscriptions", e.Subscriptions),
+		)
+
 		return api.app.OnRealtimeAfterSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeEvent) error {
 			if e.HttpContext.Response().Committed {
 				return nil
@@ -230,7 +245,7 @@ func (api *realtimeApi) unregisterClientsByAuthModel(contextKey string, model mo
 		if clientModel != nil &&
 			clientModel.TableName() == model.TableName() &&
 			clientModel.GetId() == model.GetId() {
-			api.app.SubscriptionsBroker().Unregister(client.Id())
+			client.Unset(contextKey)
 		}
 	}
 
@@ -266,8 +281,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterCreate().PreAdd(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("create", record, false); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("create", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record create",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -275,8 +295,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterUpdate().PreAdd(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("update", record, false); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("update", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record update",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -284,8 +309,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelBeforeDelete().Add(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastRecord("delete", record, true); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastRecord("delete", record, true); err != nil {
+				api.app.Logger().Debug(
+					"Failed to dry cache record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -293,8 +323,13 @@ func (api *realtimeApi) bindEvents() {
 
 	api.app.OnModelAfterDelete().Add(func(e *core.ModelEvent) error {
 		if record := api.resolveRecord(e.Model); record != nil {
-			if err := api.broadcastDryCachedRecord("delete", record); err != nil && api.app.IsDebug() {
-				log.Println(err)
+			if err := api.broadcastDryCachedRecord("delete", record); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
 		return nil
@@ -327,58 +362,16 @@ func (api *realtimeApi) resolveRecordCollection(model models.Model) (collection
 	return collection
 }
 
-// canAccessRecord checks if the subscription client has access to the specified record model.
-func (api *realtimeApi) canAccessRecord(client subscriptions.Client, record *models.Record, accessRule *string) bool {
-	admin, _ := client.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		// admins can access everything
-		return true
-	}
-
-	if accessRule == nil {
-		// only admins can access this record
-		return false
-	}
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if *accessRule == "" {
-			return nil // empty public rule
-		}
-
-		// mock request data
-		requestInfo := &models.RequestInfo{
-			Method: "GET",
-		}
-		requestInfo.AuthRecord, _ = client.Get(ContextAuthRecordKey).(*models.Record)
-
-		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestInfo, true)
-		expr, err := search.FilterData(*accessRule).BuildExpr(resolver)
-		if err != nil {
-			return err
-		}
-		resolver.UpdateQuery(q)
-		q.AndWhere(expr)
-
-		return nil
-	}
-
-	foundRecord, err := api.app.Dao().FindRecordById(record.Collection().Id, record.Id, ruleFunc)
-	if err == nil && foundRecord != nil {
-		return true
-	}
-
-	return false
-}
-
+// recordData represents the broadcasted record subscrition message data.
 type recordData struct {
-	Action string         `json:"action"`
-	Record *models.Record `json:"record"`
+	Record any    `json:"record"` /* map or models.Record */
+	Action string `json:"action"`
 }
 
 func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dryCache bool) error {
 	collection := record.Collection()
 	if collection == nil {
-		return errors.New("Record collection not set.")
+		return errors.New("[broadcastRecord] Record collection not set")
 	}
 
 	clients := api.app.SubscriptionsBroker().Clients()
@@ -386,67 +379,126 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dr
 		return nil // no subscribers
 	}
 
-	// create a clean record copy without expand and unknown fields
-	// because we don't know if the clients have permissions to view them
-	cleanRecord := record.CleanCopy()
-
 	subscriptionRuleMap := map[string]*string{
-		(collection.Name + "/" + cleanRecord.Id): collection.ViewRule,
-		(collection.Id + "/" + cleanRecord.Id):   collection.ViewRule,
-		(collection.Name + "/*"):                 collection.ListRule,
-		(collection.Id + "/*"):                   collection.ListRule,
-		// @deprecated: the same as the wildcard topic but kept for backward compatibility
-		collection.Name: collection.ListRule,
-		collection.Id:   collection.ListRule,
+		(collection.Name + "/" + record.Id + "?"): collection.ViewRule,
+		(collection.Id + "/" + record.Id + "?"):   collection.ViewRule,
+		(collection.Name + "/*?"):                 collection.ListRule,
+		(collection.Id + "/*?"):                   collection.ListRule,
+		// @deprecated: the same      as the wildcard topic but kept for backward compatibility
+		(collection.Name + "?"): collection.ListRule,
+		(collection.Id + "?"):   collection.ListRule,
 	}
 
-	data := &recordData{
-		Action: action,
-		Record: cleanRecord,
-	}
-
-	dataBytes, err := json.Marshal(data)
-	if err != nil {
-		return err
-	}
+	dryCacheKey := action + "/" + record.Id
 
 	for _, client := range clients {
 		client := client
 
-		for subscription, rule := range subscriptionRuleMap {
-			if !client.HasSubscription(subscription) {
+		// note: not executed concurrently to avoid races and to ensure
+		// that the access checks are applied for the current record db state
+		for prefix, rule := range subscriptionRuleMap {
+			subs := client.Subscriptions(prefix)
+			if len(subs) == 0 {
 				continue
 			}
 
-			if !api.canAccessRecord(client, data.Record, rule) {
-				continue
-			}
+			for sub, options := range subs {
+				// create a clean record copy without expand and unknown fields
+				// because we don't know yet which exact fields the client subscription has permissions to access
+				cleanRecord := record.CleanCopy()
 
-			msg := subscriptions.Message{
-				Name: subscription,
-				Data: dataBytes,
-			}
-
-			// ignore the auth record email visibility checks for
-			// auth owner, admin or manager
-			if collection.IsAuth() {
-				authId := extractAuthIdFromGetter(client)
-				if authId == data.Record.Id ||
-					api.canAccessRecord(client, data.Record, collection.AuthOptions().ManageRule) {
-					data.Record.IgnoreEmailVisibility(true) // ignore
-					if newData, err := json.Marshal(data); err == nil {
-						msg.Data = newData
-					}
-					data.Record.IgnoreEmailVisibility(false) // restore
+				// mock request data
+				requestInfo := &models.RequestInfo{
+					Context: models.RequestInfoContextRealtime,
+					Method:  "GET",
+					Query:   options.Query,
+					Headers: options.Headers,
 				}
-			}
+				requestInfo.Admin, _ = client.Get(ContextAdminKey).(*models.Admin)
+				requestInfo.AuthRecord, _ = client.Get(ContextAuthRecordKey).(*models.Record)
 
-			if dryCache {
-				client.Set(action+"/"+data.Record.Id, msg)
-			} else {
-				routine.FireAndForget(func() {
-					client.Send(msg)
-				})
+				if !api.canAccessRecord(cleanRecord, requestInfo, rule) {
+					continue
+				}
+
+				rawExpand := cast.ToString(options.Query[expandQueryParam])
+				if rawExpand != "" {
+					expandErrs := api.app.Dao().ExpandRecord(cleanRecord, strings.Split(rawExpand, ","), expandFetch(api.app.Dao(), requestInfo))
+					if len(expandErrs) > 0 {
+						api.app.Logger().Debug(
+							"[broadcastRecord] expand errors",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("expand", rawExpand),
+							slog.Any("errors", expandErrs),
+						)
+					}
+				}
+
+				// ignore the auth record email visibility checks
+				// for auth owner, admin or manager
+				if collection.IsAuth() {
+					authId := extractAuthIdFromGetter(client)
+					if authId == cleanRecord.Id {
+						if api.canAccessRecord(cleanRecord, requestInfo, collection.AuthOptions().ManageRule) {
+							cleanRecord.IgnoreEmailVisibility(true)
+						}
+					}
+				}
+
+				data := &recordData{
+					Action: action,
+					Record: cleanRecord,
+				}
+
+				// check fields
+				rawFields := cast.ToString(options.Query[fieldsQueryParam])
+				if rawFields != "" {
+					decoded, err := rest.PickFields(cleanRecord, rawFields)
+					if err == nil {
+						data.Record = decoded
+					} else {
+						api.app.Logger().Debug(
+							"[broadcastRecord] pick fields error",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("fields", rawFields),
+							slog.String("error", err.Error()),
+						)
+					}
+				}
+
+				dataBytes, err := json.Marshal(data)
+				if err != nil {
+					api.app.Logger().Debug(
+						"[broadcastRecord] data marshal error",
+						slog.String("id", cleanRecord.Id),
+						slog.String("collectionName", cleanRecord.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+					continue
+				}
+
+				msg := subscriptions.Message{
+					Name: sub,
+					Data: dataBytes,
+				}
+
+				if dryCache {
+					messages, ok := client.Get(dryCacheKey).([]subscriptions.Message)
+					if !ok {
+						messages = []subscriptions.Message{msg}
+					} else {
+						messages = append(messages, msg)
+					}
+					client.Set(dryCacheKey, messages)
+				} else {
+					routine.FireAndForget(func() {
+						client.Send(msg)
+					})
+				}
 			}
 		}
 	}
@@ -454,14 +506,14 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dr
 	return nil
 }
 
-// broadcastDryCachedRecord broadcasts record if it is cached in the client context.
+// broadcastDryCachedRecord broadcasts all cached record related messages.
 func (api *realtimeApi) broadcastDryCachedRecord(action string, record *models.Record) error {
+	key := action + "/" + record.Id
+
 	clients := api.app.SubscriptionsBroker().Clients()
 
 	for _, client := range clients {
-		key := action + "/" + record.Id
-
-		msg, ok := client.Get(key).(subscriptions.Message)
+		messages, ok := client.Get(key).([]subscriptions.Message)
 		if !ok {
 			continue
 		}
@@ -471,9 +523,12 @@ func (api *realtimeApi) broadcastDryCachedRecord(action string, record *models.R
 		client := client
 
 		routine.FireAndForget(func() {
-			client.Send(msg)
+			for _, msg := range messages {
+				client.Send(msg)
+			}
 		})
 	}
+
 	return nil
 }
 
@@ -494,3 +549,45 @@ func extractAuthIdFromGetter(val getter) string {
 
 	return ""
 }
+
+// canAccessRecord checks if the subscription client has access to the specified record model.
+func (api *realtimeApi) canAccessRecord(
+	record *models.Record,
+	requestInfo *models.RequestInfo,
+	accessRule *string,
+) bool {
+	// check the access rule
+	// ---
+	if ok, _ := api.app.Dao().CanAccessRecord(record, requestInfo, accessRule); !ok {
+		return false
+	}
+
+	// check the subscription client-side filter (if any)
+	// ---
+	filter := cast.ToString(requestInfo.Query[search.FilterQueryParam])
+	if filter == "" {
+		return true // no further checks needed
+	}
+
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
+		return false
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestInfo, false)
+
+		expr, err := search.FilterData(filter).BuildExpr(resolver)
+		if err != nil {
+			return err
+		}
+		q.AndWhere(expr)
+
+		resolver.UpdateQuery(q)
+
+		return nil
+	}
+
+	_, err := api.app.Dao().FindRecordById(record.Collection().Id, record.Id, ruleFunc)
+
+	return err == nil
+}

apis/realtime_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -22,6 +23,7 @@ func TestRealtimeConnect(t *testing.T) {
 		{
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`id:`,
@@ -44,6 +46,7 @@ func TestRealtimeConnect(t *testing.T) {
 			Name:           "PB_CONNECT interrupt",
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeConnectRequest":    1,
@@ -68,6 +71,7 @@ func TestRealtimeConnect(t *testing.T) {
 			Name:           "Skipping/ignoring messages",
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeConnectRequest":    1,
@@ -245,22 +249,48 @@ func TestRealtimeAuthRecordDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	authRecord1, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAuthRecordKey, authRecord)
-	testApp.SubscriptionsBroker().Register(client)
+	authRecord2, err := testApp.Dao().FindFirstRecordByData("users", "email", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAuthRecordKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// "delete" authRecord1
 	e := new(core.ModelEvent)
 	e.Dao = testApp.Dao()
-	e.Model = authRecord
+	e.Model = authRecord1
 	testApp.OnModelAfterDelete().Trigger(e)
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAuthRecordKey); auth == nil || auth.(*models.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 
@@ -303,22 +333,48 @@ func TestRealtimeAdminDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	admin1, err := testApp.Dao().FindAdminByEmail("test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAdminKey, admin)
-	testApp.SubscriptionsBroker().Register(client)
+	admin2, err := testApp.Dao().FindAdminByEmail("test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAdminKey, admin1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAdminKey, admin1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAdminKey, admin2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// "delete" admin1
 	e := new(core.ModelEvent)
 	e.Dao = testApp.Dao()
-	e.Model = admin
+	e.Model = admin1
 	testApp.OnModelAfterDelete().Trigger(e)
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAdminKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAdminKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAdminKey); auth == nil || auth.(*models.Admin).Id != admin2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 
@@ -390,16 +446,29 @@ func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	authRecord1, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAuthRecordKey, authRecord)
-	testApp.SubscriptionsBroker().Register(client)
+	authRecord2, err := testApp.Dao().FindFirstRecordByData("users", "email", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	// refetch the authRecord as CustomUser
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAuthRecordKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// refetch authRecord1 as CustomUser
 	customUser, err := findCustomUserByEmail(testApp.Dao(), "test@example.com")
 	if err != nil {
 		t.Fatal(err)
@@ -410,8 +479,20 @@ func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAuthRecordKey); auth == nil || auth.(*models.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 

apis/record_auth.go

@@ -4,21 +4,26 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
+	"sort"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/oauth2"
 )
 
@@ -29,6 +34,7 @@ func bindRecordAuthApi(app core.App, rg *echo.Group) {
 
 	// global oauth2 subscription redirect handler
 	rg.GET("/oauth2-redirect", api.oauth2SubscriptionRedirect)
+	rg.POST("/oauth2-redirect", api.oauth2SubscriptionRedirect) // needed in case of response_mode=form_post
 
 	// common collection record related routes
 	subGroup := rg.Group(
@@ -73,12 +79,15 @@ func (api *recordAuthApi) authRefresh(c echo.Context) error {
 }
 
 type providerInfo struct {
-	Name                string `json:"name"`
-	State               string `json:"state"`
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+	State       string `json:"state"`
+	AuthUrl     string `json:"authUrl"`
+	// technically could be omitted if the provider doesn't support PKCE,
+	// but to avoid breaking existing typed clients we'll return them as empty string
 	CodeVerifier        string `json:"codeVerifier"`
 	CodeChallenge       string `json:"codeChallenge"`
 	CodeChallengeMethod string `json:"codeChallengeMethod"`
-	AuthUrl             string `json:"authUrl"`
 }
 
 func (api *recordAuthApi) authMethods(c echo.Context) error {
@@ -90,12 +99,14 @@ func (api *recordAuthApi) authMethods(c echo.Context) error {
 	authOptions := collection.AuthOptions()
 
 	result := struct {
+		AuthProviders    []providerInfo `json:"authProviders"`
 		UsernamePassword bool           `json:"usernamePassword"`
 		EmailPassword    bool           `json:"emailPassword"`
-		AuthProviders    []providerInfo `json:"authProviders"`
+		OnlyVerified     bool           `json:"onlyVerified"`
 	}{
 		UsernamePassword: authOptions.AllowUsernameAuth,
 		EmailPassword:    authOptions.AllowEmailAuth,
+		OnlyVerified:     authOptions.OnlyVerified,
 		AuthProviders:    []providerInfo{},
 	}
 
@@ -111,51 +122,61 @@ func (api *recordAuthApi) authMethods(c echo.Context) error {
 
 		provider, err := auth.NewProviderByName(name)
 		if err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
+			api.app.Logger().Debug("Missing or invalid provider name", slog.String("name", name))
 			continue // skip provider
 		}
 
 		if err := config.SetupProvider(provider); err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
+			api.app.Logger().Debug(
+				"Failed to setup provider",
+				slog.String("name", name),
+				slog.String("error", err.Error()),
+			)
 			continue // skip provider
 		}
 
-		state := security.RandomString(30)
-		codeVerifier := security.RandomString(43)
-		codeChallenge := security.S256Challenge(codeVerifier)
-		codeChallengeMethod := "S256"
-		urlOpts := []oauth2.AuthCodeOption{
-			oauth2.SetAuthURLParam("code_challenge", codeChallenge),
-			oauth2.SetAuthURLParam("code_challenge_method", codeChallengeMethod),
+		info := providerInfo{
+			Name:        name,
+			DisplayName: provider.DisplayName(),
+			State:       security.RandomString(30),
 		}
 
+		if info.DisplayName == "" {
+			info.DisplayName = name
+		}
+
+		urlOpts := []oauth2.AuthCodeOption{}
+
 		// custom providers url options
 		switch name {
 		case auth.NameApple:
 			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
-			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "query"))
-		case auth.NameVK:
-			// vk currently doesn't support PKCE for server-side authorization
-			urlOpts = []oauth2.AuthCodeOption{}
+			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "form_post"))
 		}
 
-		result.AuthProviders = append(result.AuthProviders, providerInfo{
-			Name:                name,
-			State:               state,
-			CodeVerifier:        codeVerifier,
-			CodeChallenge:       codeChallenge,
-			CodeChallengeMethod: codeChallengeMethod,
-			AuthUrl: provider.BuildAuthUrl(
-				state,
-				urlOpts...,
-			) + "&redirect_uri=", // empty redirect_uri so that users can append their redirect url
-		})
+		if provider.PKCE() {
+			info.CodeVerifier = security.RandomString(43)
+			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
+			info.CodeChallengeMethod = "S256"
+			urlOpts = append(urlOpts,
+				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
+				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
+			)
+		}
+
+		info.AuthUrl = provider.BuildAuthUrl(
+			info.State,
+			urlOpts...,
+		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
+
+		result.AuthProviders = append(result.AuthProviders, info)
 	}
 
+	// sort providers
+	sort.SliceStable(result.AuthProviders, func(i, j int) bool {
+		return result.AuthProviders[i].Name < result.AuthProviders[j].Name
+	})
+
 	return c.JSON(http.StatusOK, result)
 }
 
@@ -185,13 +206,14 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 	event.HttpContext = c
 	event.Collection = collection
 	event.ProviderName = form.Provider
-	event.IsNewRecord = false
 
 	form.SetBeforeNewRecordCreateFunc(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
 		return createForm.DrySubmit(func(txDao *daos.Dao) error {
 			event.IsNewRecord = true
+
 			// clone the current request data and assign the form create data as its body data
 			requestInfo := *RequestInfo(c)
+			requestInfo.Context = models.RequestInfoContextOAuth2
 			requestInfo.Data = form.CreateData
 
 			createRuleFunc := func(q *dbx.SelectQuery) error {
@@ -230,6 +252,7 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 			event.Record = data.Record
 			event.OAuth2User = data.OAuth2User
 			event.ProviderClient = data.ProviderClient
+			event.IsNewRecord = data.Record == nil
 
 			return api.app.OnRecordBeforeAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
 				data.Record = e.Record
@@ -251,6 +274,14 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 				}
 
 				return api.app.OnRecordAfterAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+					// clear the lastLoginAlertSentAt field so that we can enforce password auth notifications
+					if !e.Record.LastLoginAlertSentAt().IsZero() {
+						e.Record.Set(schema.FieldNameLastLoginAlertSentAt, "")
+						if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+							api.app.Logger().Warn("Failed to reset lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+						}
+					}
+
 					return RecordAuthResponse(api.app, e.HttpContext, e.Record, meta)
 				})
 			})
@@ -286,6 +317,42 @@ func (api *recordAuthApi) authWithPassword(c echo.Context) error {
 					return NewBadRequestError("Failed to authenticate.", err)
 				}
 
+				// @todo remove after the refactoring
+				if collection.AuthOptions().AllowOAuth2Auth && e.Record.Email() != "" {
+					externalAuths, err := api.app.Dao().FindAllExternalAuthsByRecord(e.Record)
+					if err != nil {
+						return NewBadRequestError("Failed to authenticate.", err)
+					}
+					if len(externalAuths) > 0 {
+						lastLoginAlert := e.Record.LastLoginAlertSentAt().Time()
+
+						// send an email alert if the password auth is after OAuth2 auth (lastLoginAlert will be empty)
+						// or if it has been ~7 days since the last alert
+						if lastLoginAlert.IsZero() || time.Now().UTC().Sub(lastLoginAlert).Hours() > 168 {
+							providerNames := make([]string, len(externalAuths))
+							for i, ea := range externalAuths {
+								var name string
+								if provider, err := auth.NewProviderByName(ea.Provider); err == nil {
+									name = provider.DisplayName()
+								}
+								if name == "" {
+									name = ea.Provider
+								}
+								providerNames[i] = name
+							}
+
+							if err := mails.SendRecordPasswordLoginAlert(api.app, e.Record, providerNames...); err != nil {
+								return NewBadRequestError("Failed to authenticate.", err)
+							}
+
+							e.Record.SetLastLoginAlertSentAt(types.NowDateTime())
+							if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+								api.app.Logger().Warn("Failed to update lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+							}
+						}
+					}
+				}
+
 				return api.app.OnRecordAfterAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
 					return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
 				})
@@ -327,8 +394,11 @@ func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
 			return api.app.OnRecordBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Record); err != nil && api.app.IsDebug() {
-						log.Println(err)
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send password reset email",
+							slog.String("error", err.Error()),
+						)
 					}
 				})
 
@@ -416,8 +486,11 @@ func (api *recordAuthApi) requestVerification(c echo.Context) error {
 			return api.app.OnRecordBeforeRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
 				// run in background because we don't need to show the result to the client
 				routine.FireAndForget(func() {
-					if err := next(e.Record); err != nil && api.app.IsDebug() {
-						log.Println(err)
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send verification email",
+							slog.String("error", err.Error()),
+						)
 					}
 				})
 
@@ -634,29 +707,46 @@ func (api *recordAuthApi) unlinkExternalAuth(c echo.Context) error {
 
 // -------------------------------------------------------------------
 
-const oauth2SubscriptionTopic = "@oauth2"
+const (
+	oauth2SubscriptionTopic   string = "@oauth2"
+	oauth2RedirectFailurePath string = "../_/#/auth/oauth2-redirect-failure"
+	oauth2RedirectSuccessPath string = "../_/#/auth/oauth2-redirect-success"
+)
+
+type oauth2RedirectData struct {
+	State string `form:"state" query:"state" json:"state"`
+	Code  string `form:"code" query:"code" json:"code"`
+	Error string `form:"error" query:"error" json:"error,omitempty"`
+}
 
 func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
-	state := c.QueryParam("state")
-	code := c.QueryParam("code")
-
-	if code == "" || state == "" {
-		return NewBadRequestError("Invalid OAuth2 redirect parameters.", nil)
+	redirectStatusCode := http.StatusTemporaryRedirect
+	if c.Request().Method != http.MethodGet {
+		redirectStatusCode = http.StatusSeeOther
 	}
 
-	client, err := api.app.SubscriptionsBroker().ClientById(state)
+	data := oauth2RedirectData{}
+	if err := c.Bind(&data); err != nil {
+		api.app.Logger().Debug("Failed to read OAuth2 redirect data", "error", err)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	if data.State == "" {
+		api.app.Logger().Debug("Missing OAuth2 state parameter")
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	client, err := api.app.SubscriptionsBroker().ClientById(data.State)
 	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
-		return NewNotFoundError("Missing or invalid OAuth2 subscription client.", err)
-	}
-
-	data := map[string]string{
-		"state": state,
-		"code":  code,
+		api.app.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", data.State)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
 	}
+	defer client.Unsubscribe(oauth2SubscriptionTopic)
 
 	encodedData, err := json.Marshal(data)
 	if err != nil {
-		return NewBadRequestError("Failed to marshalize OAuth2 redirect data.", err)
+		api.app.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
 	}
 
 	msg := subscriptions.Message{
@@ -666,5 +756,10 @@ func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
 
 	client.Send(msg)
 
-	return c.Redirect(http.StatusTemporaryRedirect, "../_/#/auth/oauth2-redirect")
+	if data.Error != "" || data.Code == "" {
+		api.app.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	return c.Redirect(redirectStatusCode, oauth2RedirectSuccessPath)
 }

apis/record_auth_test.go

@@ -17,6 +17,8 @@ import (
 )
 
 func TestRecordAuthMethodsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "missing collection",
@@ -40,6 +42,7 @@ func TestRecordAuthMethodsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"usernamePassword":true`,
 				`"emailPassword":true`,
+				`"onlyVerified":false`,
 				`"authProviders":[{`,
 				`"name":"gitlab"`,
 				`"state":`,
@@ -58,6 +61,7 @@ func TestRecordAuthMethodsList(t *testing.T) {
 			ExpectedContent: []string{
 				`"usernamePassword":false`,
 				`"emailPassword":true`,
+				`"onlyVerified":true`,
 				`"authProviders":[]`,
 			},
 		},
@@ -69,6 +73,8 @@ func TestRecordAuthMethodsList(t *testing.T) {
 }
 
 func TestRecordAuthWithPassword(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "invalid body format",
@@ -212,7 +218,7 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			},
 		},
 		{
-			Name:   "valid email and valid password in allowed collection",
+			Name:   "valid email (unverified) and valid password in allowed collection",
 			Method: http.MethodPost,
 			Url:    "/api/collections/users/auth-with-password",
 			Body: strings.NewReader(`{
@@ -225,6 +231,51 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				`"token":"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"email":"test@example.com"`,
+				`"verified":false`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
+			},
+		},
+
+		// onlyVerified collection check
+		{
+			Name:   "unverified user in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test2@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 403,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthWithPasswordRequest": 1,
+				"OnRecordAfterAuthWithPasswordRequest":  1,
+			},
+		},
+		{
+			Name:   "verified user in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"id":"gk390qegs4y47wn"`,
+				`"email":"test@example.com"`,
+				`"verified":true`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
@@ -256,6 +307,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
 				"OnRecordAfterAuthWithPasswordRequest":  1,
 				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
 			},
 		},
 		{
@@ -280,6 +334,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
 				"OnRecordAfterAuthWithPasswordRequest":  1,
 				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
 			},
 		},
 
@@ -312,6 +369,8 @@ func TestRecordAuthWithPassword(t *testing.T) {
 }
 
 func TestRecordAuthRefresh(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -377,6 +436,41 @@ func TestRecordAuthRefresh(t *testing.T) {
 				"OnRecordAfterAuthRefreshRequest":  1,
 			},
 		},
+		{
+			Name:   "unverified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im8xeTBkZDBzcGQ3ODZtZCIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.-JYlrz5DcGzvb0nYx-xqnSFMu9dupyKY7Vg_FUm0OaM",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthRefreshRequest": 1,
+				"OnRecordAfterAuthRefreshRequest":  1,
+			},
+		},
+		{
+			Name:   "verified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			Url:    "/api/collections/clients/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.q34IWXrRWsjLvbbVNRfAs_J4SoTHloNBfdGEiLmy-D8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":`,
+				`"record":`,
+				`"id":"gk390qegs4y47wn"`,
+				`"verified":true`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":              1,
+				"OnRecordAfterAuthRefreshRequest":  1,
+			},
+		},
 		{
 			Name:   "OnRecordAfterAuthRefreshRequest error response",
 			Method: http.MethodPost,
@@ -404,6 +498,8 @@ func TestRecordAuthRefresh(t *testing.T) {
 }
 
 func TestRecordAuthRequestPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "not an auth collection",
@@ -489,6 +585,8 @@ func TestRecordAuthRequestPasswordReset(t *testing.T) {
 }
 
 func TestRecordAuthConfirmPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:           "empty data",
@@ -555,7 +653,7 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 			},
 		},
 		{
-			Name:   "valid token and data",
+			Name:   "valid token and data (unverified user)",
 			Method: http.MethodPost,
 			Url:    "/api/collections/users/confirm-password-reset",
 			Body: strings.NewReader(`{
@@ -570,6 +668,132 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 				"OnRecordBeforeConfirmPasswordResetRequest": 1,
 				"OnRecordAfterConfirmPasswordResetRequest":  1,
 			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				user, err := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected the user to be unverified")
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				user, err := app.Dao().FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg",
+					app.Settings().RecordPasswordResetToken.Secret,
+				)
+				if err == nil {
+					t.Fatalf("Expected the password reset token to be invalidated")
+				}
+
+				user, err = app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if !user.Verified() {
+					t.Fatalf("Expected the user to be marked as verified")
+				}
+			},
+		},
+		{
+			Name:   "valid token and data (unverified user with different email from the one in the token)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg",
+				"password":"12345678",
+				"passwordConfirm":"12345678"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelAfterUpdate":                        1,
+				"OnModelBeforeUpdate":                       1,
+				"OnRecordBeforeConfirmPasswordResetRequest": 1,
+				"OnRecordAfterConfirmPasswordResetRequest":  1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				user, err := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected the user to be unverified")
+				}
+
+				// manually change the email to check whether the verified state will be updated
+				user.SetEmail("test_update@example.com")
+				if err := app.Dao().WithoutHooks().SaveRecord(user); err != nil {
+					t.Fatalf("Failed to update user test email")
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				user, err := app.Dao().FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg",
+					app.Settings().RecordPasswordResetToken.Secret,
+				)
+				if err == nil {
+					t.Fatalf("Expected the password reset token to be invalidated")
+				}
+
+				user, err = app.Dao().FindAuthRecordByEmail("users", "test_update@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected the user to remain unverified")
+				}
+			},
+		},
+		{
+			Name:   "valid token and data (verified user)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg",
+				"password":"12345678",
+				"passwordConfirm":"12345678"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnModelAfterUpdate":                        1,
+				"OnModelBeforeUpdate":                       1,
+				"OnRecordBeforeConfirmPasswordResetRequest": 1,
+				"OnRecordAfterConfirmPasswordResetRequest":  1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				user, err := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				// ensure that the user is already verified
+				user.SetVerified(true)
+				if err := app.Dao().WithoutHooks().SaveRecord(user); err != nil {
+					t.Fatalf("Failed to update user verified state")
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				user, err := app.Dao().FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg",
+					app.Settings().RecordPasswordResetToken.Secret,
+				)
+				if err == nil {
+					t.Fatalf("Expected the password reset token to be invalidated")
+				}
+
+				user, err = app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if !user.Verified() {
+					t.Fatalf("Expected the user to remain verified")
+				}
+			},
 		},
 		{
 			Name:   "OnRecordAfterConfirmPasswordResetRequest error response",
@@ -602,6 +826,8 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 }
 
 func TestRecordAuthRequestVerification(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "not an auth collection",
@@ -695,6 +921,8 @@ func TestRecordAuthRequestVerification(t *testing.T) {
 }
 
 func TestRecordAuthConfirmVerification(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:           "empty data",
@@ -823,6 +1051,8 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 }
 
 func TestRecordAuthRequestEmailChange(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -898,7 +1128,7 @@ func TestRecordAuthRequestEmailChange(t *testing.T) {
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":`,
-				`"newEmail":{"code":"validation_record_email_exists"`,
+				`"newEmail":{"code":"validation_record_email_invalid"`,
 			},
 		},
 		{
@@ -925,6 +1155,8 @@ func TestRecordAuthRequestEmailChange(t *testing.T) {
 }
 
 func TestRecordAuthConfirmEmailChange(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:           "not an auth collection",
@@ -1045,6 +1277,8 @@ func TestRecordAuthConfirmEmailChange(t *testing.T) {
 }
 
 func TestRecordAuthListExternalsAuths(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -1145,6 +1379,8 @@ func TestRecordAuthListExternalsAuths(t *testing.T) {
 }
 
 func TestRecordAuthUnlinkExternalsAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -1274,114 +1510,229 @@ func TestRecordAuthUnlinkExternalsAuth(t *testing.T) {
 }
 
 func TestRecordAuthOAuth2Redirect(t *testing.T) {
-	c1 := subscriptions.NewDefaultClient()
+	t.Parallel()
 
-	c2 := subscriptions.NewDefaultClient()
-	c2.Subscribe("@oauth2")
+	clientStubs := make([]map[string]subscriptions.Client, 0, 10)
 
-	c3 := subscriptions.NewDefaultClient()
-	c3.Subscribe("test1", "@oauth2")
+	for i := 0; i < 10; i++ {
+		c1 := subscriptions.NewDefaultClient()
 
-	c4 := subscriptions.NewDefaultClient()
-	c4.Subscribe("test1", "test2")
+		c2 := subscriptions.NewDefaultClient()
+		c2.Subscribe("@oauth2")
 
-	c5 := subscriptions.NewDefaultClient()
-	c5.Subscribe("@oauth2")
-	c5.Discard()
+		c3 := subscriptions.NewDefaultClient()
+		c3.Subscribe("test1", "@oauth2")
 
-	beforeTestFunc := func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-		app.SubscriptionsBroker().Register(c1)
-		app.SubscriptionsBroker().Register(c2)
-		app.SubscriptionsBroker().Register(c3)
-		app.SubscriptionsBroker().Register(c4)
-		app.SubscriptionsBroker().Register(c5)
+		c4 := subscriptions.NewDefaultClient()
+		c4.Subscribe("test1", "test2")
+
+		c5 := subscriptions.NewDefaultClient()
+		c5.Subscribe("@oauth2")
+		c5.Discard()
+
+		clientStubs = append(clientStubs, map[string]subscriptions.Client{
+			"c1": c1,
+			"c2": c2,
+			"c3": c3,
+			"c4": c4,
+			"c5": c5,
+		})
+	}
+
+	checkFailureRedirect := func(t *testing.T, app *tests.TestApp, res *http.Response) {
+		loc := res.Header.Get("Location")
+		if !strings.Contains(loc, "/oauth2-redirect-failure") {
+			t.Fatalf("Expected failure redirect, got %q", loc)
+		}
+	}
+
+	checkSuccessRedirect := func(t *testing.T, app *tests.TestApp, res *http.Response) {
+		loc := res.Header.Get("Location")
+		if !strings.Contains(loc, "/oauth2-redirect-success") {
+			t.Fatalf("Expected success redirect, got %q", loc)
+		}
+	}
+
+	checkClientMessages := func(t *testing.T, clientId string, msg subscriptions.Message, expectedMessages map[string][]string) {
+		if len(expectedMessages[clientId]) == 0 {
+			t.Fatalf("Unexpected client %q message, got %s:\n%s", clientId, msg.Name, msg.Data)
+		}
+
+		if msg.Name != "@oauth2" {
+			t.Fatalf("Expected @oauth2 msg.Name, got %q", msg.Name)
+		}
+
+		for _, txt := range expectedMessages[clientId] {
+			if !strings.Contains(string(msg.Data), txt) {
+				t.Fatalf("Failed to find %q in \n%s", txt, msg.Data)
+			}
+		}
+	}
+
+	beforeTestFunc := func(
+		clients map[string]subscriptions.Client,
+		expectedMessages map[string][]string,
+	) func(*testing.T, *tests.TestApp, *echo.Echo) {
+		return func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			for _, client := range clients {
+				app.SubscriptionsBroker().Register(client)
+			}
+
+			ctx, cancelFunc := context.WithTimeout(context.Background(), 100*time.Millisecond)
+
+			// add to the app store so that it can be cancelled manually after test completion
+			app.Store().Set("cancelFunc", cancelFunc)
+
+			go func() {
+				defer cancelFunc()
+
+				for {
+					select {
+					case msg := <-clients["c1"].Channel():
+						checkClientMessages(t, "c1", msg, expectedMessages)
+					case msg := <-clients["c2"].Channel():
+						checkClientMessages(t, "c2", msg, expectedMessages)
+					case msg := <-clients["c3"].Channel():
+						checkClientMessages(t, "c3", msg, expectedMessages)
+					case msg := <-clients["c4"].Channel():
+						checkClientMessages(t, "c4", msg, expectedMessages)
+					case msg := <-clients["c5"].Channel():
+						checkClientMessages(t, "c5", msg, expectedMessages)
+					case <-ctx.Done():
+						for _, c := range clients {
+							close(c.Channel())
+						}
+						return
+					}
+				}
+			}()
+		}
 	}
 
 	scenarios := []tests.ApiScenario{
 		{
-			Name:            "no state query param",
-			Method:          http.MethodGet,
-			Url:             "/api/oauth2-redirect?code=123",
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
+			Name:           "no state query param",
+			Method:         http.MethodGet,
+			Url:            "/api/oauth2-redirect?code=123",
+			BeforeTestFunc: beforeTestFunc(clientStubs[0], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
 		},
 		{
-			Name:            "no code query param",
-			Method:          http.MethodGet,
-			Url:             "/api/oauth2-redirect?state=" + c3.Id(),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
+			Name:           "invalid or missing client",
+			Method:         http.MethodGet,
+			Url:            "/api/oauth2-redirect?code=123&state=missing",
+			BeforeTestFunc: beforeTestFunc(clientStubs[1], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
 		},
 		{
-			Name:            "missing client",
-			Method:          http.MethodGet,
-			Url:             "/api/oauth2-redirect?code=123&state=missing",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
+			Name:   "no code query param",
+			Method: http.MethodGet,
+			Url:    "/api/oauth2-redirect?state=" + clientStubs[2]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[2], map[string][]string{
+				"c3": {`"state":"` + clientStubs[2]["c3"].Id(), `"code":""`},
+			}),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+
+				if clientStubs[2]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
 		},
 		{
-			Name:            "discarded client with @oauth2 subscription",
-			Method:          http.MethodGet,
-			Url:             "/api/oauth2-redirect?code=123&state=" + c5.Id(),
-			BeforeTestFunc:  beforeTestFunc,
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
+			Name:   "error query param",
+			Method: http.MethodGet,
+			Url:    "/api/oauth2-redirect?error=example&code=123&state=" + clientStubs[3]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[3], map[string][]string{
+				"c3": {`"state":"` + clientStubs[3]["c3"].Id(), `"code":"123"`, `"error":"example"`},
+			}),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+
+				if clientStubs[3]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
 		},
 		{
-			Name:            "client without @oauth2 subscription",
-			Method:          http.MethodGet,
-			Url:             "/api/oauth2-redirect?code=123&state=" + c4.Id(),
-			BeforeTestFunc:  beforeTestFunc,
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
+			Name:           "discarded client with @oauth2 subscription",
+			Method:         http.MethodGet,
+			Url:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c5"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[4], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
+		},
+		{
+			Name:           "client without @oauth2 subscription",
+			Method:         http.MethodGet,
+			Url:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c4"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[5], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
 		},
 		{
 			Name:   "client with @oauth2 subscription",
 			Method: http.MethodGet,
-			Url:    "/api/oauth2-redirect?code=123&state=" + c3.Id(),
-			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				beforeTestFunc(t, app, e)
-
-				ctx, cancelFunc := context.WithTimeout(context.Background(), 1*time.Second)
-
-				go func() {
-					defer cancelFunc()
-				L:
-					for {
-						select {
-						case <-c1.Channel():
-							t.Error("Unexpected c1 message")
-							break L
-						case <-c2.Channel():
-							t.Error("Unexpected c2 message")
-							break L
-						case msg := <-c3.Channel():
-							if msg.Name != "@oauth2" {
-								t.Errorf("Expected @oauth2 msg.Name, got %q", msg.Name)
-							}
-
-							expectedParams := []string{`"state"`, `"code"`}
-							for _, p := range expectedParams {
-								if !strings.Contains(string(msg.Data), p) {
-									t.Errorf("Couldn't find %s in \n%v", p, msg.Data)
-								}
-							}
-
-							break L
-						case <-c4.Channel():
-							t.Error("Unexpected c4 message")
-							break L
-						case <-c5.Channel():
-							t.Error("Unexpected c5 message")
-							break L
-						case <-ctx.Done():
-							t.Error("Context timeout reached")
-							break L
-						}
-					}
-				}()
-			},
+			Url:    "/api/oauth2-redirect?code=123&state=" + clientStubs[6]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[6], map[string][]string{
+				"c3": {`"state":"` + clientStubs[6]["c3"].Id(), `"code":"123"`},
+			}),
 			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[6]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
+		{
+			Name:   "(POST) client with @oauth2 subscription",
+			Method: http.MethodPost,
+			Url:    "/api/oauth2-redirect",
+			Body:   strings.NewReader("code=123&state=" + clientStubs[7]["c3"].Id()),
+			RequestHeaders: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[7], map[string][]string{
+				"c3": {`"state":"` + clientStubs[7]["c3"].Id(), `"code":"123"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[7]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
 		},
 	}
 

apis/record_crud.go

@@ -1,10 +1,12 @@
 package apis
 
 import (
+	cryptoRand "crypto/rand"
 	"fmt"
-	"log"
+	"log/slog"
+	"math/big"
 	"net/http"
-	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -16,8 +18,6 @@ import (
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
-const expandQueryParam = "expand"
-
 // bindRecordCrudApi registers the record crud api endpoints and
 // the corresponding handlers.
 func bindRecordCrudApi(app core.App, rg *echo.Group) {
@@ -45,13 +45,13 @@ func (api *recordApi) list(c echo.Context) error {
 		return NewNotFoundError("", "Missing collection context.")
 	}
 
+	requestInfo := RequestInfo(c)
+
 	// forbid users and guests to query special filter/sort fields
-	if err := api.checkForForbiddenQueryFields(c); err != nil {
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
 		return err
 	}
 
-	requestInfo := RequestInfo(c)
-
 	if requestInfo.Admin == nil && collection.ListRule == nil {
 		// only admins can access if the rule is nil
 		return NewForbiddenError("Only admins can perform this action.", nil)
@@ -74,9 +74,15 @@ func (api *recordApi) list(c echo.Context) error {
 
 	records := []*models.Record{}
 
-	result, err := searchProvider.ParseAndExec(c.QueryParams().Encode(), &records)
+	// note: in v0.23.0 this has been migrated as option check in the search.Provider
+	queryStr := c.QueryParams().Encode()
+	if len(queryStr) > 2048 {
+		return NewBadRequestError("query string is too large", nil)
+	}
+
+	result, err := searchProvider.ParseAndExec(queryStr, &records)
 	if err != nil {
-		return NewBadRequestError("Invalid filter parameters.", err)
+		return NewBadRequestError("", err)
 	}
 
 	event := new(core.RecordsListEvent)
@@ -90,14 +96,47 @@ func (api *recordApi) list(c echo.Context) error {
 			return nil
 		}
 
-		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil {
+			api.app.Logger().Debug("Failed to enrich list records", slog.String("error", err.Error()))
+		}
+
+		// note: in v0.23.0 this is combined with extra check for repeated attempts
+		//
+		// Add a randomized throttle in case of empty search filter attempts.
+		//
+		// This is just for extra precaution since security researches raised concern regarding the possibity of eventual
+		// timing attacks because the List API rule acts also as filter and executes in a single run with the client-side filters.
+		// This is by design and it is an accepted tradeoff between performance, usability and correctness.
+		//
+		// While technically the below doesn't fully guarantee protection against filter timing attacks, in practice combined with the network latency it makes them even less feasible.
+		// A properly configured rate limiter or individual fields Hidden checks are better suited if you are really concerned about eventual information disclosure by side-channel attacks.
+		//
+		// In all cases it doesn't really matter that much because it doesn't affect the builtin PocketBase security sensitive fields (e.g. password and tokenKey) since they
+		// are not client-side filterable and in the few places where they need to be compared against an external value, a constant time check is used.
+		if requestInfo.Admin == nil &&
+			(collection.ListRule != nil && *collection.ListRule != "") &&
+			(requestInfo.Query["filter"] != "") &&
+			len(e.Records) == 0 {
+			api.app.Logger().Debug("Randomized throttle because of failed filter search", "collectionId", collection.Id)
+			randomizedThrottle(100)
 		}
 
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
 	})
 }
 
+func randomizedThrottle(softMax int64) {
+	var timeout int64
+	randRange, err := cryptoRand.Int(cryptoRand.Reader, big.NewInt(softMax))
+	if err == nil {
+		timeout = randRange.Int64()
+	} else {
+		timeout = softMax
+	}
+
+	time.Sleep(time.Duration(timeout) * time.Millisecond)
+}
+
 func (api *recordApi) view(c echo.Context) error {
 	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
 	if collection == nil {
@@ -144,8 +183,13 @@ func (api *recordApi) view(c echo.Context) error {
 			return nil
 		}
 
-		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-			log.Println(err)
+		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+			api.app.Logger().Debug(
+				"Failed to enrich view record",
+				slog.String("id", e.Record.Id),
+				slog.String("collectionName", e.Record.Collection().Name),
+				slog.String("error", err.Error()),
+			)
 		}
 
 		return e.HttpContext.JSON(http.StatusOK, e.Record)
@@ -183,6 +227,11 @@ func (api *recordApi) create(c echo.Context) error {
 			return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 		}
 
+		// force unset the verified state to prevent ManageRule misuse
+		if !hasFullManageAccess {
+			testForm.Verified = false
+		}
+
 		createRuleFunc := func(q *dbx.SelectQuery) error {
 			if *collection.CreateRule == "" {
 				return nil // no create rule to resolve
@@ -237,8 +286,13 @@ func (api *recordApi) create(c echo.Context) error {
 					return NewBadRequestError("Failed to create record.", err)
 				}
 
-				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-					log.Println(err)
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich create record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
 				}
 
 				return api.app.OnRecordAfterCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
@@ -324,8 +378,13 @@ func (api *recordApi) update(c echo.Context) error {
 					return NewBadRequestError("Failed to update record.", err)
 				}
 
-				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil && api.app.IsDebug() {
-					log.Println(err)
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich update record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
 				}
 
 				return api.app.OnRecordAfterUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
@@ -396,21 +455,3 @@ func (api *recordApi) delete(c echo.Context) error {
 		})
 	})
 }
-
-func (api *recordApi) checkForForbiddenQueryFields(c echo.Context) error {
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		return nil // admins are allowed to query everything
-	}
-
-	decodedQuery := c.QueryParam(search.FilterQueryParam) + c.QueryParam(search.SortQueryParam)
-	forbiddenFields := []string{"@collection.", "@request."}
-
-	for _, field := range forbiddenFields {
-		if strings.Contains(decodedQuery, field) {
-			return NewForbiddenError("Only admins can filter by @collection and @request query params", nil)
-		}
-	}
-
-	return nil
-}

apis/record_crud_test.go

@@ -14,9 +14,13 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestRecordCrudList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "missing collection",
@@ -43,9 +47,16 @@ func TestRecordCrudList(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:            "public collection but with admin only filter/sort (aka. @collection)",
+			Name:            "public collection but with admin only filter param (aka. @collection, @request, etc.)",
 			Method:          http.MethodGet,
-			Url:             "/api/collections/demo2/records?filter=@collection.demo2.title='test1'",
+			Url:             "/api/collections/demo2/records?filter=%40collection.demo2.title='test1'",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:            "public collection but with admin only sort param (aka. @collection, @request, etc.)",
+			Method:          http.MethodGet,
+			Url:             "/api/collections/demo2/records?sort=@request.auth.title",
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
 		},
@@ -486,6 +497,8 @@ func TestRecordCrudList(t *testing.T) {
 }
 
 func TestRecordCrudView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "missing collection",
@@ -765,6 +778,8 @@ func TestRecordCrudView(t *testing.T) {
 }
 
 func TestRecordCrudDelete(t *testing.T) {
+	t.Parallel()
+
 	ensureDeletedFiles := func(app *tests.TestApp, collectionId string, recordId string) {
 		storageDir := filepath.Join(app.DataDir(), "storage", collectionId, recordId)
 
@@ -1008,6 +1023,8 @@ func TestRecordCrudDelete(t *testing.T) {
 }
 
 func TestRecordCrudCreate(t *testing.T) {
+	t.Parallel()
+
 	formData, mp, err := tests.MockMultipartData(map[string]string{
 		"title": "title_test",
 	}, "files")
@@ -1015,6 +1032,20 @@ func TestRecordCrudCreate(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	formData2, mp2, err2 := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: `{"title": "title_test2", "testPayload": 123}`,
+	}, "files")
+	if err2 != nil {
+		t.Fatal(err2)
+	}
+
+	formData3, mp3, err3 := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: `{"title": "title_test3", "testPayload": 123}`,
+	}, "files")
+	if err3 != nil {
+		t.Fatal(err3)
+	}
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "missing collection",
@@ -1222,6 +1253,60 @@ func TestRecordCrudCreate(t *testing.T) {
 				"OnModelAfterCreate":          1,
 			},
 		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and unsatisfied @request.data rule",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo3/records",
+			Body:   formData2,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp2.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.CreateRule = types.Pointer("@request.data.testPayload != 123")
+				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection create rule: %v", err)
+				}
+				core.ReloadCachedCollections(app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and satisfied @request.data rule",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo3/records",
+			Body:   formData3,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp3.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.CreateRule = types.Pointer("@request.data.testPayload = 123")
+				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection create rule: %v", err)
+				}
+				core.ReloadCachedCollections(app)
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"title":"title_test3"`,
+				`"files":["`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeCreateRequest": 1,
+				"OnRecordAfterCreateRequest":  1,
+				"OnModelBeforeCreate":         1,
+				"OnModelAfterCreate":          1,
+			},
+		},
 		{
 			Name:   "unique field error check",
 			Method: http.MethodPost,
@@ -1584,6 +1669,8 @@ func TestRecordCrudCreate(t *testing.T) {
 }
 
 func TestRecordCrudUpdate(t *testing.T) {
+	t.Parallel()
+
 	formData, mp, err := tests.MockMultipartData(map[string]string{
 		"title": "title_test",
 	}, "files")
@@ -1591,6 +1678,20 @@ func TestRecordCrudUpdate(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	formData2, mp2, err2 := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: `{"title": "title_test2", "testPayload": 123}`,
+	}, "files")
+	if err2 != nil {
+		t.Fatal(err2)
+	}
+
+	formData3, mp3, err3 := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: `{"title": "title_test3", "testPayload": 123}`,
+	}, "files")
+	if err3 != nil {
+		t.Fatal(err3)
+	}
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "missing collection",
@@ -1813,6 +1914,60 @@ func TestRecordCrudUpdate(t *testing.T) {
 				"OnModelAfterUpdate":          1,
 			},
 		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and unsatisfied @request.data rule",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   formData2,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp2.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.UpdateRule = types.Pointer("@request.data.testPayload != 123")
+				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection update rule: %v", err)
+				}
+				core.ReloadCachedCollections(app)
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and satisfied @request.data rule",
+			Method: http.MethodPatch,
+			Url:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   formData3,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp3.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.UpdateRule = types.Pointer("@request.data.testPayload = 123")
+				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection update rule: %v", err)
+				}
+				core.ReloadCachedCollections(app)
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"mk5fmymtx4wsprk"`,
+				`"title":"title_test3"`,
+				`"files":["`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeUpdateRequest": 1,
+				"OnRecordAfterUpdateRequest":  1,
+				"OnModelBeforeUpdate":         1,
+				"OnModelAfterUpdate":          1,
+			},
+		},
 		{
 			Name:   "OnRecordAfterUpdateRequest error response",
 			Method: http.MethodPatch,

apis/record_helpers.go

@@ -3,6 +3,7 @@ package apis
 import (
 	"fmt"
 	"log"
+	"log/slog"
 	"net/http"
 	"strings"
 
@@ -13,12 +14,16 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
 const ContextRequestInfoKey = "requestInfo"
 
+const expandQueryParam = "expand"
+const fieldsQueryParam = "fields"
+
 // Deprecated: Use RequestInfo instead.
 func RequestData(c echo.Context) *models.RequestInfo {
 	log.Println("RequestData(c) is deprecated and will be removed in the future! You can replace it with RequestInfo(c).")
@@ -39,6 +44,7 @@ func RequestInfo(c echo.Context) *models.RequestInfo {
 	}
 
 	result := &models.RequestInfo{
+		Context: models.RequestInfoContextDefault,
 		Method:  c.Request().Method,
 		Query:   map[string]any{},
 		Data:    map[string]any{},
@@ -49,7 +55,7 @@ func RequestInfo(c echo.Context) *models.RequestInfo {
 	// ("X-Token" is converted to "x_token")
 	for k, v := range c.Request().Header {
 		if len(v) > 0 {
-			result.Headers[strings.ToLower(strings.ReplaceAll(k, "-", "_"))] = v[0]
+			result.Headers[inflector.Snakecase(k)] = v[0]
 		}
 	}
 
@@ -72,6 +78,10 @@ func RecordAuthResponse(
 	meta any,
 	finalizers ...func(token string) error,
 ) error {
+	if !authRecord.Verified() && authRecord.Collection().AuthOptions().OnlyVerified {
+		return NewForbiddenError("Please verify your account first.", nil)
+	}
+
 	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
 	if tokenErr != nil {
 		return NewBadRequestError("Failed to create auth token.", tokenErr)
@@ -104,8 +114,8 @@ func RecordAuthResponse(
 				expands,
 				expandFetch(app.Dao(), &requestInfo),
 			)
-			if len(failed) > 0 && app.IsDebug() {
-				log.Println("Failed to expand relations: ", failed)
+			if len(failed) > 0 {
+				app.Logger().Debug("[RecordAuthResponse] Failed to expand relations", slog.Any("errors", failed))
 			}
 		}
 
@@ -131,7 +141,7 @@ func RecordAuthResponse(
 // EnrichRecord parses the request context and enrich the provided record:
 //   - expands relations (if defaultExpands and/or ?expand query param is set)
 //   - ensures that the emails of the auth record and its expanded auth relations
-//     are visibe only for the current logged admin, record owner or record with manage access
+//     are visible only for the current logged admin, record owner or record with manage access
 func EnrichRecord(c echo.Context, dao *daos.Dao, record *models.Record, defaultExpands ...string) error {
 	return EnrichRecords(c, dao, []*models.Record{record}, defaultExpands...)
 }
@@ -139,12 +149,12 @@ func EnrichRecord(c echo.Context, dao *daos.Dao, record *models.Record, defaultE
 // EnrichRecords parses the request context and enriches the provided records:
 //   - expands relations (if defaultExpands and/or ?expand query param is set)
 //   - ensures that the emails of the auth records and their expanded auth relations
-//     are visibe only for the current logged admin, record owner or record with manage access
+//     are visible only for the current logged admin, record owner or record with manage access
 func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defaultExpands ...string) error {
 	requestInfo := RequestInfo(c)
 
 	if err := autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo); err != nil {
-		return fmt.Errorf("Failed to resolve email visibility: %w", err)
+		return fmt.Errorf("failed to resolve email visibility: %w", err)
 	}
 
 	expands := defaultExpands
@@ -157,7 +167,7 @@ func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defa
 
 	errs := dao.ExpandRecords(records, expands, expandFetch(dao, requestInfo))
 	if len(errs) > 0 {
-		return fmt.Errorf("Failed to expand: %v", errs)
+		return fmt.Errorf("failed to expand: %v", errs)
 	}
 
 	return nil
@@ -175,7 +185,7 @@ func expandFetch(
 			}
 
 			if relCollection.ViewRule == nil {
-				return fmt.Errorf("Only admins can view collection %q records", relCollection.Name)
+				return fmt.Errorf("only admins can view collection %q records", relCollection.Name)
 			}
 
 			if *relCollection.ViewRule != "" {
@@ -305,3 +315,31 @@ func hasAuthManageAccess(
 
 	return findErr == nil
 }
+
+var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
+var adminOnlyRuleFields = []string{"@collection.", "@request."}
+
+// @todo consider moving the rules check to the RecordFieldResolver.
+//
+// checkForAdminOnlyRuleFields loosely checks and returns an error if
+// the provided RequestInfo contains rule fields that only the admin can use.
+func checkForAdminOnlyRuleFields(requestInfo *models.RequestInfo) error {
+	if requestInfo.Admin != nil || len(requestInfo.Query) == 0 {
+		return nil // admin or nothing to check
+	}
+
+	for _, param := range ruleQueryParams {
+		v, _ := requestInfo.Query[param].(string)
+		if v == "" {
+			continue
+		}
+
+		for _, field := range adminOnlyRuleFields {
+			if strings.Contains(v, field) {
+				return NewForbiddenError("Only admins can filter by "+field, nil)
+			}
+		}
+	}
+
+	return nil
+}

apis/record_helpers_test.go

@@ -14,6 +14,8 @@ import (
 )
 
 func TestRequestInfo(t *testing.T) {
+	t.Parallel()
+
 	e := echo.New()
 	req := httptest.NewRequest(http.MethodPost, "/?test=123", strings.NewReader(`{"test":456}`))
 	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
@@ -67,6 +69,8 @@ func TestRequestInfo(t *testing.T) {
 }
 
 func TestRecordAuthResponse(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -83,6 +87,11 @@ func TestRecordAuthResponse(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	unverifiedAuthRecord, err := app.Dao().FindRecordById("clients", "o1y0dd0spd786md")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	scenarios := []struct {
 		name               string
 		record             *models.Record
@@ -97,6 +106,11 @@ func TestRecordAuthResponse(t *testing.T) {
 			record:      nonAuthRecord,
 			expectError: true,
 		},
+		{
+			name:        "valid auth record but with unverified email in onlyVerified collection",
+			record:      unverifiedAuthRecord,
+			expectError: true,
+		},
 		{
 			name:        "valid auth record - without meta",
 			record:      authRecord,
@@ -179,6 +193,8 @@ func TestRecordAuthResponse(t *testing.T) {
 }
 
 func TestEnrichRecords(t *testing.T) {
+	t.Parallel()
+
 	e := echo.New()
 	req := httptest.NewRequest(http.MethodGet, "/?expand=rel_many", nil)
 	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)

apis/serve.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/fatih/color"
@@ -52,11 +53,11 @@ type ServeConfig struct {
 //
 // Example:
 //
-// 	app.Bootstrap()
-// 	apis.Serve(app, apis.ServeConfig{
-// 		HttpAddr:        "127.0.0.1:8080",
-// 		ShowStartBanner: false,
-// 	})
+//	app.Bootstrap()
+//	apis.Serve(app, apis.ServeConfig{
+//		HttpAddr:        "127.0.0.1:8080",
+//		ShowStartBanner: false,
+//	})
 func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 	if len(config.AllowedOrigins) == 0 {
 		config.AllowedOrigins = []string{"*"}
@@ -139,6 +140,11 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		HostPolicy: autocert.HostWhitelist(hostNames...),
 	}
 
+	// base request context used for cancelling long running requests
+	// like the SSE connections
+	baseCtx, cancelBaseCtx := context.WithCancel(context.Background())
+	defer cancelBaseCtx()
+
 	server := &http.Server{
 		TLSConfig: &tls.Config{
 			MinVersion:     tls.VersionTLS12,
@@ -150,6 +156,10 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		// WriteTimeout: 60 * time.Second, // breaks sse!
 		Handler: router,
 		Addr:    mainAddr,
+		BaseContext: func(l net.Listener) context.Context {
+			return baseCtx
+		},
+		ErrorLog: log.New(&serverErrorLogWriter{app: app}, "", 0),
 	}
 
 	serveEvent := &core.ServeEvent{
@@ -189,14 +199,39 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		regular.Printf("└─ Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, addr))
 	}
 
+	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
+	// Note that the WaitGroup would not do anything if the app.OnTerminate() hook isn't triggered.
+	var wg sync.WaitGroup
+
 	// try to gracefully shutdown the server on app termination
 	app.OnTerminate().Add(func(e *core.TerminateEvent) error {
+		cancelBaseCtx()
+
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 		defer cancel()
+
+		wg.Add(1)
 		server.Shutdown(ctx)
+		if e.IsRestart {
+			// wait for execve and other handlers up to 5 seconds before exit
+			time.AfterFunc(5*time.Second, func() {
+				wg.Done()
+			})
+		} else {
+			wg.Done()
+		}
+
 		return nil
 	})
 
+	// wait for the graceful shutdown to complete before exit
+	defer wg.Wait()
+
+	// ---
+	// @todo consider removing the server return value because it is
+	// not really useful when combined with the blocking serve calls
+	// ---
+
 	// start HTTPS server
 	if config.HttpsAddr != "" {
 		// if httpAddr is set, start an HTTP server to redirect the traffic to the HTTPS version
@@ -241,3 +276,13 @@ func runMigrations(app core.App) error {
 
 	return nil
 }
+
+type serverErrorLogWriter struct {
+	app core.App
+}
+
+func (s *serverErrorLogWriter) Write(p []byte) (int, error) {
+	s.app.Logger().Debug(strings.TrimSpace(string(p)))
+
+	return len(p), nil
+}

apis/settings_test.go

@@ -18,6 +18,8 @@ import (
 )
 
 func TestSettingsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -80,6 +82,10 @@ func TestSettingsList(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 			},
@@ -95,6 +101,8 @@ func TestSettingsList(t *testing.T) {
 }
 
 func TestSettingsSet(t *testing.T) {
+	t.Parallel()
+
 	validData := `{"meta":{"appName":"update_test"}}`
 
 	scenarios := []tests.ApiScenario{
@@ -161,6 +169,10 @@ func TestSettingsSet(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"acme_test"`,
@@ -231,6 +243,10 @@ func TestSettingsSet(t *testing.T) {
 				`"instagramAuth":{`,
 				`"vkAuth":{`,
 				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"update_test"`,
@@ -272,6 +288,8 @@ func TestSettingsSet(t *testing.T) {
 }
 
 func TestSettingsTestS3(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -338,6 +356,8 @@ func TestSettingsTestS3(t *testing.T) {
 }
 
 func TestSettingsTestEmail(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "unauthorized",
@@ -502,6 +522,8 @@ func TestSettingsTestEmail(t *testing.T) {
 }
 
 func TestGenerateAppleClientSecret(t *testing.T) {
+	t.Parallel()
+
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)

cmd/admin.go

@@ -28,12 +28,10 @@ func NewAdminCommand(app core.App) *cobra.Command {
 
 func adminCreateCommand(app core.App) *cobra.Command {
 	command := &cobra.Command{
-		Use:     "create",
-		Example: "admin create test@example.com 1234567890",
-		Short:   "Creates a new admin account",
-		// prevents printing the error log twice
-		SilenceErrors: true,
-		SilenceUsage:  true,
+		Use:          "create",
+		Example:      "admin create test@example.com 1234567890",
+		Short:        "Creates a new admin account",
+		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) != 2 {
 				return errors.New("Missing email and password arguments.")
@@ -51,6 +49,10 @@ func adminCreateCommand(app core.App) *cobra.Command {
 			admin.Email = args[0]
 			admin.SetPassword(args[1])
 
+			if !app.Dao().HasTable(admin.TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
 			if err := app.Dao().SaveAdmin(admin); err != nil {
 				return fmt.Errorf("Failed to create new admin account: %v", err)
 			}
@@ -65,12 +67,10 @@ func adminCreateCommand(app core.App) *cobra.Command {
 
 func adminUpdateCommand(app core.App) *cobra.Command {
 	command := &cobra.Command{
-		Use:     "update",
-		Example: "admin update test@example.com 1234567890",
-		Short:   "Changes the password of a single admin account",
-		// prevents printing the error log twice
-		SilenceErrors: true,
-		SilenceUsage:  true,
+		Use:          "update",
+		Example:      "admin update test@example.com 1234567890",
+		Short:        "Changes the password of a single admin account",
+		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) != 2 {
 				return errors.New("Missing email and password arguments.")
@@ -84,6 +84,10 @@ func adminUpdateCommand(app core.App) *cobra.Command {
 				return errors.New("The new password must be at least 8 chars long.")
 			}
 
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
 			admin, err := app.Dao().FindAdminByEmail(args[0])
 			if err != nil {
 				return fmt.Errorf("Admin with email %s doesn't exist.", args[0])
@@ -105,17 +109,19 @@ func adminUpdateCommand(app core.App) *cobra.Command {
 
 func adminDeleteCommand(app core.App) *cobra.Command {
 	command := &cobra.Command{
-		Use:     "delete",
-		Example: "admin delete test@example.com",
-		Short:   "Deletes an existing admin account",
-		// prevents printing the error log twice
-		SilenceErrors: true,
-		SilenceUsage:  true,
+		Use:          "delete",
+		Example:      "admin delete test@example.com",
+		Short:        "Deletes an existing admin account",
+		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
 				return errors.New("Invalid or missing email address.")
 			}
 
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
 			admin, err := app.Dao().FindAdminByEmail(args[0])
 			if err != nil {
 				color.Yellow("Admin %s is already deleted.", args[0])

cmd/admin_test.go

@@ -8,6 +8,8 @@ import (
 )
 
 func TestAdminCreateCommand(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

cmd/serve.go

@@ -1,7 +1,7 @@
 package cmd
 
 import (
-	"log"
+	"errors"
 	"net/http"
 
 	"github.com/pocketbase/pocketbase/apis"
@@ -17,10 +17,11 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 	var httpsAddr string
 
 	command := &cobra.Command{
-		Use:   "serve [domain(s)]",
-		Args:  cobra.ArbitraryArgs,
-		Short: "Starts the web server (default to 127.0.0.1:8090 if no domain is specified)",
-		Run: func(command *cobra.Command, args []string) {
+		Use:          "serve [domain(s)]",
+		Args:         cobra.ArbitraryArgs,
+		Short:        "Starts the web server (default to 127.0.0.1:8090 if no domain is specified)",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
 			// set default listener addresses if at least one domain is specified
 			if len(args) > 0 {
 				if httpAddr == "" {
@@ -43,9 +44,11 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 				CertificateDomains: args,
 			})
 
-			if err != http.ErrServerClosed {
-				log.Fatalln(err)
+			if errors.Is(err, http.ErrServerClosed) {
+				return nil
 			}
+
+			return err
 		},
 	}
 

core/app.go

@@ -5,6 +5,7 @@ package core
 
 import (
 	"context"
+	"log/slog"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
@@ -48,6 +49,9 @@ type App interface {
 	// the users table from LogsDao will result in error.
 	LogsDao() *daos.Dao
 
+	// Logger returns the active app logger.
+	Logger() *slog.Logger
+
 	// DataDir returns the app data directory path.
 	DataDir() string
 
@@ -55,16 +59,18 @@ type App interface {
 	// (used for settings encryption).
 	EncryptionEnv() string
 
-	// IsDebug returns whether the app is in debug mode
-	// (showing more detailed error logs, executed sql statements, etc.).
-	IsDebug() bool
+	// IsDev returns whether the app is in dev mode.
+	IsDev() bool
 
 	// Settings returns the loaded app settings.
 	Settings() *settings.Settings
 
-	// Cache returns the app internal cache store.
+	// Deprecated: Use app.Store() instead.
 	Cache() *store.Store[any]
 
+	// Store returns the app runtime store.
+	Store() *store.Store[any]
+
 	// SubscriptionsBroker returns the app realtime subscriptions broker instance.
 	SubscriptionsBroker() *subscriptions.Broker
 
@@ -285,14 +291,14 @@ type App interface {
 	// SSE client connection.
 	OnRealtimeDisconnectRequest() *hook.Hook[*RealtimeDisconnectEvent]
 
-	// OnRealtimeBeforeMessage hook is triggered right before sending
+	// OnRealtimeBeforeMessageSend hook is triggered right before sending
 	// an SSE message to a client.
 	//
 	// Returning [hook.StopPropagation] will prevent sending the message.
 	// Returning any other non-nil error will close the realtime connection.
 	OnRealtimeBeforeMessageSend() *hook.Hook[*RealtimeMessageEvent]
 
-	// OnRealtimeBeforeMessage hook is triggered right after sending
+	// OnRealtimeAfterMessageSend hook is triggered right after sending
 	// an SSE message to a client.
 	OnRealtimeAfterMessageSend() *hook.Hook[*RealtimeMessageEvent]
 

core/base.go

@@ -5,9 +5,11 @@ import (
 	"database/sql"
 	"errors"
 	"log"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"syscall"
 	"time"
 
@@ -18,10 +20,14 @@ import (
 	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
 )
 
 const (
@@ -39,8 +45,10 @@ var _ App = (*BaseApp)(nil)
 
 // BaseApp implements core.App and defines the base PocketBase app structure.
 type BaseApp struct {
+	// @todo consider introducing a mutex to allow safe concurrent config changes during runtime
+
 	// configurable parameters
-	isDebug          bool
+	isDev            bool
 	dataDir          string
 	encryptionEnv    string
 	dataMaxOpenConns int
@@ -49,11 +57,12 @@ type BaseApp struct {
 	logsMaxIdleConns int
 
 	// internals
-	cache               *store.Store[any]
+	store               *store.Store[any]
 	settings            *settings.Settings
 	dao                 *daos.Dao
 	logsDao             *daos.Dao
 	subscriptionsBroker *subscriptions.Broker
+	logger              *slog.Logger
 
 	// app event hooks
 	onBeforeBootstrap *hook.Hook[*BootstrapEvent]
@@ -167,9 +176,9 @@ type BaseApp struct {
 
 // BaseAppConfig defines a BaseApp configuration option
 type BaseAppConfig struct {
+	IsDev            bool
 	DataDir          string
 	EncryptionEnv    string
-	IsDebug          bool
 	DataMaxOpenConns int // default to 500
 	DataMaxIdleConns int // default 20
 	LogsMaxOpenConns int // default to 100
@@ -182,14 +191,14 @@ type BaseAppConfig struct {
 // To initialize the app, you need to call `app.Bootstrap()`.
 func NewBaseApp(config BaseAppConfig) *BaseApp {
 	app := &BaseApp{
+		isDev:               config.IsDev,
 		dataDir:             config.DataDir,
-		isDebug:             config.IsDebug,
 		encryptionEnv:       config.EncryptionEnv,
 		dataMaxOpenConns:    config.DataMaxOpenConns,
 		dataMaxIdleConns:    config.DataMaxIdleConns,
 		logsMaxOpenConns:    config.LogsMaxOpenConns,
 		logsMaxIdleConns:    config.LogsMaxIdleConns,
-		cache:               store.New[any](nil),
+		store:               store.New[any](nil),
 		settings:            settings.New(),
 		subscriptionsBroker: subscriptions.NewBroker(),
 
@@ -314,6 +323,17 @@ func (app *BaseApp) IsBootstrapped() bool {
 	return app.dao != nil && app.logsDao != nil && app.settings != nil
 }
 
+// Logger returns the default app logger.
+//
+// If the application is not bootstrapped yet, fallbacks to slog.Default().
+func (app *BaseApp) Logger() *slog.Logger {
+	if app.logger == nil {
+		return slog.Default()
+	}
+
+	return app.logger
+}
+
 // Bootstrap initializes the application
 // (aka. create data dir, open db connections, load settings, etc.).
 //
@@ -343,6 +363,10 @@ func (app *BaseApp) Bootstrap() error {
 		return err
 	}
 
+	if err := app.initLogger(); err != nil {
+		return err
+	}
+
 	// we don't check for an error because the db migrations may have not been executed yet
 	app.RefreshSettings()
 
@@ -438,10 +462,11 @@ func (app *BaseApp) EncryptionEnv() string {
 	return app.encryptionEnv
 }
 
-// IsDebug returns whether the app is in debug mode
-// (showing more detailed error logs, executed sql statements, etc.).
-func (app *BaseApp) IsDebug() bool {
-	return app.isDebug
+// IsDev returns whether the app is in dev mode.
+//
+// When enabled logs, executed sql statements, etc. are printed to the stderr.
+func (app *BaseApp) IsDev() bool {
+	return app.isDev
 }
 
 // Settings returns the loaded app settings.
@@ -449,9 +474,15 @@ func (app *BaseApp) Settings() *settings.Settings {
 	return app.settings
 }
 
-// Cache returns the app internal cache store.
+// Deprecated: Use app.Store() instead.
 func (app *BaseApp) Cache() *store.Store[any] {
-	return app.cache
+	color.Yellow("app.Store() is soft-deprecated. Please replace it with app.Store().")
+	return app.Store()
+}
+
+// Store returns the app internal runtime store.
+func (app *BaseApp) Store() *store.Store[any] {
+	return app.store
 }
 
 // SubscriptionsBroker returns the app realtime subscriptions broker instance.
@@ -533,17 +564,17 @@ func (app *BaseApp) Restart() error {
 		return err
 	}
 
-	// optimistically reset the app bootstrap state
-	app.ResetBootstrapState()
+	return app.OnTerminate().Trigger(&TerminateEvent{
+		App:       app,
+		IsRestart: true,
+	}, func(e *TerminateEvent) error {
+		e.App.ResetBootstrapState()
 
-	if err := syscall.Exec(execPath, os.Args, os.Environ()); err != nil {
-		// restart the app bootstrap state
-		app.Bootstrap()
+		// attempt to restart the bootstrap process in case execve returns an error for some reason
+		defer e.App.Bootstrap()
 
-		return err
-	}
-
-	return nil
+		return syscall.Exec(execPath, os.Args, os.Environ())
+	})
 }
 
 // RefreshSettings reinitializes and reloads the stored application settings.
@@ -555,7 +586,7 @@ func (app *BaseApp) RefreshSettings() error {
 	encryptionKey := os.Getenv(app.EncryptionEnv())
 
 	storedSettings, err := app.Dao().FindSettings(encryptionKey)
-	if err != nil && err != sql.ErrNoRows {
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
 		return err
 	}
 
@@ -569,6 +600,13 @@ func (app *BaseApp) RefreshSettings() error {
 		return err
 	}
 
+	// reload handler level (if initialized)
+	if app.Logger() != nil {
+		if h, ok := app.Logger().Handler().(*logger.BatchHandler); ok {
+			h.SetLevel(app.getLoggerMinLevel())
+		}
+	}
+
 	return nil
 }
 
@@ -988,7 +1026,7 @@ func (app *BaseApp) initLogsDB() error {
 	}
 	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
 	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
-	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "logs.db"))
 	if err != nil {
@@ -996,7 +1034,7 @@ func (app *BaseApp) initLogsDB() error {
 	}
 	nonconcurrentDB.DB().SetMaxOpenConns(1)
 	nonconcurrentDB.DB().SetMaxIdleConns(1)
-	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	app.logsDao = daos.NewMultiDB(concurrentDB, nonconcurrentDB)
 
@@ -1019,7 +1057,7 @@ func (app *BaseApp) initDataDB() error {
 	}
 	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
 	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
-	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
 	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "data.db"))
 	if err != nil {
@@ -1027,17 +1065,16 @@ func (app *BaseApp) initDataDB() error {
 	}
 	nonconcurrentDB.DB().SetMaxOpenConns(1)
 	nonconcurrentDB.DB().SetMaxIdleConns(1)
-	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
 
-	if app.IsDebug() {
+	if app.IsDev() {
 		nonconcurrentDB.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
-		concurrentDB.QueryLogFunc = nonconcurrentDB.QueryLogFunc
-
 		nonconcurrentDB.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
+		concurrentDB.QueryLogFunc = nonconcurrentDB.QueryLogFunc
 		concurrentDB.ExecLogFunc = nonconcurrentDB.ExecLogFunc
 	}
 
@@ -1125,18 +1162,19 @@ func (app *BaseApp) registerDefaultHooks() {
 	// try to delete the storage files from deleted Collection, Records, etc. model
 	app.OnModelAfterDelete().Add(func(e *ModelEvent) error {
 		if m, ok := e.Model.(models.FilesManager); ok && m.BaseFilesPath() != "" {
-			prefix := m.BaseFilesPath()
+			// ensure that there is a trailing slash so that the list iterator could start walking from the prefix
+			// (https://github.com/pocketbase/pocketbase/discussions/5246#discussioncomment-10128955)
+			prefix := strings.TrimRight(m.BaseFilesPath(), "/") + "/"
 
 			// run in the background for "optimistic" delete to avoid
 			// blocking the delete transaction
-			//
-			// @todo consider creating a bg process queue so that the
-			// call could be "retried" in case of a failure.
 			routine.FireAndForget(func() {
-				if err := deletePrefix(prefix); err != nil && app.IsDebug() {
-					// non critical error - only log for debug
-					// (usually could happen because of S3 api limits)
-					log.Println(err)
+				if err := deletePrefix(prefix); err != nil {
+					app.Logger().Error(
+						"Failed to delete storage prefix (non critical error; usually could happen because of S3 api limits)",
+						slog.String("prefix", prefix),
+						slog.String("error", err.Error()),
+					)
 				}
 			})
 		}
@@ -1144,12 +1182,127 @@ func (app *BaseApp) registerDefaultHooks() {
 		return nil
 	})
 
-	app.OnTerminate().Add(func(e *TerminateEvent) error {
-		app.ResetBootstrapState()
+	if err := app.initAutobackupHooks(); err != nil {
+		app.Logger().Error("Failed to init auto backup hooks", slog.String("error", err.Error()))
+	}
+
+	registerCachedCollectionsAppHooks(app)
+}
+
+// getLoggerMinLevel returns the logger min level based on the
+// app configurations (dev mode, settings, etc.).
+//
+// If not in dev mode - returns the level from the app settings.
+//
+// If the app is in dev mode it returns -9999 level allowing to print
+// practically all logs to the terminal.
+// In this case DB logs are still filtered but the checks for the min level are done
+// in the BatchOptions.BeforeAddFunc instead of the slog.Handler.Enabled() method.
+func (app *BaseApp) getLoggerMinLevel() slog.Level {
+	var minLevel slog.Level
+
+	if app.IsDev() {
+		minLevel = -9999
+	} else if app.Settings() != nil {
+		minLevel = slog.Level(app.Settings().Logs.MinLevel)
+	}
+
+	return minLevel
+}
+
+func (app *BaseApp) initLogger() error {
+	duration := 3 * time.Second
+	ticker := time.NewTicker(duration)
+	done := make(chan bool)
+
+	handler := logger.NewBatchHandler(logger.BatchOptions{
+		Level:     app.getLoggerMinLevel(),
+		BatchSize: 200,
+		BeforeAddFunc: func(ctx context.Context, log *logger.Log) bool {
+			if app.IsDev() {
+				printLog(log)
+
+				// manually check the log level and skip if necessary
+				if log.Level < slog.Level(app.Settings().Logs.MinLevel) {
+					return false
+				}
+			}
+
+			ticker.Reset(duration)
+
+			return app.Settings().Logs.MaxDays > 0
+		},
+		WriteFunc: func(ctx context.Context, logs []*logger.Log) error {
+			if !app.IsBootstrapped() || app.Settings().Logs.MaxDays == 0 {
+				return nil
+			}
+
+			// write the accumulated logs
+			// (note: based on several local tests there is no significant performance difference between small number of separate write queries vs 1 big INSERT)
+			app.LogsDao().RunInTransaction(func(txDao *daos.Dao) error {
+				model := &models.Log{}
+				for _, l := range logs {
+					model.MarkAsNew()
+					// note: using pseudorandom for a slightly better performance
+					model.Id = security.PseudorandomStringWithAlphabet(models.DefaultIdLength, models.DefaultIdAlphabet)
+					model.Level = int(l.Level)
+					model.Message = l.Message
+					model.Data = l.Data
+					model.Created, _ = types.ParseDateTime(l.Time)
+					model.Updated = model.Created
+
+					if err := txDao.SaveLog(model); err != nil {
+						log.Println("Failed to write log", model, err)
+					}
+				}
+
+				return nil
+			})
+
+			// @todo replace with cron so that it doesn't rely on the logs write
+			//
+			// delete old logs
+			// ---
+			now := time.Now()
+			lastLogsDeletedAt := cast.ToTime(app.Store().Get("lastLogsDeletedAt"))
+			if now.Sub(lastLogsDeletedAt).Hours() >= 6 {
+				deleteErr := app.LogsDao().DeleteOldLogs(now.AddDate(0, 0, -1*app.Settings().Logs.MaxDays))
+				if deleteErr == nil {
+					app.Store().Set("lastLogsDeletedAt", now)
+				} else {
+					log.Println("Logs delete failed", deleteErr)
+				}
+			}
+
+			return nil
+		},
+	})
+
+	go func() {
+		ctx := context.Background()
+
+		for {
+			select {
+			case <-done:
+				return
+			case <-ticker.C:
+				handler.WriteAll(ctx)
+			}
+		}
+	}()
+
+	app.logger = slog.New(handler)
+
+	app.OnTerminate().PreAdd(func(e *TerminateEvent) error {
+		// write all remaining logs before ticker.Stop to avoid races with ResetBootstrap user calls
+		handler.WriteAll(context.Background())
+
+		ticker.Stop()
+
+		done <- true
+
 		return nil
 	})
 
-	if err := app.initAutobackupHooks(); err != nil && app.IsDebug() {
-		log.Println(err)
-	}
+	return nil
 }

core/base_backup.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -22,8 +22,11 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+// Deprecated: Replaced with StoreKeyActiveBackup.
 const CacheKeyActiveBackup string = "@activeBackup"
 
+const StoreKeyActiveBackup string = "@activeBackup"
+
 // CreateBackup creates a new backup of the current app pb_data directory.
 //
 // If name is empty, it will be autogenerated.
@@ -43,7 +46,7 @@ const CacheKeyActiveBackup string = "@activeBackup"
 //
 // Backups can be stored on S3 if it is configured in app.Settings().Backups.
 func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
-	if app.Cache().Has(CacheKeyActiveBackup) {
+	if app.Store().Has(StoreKeyActiveBackup) {
 		return errors.New("try again later - another backup/restore operation has already been started")
 	}
 
@@ -51,8 +54,8 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 		name = app.generateBackupName("pb_backup_")
 	}
 
-	app.Cache().Set(CacheKeyActiveBackup, name)
-	defer app.Cache().Remove(CacheKeyActiveBackup)
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
 
 	// root dir entries to exclude from the backup generation
 	exclude := []string{LocalBackupsDirName, LocalTempDirName}
@@ -69,9 +72,15 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 	// Run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection).
 	// ---
 	tempPath := filepath.Join(localTempDir, "pb_backup_"+security.PseudorandomString(4))
-	createErr := app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
-		// @todo consider experimenting with temp switching the readonly pragma after the db interface change
-		return archive.Create(app.DataDir(), tempPath, exclude...)
+	createErr := app.Dao().RunInTransaction(func(dataTXDao *daos.Dao) error {
+		return app.LogsDao().RunInTransaction(func(logsTXDao *daos.Dao) error {
+			// run manual checkpoint and truncate the WAL files
+			// (errors are ignored because it is not that important and the PRAGMA may not be supported by the used driver)
+			dataTXDao.DB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+			logsTXDao.DB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+
+			return archive.Create(app.DataDir(), tempPath, exclude...)
+		})
 	})
 	if createErr != nil {
 		return createErr
@@ -135,12 +144,12 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 		return errors.New("restore is not supported on windows")
 	}
 
-	if app.Cache().Has(CacheKeyActiveBackup) {
+	if app.Store().Has(StoreKeyActiveBackup) {
 		return errors.New("try again later - another backup/restore operation has already been started")
 	}
 
-	app.Cache().Set(CacheKeyActiveBackup, name)
-	defer app.Cache().Remove(CacheKeyActiveBackup)
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
 
 	fsys, err := app.NewBackupsFilesystem()
 	if err != nil {
@@ -189,8 +198,12 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 	// remove the extracted zip file since we no longer need it
 	// (this is in case the app restarts and the defer calls are not called)
-	if err := os.Remove(tempZip.Name()); err != nil && app.IsDebug() {
-		log.Println(err)
+	if err := os.Remove(tempZip.Name()); err != nil {
+		app.Logger().Debug(
+			"[RestoreBackup] Failed to remove the temp zip backup file",
+			slog.String("file", tempZip.Name()),
+			slog.String("error", err.Error()),
+		)
 	}
 
 	// root dir entries to exclude from the backup restore
@@ -223,8 +236,8 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 	// restart the app
 	if err := app.Restart(); err != nil {
-		if err := revertDataDirChanges(); err != nil {
-			panic(err)
+		if revertErr := revertDataDirChanges(); revertErr != nil {
+			panic(revertErr)
 		}
 
 		return fmt.Errorf("failed to restart the app process: %w", err)
@@ -241,6 +254,16 @@ func (app *BaseApp) initAutobackupHooks() error {
 	loadJob := func() {
 		c.Stop()
 
+		// make sure that app.Settings() is always up to date
+		//
+		// @todo remove with the refactoring as core.App and daos.Dao will be one.
+		if err := app.RefreshSettings(); err != nil {
+			app.Logger().Debug(
+				"[Backup cron] Failed to get the latest app settings",
+				slog.String("error", err.Error()),
+			)
+		}
+
 		rawSchedule := app.Settings().Backups.Cron
 		if rawSchedule == "" || !isServe || !app.IsBootstrapped() {
 			return
@@ -251,9 +274,12 @@ func (app *BaseApp) initAutobackupHooks() error {
 
 			name := app.generateBackupName(autoPrefix)
 
-			if err := app.CreateBackup(context.Background(), name); err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err := app.CreateBackup(context.Background(), name); err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to create backup",
+					slog.String("name", name),
+					slog.String("error", err.Error()),
+				)
 			}
 
 			maxKeep := app.Settings().Backups.CronMaxKeep
@@ -263,17 +289,21 @@ func (app *BaseApp) initAutobackupHooks() error {
 			}
 
 			fsys, err := app.NewBackupsFilesystem()
-			if err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to initialize the backup filesystem",
+					slog.String("error", err.Error()),
+				)
 				return
 			}
 			defer fsys.Close()
 
 			files, err := fsys.List(autoPrefix)
-			if err != nil && app.IsDebug() {
-				// @todo replace after logs generalization
-				log.Println(err)
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to list autogenerated backups",
+					slog.String("error", err.Error()),
+				)
 				return
 			}
 
@@ -290,9 +320,12 @@ func (app *BaseApp) initAutobackupHooks() error {
 			toRemove := files[maxKeep:]
 
 			for _, f := range toRemove {
-				if err := fsys.Delete(f.Key); err != nil && app.IsDebug() {
-					// @todo replace after logs generalization
-					log.Println(err)
+				if err := fsys.Delete(f.Key); err != nil {
+					app.Logger().Debug(
+						"[Backup cron] Failed to remove old autogenerated backup",
+						slog.String("key", f.Key),
+						slog.String("error", err.Error()),
+					)
 				}
 			}
 		})

core/base_backup_test.go

@@ -25,11 +25,11 @@ func TestCreateBackup(t *testing.T) {
 	expectedAppNamePrefix := "test_" + strings.Repeat("a", 45)
 
 	// test pending error
-	app.Cache().Set(core.CacheKeyActiveBackup, "")
+	app.Store().Set(core.StoreKeyActiveBackup, "")
 	if err := app.CreateBackup(context.Background(), "test.zip"); err == nil {
 		t.Fatal("Expected pending error, got nil")
 	}
-	app.Cache().Remove(core.CacheKeyActiveBackup)
+	app.Store().Remove(core.StoreKeyActiveBackup)
 
 	// create with auto generated name
 	if err := app.CreateBackup(context.Background(), ""); err != nil {
@@ -98,11 +98,11 @@ func TestRestoreBackup(t *testing.T) {
 	}
 
 	// test pending error
-	app.Cache().Set(core.CacheKeyActiveBackup, "")
+	app.Store().Set(core.StoreKeyActiveBackup, "")
 	if err := app.RestoreBackup(context.Background(), "test"); err == nil {
 		t.Fatal("Expected pending error, got nil")
 	}
-	app.Cache().Remove(core.CacheKeyActiveBackup)
+	app.Store().Remove(core.StoreKeyActiveBackup)
 
 	// missing backup
 	if err := app.RestoreBackup(context.Background(), "missing"); err == nil {

core/base_settings_test.go

@@ -20,7 +20,7 @@ func TestBaseAppRefreshSettings(t *testing.T) {
 	// check if the new settings are saved in the db
 	app.ResetEventCalls()
 	if err := app.RefreshSettings(); err != nil {
-		t.Fatal("Failed to refresh the settings after delete")
+		t.Fatalf("Failed to refresh the settings after delete: %v", err)
 	}
 	testEventCalls(t, app, map[string]int{
 		"OnModelBeforeCreate": 1,

core/base_test.go

@@ -1,10 +1,25 @@
 package core
 
 import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
 	"os"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/migrate"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestNewBaseApp(t *testing.T) {
@@ -14,7 +29,7 @@ func TestNewBaseApp(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "test_env",
-		IsDebug:       true,
+		IsDev:         true,
 	})
 
 	if app.dataDir != testDataDir {
@@ -25,12 +40,12 @@ func TestNewBaseApp(t *testing.T) {
 		t.Fatalf("expected encryptionEnv test_env, got %q", app.dataDir)
 	}
 
-	if !app.isDebug {
-		t.Fatalf("expected isDebug true, got %v", app.isDebug)
+	if !app.isDev {
+		t.Fatalf("expected isDev true, got %v", app.isDev)
 	}
 
-	if app.cache == nil {
-		t.Fatal("expected cache to be set, got nil")
+	if app.store == nil {
+		t.Fatal("expected store to be set, got nil")
 	}
 
 	if app.settings == nil {
@@ -49,7 +64,6 @@ func TestBaseAppBootstrap(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
 	})
 	defer app.ResetBootstrapState()
 
@@ -57,7 +71,6 @@ func TestBaseAppBootstrap(t *testing.T) {
 		t.Fatal("Didn't expect the application to be bootstrapped.")
 	}
 
-	// bootstrap
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
@@ -106,6 +119,14 @@ func TestBaseAppBootstrap(t *testing.T) {
 		t.Fatal("Expected app.settings to be initialized, got nil.")
 	}
 
+	if app.logger == nil {
+		t.Fatal("Expected app.logger to be initialized, got nil.")
+	}
+
+	if _, ok := app.logger.Handler().(*logger.BatchHandler); !ok {
+		t.Fatal("Expected app.logger handler to be initialized.")
+	}
+
 	// reset
 	if err := app.ResetBootstrapState(); err != nil {
 		t.Fatal(err)
@@ -127,7 +148,7 @@ func TestBaseAppGetters(t *testing.T) {
 	app := NewBaseApp(BaseAppConfig{
 		DataDir:       testDataDir,
 		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
+		IsDev:         true,
 	})
 	defer app.ResetBootstrapState()
 
@@ -159,16 +180,20 @@ func TestBaseAppGetters(t *testing.T) {
 		t.Fatalf("Expected app.EncryptionEnv %v, got %v", app.EncryptionEnv(), app.encryptionEnv)
 	}
 
-	if app.isDebug != app.IsDebug() {
-		t.Fatalf("Expected app.IsDebug %v, got %v", app.IsDebug(), app.isDebug)
+	if app.isDev != app.IsDev() {
+		t.Fatalf("Expected app.IsDev %v, got %v", app.IsDev(), app.isDev)
 	}
 
 	if app.settings != app.Settings() {
 		t.Fatalf("Expected app.Settings %v, got %v", app.Settings(), app.settings)
 	}
 
-	if app.cache != app.Cache() {
-		t.Fatalf("Expected app.Cache %v, got %v", app.Cache(), app.cache)
+	if app.store != app.Store() {
+		t.Fatalf("Expected app.Store %v, got %v", app.Store(), app.store)
+	}
+
+	if app.logger != app.Logger() {
+		t.Fatalf("Expected app.Logger %v, got %v", app.Logger(), app.logger)
 	}
 
 	if app.subscriptionsBroker != app.SubscriptionsBroker() {
@@ -181,14 +206,11 @@ func TestBaseAppGetters(t *testing.T) {
 }
 
 func TestBaseAppNewMailClient(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	client1 := app.NewMailClient()
 	if val, ok := client1.(*mailer.Sendmail); !ok {
@@ -204,14 +226,11 @@ func TestBaseAppNewMailClient(t *testing.T) {
 }
 
 func TestBaseAppNewFilesystem(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	// local
 	local, localErr := app.NewFilesystem()
@@ -234,14 +253,11 @@ func TestBaseAppNewFilesystem(t *testing.T) {
 }
 
 func TestBaseAppNewBackupsFilesystem(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-		IsDebug:       false,
-	})
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	// local
 	local, localErr := app.NewBackupsFilesystem()
@@ -262,3 +278,364 @@ func TestBaseAppNewBackupsFilesystem(t *testing.T) {
 		t.Fatalf("Expected nil s3 backups filesystem, got %v", s3)
 	}
 }
+
+func TestBaseAppLoggerWrites(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	const logsThreshold = 200
+
+	totalLogs := func(app App, t *testing.T) int {
+		var total int
+
+		err := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
+		if err != nil {
+			t.Fatalf("Failed to fetch total logs: %v", err)
+		}
+
+		return total
+	}
+
+	t.Run("disabled logs retention", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 0
+
+		for i := 0; i < logsThreshold+1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+	})
+
+	t.Run("test batch logs writes", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 1
+
+		for i := 0; i < logsThreshold-1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+
+		// should trigger batch write
+		app.Logger().Error("test")
+
+		// should be added for the next batch write
+		app.Logger().Error("test")
+
+		if total := totalLogs(app, t); total != logsThreshold {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold, total)
+		}
+
+		// wait for ~3 secs to check the timer trigger
+		time.Sleep(3200 * time.Millisecond)
+		if total := totalLogs(app, t); total != logsThreshold+1 {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold+1, total)
+		}
+	})
+
+	t.Run("test batch logs delete", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 2
+
+		deleteQueries := 0
+
+		// reset
+		app.Store().Set("lastLogsDeletedAt", time.Now())
+		if err := app.LogsDao().DeleteOldLogs(time.Now()); err != nil {
+			t.Fatal(err)
+		}
+
+		db := app.LogsDao().NonconcurrentDB().(*dbx.DB)
+		db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+			if strings.Contains(sql, "DELETE") {
+				deleteQueries++
+			}
+		}
+
+		// trigger batch write (A)
+		expectedLogs := logsThreshold
+		for i := 0; i < expectedLogs; i++ {
+			app.Logger().Error("testA")
+		}
+
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write A] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		// mark the A inserted logs as 2-day expired
+		aExpiredDate, err := types.ParseDateTime(time.Now().AddDate(0, 0, -2))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = app.LogsDao().NonconcurrentDB().NewQuery("UPDATE _logs SET created={:date}, updated={:date}").Bind(dbx.Params{
+			"date": aExpiredDate.String(),
+		}).Execute()
+		if err != nil {
+			t.Fatalf("Failed to mock logs timestamp fields: %v", err)
+		}
+
+		// simulate recently deleted logs
+		app.Store().Set("lastLogsDeletedAt", time.Now().Add(-5*time.Hour))
+
+		// trigger batch write (B)
+		for i := 0; i < logsThreshold; i++ {
+			app.Logger().Error("testB")
+		}
+
+		expectedLogs = 2 * logsThreshold
+
+		// note: even though there are expired logs it shouldn't perform the delete operation because of the lastLogsDeledAt time
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write B] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		// mark the B inserted logs as 1-day expired to ensure that they will not be deleted
+		bExpiredDate, err := types.ParseDateTime(time.Now().AddDate(0, 0, -1))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = app.LogsDao().NonconcurrentDB().NewQuery("UPDATE _logs SET created={:date}, updated={:date} where message='testB'").Bind(dbx.Params{
+			"date": bExpiredDate.String(),
+		}).Execute()
+		if err != nil {
+			t.Fatalf("Failed to mock logs timestamp fields: %v", err)
+		}
+
+		// should trigger delete on the next batch write
+		app.Store().Set("lastLogsDeletedAt", time.Now().Add(-6*time.Hour))
+
+		// trigger batch write (C)
+		for i := 0; i < logsThreshold; i++ {
+			app.Logger().Error("testC")
+		}
+
+		expectedLogs = 2 * logsThreshold // only B and C logs should remain
+
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write C] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		if deleteQueries != 1 {
+			t.Fatalf("Expected DeleteOldLogs to be called %d, got %d", 1, deleteQueries)
+		}
+	})
+}
+
+func TestBaseAppRefreshSettingsLoggerMinLevelEnabled(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+	if !ok {
+		t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+	}
+
+	scenarios := []struct {
+		name  string
+		isDev bool
+		level int
+		// level->enabled map
+		expectations map[int]bool
+	}{
+		{
+			"dev mode",
+			true,
+			4,
+			map[int]bool{
+				3: true,
+				4: true,
+				5: true,
+			},
+		},
+		{
+			"nondev mode",
+			false,
+			4,
+			map[int]bool{
+				3: false,
+				4: true,
+				5: true,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app.isDev = s.isDev
+
+			app.Settings().Logs.MinLevel = s.level
+
+			if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+				t.Fatalf("Failed to save settings: %v", err)
+			}
+
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatalf("Failed to refresh app settings: %v", err)
+			}
+
+			for level, enabled := range s.expectations {
+				if v := handler.Enabled(nil, slog.Level(level)); v != enabled {
+					t.Fatalf("Expected level %d Enabled() to be %v, got %v", level, enabled, v)
+				}
+			}
+		})
+	}
+}
+
+func TestBaseAppLoggerLevelDevPrint(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	testLogLevel := 4
+
+	app.Settings().Logs.MinLevel = testLogLevel
+	if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name            string
+		isDev           bool
+		levels          []int
+		printedLevels   []int
+		persistedLevels []int
+	}{
+		{
+			"dev mode",
+			true,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+		{
+			"nondev mode",
+			false,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			var printedLevels []int
+			var persistedLevels []int
+
+			app.isDev = s.isDev
+
+			// trigger slog handler min level refresh
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatal(err)
+			}
+
+			// track printed logs
+			originalPrintLog := printLog
+			defer func() {
+				printLog = originalPrintLog
+			}()
+			printLog = func(log *logger.Log) {
+				printedLevels = append(printedLevels, int(log.Level))
+			}
+
+			// track persisted logs
+			app.LogsDao().AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+				l, ok := m.(*models.Log)
+				if ok {
+					persistedLevels = append(persistedLevels, l.Level)
+				}
+				return nil
+			}
+
+			// write and persist logs
+			for _, l := range s.levels {
+				app.Logger().Log(nil, slog.Level(l), "test")
+			}
+			handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+			if !ok {
+				t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+			}
+			if err := handler.WriteAll(nil); err != nil {
+				t.Fatalf("Failed to write all logs: %v", err)
+			}
+
+			// check persisted log levels
+			if len(s.persistedLevels) != len(persistedLevels) {
+				t.Fatalf("Expected persisted levels \n%v\ngot\n%v", s.persistedLevels, persistedLevels)
+			}
+			for _, l := range persistedLevels {
+				if !list.ExistInSlice(l, s.persistedLevels) {
+					t.Fatalf("Missing expected persisted level %v in %v", l, persistedLevels)
+				}
+			}
+
+			// check printed log levels
+			if len(s.printedLevels) != len(printedLevels) {
+				t.Fatalf("Expected printed levels \n%v\ngot\n%v", s.printedLevels, printedLevels)
+			}
+			for _, l := range printedLevels {
+				if !list.ExistInSlice(l, s.printedLevels) {
+					t.Fatalf("Missing expected printed level %v in %v", l, printedLevels)
+				}
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+
+// note: make sure to call `defer cleanup()` when the app is no longer needed.
+func initTestBaseApp() (app *BaseApp, cleanup func(), err error) {
+	testDataDir, err := os.MkdirTemp("", "test_base_app")
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cleanup = func() {
+		os.RemoveAll(testDataDir)
+	}
+
+	app = NewBaseApp(BaseAppConfig{
+		DataDir: testDataDir,
+	})
+
+	initErr := func() error {
+		if err := app.Bootstrap(); err != nil {
+			return fmt.Errorf("bootstrap error: %w", err)
+		}
+
+		logsRunner, err := migrate.NewRunner(app.LogsDB(), logs.LogsMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := logsRunner.Up(); err != nil {
+			return fmt.Errorf("logsRunner migrations execution error: %w", err)
+		}
+
+		dataRunner, err := migrate.NewRunner(app.DB(), migrations.AppMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := dataRunner.Up(); err != nil {
+			return fmt.Errorf("dataRunner migrations execution error: %w", err)
+		}
+
+		return nil
+	}()
+	if initErr != nil {
+		cleanup()
+		return nil, nil, initErr
+	}
+
+	return app, cleanup, nil
+}

core/collections_cache.go

@@ -0,0 +1,72 @@
+package core
+
+// -------------------------------------------------------------------
+// This is a small optimization ported from the [ongoing refactoring branch](https://github.com/pocketbase/pocketbase/discussions/4355).
+//
+// @todo remove after the refactoring is finalized.
+// -------------------------------------------------------------------
+
+import (
+	"strings"
+
+	"github.com/pocketbase/pocketbase/models"
+)
+
+const storeCachedCollectionsKey = "@cachedCollectionsContext"
+
+func registerCachedCollectionsAppHooks(app App) {
+	collectionsChangeFunc := func(e *ModelEvent) error {
+		if _, ok := e.Model.(*models.Collection); !ok {
+			return nil
+		}
+
+		_ = ReloadCachedCollections(app)
+
+		return nil
+	}
+	app.OnModelAfterCreate().Add(collectionsChangeFunc)
+	app.OnModelAfterUpdate().Add(collectionsChangeFunc)
+	app.OnModelAfterDelete().Add(collectionsChangeFunc)
+	app.OnBeforeServe().Add(func(e *ServeEvent) error {
+		_ = ReloadCachedCollections(e.App)
+		return nil
+	})
+}
+
+func ReloadCachedCollections(app App) error {
+	collections := []*models.Collection{}
+
+	err := app.Dao().CollectionQuery().All(&collections)
+	if err != nil {
+		return err
+	}
+
+	app.Store().Set(storeCachedCollectionsKey, collections)
+
+	return nil
+}
+
+func FindCachedCollectionByNameOrId(app App, nameOrId string) (*models.Collection, error) {
+	// retrieve from the app cache
+	// ---
+	collections, _ := app.Store().Get(storeCachedCollectionsKey).([]*models.Collection)
+	for _, c := range collections {
+		if strings.EqualFold(c.Name, nameOrId) || c.Id == nameOrId {
+			return c, nil
+		}
+	}
+
+	// retrieve from the database
+	// ---
+	found, err := app.Dao().FindCollectionByNameOrId(nameOrId)
+	if err != nil {
+		return nil, err
+	}
+
+	err = ReloadCachedCollections(app)
+	if err != nil {
+		app.Logger().Warn("Failed to reload collections cache", "error", err)
+	}
+
+	return found, nil
+}

core/events.go

@@ -70,7 +70,8 @@ type BootstrapEvent struct {
 }
 
 type TerminateEvent struct {
-	App App
+	App       App
+	IsRestart bool
 }
 
 type ServeEvent struct {

core/log_printer.go

@@ -0,0 +1,67 @@
+package core
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+var cachedColors = store.New[*color.Color](nil)
+
+// getColor returns [color.Color] object and cache it (if not already).
+func getColor(attrs ...color.Attribute) (c *color.Color) {
+	cacheKey := fmt.Sprint(attrs)
+	if c = cachedColors.Get(cacheKey); c == nil {
+		c = color.New(attrs...)
+		cachedColors.Set(cacheKey, c)
+	}
+	return
+}
+
+// printLog prints the provided log to the stderr.
+// (note: defined as variable to overwriting in the tests)
+var printLog = func(log *logger.Log) {
+	var str strings.Builder
+
+	switch log.Level {
+	case slog.LevelDebug:
+		str.WriteString(getColor(color.Bold, color.FgHiBlack).Sprint("DEBUG "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelInfo:
+		str.WriteString(getColor(color.Bold, color.FgWhite).Sprint("INFO "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelWarn:
+		str.WriteString(getColor(color.Bold, color.FgYellow).Sprint("WARN "))
+		str.WriteString(getColor(color.FgYellow).Sprint(log.Message))
+	case slog.LevelError:
+		str.WriteString(getColor(color.Bold, color.FgRed).Sprint("ERROR "))
+		str.WriteString(getColor(color.FgRed).Sprint(log.Message))
+	default:
+		str.WriteString(getColor(color.Bold, color.FgCyan).Sprintf("[%d] ", log.Level))
+		str.WriteString(getColor(color.FgCyan).Sprint(log.Message))
+	}
+
+	str.WriteString("\n")
+
+	if v, ok := log.Data["type"]; ok && cast.ToString(v) == "request" {
+		padding := 0
+		keys := []string{"error", "details"}
+		for _, k := range keys {
+			if v := log.Data[k]; v != nil {
+				str.WriteString(getColor(color.FgHiRed).Sprintf("%s└─ %v", strings.Repeat(" ", padding), v))
+				str.WriteString("\n")
+				padding += 3
+			}
+		}
+	} else if len(log.Data) > 0 {
+		str.WriteString(getColor(color.FgHiBlack).Sprintf("└─ %v", log.Data))
+		str.WriteString("\n")
+	}
+
+	fmt.Print(str.String())
+}

daos/admin.go

@@ -46,9 +46,9 @@ func (dao *Dao) FindAdminByEmail(email string) (*models.Admin, error) {
 	return model, nil
 }
 
-// FindAdminByToken finds the admin associated with the provided JWT token.
+// FindAdminByToken finds the admin associated with the provided JWT.
 //
-// Returns an error if the JWT token is invalid or expired.
+// Returns an error if the JWT is invalid or expired.
 func (dao *Dao) FindAdminByToken(token string, baseTokenKey string) (*models.Admin, error) {
 	// @todo consider caching the unverified claims
 	unverifiedClaims, err := security.ParseUnverifiedJWT(token)
@@ -59,7 +59,7 @@ func (dao *Dao) FindAdminByToken(token string, baseTokenKey string) (*models.Adm
 	// check required claims
 	id, _ := unverifiedClaims["id"].(string)
 	if id == "" {
-		return nil, errors.New("Missing or invalid token claims.")
+		return nil, errors.New("missing or invalid token claims")
 	}
 
 	admin, err := dao.FindAdminById(id)
@@ -116,7 +116,7 @@ func (dao *Dao) DeleteAdmin(admin *models.Admin) error {
 	}
 
 	if total == 1 {
-		return errors.New("You cannot delete the only existing admin.")
+		return errors.New("you cannot delete the only existing admin")
 	}
 
 	return dao.Delete(admin)

daos/admin_test.go

@@ -8,6 +8,8 @@ import (
 )
 
 func TestAdminQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -20,6 +22,8 @@ func TestAdminQuery(t *testing.T) {
 }
 
 func TestFindAdminById(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -47,6 +51,8 @@ func TestFindAdminById(t *testing.T) {
 }
 
 func TestFindAdminByEmail(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -76,6 +82,8 @@ func TestFindAdminByEmail(t *testing.T) {
 }
 
 func TestFindAdminByToken(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -131,6 +139,8 @@ func TestFindAdminByToken(t *testing.T) {
 }
 
 func TestTotalAdmins(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -155,6 +165,8 @@ func TestTotalAdmins(t *testing.T) {
 }
 
 func TestIsAdminEmailUnique(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -180,6 +192,8 @@ func TestIsAdminEmailUnique(t *testing.T) {
 }
 
 func TestDeleteAdmin(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -225,6 +239,8 @@ func TestDeleteAdmin(t *testing.T) {
 }
 
 func TestSaveAdmin(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/base.go

@@ -6,7 +6,6 @@ package daos
 import (
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/pocketbase/dbx"
@@ -19,7 +18,7 @@ func New(db dbx.Builder) *Dao {
 	return NewMultiDB(db, db)
 }
 
-// New creates a new Dao instance with the provided dedicated
+// NewMultiDB creates a new Dao instance with the provided dedicated
 // async and sync db builders.
 func NewMultiDB(concurrentDB, nonconcurrentDB dbx.Builder) *Dao {
 	return &Dao{
@@ -88,16 +87,16 @@ func (dao *Dao) Clone() *Dao {
 // WithoutHooks returns a new Dao with the same configuration options
 // as the current one, but without create/update/delete hooks.
 func (dao *Dao) WithoutHooks() *Dao {
-	new := dao.Clone()
+	clone := dao.Clone()
 
-	new.BeforeCreateFunc = nil
-	new.AfterCreateFunc = nil
-	new.BeforeUpdateFunc = nil
-	new.AfterUpdateFunc = nil
-	new.BeforeDeleteFunc = nil
-	new.AfterDeleteFunc = nil
+	clone.BeforeCreateFunc = nil
+	clone.AfterCreateFunc = nil
+	clone.BeforeUpdateFunc = nil
+	clone.AfterUpdateFunc = nil
+	clone.BeforeDeleteFunc = nil
+	clone.AfterDeleteFunc = nil
 
-	return new
+	return clone
 }
 
 // ModelQuery creates a new preconfigured select query with preset
@@ -120,9 +119,9 @@ func (dao *Dao) FindById(m models.Model, id string) error {
 }
 
 type afterCallGroup struct {
-	Action   string
-	EventDao *Dao
 	Model    models.Model
+	EventDao *Dao
+	Action   string
 }
 
 // RunInTransaction wraps fn into a transaction.
@@ -170,19 +169,19 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 
 			if dao.AfterCreateFunc != nil {
 				txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"create", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "create"})
 					return nil
 				}
 			}
 			if dao.AfterUpdateFunc != nil {
 				txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"update", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "update"})
 					return nil
 				}
 			}
 			if dao.AfterDeleteFunc != nil {
 				txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"delete", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "delete"})
 					return nil
 				}
 			}
@@ -212,13 +211,7 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 			}
 		}
 		if len(errs) > 0 {
-			// @todo after go 1.20+ upgrade consider replacing with errors.Join()
-			var errsMsg strings.Builder
-			for _, err := range errs {
-				errsMsg.WriteString(err.Error())
-				errsMsg.WriteString("; ")
-			}
-			return fmt.Errorf("after transaction errors: %s", errsMsg.String())
+			return fmt.Errorf("after transaction errors: %w", errors.Join(errs...))
 		}
 
 		return nil

daos/base_retry.go

@@ -2,6 +2,9 @@ package daos
 
 import (
 	"context"
+	"database/sql"
+	"errors"
+	"fmt"
 	"strings"
 	"time"
 
@@ -23,9 +26,14 @@ func execLockRetry(timeout time.Duration, maxRetries int) dbx.ExecHookFunc {
 			q.WithContext(cancelCtx)
 		}
 
-		return baseLockRetry(func(attempt int) error {
+		execErr := baseLockRetry(func(attempt int) error {
 			return op()
 		}, maxRetries)
+		if execErr != nil && !errors.Is(execErr, sql.ErrNoRows) {
+			execErr = fmt.Errorf("%w; failed query: %s", execErr, q.SQL())
+		}
+
+		return execErr
 	}
 }
 

daos/base_retry_test.go

@@ -6,6 +6,8 @@ import (
 )
 
 func TestGetDefaultRetryInterval(t *testing.T) {
+	t.Parallel()
+
 	if i := getDefaultRetryInterval(-1); i.Milliseconds() != 1000 {
 		t.Fatalf("Expected 1000ms, got %v", i)
 	}
@@ -20,6 +22,8 @@ func TestGetDefaultRetryInterval(t *testing.T) {
 }
 
 func TestBaseLockRetry(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		err              error
 		failUntilAttempt int

daos/collection.go

@@ -121,7 +121,7 @@ func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeI
 // - is referenced as part of a relation field in another collection
 func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 	if collection.System {
-		return fmt.Errorf("System collection %q cannot be deleted.", collection.Name)
+		return fmt.Errorf("system collection %q cannot be deleted", collection.Name)
 	}
 
 	// ensure that there aren't any existing references.
@@ -135,7 +135,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 		for ref := range result {
 			names = append(names, ref.Name)
 		}
-		return fmt.Errorf("The collection %q has external relation field references (%s).", collection.Name, strings.Join(names, ", "))
+		return fmt.Errorf("the collection %q has external relation field references (%s)", collection.Name, strings.Join(names, ", "))
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
@@ -152,7 +152,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 
 		// trigger views resave to check for dependencies
 		if err := txDao.resaveViewsWithChangedSchema(collection.Id); err != nil {
-			return fmt.Errorf("The collection has a view dependency - %w", err)
+			return fmt.Errorf("the collection has a view dependency - %w", err)
 		}
 
 		return txDao.Delete(collection)
@@ -162,8 +162,8 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 // SaveCollection persists the provided Collection model and updates
 // its related records table schema.
 //
-// If collecction.IsNew() is true, the method will perform a create, otherwise an update.
-// To explicitly mark a collection for update you can use collecction.MarkAsNotNew().
+// If collection.IsNew() is true, the method will perform a create, otherwise an update.
+// To explicitly mark a collection for update you can use collection.MarkAsNotNew().
 func (dao *Dao) SaveCollection(collection *models.Collection) error {
 	var oldCollection *models.Collection
 
@@ -227,7 +227,7 @@ func (dao *Dao) ImportCollections(
 	afterSync func(txDao *Dao, mappedImported, mappedExisting map[string]*models.Collection) error,
 ) error {
 	if len(importedCollections) == 0 {
-		return errors.New("No collections to import")
+		return errors.New("no collections to import")
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
@@ -263,11 +263,11 @@ func (dao *Dao) ImportCollections(
 
 				// extend existing schema
 				if !deleteMissing {
-					schema, _ := existing.Schema.Clone()
+					schemaClone, _ := existing.Schema.Clone()
 					for _, f := range imported.Schema.Fields() {
-						schema.AddField(f) // add or replace
+						schemaClone.AddField(f) // add or replace
 					}
-					imported.Schema = *schema
+					imported.Schema = *schemaClone
 				}
 			} else {
 				imported.MarkAsNew()
@@ -285,7 +285,7 @@ func (dao *Dao) ImportCollections(
 				}
 
 				if existing.System {
-					return fmt.Errorf("System collection %q cannot be deleted.", existing.Name)
+					return fmt.Errorf("system collection %q cannot be deleted", existing.Name)
 				}
 
 				// delete the related records table or view
@@ -402,6 +402,8 @@ func (dao *Dao) saveViewCollection(newCollection, oldCollection *models.Collecti
 // currently we don't support non-string model ids
 // (see https://github.com/pocketbase/pocketbase/issues/3110).
 func (dao *Dao) normalizeViewQueryId(query string) (string, error) {
+	query = strings.Trim(strings.TrimSpace(query), ";")
+
 	parsed, err := dao.parseQueryToFields(query)
 	if err != nil {
 		return "", err

daos/collection_test.go

@@ -16,6 +16,8 @@ import (
 )
 
 func TestCollectionQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -28,6 +30,8 @@ func TestCollectionQuery(t *testing.T) {
 }
 
 func TestFindCollectionsByType(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -63,6 +67,8 @@ func TestFindCollectionsByType(t *testing.T) {
 }
 
 func TestFindCollectionByNameOrId(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -92,6 +98,8 @@ func TestFindCollectionByNameOrId(t *testing.T) {
 }
 
 func TestIsCollectionNameUnique(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -116,6 +124,8 @@ func TestIsCollectionNameUnique(t *testing.T) {
 }
 
 func TestFindCollectionReferences(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -143,9 +153,11 @@ func TestFindCollectionReferences(t *testing.T) {
 		"rel_one_no_cascade",
 		"rel_one_no_cascade_required",
 		"rel_one_cascade",
+		"rel_one_unique",
 		"rel_many_no_cascade",
 		"rel_many_no_cascade_required",
 		"rel_many_cascade",
+		"rel_many_unique",
 	}
 
 	for col, fields := range result {
@@ -164,6 +176,8 @@ func TestFindCollectionReferences(t *testing.T) {
 }
 
 func TestDeleteCollection(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -251,6 +265,8 @@ func TestDeleteCollection(t *testing.T) {
 }
 
 func TestSaveCollectionCreate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -297,6 +313,8 @@ func TestSaveCollectionCreate(t *testing.T) {
 }
 
 func TestSaveCollectionUpdate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -336,6 +354,8 @@ func TestSaveCollectionUpdate(t *testing.T) {
 
 // indirect update of a field used in view should cause view(s) update
 func TestSaveCollectionIndirectViewsUpdate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -395,6 +415,8 @@ func TestSaveCollectionIndirectViewsUpdate(t *testing.T) {
 }
 
 func TestSaveCollectionViewWrapping(t *testing.T) {
+	t.Parallel()
+
 	viewName := "test_wrapping"
 
 	scenarios := []struct {
@@ -504,6 +526,8 @@ func TestSaveCollectionViewWrapping(t *testing.T) {
 }
 
 func TestImportCollections(t *testing.T) {
+	t.Parallel()
+
 	totalCollections := 11
 
 	scenarios := []struct {
@@ -734,7 +758,7 @@ func TestImportCollections(t *testing.T) {
 					"demo1":      15,
 					"demo2":      2,
 					"demo3":      2,
-					"demo4":      11,
+					"demo4":      13,
 					"demo5":      6,
 					"new_import": 1,
 				}
@@ -752,37 +776,38 @@ func TestImportCollections(t *testing.T) {
 		},
 	}
 
-	for _, scenario := range scenarios {
-		testApp, _ := tests.NewTestApp()
-		defer testApp.Cleanup()
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
 
-		importedCollections := []*models.Collection{}
+			importedCollections := []*models.Collection{}
 
-		// load data
-		loadErr := json.Unmarshal([]byte(scenario.jsonData), &importedCollections)
-		if loadErr != nil {
-			t.Fatalf("[%s] Failed to load  data: %v", scenario.name, loadErr)
-			continue
-		}
+			// load data
+			loadErr := json.Unmarshal([]byte(s.jsonData), &importedCollections)
+			if loadErr != nil {
+				t.Fatalf("Failed to load  data: %v", loadErr)
+			}
 
-		err := testApp.Dao().ImportCollections(importedCollections, scenario.deleteMissing, scenario.beforeRecordsSync)
+			err := testApp.Dao().ImportCollections(importedCollections, s.deleteMissing, s.beforeRecordsSync)
 
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, err)
-		}
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
 
-		// check collections count
-		collections := []*models.Collection{}
-		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
-			t.Fatal(err)
-		}
-		if len(collections) != scenario.expectCollectionsCount {
-			t.Errorf("[%s] Expected %d collections, got %d", scenario.name, scenario.expectCollectionsCount, len(collections))
-		}
+			// check collections count
+			collections := []*models.Collection{}
+			if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
 
-		if scenario.afterTestFunc != nil {
-			scenario.afterTestFunc(testApp, collections)
-		}
+			if s.afterTestFunc != nil {
+				s.afterTestFunc(testApp, collections)
+			}
+		})
 	}
 }

daos/external_auth.go

@@ -32,27 +32,6 @@ func (dao *Dao) FindAllExternalAuthsByRecord(authRecord *models.Record) ([]*mode
 	return auths, nil
 }
 
-// FindExternalAuthByProvider returns the first available
-// ExternalAuth model for the specified provider and providerId.
-func (dao *Dao) FindExternalAuthByProvider(provider, providerId string) (*models.ExternalAuth, error) {
-	model := &models.ExternalAuth{}
-
-	err := dao.ExternalAuthQuery().
-		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
-		AndWhere(dbx.HashExp{
-			"provider":   provider,
-			"providerId": providerId,
-		}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return model, nil
-}
-
 // FindExternalAuthByRecordAndProvider returns the first available
 // ExternalAuth model for the specified record data and provider.
 func (dao *Dao) FindExternalAuthByRecordAndProvider(authRecord *models.Record, provider string) (*models.ExternalAuth, error) {
@@ -74,6 +53,24 @@ func (dao *Dao) FindExternalAuthByRecordAndProvider(authRecord *models.Record, p
 	return model, nil
 }
 
+// FindFirstExternalAuthByExpr returns the first available
+// ExternalAuth model that satisfies the non-nil expression.
+func (dao *Dao) FindFirstExternalAuthByExpr(expr dbx.Expression) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
+		AndWhere(expr).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
 // SaveExternalAuth upserts the provided ExternalAuth model.
 func (dao *Dao) SaveExternalAuth(model *models.ExternalAuth) error {
 	// extra check the model data in case the provider's API response

daos/external_auth_test.go

@@ -3,11 +3,14 @@ package daos_test
 import (
 	"testing"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
 func TestExternalAuthQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -20,6 +23,8 @@ func TestExternalAuthQuery(t *testing.T) {
 }
 
 func TestFindAllExternalAuthsByRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -56,25 +61,25 @@ func TestFindAllExternalAuthsByRecord(t *testing.T) {
 	}
 }
 
-func TestFindExternalAuthByProvider(t *testing.T) {
+func TestFindFirstExternalAuthByExpr(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
 	scenarios := []struct {
-		provider   string
-		providerId string
+		expr       dbx.Expression
 		expectedId string
 	}{
-		{"", "", ""},
-		{"github", "", ""},
-		{"github", "id1", ""},
-		{"github", "id2", ""},
-		{"google", "test123", "clmflokuq1xl341"},
-		{"gitlab", "test123", "dlmflokuq1xl342"},
+		{dbx.HashExp{"provider": "github", "providerId": ""}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id1"}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id2"}, ""},
+		{dbx.HashExp{"provider": "google", "providerId": "test123"}, "clmflokuq1xl341"},
+		{dbx.HashExp{"provider": "gitlab", "providerId": "test123"}, "dlmflokuq1xl342"},
 	}
 
 	for i, s := range scenarios {
-		auth, err := app.Dao().FindExternalAuthByProvider(s.provider, s.providerId)
+		auth, err := app.Dao().FindFirstExternalAuthByExpr(s.expr)
 
 		hasErr := err != nil
 		expectErr := s.expectedId == ""
@@ -90,6 +95,8 @@ func TestFindExternalAuthByProvider(t *testing.T) {
 }
 
 func TestFindExternalAuthByRecordAndProvider(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -126,6 +133,8 @@ func TestFindExternalAuthByRecordAndProvider(t *testing.T) {
 }
 
 func TestSaveExternalAuth(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -147,7 +156,11 @@ func TestSaveExternalAuth(t *testing.T) {
 	}
 
 	// check if it was really saved
-	foundAuth, err := app.Dao().FindExternalAuthByProvider("test", "test_id")
+	foundAuth, err := app.Dao().FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionId": "v851q4r790rhknl",
+		"provider":     "test",
+		"providerId":   "test_id",
+	})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -158,6 +171,8 @@ func TestSaveExternalAuth(t *testing.T) {
 }
 
 func TestDeleteExternalAuth(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/log.go

@@ -0,0 +1,67 @@
+package daos
+
+import (
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// LogQuery returns a new Log select query.
+func (dao *Dao) LogQuery() *dbx.SelectQuery {
+	return dao.ModelQuery(&models.Log{})
+}
+
+// FindLogById finds a single Log entry by its id.
+func (dao *Dao) FindLogById(id string) (*models.Log, error) {
+	model := &models.Log{}
+
+	err := dao.LogQuery().
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+type LogsStatsItem struct {
+	Total int            `db:"total" json:"total"`
+	Date  types.DateTime `db:"date" json:"date"`
+}
+
+// LogsStats returns hourly grouped requests logs statistics.
+func (dao *Dao) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
+	result := []*LogsStatsItem{}
+
+	query := dao.LogQuery().
+		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
+		GroupBy("date")
+
+	if expr != nil {
+		query.AndWhere(expr)
+	}
+
+	err := query.All(&result)
+
+	return result, err
+}
+
+// DeleteOldLogs delete all requests that are created before createdBefore.
+func (dao *Dao) DeleteOldLogs(createdBefore time.Time) error {
+	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
+	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
+
+	_, err := dao.NonconcurrentDB().Delete((&models.Log{}).TableName(), expr).Execute()
+
+	return err
+}
+
+// SaveLog upserts the provided Log model.
+func (dao *Dao) SaveLog(log *models.Log) error {
+	return dao.Save(log)
+}

daos/log_test.go

@@ -11,23 +11,27 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-func TestRequestQuery(t *testing.T) {
+func TestLogQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	expected := "SELECT {{_requests}}.* FROM `_requests`"
+	expected := "SELECT {{_logs}}.* FROM `_logs`"
 
-	sql := app.Dao().RequestQuery().Build().SQL()
+	sql := app.Dao().LogQuery().Build().SQL()
 	if sql != expected {
 		t.Errorf("Expected sql %s, got %s", expected, sql)
 	}
 }
 
-func TestFindRequestById(t *testing.T) {
+func TestFindLogById(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		id          string
@@ -40,7 +44,7 @@ func TestFindRequestById(t *testing.T) {
 	}
 
 	for i, scenario := range scenarios {
-		admin, err := app.LogsDao().FindRequestById(scenario.id)
+		admin, err := app.LogsDao().FindLogById(scenario.id)
 
 		hasErr := err != nil
 		if hasErr != scenario.expectError {
@@ -53,17 +57,19 @@ func TestFindRequestById(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	expected := `[{"total":1,"date":"2022-05-01 10:00:00.000Z"},{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`
 
 	now := time.Now().UTC().Format(types.DefaultDateLayout)
 	exp := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": now})
-	result, err := app.LogsDao().RequestsStats(exp)
+	result, err := app.LogsDao().LogsStats(exp)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -74,20 +80,22 @@ func TestRequestsStats(t *testing.T) {
 	}
 }
 
-func TestDeleteOldRequests(t *testing.T) {
+func TestDeleteOldLogs(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		date          string
 		expectedTotal int
 	}{
-		{"2022-01-01 10:00:00.000Z", 2}, // no requests to delete before that time
-		{"2022-05-01 11:00:00.000Z", 1}, // only 1 request should have left
-		{"2022-05-03 11:00:00.000Z", 0}, // no more requests should have left
-		{"2022-05-04 11:00:00.000Z", 0}, // no more requests should have left
+		{"2022-01-01 10:00:00.000Z", 2}, // no logs to delete before that time
+		{"2022-05-01 11:00:00.000Z", 1}, // only 1 log should have left
+		{"2022-05-03 11:00:00.000Z", 0}, // no more logs should have left
+		{"2022-05-04 11:00:00.000Z", 0}, // no more logs should have left
 	}
 
 	for i, scenario := range scenarios {
@@ -96,53 +104,55 @@ func TestDeleteOldRequests(t *testing.T) {
 			t.Errorf("(%d) Date error %v", i, dateErr)
 		}
 
-		deleteErr := app.LogsDao().DeleteOldRequests(date)
+		deleteErr := app.LogsDao().DeleteOldLogs(date)
 		if deleteErr != nil {
 			t.Errorf("(%d) Delete error %v", i, deleteErr)
 		}
 
-		// check total remaining requests
+		// check total remaining logs
 		var total int
-		countErr := app.LogsDao().RequestQuery().Select("count(*)").Row(&total)
+		countErr := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
 		if countErr != nil {
 			t.Errorf("(%d) Count error %v", i, countErr)
 		}
 
 		if total != scenario.expectedTotal {
-			t.Errorf("(%d) Expected %d remaining requests, got %d", i, scenario.expectedTotal, total)
+			t.Errorf("(%d) Expected %d remaining logs, got %d", i, scenario.expectedTotal, total)
 		}
 	}
 }
 
-func TestSaveRequest(t *testing.T) {
+func TestSaveLog(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
-	// create new request
-	newRequest := &models.Request{}
-	newRequest.Method = "get"
-	newRequest.Meta = types.JsonMap{}
-	createErr := app.LogsDao().SaveRequest(newRequest)
+	// create new log
+	newLog := &models.Log{}
+	newLog.Level = -4
+	newLog.Data = types.JsonMap{}
+	createErr := app.LogsDao().SaveLog(newLog)
 	if createErr != nil {
 		t.Fatal(createErr)
 	}
 
 	// check if it was really created
-	existingRequest, fetchErr := app.LogsDao().FindRequestById(newRequest.Id)
+	existingLog, fetchErr := app.LogsDao().FindLogById(newLog.Id)
 	if fetchErr != nil {
 		t.Fatal(fetchErr)
 	}
 
-	existingRequest.Method = "post"
-	updateErr := app.LogsDao().SaveRequest(existingRequest)
+	existingLog.Level = 4
+	updateErr := app.LogsDao().SaveLog(existingLog)
 	if updateErr != nil {
 		t.Fatal(updateErr)
 	}
 	// refresh instance to check if it was really updated
-	existingRequest, _ = app.LogsDao().FindRequestById(existingRequest.Id)
-	if existingRequest.Method != "post" {
-		t.Fatalf("Expected request method to be %s, got %s", "post", existingRequest.Method)
+	existingLog, _ = app.LogsDao().FindLogById(existingLog.Id)
+	if existingLog.Level != 4 {
+		t.Fatalf("Expected log level to be %d, got %d", 4, existingLog.Level)
 	}
 }

daos/param_test.go

@@ -11,6 +11,8 @@ import (
 )
 
 func TestParamQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -23,6 +25,8 @@ func TestParamQuery(t *testing.T) {
 }
 
 func TestFindParamByKey(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -50,6 +54,8 @@ func TestFindParamByKey(t *testing.T) {
 }
 
 func TestSaveParam(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -92,6 +98,8 @@ func TestSaveParam(t *testing.T) {
 }
 
 func TestSaveParamEncrypted(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -126,6 +134,8 @@ func TestSaveParamEncrypted(t *testing.T) {
 }
 
 func TestDeleteParam(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/record.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"sort"
 	"strings"
 
 	"github.com/pocketbase/dbx"
@@ -39,16 +40,16 @@ func (dao *Dao) RecordQuery(collectionModelOrIdentifier any) *dbx.SelectQuery {
 		collection, collectionErr = dao.FindCollectionByNameOrId(c)
 		if collection != nil {
 			tableName = collection.Name
-		} else {
-			// update with some fake table name for easier debugging
-			tableName = "@@__missing_" + c
 		}
 	default:
-		// update with some fake table name for easier debugging
-		tableName = "@@__invalidCollectionModelOrIdentifier"
 		collectionErr = errors.New("unsupported collection identifier, must be collection model, id or name")
 	}
 
+	// update with some fake table name for easier debugging
+	if tableName == "" {
+		tableName = "@@__invalidCollectionModelOrIdentifier"
+	}
+
 	selectCols := fmt.Sprintf("%s.*", dao.DB().QuoteSimpleColumnName(tableName))
 
 	query := dao.DB().Select(selectCols).From(tableName)
@@ -197,8 +198,6 @@ func (dao *Dao) FindRecordsByIds(
 	return records, nil
 }
 
-// @todo consider to depricate as it may be easier to just use dao.RecordQuery()
-//
 // FindRecordsByExpr finds all records by the specified db expression.
 //
 // Returns all collection records if no expressions are provided.
@@ -409,9 +408,9 @@ func (dao *Dao) IsRecordValueUnique(
 	return query.Row(&exists) == nil && !exists
 }
 
-// FindAuthRecordByToken finds the auth record associated with the provided JWT token.
+// FindAuthRecordByToken finds the auth record associated with the provided JWT.
 //
-// Returns an error if the JWT token is invalid, expired or not associated to an auth collection record.
+// Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
 func (dao *Dao) FindAuthRecordByToken(token string, baseTokenKey string) (*models.Record, error) {
 	unverifiedClaims, err := security.ParseUnverifiedJWT(token)
 	if err != nil {
@@ -431,7 +430,7 @@ func (dao *Dao) FindAuthRecordByToken(token string, baseTokenKey string) (*model
 	}
 
 	if !record.Collection().IsAuth() {
-		return nil, errors.New("The token is not associated to an auth collection record.")
+		return nil, errors.New("the token is not associated to an auth collection record")
 	}
 
 	verificationKey := record.TokenKey() + baseTokenKey
@@ -658,26 +657,40 @@ func (dao *Dao) DeleteRecord(record *models.Record) error {
 //
 // NB! This method is expected to be called inside a transaction.
 func (dao *Dao) cascadeRecordDelete(mainRecord *models.Record, refs map[*models.Collection][]*schema.SchemaField) error {
-	uniqueJsonEachAlias := "__je__" + security.PseudorandomString(4)
+	// @todo consider changing refs to a slice
+	//
+	// Sort the refs keys to ensure that the cascade events firing order is always the same.
+	// This is not necessary for the operation to function correctly but it helps having deterministic output during testing.
+	sortedRefKeys := make([]*models.Collection, 0, len(refs))
+	for k := range refs {
+		sortedRefKeys = append(sortedRefKeys, k)
+	}
+	sort.Slice(sortedRefKeys, func(i, j int) bool {
+		return sortedRefKeys[i].Name < sortedRefKeys[j].Name
+	})
 
-	for refCollection, fields := range refs {
-		if refCollection.IsView() {
-			continue // skip view collections
+	for _, refCollection := range sortedRefKeys {
+		fields, ok := refs[refCollection]
+
+		if refCollection.IsView() || !ok {
+			continue // skip missing or view collections
 		}
 
 		for _, field := range fields {
 			recordTableName := inflector.Columnify(refCollection.Name)
 			prefixedFieldName := recordTableName + "." + inflector.Columnify(field.Name)
 
-			query := dao.RecordQuery(refCollection).Distinct(true)
+			query := dao.RecordQuery(refCollection)
 
 			if opt, ok := field.Options.(schema.MultiValuer); !ok || !opt.IsMultiple() {
 				query.AndWhere(dbx.HashExp{prefixedFieldName: mainRecord.Id})
 			} else {
-				query.InnerJoin(fmt.Sprintf(
-					`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) as {{%s}}`,
-					prefixedFieldName, prefixedFieldName, prefixedFieldName, uniqueJsonEachAlias,
-				), dbx.HashExp{uniqueJsonEachAlias + ".value": mainRecord.Id})
+				query.AndWhere(dbx.Exists(dbx.NewExp(fmt.Sprintf(
+					`SELECT 1 FROM json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) {{__je__}} WHERE [[__je__.value]]={:jevalue}`,
+					prefixedFieldName, prefixedFieldName, prefixedFieldName,
+				), dbx.Params{
+					"jevalue": mainRecord.Id,
+				})))
 			}
 
 			if refCollection.Id == mainRecord.Collection().Id {

daos/record_expand.go

@@ -1,7 +1,9 @@
 package daos
 
 import (
+	"errors"
 	"fmt"
+	"log"
 	"regexp"
 	"strings"
 
@@ -9,13 +11,14 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tools/dbutils"
-	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 // MaxExpandDepth specifies the max allowed nested expand depth path.
+//
+// @todo Consider eventually reusing resolvers.maxNestedRels
 const MaxExpandDepth = 6
 
 // ExpandFetchFunc defines the function that is used to fetch the expanded relation records.
@@ -51,13 +54,15 @@ func (dao *Dao) ExpandRecords(records []*models.Record, expands []string, optFet
 	return failed
 }
 
-var indirectExpandRegex = regexp.MustCompile(`^(\w+)\((\w+)\)$`)
+// Deprecated
+var indirectExpandRegexOld = regexp.MustCompile(`^(\w+)\((\w+)\)$`)
+
+var indirectExpandRegex = regexp.MustCompile(`^(\w+)_via_(\w+)$`)
 
 // notes:
 // - if fetchFunc is nil, dao.FindRecordsByIds will be used
 // - all records are expected to be from the same collection
 // - if MaxExpandDepth is reached, the function returns nil ignoring the remaining expand path
-// - indirect expands are supported only with single relation fields
 func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetchFunc ExpandFetchFunc, recursionLevel int) error {
 	if fetchFunc == nil {
 		// load a default fetchFunc
@@ -77,70 +82,87 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 	var relCollection *models.Collection
 
 	parts := strings.SplitN(expandPath, ".", 2)
-	matches := indirectExpandRegex.FindStringSubmatch(parts[0])
+	var matches []string
+
+	// @todo remove the old syntax support
+	if strings.Contains(parts[0], "(") {
+		matches = indirectExpandRegexOld.FindStringSubmatch(parts[0])
+		if len(matches) == 3 {
+			log.Printf(
+				"%s expand format is deprecated and will be removed in the future. Consider replacing it with %s_via_%s.\n",
+				matches[0],
+				matches[1],
+				matches[2],
+			)
+		}
+	} else {
+		matches = indirectExpandRegex.FindStringSubmatch(parts[0])
+	}
 
 	if len(matches) == 3 {
 		indirectRel, _ := dao.FindCollectionByNameOrId(matches[1])
 		if indirectRel == nil {
-			return fmt.Errorf("Couldn't find indirect related collection %q.", matches[1])
+			return fmt.Errorf("couldn't find back-related collection %q", matches[1])
 		}
 
 		indirectRelField := indirectRel.Schema.GetFieldByName(matches[2])
 		if indirectRelField == nil || indirectRelField.Type != schema.FieldTypeRelation {
-			return fmt.Errorf("Couldn't find indirect relation field %q in collection %q.", matches[2], mainCollection.Name)
+			return fmt.Errorf("couldn't find back-relation field %q in collection %q", matches[2], indirectRel.Name)
 		}
 
 		indirectRelField.InitOptions()
 		indirectRelFieldOptions, _ := indirectRelField.Options.(*schema.RelationOptions)
 		if indirectRelFieldOptions == nil || indirectRelFieldOptions.CollectionId != mainCollection.Id {
-			return fmt.Errorf("Invalid indirect relation field path %q.", parts[0])
-		}
-		if indirectRelFieldOptions.IsMultiple() {
-			// for now don't allow multi-relation indirect fields expand
-			// due to eventual poor query performance with large data sets.
-			return fmt.Errorf("Multi-relation fields cannot be indirectly expanded in %q.", parts[0])
+			return fmt.Errorf("invalid back-relation field path %q", parts[0])
 		}
 
-		recordIds := make([]any, len(records))
-		for i, record := range records {
-			recordIds[i] = record.Id
-		}
+		// add the related id(s) as a dynamic relation field value to
+		// allow further expand checks at later stage in a more unified manner
+		prepErr := func() error {
+			q := dao.DB().Select("id").
+				From(indirectRel.Name).
+				Limit(1000) // the limit is arbitrary chosen and may change in the future
 
-		// @todo after the index optimizations consider allowing
-		// indirect expand for multi-relation fields
-		indirectRecords, err := dao.FindRecordsByExpr(
-			indirectRel.Id,
-			dbx.In(inflector.Columnify(matches[2]), recordIds...),
-		)
-		if err != nil {
-			return err
-		}
-		mappedIndirectRecordIds := make(map[string][]string, len(indirectRecords))
-		for _, indirectRecord := range indirectRecords {
-			recId := indirectRecord.GetString(matches[2])
-			if recId != "" {
-				mappedIndirectRecordIds[recId] = append(mappedIndirectRecordIds[recId], indirectRecord.Id)
+			if indirectRelFieldOptions.IsMultiple() {
+				q.AndWhere(dbx.Exists(dbx.NewExp(fmt.Sprintf(
+					"SELECT 1 FROM %s je WHERE je.value = {:id}",
+					dbutils.JsonEach(indirectRelField.Name),
+				))))
+			} else {
+				q.AndWhere(dbx.NewExp("[[" + indirectRelField.Name + "]] = {:id}"))
 			}
-		}
 
-		// add the indirect relation ids as a new relation field value
-		for _, record := range records {
-			relIds, ok := mappedIndirectRecordIds[record.Id]
-			if ok && len(relIds) > 0 {
-				record.Set(parts[0], relIds)
+			pq := q.Build().Prepare()
+
+			for _, record := range records {
+				var relIds []string
+
+				err := pq.Bind(dbx.Params{"id": record.Id}).Column(&relIds)
+				if err != nil {
+					return errors.Join(err, pq.Close())
+				}
+
+				if len(relIds) > 0 {
+					record.Set(parts[0], relIds)
+				}
 			}
+
+			return pq.Close()
+		}()
+		if prepErr != nil {
+			return prepErr
 		}
 
 		relFieldOptions = &schema.RelationOptions{
 			MaxSelect:    nil,
 			CollectionId: indirectRel.Id,
 		}
-		if isRelFieldUnique(indirectRel, indirectRelField.Name) {
+		if dbutils.HasSingleColumnUniqueIndex(indirectRelField.Name, indirectRel.Indexes) {
 			relFieldOptions.MaxSelect = types.Pointer(1)
 		}
-		// indirect relation
+		// indirect/back relation
 		relField = &schema.SchemaField{
-			Id:      "indirect_" + security.PseudorandomString(5),
+			Id:      "_" + parts[0] + security.PseudorandomString(3),
 			Type:    schema.FieldTypeRelation,
 			Name:    parts[0],
 			Options: relFieldOptions,

daos/record_expand_test.go

@@ -14,6 +14,8 @@ import (
 )
 
 func TestExpandRecords(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -161,7 +163,7 @@ func TestExpandRecords(t *testing.T) {
 			0,
 		},
 		{
-			"simple indirect expand",
+			"simple back single relation field expand (deprecated syntax)",
 			"demo3",
 			[]string{"lcl9d87w22ml6jy"},
 			[]string{"demo4(rel_one_no_cascade_required)"},
@@ -172,11 +174,22 @@ func TestExpandRecords(t *testing.T) {
 			0,
 		},
 		{
-			"nested indirect expand",
+			"simple back expand via single relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested back expand via single relation field",
 			"demo3",
 			[]string{"lcl9d87w22ml6jy"},
 			[]string{
-				"demo4(rel_one_no_cascade_required).self_rel_many.self_rel_many.self_rel_one",
+				"demo4_via_rel_one_no_cascade_required.self_rel_many.self_rel_many.self_rel_one",
 			},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
 				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
@@ -184,6 +197,19 @@ func TestExpandRecords(t *testing.T) {
 			5,
 			0,
 		},
+		{
+			"nested back expand via multiple relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
 		{
 			"expand multiple relations sharing a common path",
 			"demo4",
@@ -222,6 +248,8 @@ func TestExpandRecords(t *testing.T) {
 }
 
 func TestExpandRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -328,7 +356,7 @@ func TestExpandRecord(t *testing.T) {
 			0,
 		},
 		{
-			"simple indirect expand",
+			"simple indirect expand via single relation field (deprecated syntax)",
 			"demo3",
 			"lcl9d87w22ml6jy",
 			[]string{"demo4(rel_one_no_cascade_required)"},
@@ -339,7 +367,18 @@ func TestExpandRecord(t *testing.T) {
 			0,
 		},
 		{
-			"nested indirect expand",
+			"simple indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested indirect expand via single relation field",
 			"demo3",
 			"lcl9d87w22ml6jy",
 			[]string{
@@ -351,6 +390,19 @@ func TestExpandRecord(t *testing.T) {
 			5,
 			0,
 		},
+		{
+			"nested indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
 	}
 
 	for _, s := range scenarios {
@@ -372,6 +424,8 @@ func TestExpandRecord(t *testing.T) {
 }
 
 func TestIndirectExpandSingeVsArrayResult(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -382,21 +436,23 @@ func TestIndirectExpandSingeVsArrayResult(t *testing.T) {
 
 	// non-unique indirect expand
 	{
-		errs := app.Dao().ExpandRecord(record, []string{"demo4(rel_one_cascade)"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
+		errs := app.Dao().ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
 			return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 		})
 		if len(errs) > 0 {
 			t.Fatal(errs)
 		}
 
-		result, ok := record.Expand()["demo4(rel_one_cascade)"].([]*models.Record)
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].([]*models.Record)
 		if !ok {
 			t.Fatalf("Expected the expanded result to be a slice, got %v", result)
 		}
 	}
 
-	// mock a unique constraint for the rel_one_cascade field
+	// unique indirect expand
 	{
+		// mock a unique constraint for the rel_one_cascade field
+		// ---
 		demo4, err := app.Dao().FindCollectionByNameOrId("demo4")
 		if err != nil {
 			t.Fatal(err)
@@ -407,18 +463,16 @@ func TestIndirectExpandSingeVsArrayResult(t *testing.T) {
 		if err := app.Dao().SaveCollection(demo4); err != nil {
 			t.Fatalf("Failed to mock unique constraint: %v", err)
 		}
-	}
+		// ---
 
-	// non-unique indirect expand
-	{
-		errs := app.Dao().ExpandRecord(record, []string{"demo4(rel_one_cascade)"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
+		errs := app.Dao().ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
 			return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 		})
 		if len(errs) > 0 {
 			t.Fatal(errs)
 		}
 
-		result, ok := record.Expand()["demo4(rel_one_cascade)"].(*models.Record)
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].(*models.Record)
 		if !ok {
 			t.Fatalf("Expected the expanded result to be a single model, got %v", result)
 		}

daos/record_table_sync.go

@@ -37,6 +37,7 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 				cols[schema.FieldNamePasswordHash] = "TEXT NOT NULL"
 				cols[schema.FieldNameLastResetSentAt] = "TEXT DEFAULT '' NOT NULL"
 				cols[schema.FieldNameLastVerificationSentAt] = "TEXT DEFAULT '' NOT NULL"
+				cols[schema.FieldNameLastLoginAlertSentAt] = "TEXT DEFAULT '' NOT NULL"
 			}
 
 			// ensure that the new collection has an id

daos/record_table_sync_test.go

@@ -14,6 +14,8 @@ import (
 )
 
 func TestSyncRecordTableSchema(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -81,7 +83,7 @@ func TestSyncRecordTableSchema(t *testing.T) {
 			[]string{
 				"id", "created", "updated", "test",
 				"username", "email", "verified", "emailVisibility",
-				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt",
+				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt", "lastLoginAlertSentAt",
 			},
 			4,
 		},
@@ -132,6 +134,8 @@ func TestSyncRecordTableSchema(t *testing.T) {
 }
 
 func TestSingleVsMultipleValuesNormalization(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/record_test.go

@@ -19,6 +19,8 @@ import (
 )
 
 func TestRecordQueryWithDifferentCollectionValues(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -58,6 +60,8 @@ func TestRecordQueryWithDifferentCollectionValues(t *testing.T) {
 }
 
 func TestRecordQueryOneWithRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -82,6 +86,8 @@ func TestRecordQueryOneWithRecord(t *testing.T) {
 }
 
 func TestRecordQueryAllWithRecordsSlices(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -143,6 +149,8 @@ func TestRecordQueryAllWithRecordsSlices(t *testing.T) {
 }
 
 func TestFindRecordById(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -203,6 +211,8 @@ func TestFindRecordById(t *testing.T) {
 }
 
 func TestFindRecordsByIds(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -294,6 +304,8 @@ func TestFindRecordsByIds(t *testing.T) {
 }
 
 func TestFindRecordsByExpr(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -364,6 +376,8 @@ func TestFindRecordsByExpr(t *testing.T) {
 }
 
 func TestFindFirstRecordByData(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -427,6 +441,8 @@ func TestFindFirstRecordByData(t *testing.T) {
 }
 
 func TestFindRecordsByFilter(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -530,6 +546,19 @@ func TestFindRecordsByFilter(t *testing.T) {
 				"llvuca81nly1qls",
 			},
 		},
+		{
+			"with json filter and sort",
+			"demo4",
+			"json_object != null && json_object.a.b = 'test'",
+			"-json_object.a",
+			10,
+			0,
+			[]dbx.Params{{"active": false}},
+			false,
+			[]string{
+				"i9naidtvr6qsgb4",
+			},
+		},
 	}
 
 	for _, s := range scenarios {
@@ -566,6 +595,8 @@ func TestFindRecordsByFilter(t *testing.T) {
 }
 
 func TestFindFirstRecordByFilter(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -647,6 +678,8 @@ func TestFindFirstRecordByFilter(t *testing.T) {
 }
 
 func TestCanAccessRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -814,6 +847,8 @@ func TestCanAccessRecord(t *testing.T) {
 }
 
 func TestIsRecordValueUnique(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -863,6 +898,8 @@ func TestIsRecordValueUnique(t *testing.T) {
 }
 
 func TestFindAuthRecordByToken(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -925,6 +962,8 @@ func TestFindAuthRecordByToken(t *testing.T) {
 }
 
 func TestFindAuthRecordByEmail(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -956,6 +995,8 @@ func TestFindAuthRecordByEmail(t *testing.T) {
 }
 
 func TestFindAuthRecordByUsername(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -988,6 +1029,8 @@ func TestFindAuthRecordByUsername(t *testing.T) {
 }
 
 func TestSuggestUniqueAuthRecordUsername(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -1025,6 +1068,8 @@ func TestSuggestUniqueAuthRecordUsername(t *testing.T) {
 }
 
 func TestSaveRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -1058,6 +1103,8 @@ func TestSaveRecord(t *testing.T) {
 }
 
 func TestSaveRecordWithIdFromOtherCollection(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -1090,6 +1137,8 @@ func TestSaveRecordWithIdFromOtherCollection(t *testing.T) {
 }
 
 func TestDeleteRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -1156,17 +1205,19 @@ func TestDeleteRecord(t *testing.T) {
 	}
 	// ensure that the json rel fields were prefixed
 	joinedQueries := strings.Join(calledQueries, " ")
-	expectedRelManyPart := "`demo1` INNER JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END)"
+	expectedRelManyPart := "SELECT `demo1`.* FROM `demo1` WHERE EXISTS (SELECT 1 FROM json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) {{__je__}} WHERE [[__je__.value]]='"
 	if !strings.Contains(joinedQueries, expectedRelManyPart) {
 		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelManyPart, calledQueries)
 	}
-	expectedRelOnePart := "SELECT DISTINCT `demo1`.* FROM `demo1` WHERE (`demo1`.`rel_one`="
+	expectedRelOnePart := "SELECT `demo1`.* FROM `demo1` WHERE (`demo1`.`rel_one`='"
 	if !strings.Contains(joinedQueries, expectedRelOnePart) {
 		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelOnePart, calledQueries)
 	}
 }
 
 func TestDeleteRecordBatchProcessing(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/request.go

@@ -1,70 +0,0 @@
-package daos
-
-import (
-	"time"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-// RequestQuery returns a new Request logs select query.
-func (dao *Dao) RequestQuery() *dbx.SelectQuery {
-	return dao.ModelQuery(&models.Request{})
-}
-
-// FindRequestById finds a single Request log by its id.
-func (dao *Dao) FindRequestById(id string) (*models.Request, error) {
-	model := &models.Request{}
-
-	err := dao.RequestQuery().
-		AndWhere(dbx.HashExp{"id": id}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return model, nil
-}
-
-type RequestsStatsItem struct {
-	Total int            `db:"total" json:"total"`
-	Date  types.DateTime `db:"date" json:"date"`
-}
-
-// RequestsStats returns hourly grouped requests logs statistics.
-func (dao *Dao) RequestsStats(expr dbx.Expression) ([]*RequestsStatsItem, error) {
-	result := []*RequestsStatsItem{}
-
-	query := dao.RequestQuery().
-		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
-		GroupBy("date")
-
-	if expr != nil {
-		query.AndWhere(expr)
-	}
-
-	err := query.All(&result)
-
-	return result, err
-}
-
-// DeleteOldRequests delete all requests that are created before createdBefore.
-func (dao *Dao) DeleteOldRequests(createdBefore time.Time) error {
-	m := models.Request{}
-	tableName := m.TableName()
-
-	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
-	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
-
-	_, err := dao.NonconcurrentDB().Delete(tableName, expr).Execute()
-
-	return err
-}
-
-// SaveRequest upserts the provided Request model.
-func (dao *Dao) SaveRequest(request *models.Request) error {
-	return dao.Save(request)
-}

daos/settings_test.go

@@ -8,6 +8,8 @@ import (
 )
 
 func TestSaveAndFindSettings(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/table_test.go

@@ -12,6 +12,8 @@ import (
 )
 
 func TestHasTable(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -36,6 +38,8 @@ func TestHasTable(t *testing.T) {
 }
 
 func TestTableColumns(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -64,6 +68,8 @@ func TestTableColumns(t *testing.T) {
 }
 
 func TestTableInfo(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -92,6 +98,8 @@ func TestTableInfo(t *testing.T) {
 }
 
 func TestDeleteTable(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -116,6 +124,8 @@ func TestDeleteTable(t *testing.T) {
 }
 
 func TestVacuum(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -141,6 +151,8 @@ func TestVacuum(t *testing.T) {
 }
 
 func TestTableIndexes(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/view.go

@@ -43,10 +43,10 @@ func (dao *Dao) SaveView(name string, selectQuery string) error {
 			return err
 		}
 
-		trimmed := strings.Trim(selectQuery, ";")
+		selectQuery = strings.Trim(strings.TrimSpace(selectQuery), ";")
 
 		// try to eagerly detect multiple inline statements
-		tk := tokenizer.NewFromString(trimmed)
+		tk := tokenizer.NewFromString(selectQuery)
 		tk.Separators(';')
 		if queryParts, _ := tk.ScanAll(); len(queryParts) > 1 {
 			return errors.New("multiple statements are not supported")
@@ -56,7 +56,7 @@ func (dao *Dao) SaveView(name string, selectQuery string) error {
 		//
 		// note: the query is wrapped in a secondary SELECT as a rudimentary
 		// measure to discourage multiple inline sql statements execution.
-		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, trimmed)
+		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, selectQuery)
 		if _, err := txDao.DB().NewQuery(viewQuery).Execute(); err != nil {
 			return err
 		}
@@ -232,6 +232,9 @@ func defaultViewField(name string) *schema.SchemaField {
 	return &schema.SchemaField{
 		Name: name,
 		Type: schema.FieldTypeJson,
+		Options: &schema.JsonOptions{
+			MaxSize: 1, // the size doesn't matter in this case
+		},
 	}
 }
 
@@ -458,7 +461,7 @@ type identifiersParser struct {
 }
 
 func (p *identifiersParser) parse(selectQuery string) error {
-	str := strings.Trim(selectQuery, ";")
+	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
 	str = joinReplaceRegex.ReplaceAllString(str, " _join_ ")
 	str = discardReplaceRegex.ReplaceAllString(str, " _discard_ ")
 	str = commentsReplaceRegex.ReplaceAllString(str, "")
@@ -599,13 +602,20 @@ func identifierFromParts(parts []string) (identifier, error) {
 	}
 
 	result.original = trimRawIdentifier(result.original)
-	result.alias = trimRawIdentifier(result.alias)
+
+	// we trim the single quote even though it is not a valid column quote character
+	// because SQLite allows it if the context expects an identifier and not string literal
+	// (https://www.sqlite.org/lang_keywords.html)
+	result.alias = trimRawIdentifier(result.alias, "'")
 
 	return result, nil
 }
 
-func trimRawIdentifier(rawIdentifier string) string {
-	const trimChars = "`\"[];"
+func trimRawIdentifier(rawIdentifier string, extraTrimChars ...string) string {
+	trimChars := "`\"[];"
+	if len(extraTrimChars) > 0 {
+		trimChars += strings.Join(extraTrimChars, "")
+	}
 
 	parts := strings.Split(rawIdentifier, ".")
 

daos/view_test.go

@@ -33,6 +33,8 @@ func ensureNoTempViews(app core.App, t *testing.T) {
 }
 
 func TestDeleteView(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -60,6 +62,8 @@ func TestDeleteView(t *testing.T) {
 }
 
 func TestSaveView(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -147,40 +151,41 @@ func TestSaveView(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		err := app.Dao().SaveView(s.viewName, s.query)
+		t.Run(s.scenarioName, func(t *testing.T) {
+			err := app.Dao().SaveView(s.viewName, s.query)
 
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.scenarioName, s.expectError, hasErr, err)
-			continue
-		}
-
-		if hasErr {
-			continue
-		}
-
-		infoRows, err := app.Dao().TableInfo(s.viewName)
-		if err != nil {
-			t.Errorf("[%s] Failed to fetch table info for %s: %v", s.scenarioName, s.viewName, err)
-			continue
-		}
-
-		if len(s.expectColumns) != len(infoRows) {
-			t.Errorf("[%s] Expected %d columns, got %d", s.scenarioName, len(s.expectColumns), len(infoRows))
-			continue
-		}
-
-		for _, row := range infoRows {
-			if !list.ExistInSlice(row.Name, s.expectColumns) {
-				t.Errorf("[%s] Missing %q column in %v", s.scenarioName, row.Name, s.expectColumns)
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
 			}
-		}
+
+			if hasErr {
+				return
+			}
+
+			infoRows, err := app.Dao().TableInfo(s.viewName)
+			if err != nil {
+				t.Fatalf("Failed to fetch table info for %s: %v", s.viewName, err)
+			}
+
+			if len(s.expectColumns) != len(infoRows) {
+				t.Fatalf("Expected %d columns, got %d", len(s.expectColumns), len(infoRows))
+			}
+
+			for _, row := range infoRows {
+				if !list.ExistInSlice(row.Name, s.expectColumns) {
+					t.Fatalf("Missing %q column in %v", row.Name, s.expectColumns)
+				}
+			}
+		})
 	}
 
 	ensureNoTempViews(app, t)
 }
 
 func TestCreateViewSchemaWithDiscardedNestedTransaction(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -197,6 +202,8 @@ func TestCreateViewSchemaWithDiscardedNestedTransaction(t *testing.T) {
 }
 
 func TestCreateViewSchema(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -272,24 +279,26 @@ func TestCreateViewSchema(t *testing.T) {
 					"datetime",
 					"json",
 					"rel_one",
-					"rel_many"
+					"rel_many",
+					'single_quoted_custom_literal' as 'single_quoted_column'
 				from demo1
 			`,
 			false,
 			map[string]string{
-				"text":         schema.FieldTypeText,
-				"bool":         schema.FieldTypeBool,
-				"url":          schema.FieldTypeUrl,
-				"select_one":   schema.FieldTypeSelect,
-				"select_many":  schema.FieldTypeSelect,
-				"file_one":     schema.FieldTypeFile,
-				"file_many":    schema.FieldTypeFile,
-				"number_alias": schema.FieldTypeNumber,
-				"email":        schema.FieldTypeEmail,
-				"datetime":     schema.FieldTypeDate,
-				"json":         schema.FieldTypeJson,
-				"rel_one":      schema.FieldTypeRelation,
-				"rel_many":     schema.FieldTypeRelation,
+				"text":                 schema.FieldTypeText,
+				"bool":                 schema.FieldTypeBool,
+				"url":                  schema.FieldTypeUrl,
+				"select_one":           schema.FieldTypeSelect,
+				"select_many":          schema.FieldTypeSelect,
+				"file_one":             schema.FieldTypeFile,
+				"file_many":            schema.FieldTypeFile,
+				"number_alias":         schema.FieldTypeNumber,
+				"email":                schema.FieldTypeEmail,
+				"datetime":             schema.FieldTypeDate,
+				"json":                 schema.FieldTypeJson,
+				"rel_one":              schema.FieldTypeRelation,
+				"rel_many":             schema.FieldTypeRelation,
+				"single_quoted_column": schema.FieldTypeJson,
 			},
 		},
 		{
@@ -485,6 +494,8 @@ func TestCreateViewSchema(t *testing.T) {
 }
 
 func TestFindRecordByViewFile(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

examples/base/main.go

@@ -110,7 +110,7 @@ func main() {
 	// GitHub selfupdate
 	ghupdate.MustRegister(app, app.RootCmd, ghupdate.Config{})
 
-	app.OnAfterBootstrap().Add(func(e *core.BootstrapEvent) error {
+	app.OnAfterBootstrap().PreAdd(func(e *core.BootstrapEvent) error {
 		app.Dao().ModelQueryTimeout = time.Duration(queryTimeout) * time.Second
 		return nil
 	})

forms/admin_login_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestAdminLoginValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -51,6 +53,8 @@ func TestAdminLoginValidateAndSubmit(t *testing.T) {
 }
 
 func TestAdminLoginInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/admin_password_reset_confirm_test.go

@@ -11,6 +11,8 @@ import (
 )
 
 func TestAdminPasswordResetConfirmValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -99,6 +101,8 @@ func TestAdminPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 }
 
 func TestAdminPasswordResetConfirmInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/admin_password_reset_request.go

@@ -2,6 +2,7 @@ package forms
 
 import (
 	"errors"
+	"fmt"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -66,7 +67,7 @@ func (form *AdminPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*m
 
 	admin, err := form.dao.FindAdminByEmail(form.Email)
 	if err != nil {
-		return err
+		return fmt.Errorf("Failed to fetch admin with email %s: %w", form.Email, err)
 	}
 
 	now := time.Now().UTC()

forms/admin_password_reset_request_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestAdminPasswordResetRequestValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -74,6 +76,8 @@ func TestAdminPasswordResetRequestValidateAndSubmit(t *testing.T) {
 }
 
 func TestAdminPasswordResetRequestInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/admin_upsert_test.go

@@ -12,6 +12,8 @@ import (
 )
 
 func TestNewAdminUpsert(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -31,6 +33,8 @@ func TestNewAdminUpsert(t *testing.T) {
 }
 
 func TestAdminUpsertValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -183,6 +187,8 @@ func TestAdminUpsertValidateAndSubmit(t *testing.T) {
 }
 
 func TestAdminUpsertSubmitInterceptors(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -231,6 +237,8 @@ func TestAdminUpsertSubmitInterceptors(t *testing.T) {
 }
 
 func TestAdminUpsertWithCustomId(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

forms/apple_client_secret_create.go

@@ -12,7 +12,7 @@ import (
 
 var privateKeyRegex = regexp.MustCompile(`(?m)-----BEGIN PRIVATE KEY----[\s\S]+-----END PRIVATE KEY-----`)
 
-// AppleClientSecretCreate is a [models.Admin] upsert (create/update) form.
+// AppleClientSecretCreate is a form struct to generate a new Apple Client Secret.
 //
 // Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
 type AppleClientSecretCreate struct {
@@ -33,7 +33,7 @@ type AppleClientSecretCreate struct {
 	// Usually wrapped within -----BEGIN PRIVATE KEY----- X -----END PRIVATE KEY-----.
 	PrivateKey string `form:"privateKey" json:"privateKey"`
 
-	// Duration specifies how long the generated JWT token should be considered valid.
+	// Duration specifies how long the generated JWT should be considered valid.
 	// The specified value must be in seconds and max 15777000 (~6months).
 	Duration int `form:"duration" json:"duration"`
 }

forms/apple_client_secret_create_test.go

@@ -15,6 +15,8 @@ import (
 )
 
 func TestAppleClientSecretCreateValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

forms/backup_create_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestBackupCreateValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		name           string
 		backupName     string

forms/backup_upload_test.go

@@ -12,6 +12,8 @@ import (
 )
 
 func TestBackupUploadValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	var zb bytes.Buffer
 	zw := zip.NewWriter(&zb)
 	if err := zw.Close(); err != nil {

forms/collection_upsert.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"regexp"
 	"strconv"
+	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
@@ -131,6 +132,7 @@ func (form *CollectionUpsert) Validate() error {
 			validation.Match(collectionNameRegex),
 			validation.By(form.ensureNoSystemNameChange),
 			validation.By(form.checkUniqueName),
+			validation.By(form.checkForVia),
 		),
 		// validates using the type's own validation rules + some collection's specifics
 		validation.Field(
@@ -163,6 +165,19 @@ func (form *CollectionUpsert) Validate() error {
 	)
 }
 
+func (form *CollectionUpsert) checkForVia(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil
+	}
+
+	if strings.Contains(strings.ToLower(v), "_via_") {
+		return validation.NewError("validation_invalid_name", "The name of the collection cannot contain '_via_'.")
+	}
+
+	return nil
+}
+
 func (form *CollectionUpsert) checkUniqueName(value any) error {
 	v, _ := value.(string)
 
@@ -370,7 +385,7 @@ func (form *CollectionUpsert) checkRule(value any) error {
 
 	_, err := search.FilterData(*v).BuildExpr(r)
 	if err != nil {
-		return validation.NewError("validation_invalid_rule", "Invalid filter rule.")
+		return validation.NewError("validation_invalid_rule", "Invalid filter rule. Raw error: "+err.Error())
 	}
 
 	return nil

forms/collection_upsert_test.go

@@ -16,6 +16,8 @@ import (
 )
 
 func TestNewCollectionUpsert(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -88,6 +90,8 @@ func TestNewCollectionUpsert(t *testing.T) {
 }
 
 func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -101,6 +105,17 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 		{"empty create (auth)", "", `{"type":"auth"}`, []string{"name"}},
 		{"empty create (view)", "", `{"type":"view"}`, []string{"name", "options"}},
 		{"empty update", "demo2", "{}", []string{}},
+		{
+			"collection and field with _via_ names",
+			"",
+			`{
+				"name": "a_via_b",
+				"schema": [
+					{"name":"c_via_d","type":"text"}
+				]
+			}`,
+			[]string{"name", "schema"},
+		},
 		{
 			"create failure",
 			"",
@@ -654,6 +669,8 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 }
 
 func TestCollectionUpsertSubmitInterceptors(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -704,6 +721,8 @@ func TestCollectionUpsertSubmitInterceptors(t *testing.T) {
 }
 
 func TestCollectionUpsertWithCustomId(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

forms/collections_import.go

@@ -3,7 +3,6 @@ package forms
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
@@ -78,12 +77,9 @@ func (form *CollectionsImport) Submit(interceptors ...InterceptorFunc[[]*models.
 			}
 
 			// generic/db failure
-			if form.app.IsDebug() {
-				log.Println("Internal import failure:", importErr)
-			}
 			return validation.Errors{"collections": validation.NewError(
 				"collections_import_failure",
-				"Failed to import the collections configuration.",
+				"Failed to import the collections configuration. Raw error:\n"+importErr.Error(),
 			)}
 		})
 	}, interceptors...)

forms/collections_import_test.go

@@ -11,6 +11,8 @@ import (
 )
 
 func TestCollectionsImportValidate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -38,6 +40,8 @@ func TestCollectionsImportValidate(t *testing.T) {
 }
 
 func TestCollectionsImportSubmit(t *testing.T) {
+	t.Parallel()
+
 	totalCollections := 11
 
 	scenarios := []struct {
@@ -206,7 +210,7 @@ func TestCollectionsImportSubmit(t *testing.T) {
 			expectError:            true,
 			expectCollectionsCount: totalCollections,
 			expectEvents: map[string]int{
-				"OnModelBeforeDelete": 4,
+				"OnModelBeforeDelete": 1,
 			},
 		},
 		{
@@ -418,48 +422,51 @@ func TestCollectionsImportSubmit(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		testApp, _ := tests.NewTestApp()
-		defer testApp.Cleanup()
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
 
-		form := forms.NewCollectionsImport(testApp)
+			form := forms.NewCollectionsImport(testApp)
 
-		// load data
-		loadErr := json.Unmarshal([]byte(s.jsonData), form)
-		if loadErr != nil {
-			t.Errorf("[%s] Failed to load form data: %v", s.name, loadErr)
-			continue
-		}
-
-		err := form.Submit()
-
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", s.name, s.expectError, hasErr, err)
-		}
-
-		// check collections count
-		collections := []*models.Collection{}
-		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
-			t.Fatal(err)
-		}
-		if len(collections) != s.expectCollectionsCount {
-			t.Errorf("[%s] Expected %d collections, got %d", s.name, s.expectCollectionsCount, len(collections))
-		}
-
-		// check events
-		if len(testApp.EventCalls) > len(s.expectEvents) {
-			t.Errorf("[%s] Expected events %v, got %v", s.name, s.expectEvents, testApp.EventCalls)
-		}
-		for event, expectedCalls := range s.expectEvents {
-			actualCalls := testApp.EventCalls[event]
-			if actualCalls != expectedCalls {
-				t.Errorf("[%s] Expected event %s to be called %d, got %d", s.name, event, expectedCalls, actualCalls)
+			// load data
+			loadErr := json.Unmarshal([]byte(s.jsonData), form)
+			if loadErr != nil {
+				t.Fatalf("Failed to load form data: %v", loadErr)
 			}
-		}
+
+			err := form.Submit()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			// check collections count
+			collections := []*models.Collection{}
+			if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
+
+			// check events
+			if len(testApp.EventCalls) > len(s.expectEvents) {
+				t.Fatalf("Expected events %v, got %v", s.expectEvents, testApp.EventCalls)
+			}
+			for event, expectedCalls := range s.expectEvents {
+				actualCalls := testApp.EventCalls[event]
+				if actualCalls != expectedCalls {
+					t.Fatalf("Expected event %s to be called %d, got %d", event, expectedCalls, actualCalls)
+				}
+			}
+		})
 	}
 }
 
 func TestCollectionsImportSubmitInterceptors(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

forms/realtime_subscribe.go

@@ -19,5 +19,9 @@ func NewRealtimeSubscribe() *RealtimeSubscribe {
 func (form *RealtimeSubscribe) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.ClientId, validation.Required, validation.Length(1, 255)),
+		validation.Field(&form.Subscriptions,
+			validation.Length(0, 1000),
+			validation.Each(validation.Length(0, 2500)),
+		),
 	)
 }

forms/realtime_subscribe_test.go

@@ -1,31 +1,96 @@
 package forms_test
 
 import (
+	"encoding/json"
+	"fmt"
 	"strings"
 	"testing"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
 )
 
 func TestRealtimeSubscribeValidate(t *testing.T) {
-	scenarios := []struct {
-		clientId    string
-		expectError bool
-	}{
-		{"", true},
-		{strings.Repeat("a", 256), true},
-		{"test", false},
+	t.Parallel()
+
+	validSubscriptionsLimit := make([]string, 1000)
+	for i := 0; i < len(validSubscriptionsLimit); i++ {
+		validSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
+	}
+	invalidSubscriptionsLimit := make([]string, 1001)
+	for i := 0; i < len(invalidSubscriptionsLimit); i++ {
+		invalidSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
 	}
 
-	for i, s := range scenarios {
-		form := forms.NewRealtimeSubscribe()
-		form.ClientId = s.clientId
+	scenarios := []struct {
+		name           string
+		data           string
+		expectedErrors []string
+	}{
+		{
+			"empty data",
+			`{}`,
+			[]string{"clientId"},
+		},
+		{
+			"clientId > max chars limit",
+			`{"clientId":"` + strings.Repeat("a", 256) + `"}`,
+			[]string{"clientId"},
+		},
+		{
+			"clientId <= max chars limit",
+			`{"clientId":"` + strings.Repeat("a", 255) + `"}`,
+			[]string{},
+		},
+		{
+			"total subscriptions > max limit",
+			`{"clientId":"test", "subscriptions":[` + strings.Join(invalidSubscriptionsLimit, ",") + `]}`,
+			[]string{"subscriptions"},
+		},
+		{
+			"total subscriptions <= max limit",
+			`{"clientId":"test", "subscriptions":[` + strings.Join(validSubscriptionsLimit, ",") + `]}`,
+			[]string{},
+		},
+		{
+			"single subscription > max limit",
+			`{"clientId":"test", "subscriptions":["abc", "` + strings.Repeat("a", 2501) + `"]}`,
+			[]string{"subscriptions"},
+		},
+		{
+			"single subscription <= max limit",
+			`{"clientId":"test", "subscriptions":["abc", "` + strings.Repeat("a", 2500) + `"]}`,
+			[]string{},
+		},
+	}
 
-		err := form.Validate()
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			form := forms.NewRealtimeSubscribe()
 
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
-		}
+			err := json.Unmarshal([]byte(s.data), &form)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			result := form.Validate()
+
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
+				return
+			}
+
+			// check errors
+			if len(errs) > len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got %v", s.expectedErrors, errs)
+			}
+			for _, k := range s.expectedErrors {
+				if _, ok := errs[k]; !ok {
+					t.Fatalf("Missing expected error key %q in %v", k, errs)
+				}
+			}
+		})
 	}
 }

forms/record_email_change_confirm.go

@@ -128,6 +128,8 @@ func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorFunc[*mo
 
 	authRecord.SetEmail(newEmail)
 	authRecord.SetVerified(true)
+
+	// @todo consider removing if not necessary anymore
 	authRecord.RefreshTokenKey() // invalidate old tokens
 
 	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {

forms/record_email_change_confirm_test.go

@@ -13,6 +13,8 @@ import (
 )
 
 func TestRecordEmailChangeConfirmValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -145,6 +147,8 @@ func TestRecordEmailChangeConfirmValidateAndSubmit(t *testing.T) {
 }
 
 func TestRecordEmailChangeConfirmInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_email_change_request.go

@@ -54,7 +54,7 @@ func (form *RecordEmailChangeRequest) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
 	if !form.dao.IsRecordValueUnique(form.record.Collection().Id, schema.FieldNameEmail, v) {
-		return validation.NewError("validation_record_email_exists", "User email already exists.")
+		return validation.NewError("validation_record_email_invalid", "User email already exists or it is invalid.")
 	}
 
 	return nil

forms/record_email_change_request_test.go

@@ -12,6 +12,8 @@ import (
 )
 
 func TestRecordEmailChangeRequestValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -106,6 +108,8 @@ func TestRecordEmailChangeRequestValidateAndSubmit(t *testing.T) {
 }
 
 func TestRecordEmailChangeRequestInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_oauth2_login.go

@@ -7,7 +7,7 @@ import (
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
@@ -46,7 +46,7 @@ type RecordOAuth2Login struct {
 	// The authorization code returned from the initial request.
 	Code string `form:"code" json:"code"`
 
-	// The code verifier sent with the initial request as part of the code_challenge.
+	// The optional PKCE code verifier as part of the code_challenge sent with the initial request.
 	CodeVerifier string `form:"codeVerifier" json:"codeVerifier"`
 
 	// The redirect url sent with the initial request.
@@ -88,8 +88,7 @@ func (form *RecordOAuth2Login) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.Provider, validation.Required, validation.By(form.checkProviderName)),
 		validation.Field(&form.Code, validation.Required),
-		validation.Field(&form.CodeVerifier, validation.Required),
-		validation.Field(&form.RedirectUrl, validation.Required, is.URL),
+		validation.Field(&form.RedirectUrl, validation.Required),
 	)
 }
 
@@ -130,6 +129,10 @@ func (form *RecordOAuth2Login) Submit(
 		return nil, nil, err
 	}
 
+	if form.Provider == auth.NameInstagram {
+		form.app.Logger().Warn("Instagram OAuth2 provider is deprecated and will stop working after December 4th. For more details please check https://github.com/pocketbase/pocketbase/discussions/5652.")
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -143,11 +146,14 @@ func (form *RecordOAuth2Login) Submit(
 
 	provider.SetRedirectUrl(form.RedirectUrl)
 
+	var opts []oauth2.AuthCodeOption
+
+	if provider.PKCE() {
+		opts = append(opts, oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier))
+	}
+
 	// fetch token
-	token, err := provider.FetchToken(
-		form.Code,
-		oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier),
-	)
+	token, err := provider.FetchToken(form.Code, opts...)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -161,7 +167,11 @@ func (form *RecordOAuth2Login) Submit(
 	var authRecord *models.Record
 
 	// check for existing relation with the auth record
-	rel, _ := form.dao.FindExternalAuthByProvider(form.Provider, authUser.Id)
+	rel, _ := form.dao.FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionId": form.collection.Id,
+		"provider":     form.Provider,
+		"providerId":   authUser.Id,
+	})
 	switch {
 	case rel != nil:
 		authRecord, err = form.dao.FindRecordById(form.collection.Id, rel.RecordId)
@@ -216,15 +226,11 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
 			// load custom data
 			createForm.LoadData(form.CreateData)
 
-			// load the OAuth2 profile data as fallback
-			if createForm.Email == "" {
-				createForm.Email = data.OAuth2User.Email
-			}
-			createForm.Verified = false
-			if createForm.Email == data.OAuth2User.Email {
-				// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
-				createForm.Verified = true
-			}
+			// load the OAuth2 user data
+			createForm.Email = data.OAuth2User.Email
+			createForm.Verified = true // mark as verified as long as it matches the OAuth2 data (even if the email is empty)
+
+			// generate a random password if not explicitly set
 			if createForm.Password == "" {
 				createForm.Password = security.RandomString(30)
 				createForm.PasswordConfirm = createForm.Password
@@ -241,6 +247,19 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
 				return err
 			}
 		} else {
+			isLoggedAuthRecord := form.loggedAuthRecord != nil &&
+				form.loggedAuthRecord.Id == data.Record.Id &&
+				form.loggedAuthRecord.Collection().Id == data.Record.Collection().Id
+
+			// set random password for users with unverified email
+			// (this is in case a malicious actor has registered via password using the user email)
+			if !isLoggedAuthRecord && data.Record.Email() != "" && !data.Record.Verified() {
+				data.Record.SetPassword(security.RandomString(30))
+				if err := txDao.SaveRecord(data.Record); err != nil {
+					return err
+				}
+			}
+
 			// update the existing auth record empty email if the data.OAuth2User has one
 			// (this is in case previously the auth record was created
 			// with an OAuth2 provider that didn't return an email address)

forms/record_oauth2_login_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestUserOauth2LoginValidate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -23,13 +25,13 @@ func TestUserOauth2LoginValidate(t *testing.T) {
 			"empty payload",
 			"users",
 			"{}",
-			[]string{"provider", "code", "codeVerifier", "redirectUrl"},
+			[]string{"provider", "code", "redirectUrl"},
 		},
 		{
 			"empty data",
 			"users",
 			`{"provider":"","code":"","codeVerifier":"","redirectUrl":""}`,
-			[]string{"provider", "code", "codeVerifier", "redirectUrl"},
+			[]string{"provider", "code", "redirectUrl"},
 		},
 		{
 			"missing provider",
@@ -49,6 +51,12 @@ func TestUserOauth2LoginValidate(t *testing.T) {
 			`{"provider":"gitlab","code":"123","codeVerifier":"123","redirectUrl":"https://example.com"}`,
 			[]string{},
 		},
+		{
+			"[#3689] any redirectUrl value",
+			"users",
+			`{"provider":"gitlab","code":"123","codeVerifier":"123","redirectUrl":"something"}`,
+			[]string{},
+		},
 	}
 
 	for _, s := range scenarios {

forms/record_password_login_test.go

@@ -10,6 +10,8 @@ import (
 )
 
 func TestRecordPasswordLoginValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -132,6 +134,8 @@ func TestRecordPasswordLoginValidateAndSubmit(t *testing.T) {
 }
 
 func TestRecordPasswordLoginInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_password_reset_confirm.go

@@ -6,6 +6,8 @@ import (
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
 )
 
 // RecordPasswordResetConfirm is an auth record password reset confirmation form.
@@ -91,9 +93,21 @@ func (form *RecordPasswordResetConfirm) Submit(interceptors ...InterceptorFunc[*
 		return nil, err
 	}
 
+	if !authRecord.Verified() {
+		payload, err := security.ParseUnverifiedJWT(form.Token)
+		if err != nil {
+			return nil, err
+		}
+
+		// mark as verified if the email hasn't changed
+		if authRecord.Email() == cast.ToString(payload["email"]) {
+			authRecord.SetVerified(true)
+		}
+	}
+
 	interceptorsErr := runInterceptors(authRecord, func(m *models.Record) error {
 		authRecord = m
-		return form.dao.SaveRecord(m)
+		return form.dao.SaveRecord(authRecord)
 	}, interceptors...)
 
 	if interceptorsErr != nil {

forms/record_password_reset_confirm_test.go

@@ -13,6 +13,8 @@ import (
 )
 
 func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -136,6 +138,8 @@ func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 }
 
 func TestRecordPasswordResetConfirmInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_password_reset_request.go

@@ -2,6 +2,7 @@ package forms
 
 import (
 	"errors"
+	"fmt"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -45,7 +46,7 @@ func (form *RecordPasswordResetRequest) SetDao(dao *daos.Dao) {
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 //
-// This method doesn't checks whether auth record with `form.Email` exists (this is done on Submit).
+// This method doesn't check whether auth record with `form.Email` exists (this is done on Submit).
 func (form *RecordPasswordResetRequest) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(
@@ -69,7 +70,7 @@ func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*
 
 	authRecord, err := form.dao.FindAuthRecordByEmail(form.collection.Id, form.Email)
 	if err != nil {
-		return err
+		return fmt.Errorf("Failed to fetch %s record with email %s: %w", form.collection.Id, form.Email, err)
 	}
 
 	now := time.Now().UTC()

forms/record_password_reset_request_test.go

@@ -13,6 +13,8 @@ import (
 )
 
 func TestRecordPasswordResetRequestSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -116,6 +118,8 @@ func TestRecordPasswordResetRequestSubmit(t *testing.T) {
 }
 
 func TestRecordPasswordResetRequestInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_upsert.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
 	"regexp"
 	"strings"
@@ -25,7 +25,7 @@ import (
 )
 
 // username value regex pattern
-var usernameRegex = regexp.MustCompile(`^[\w][\w\.]*$`)
+var usernameRegex = regexp.MustCompile(`^[\w][\w\.\-]*$`)
 
 // RecordUpsert is a [models.Record] upsert (create/update) form.
 type RecordUpsert struct {
@@ -117,7 +117,7 @@ func (form *RecordUpsert) getContentType(r *http.Request) string {
 	return t
 }
 
-func (form *RecordUpsert) extractRequestInfo(
+func (form *RecordUpsert) extractRequestData(
 	r *http.Request,
 	keyPrefix string,
 ) (map[string]any, map[string][]*filesystem.File, error) {
@@ -165,7 +165,7 @@ func (form *RecordUpsert) extractMultipartFormData(
 
 	data := map[string]any{}
 	filesToUpload := map[string][]*filesystem.File{}
-	arrayValueSupportTypes := schema.ArraybleFieldTypes()
+	arraybleFieldTypes := schema.ArraybleFieldTypes()
 
 	for fullKey, values := range r.PostForm {
 		key := fullKey
@@ -178,8 +178,18 @@ func (form *RecordUpsert) extractMultipartFormData(
 			continue
 		}
 
+		// special case for multipart json encoded fields
+		if key == rest.MultipartJsonKey {
+			for _, v := range values {
+				if err := json.Unmarshal([]byte(v), &data); err != nil {
+					form.app.Logger().Debug("Failed to decode @json value into the data map", "error", err, "value", v)
+				}
+			}
+			continue
+		}
+
 		field := form.record.Collection().Schema.GetFieldByName(key)
-		if field != nil && list.ExistInSlice(field.Type, arrayValueSupportTypes) {
+		if field != nil && list.ExistInSlice(field.Type, arraybleFieldTypes) {
 			data[key] = values
 		} else {
 			data[key] = values[0]
@@ -200,8 +210,12 @@ func (form *RecordUpsert) extractMultipartFormData(
 
 		files, err := rest.FindUploadedFiles(r, fullKey)
 		if err != nil || len(files) == 0 {
-			if err != nil && err != http.ErrMissingFile && form.app.IsDebug() {
-				log.Printf("%q uploaded file error: %v\n", fullKey, err)
+			if err != nil && err != http.ErrMissingFile {
+				form.app.Logger().Debug(
+					"Uploaded file error",
+					slog.String("key", fullKey),
+					slog.String("error", err.Error()),
+				)
 			}
 
 			// skip invalid or missing file(s)
@@ -219,12 +233,12 @@ func (form *RecordUpsert) extractMultipartFormData(
 //
 // File upload is supported only via multipart/form-data.
 func (form *RecordUpsert) LoadRequest(r *http.Request, keyPrefix string) error {
-	requestInfo, uploadedFiles, err := form.extractRequestInfo(r, keyPrefix)
+	requestData, uploadedFiles, err := form.extractRequestData(r, keyPrefix)
 	if err != nil {
 		return err
 	}
 
-	if err := form.LoadData(requestInfo); err != nil {
+	if err := form.LoadData(requestData); err != nil {
 		return err
 	}
 
@@ -309,10 +323,10 @@ func (form *RecordUpsert) AddFiles(key string, files ...*filesystem.File) error
 // Example
 //
 //	// mark only only 2 files for removal
-//	form.AddFiles("documents", "file1_aw4bdrvws6.txt", "file2_xwbs36bafv.txt")
+//	form.RemoveFiles("documents", "file1_aw4bdrvws6.txt", "file2_xwbs36bafv.txt")
 //
 //	// mark all "documents" files for removal
-//	form.AddFiles("documents")
+//	form.RemoveFiles("documents")
 func (form *RecordUpsert) RemoveFiles(key string, toDelete ...string) error {
 	field := form.record.Collection().Schema.GetFieldByName(key)
 	if field == nil || field.Type != schema.FieldTypeFile {
@@ -349,39 +363,39 @@ func (form *RecordUpsert) RemoveFiles(key string, toDelete ...string) error {
 }
 
 // LoadData loads and normalizes the provided regular record data fields into the form.
-func (form *RecordUpsert) LoadData(requestInfo map[string]any) error {
+func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 	// load base system fields
-	if v, ok := requestInfo[schema.FieldNameId]; ok {
+	if v, ok := requestData[schema.FieldNameId]; ok {
 		form.Id = cast.ToString(v)
 	}
 
 	// load auth system fields
 	if form.record.Collection().IsAuth() {
-		if v, ok := requestInfo[schema.FieldNameUsername]; ok {
+		if v, ok := requestData[schema.FieldNameUsername]; ok {
 			form.Username = cast.ToString(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameEmail]; ok {
+		if v, ok := requestData[schema.FieldNameEmail]; ok {
 			form.Email = cast.ToString(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameEmailVisibility]; ok {
+		if v, ok := requestData[schema.FieldNameEmailVisibility]; ok {
 			form.EmailVisibility = cast.ToBool(v)
 		}
-		if v, ok := requestInfo[schema.FieldNameVerified]; ok {
+		if v, ok := requestData[schema.FieldNameVerified]; ok {
 			form.Verified = cast.ToBool(v)
 		}
-		if v, ok := requestInfo["password"]; ok {
+		if v, ok := requestData["password"]; ok {
 			form.Password = cast.ToString(v)
 		}
-		if v, ok := requestInfo["passwordConfirm"]; ok {
+		if v, ok := requestData["passwordConfirm"]; ok {
 			form.PasswordConfirm = cast.ToString(v)
 		}
-		if v, ok := requestInfo["oldPassword"]; ok {
+		if v, ok := requestData["oldPassword"]; ok {
 			form.OldPassword = cast.ToString(v)
 		}
 	}
 
 	// replace modifiers (if any)
-	requestInfo = form.record.ReplaceModifers(requestInfo)
+	requestData = form.record.ReplaceModifers(requestData)
 
 	// create a shallow copy of form.data
 	var extendedData = make(map[string]any, len(form.data))
@@ -390,7 +404,7 @@ func (form *RecordUpsert) LoadData(requestInfo map[string]any) error {
 	}
 
 	// extend form.data with the request data
-	rawData, err := json.Marshal(requestInfo)
+	rawData, err := json.Marshal(requestData)
 	if err != nil {
 		return err
 	}
@@ -742,6 +756,8 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 
 		dao := form.dao.Clone()
 
+		var uploaded []string
+
 		// upload new files (if any)
 		//
 		// note: executed after the default BeforeCreateFunc and BeforeUpdateFunc hook actions
@@ -751,7 +767,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		dao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 			newAction := func() error {
 				if m.TableName() == form.record.TableName() && m.GetId() == form.record.GetId() {
-					if err := form.processFilesToUpload(); err != nil {
+					var err error
+					uploaded, err = form.processFilesToUpload()
+					if err != nil {
 						return err
 					}
 				}
@@ -769,7 +787,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		dao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 			newAction := func() error {
 				if m.TableName() == form.record.TableName() && m.GetId() == form.record.GetId() {
-					if err := form.processFilesToUpload(); err != nil {
+					var err error
+					uploaded, err = form.processFilesToUpload()
+					if err != nil {
 						return err
 					}
 				}
@@ -787,6 +807,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 
 		// persist the record model
 		if err := dao.SaveRecord(form.record); err != nil {
+			// cleanup - try to delete only the successfully uploaded files
+			form.deleteFilesByNamesList(uploaded)
+
 			return form.prepareError(err)
 		}
 
@@ -794,38 +817,41 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		//
 		// for now fail silently to avoid reupload when `form.Submit()`
 		// is called manually (aka. not from an api request)...
-		if err := form.processFilesToDelete(); err != nil && form.app.IsDebug() {
-			log.Println(err)
+		if err := form.processFilesToDelete(); err != nil {
+			form.app.Logger().Debug(
+				"Failed to delete old files",
+				slog.String("error", err.Error()),
+			)
 		}
 
 		return nil
 	}, interceptors...)
 }
 
-func (form *RecordUpsert) processFilesToUpload() error {
+func (form *RecordUpsert) processFilesToUpload() ([]string, error) {
 	if len(form.filesToUpload) == 0 {
-		return nil // no parsed file fields
+		return nil, nil // no parsed file fields
 	}
 
 	if !form.record.HasId() {
-		return errors.New("the record doesn't have an id")
+		return nil, errors.New("the record doesn't have an id")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	fsys, err := form.app.NewFilesystem()
 	if err != nil {
-		return err
+		return nil, err
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	var uploadErrors []error // list of upload errors
-	var uploaded []string    // list of uploaded file paths
+	var uploaded []string    // list of uploaded file names
 
 	for fieldKey := range form.filesToUpload {
 		for i, file := range form.filesToUpload[fieldKey] {
 			path := form.record.BaseFilesPath() + "/" + file.Name
-			if err := fs.UploadFile(file, path); err == nil {
+			if err := fsys.UploadFile(file, path); err == nil {
 				// keep track of the already uploaded file
-				uploaded = append(uploaded, path)
+				uploaded = append(uploaded, file.Name)
 			} else {
 				// store the upload error
 				uploadErrors = append(uploadErrors, fmt.Errorf("file %d: %v", i, err))
@@ -837,10 +863,10 @@ func (form *RecordUpsert) processFilesToUpload() error {
 		// cleanup - try to delete the successfully uploaded files (if any)
 		form.deleteFilesByNamesList(uploaded)
 
-		return fmt.Errorf("failed to upload all files: %v", uploadErrors)
+		return nil, fmt.Errorf("failed to upload all files: %v", uploadErrors)
 	}
 
-	return nil
+	return uploaded, nil
 }
 
 func (form *RecordUpsert) processFilesToDelete() (err error) {
@@ -859,24 +885,28 @@ func (form *RecordUpsert) deleteFilesByNamesList(filenames []string) ([]string,
 		return filenames, errors.New("the record doesn't have an id")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	isNew := form.record.IsNew()
+
+	baseDir := form.record.BaseFilesPath()
+
+	fsys, err := form.app.NewFilesystem()
 	if err != nil {
 		return filenames, err
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	var deleteErrors []error
 
 	for i := len(filenames) - 1; i >= 0; i-- {
 		filename := filenames[i]
-		path := form.record.BaseFilesPath() + "/" + filename
+		path := baseDir + "/" + filename
 
-		if err := fs.Delete(path); err == nil {
+		if err := fsys.Delete(path); err == nil {
 			// remove the deleted file from the list
 			filenames = append(filenames[:i], filenames[i+1:]...)
 
 			// try to delete the related file thumbs (if any)
-			fs.DeletePrefix(form.record.BaseFilesPath() + "/thumbs_" + filename + "/")
+			fsys.DeletePrefix(baseDir + "/thumbs_" + filename + "/")
 		} else {
 			// store the delete error
 			deleteErrors = append(deleteErrors, fmt.Errorf("file %d: %v", i, err))
@@ -887,6 +917,11 @@ func (form *RecordUpsert) deleteFilesByNamesList(filenames []string) ([]string,
 		return filenames, fmt.Errorf("failed to delete all files: %v", deleteErrors)
 	}
 
+	// cleanup empty dir for new records if there are no other files
+	if isNew && fsys.IsEmptyDir(baseDir) {
+		_ = fsys.Delete(baseDir)
+	}
+
 	return filenames, nil
 }
 

forms/record_upsert_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -150,9 +151,10 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 	}
 
 	formData, mp, err := tests.MockMultipartData(map[string]string{
-		"a.b.id":      "test_id",
-		"a.b.text":    "test123",
-		"a.b.unknown": "test456",
+		"a.b.id":                       "test_id",
+		"a.b.text":                     "test123",
+		"a.b.unknown":                  "test456",
+		"a.b." + rest.MultipartJsonKey: `{"json":["a","b"],"email":"test3@example.com"}`,
 		// file fields unset/delete
 		"a.b.file_one-":                    "test_d61b33QdDU.txt", // delete with modifier
 		"a.b.file_many.0":                  "",                    // delete by index
@@ -184,6 +186,19 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 		t.Fatalf("Didn't expect unknown field to be set, got %v", v)
 	}
 
+	if v, ok := form.Data()["email"]; !ok || v != "test3@example.com" {
+		t.Fatalf("Expect email field to be %q, got %q", "test3@example.com", v)
+	}
+
+	rawJsonValue, ok := form.Data()["json"].(types.JsonRaw)
+	if !ok {
+		t.Fatal("Expect json field to be set")
+	}
+	expectedJsonValue := `["a","b"]`
+	if rawJsonValue.String() != expectedJsonValue {
+		t.Fatalf("Expect json field %v, got %v", expectedJsonValue, rawJsonValue)
+	}
+
 	fileOne, ok := form.Data()["file_one"]
 	if !ok {
 		t.Fatal("Expect file_one field to be set")
@@ -604,6 +619,94 @@ func TestRecordUpsertSubmitInterceptors(t *testing.T) {
 	}
 }
 
+func TestRecordUpsertSubmitFailureFilesCleanup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// ensure that there is a unique index constraint
+	collection.Indexes = append(collection.Indexes, `CREATE UNIQUE INDEX "idx_unique_demo3_title" on "demo3" ("title")`)
+	if err := app.Dao().SaveCollection(collection); err != nil {
+		t.Fatal(err)
+	}
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test1"), "new_test1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test1"), "new_test2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	uploadedFiles := []string{f1.Name, f2.Name}
+
+	existing, err := app.Dao().FindRecordById(collection.Id, "mk5fmymtx4wsprk")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		recordId string
+	}{
+		{""},
+		{"7nwo8tuiatetxdm"},
+		{"1tmknxy2868d869"},
+	}
+
+	for _, s := range scenarios {
+		sname := s.recordId
+		if sname == "" {
+			sname = "new"
+		}
+
+		t.Run(sname, func(t *testing.T) {
+			var originalFiles []string
+
+			var record *models.Record
+			if s.recordId == "" {
+				record = models.NewRecord(collection)
+			} else {
+				record, err = app.Dao().FindRecordById(collection.Id, s.recordId)
+				if err != nil {
+					t.Fatal(err)
+				}
+				originalFiles = record.GetStringSlice("files")
+			}
+
+			record.Set("title", existing.GetString("title"))
+
+			form := forms.NewRecordUpsert(app, record)
+
+			form.AddFiles("files", f1, f2)
+
+			err := form.Submit()
+			if err == nil {
+				t.Fatal("Expected form submit to fail")
+			}
+
+			// ensure that the original files still exists
+			for _, name := range originalFiles {
+				if !hasRecordFile(app, record, name) {
+					t.Fatalf("Missing original file %q", name)
+				}
+			}
+
+			// ensure that the new uploaded files were deleted
+			for _, name := range uploadedFiles {
+				if hasRecordFile(app, record, name) {
+					t.Fatalf("Expected file %q to be deleted", name)
+				}
+			}
+		})
+	}
+}
+
 func TestRecordUpsertWithCustomId(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -753,7 +856,7 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 			"create with all allowed auth fields",
 			"",
 			map[string]any{
-				"username":        "test_new",
+				"username":        "test_new-a.b",
 				"email":           "test_new@example.com",
 				"emailVisibility": true,
 				"password":        "12345678",

forms/record_verification_confirm_test.go

@@ -12,6 +12,8 @@ import (
 )
 
 func TestRecordVerificationConfirmValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -98,6 +100,8 @@ func TestRecordVerificationConfirmValidateAndSubmit(t *testing.T) {
 }
 
 func TestRecordVerificationConfirmInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/record_verification_request_test.go

@@ -13,6 +13,8 @@ import (
 )
 
 func TestRecordVerificationRequestSubmit(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -134,6 +136,8 @@ func TestRecordVerificationRequestSubmit(t *testing.T) {
 }
 
 func TestRecordVerificationRequestInterceptors(t *testing.T) {
+	t.Parallel()
+
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 

forms/settings_upsert.go

@@ -4,9 +4,12 @@ import (
 	"os"
 	"time"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/settings"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 // SettingsUpsert is a [settings.Settings] upsert (create/update) form.
@@ -58,32 +61,27 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc[*settings.Set
 	return runInterceptors(form.Settings, func(s *settings.Settings) error {
 		form.Settings = s
 
-		oldSettings, err := form.app.Settings().Clone()
-		if err != nil {
-			return err
-		}
-
-		// eagerly merge the application settings with the form ones
-		if err := form.app.Settings().Merge(form.Settings); err != nil {
-			return err
-		}
-
 		// persists settings change
 		encryptionKey := os.Getenv(form.app.EncryptionEnv())
 		if err := form.dao.SaveSettings(form.Settings, encryptionKey); err != nil {
-			// try to revert app settings
-			form.app.Settings().Merge(oldSettings)
-
 			return err
 		}
 
-		// explicitly trigger old logs deletion
-		form.app.LogsDao().DeleteOldRequests(
-			time.Now().AddDate(0, 0, -1*form.Settings.Logs.MaxDays),
-		)
+		// reload app settings
+		if err := form.app.RefreshSettings(); err != nil {
+			return err
+		}
 
+		// try to clear old logs not matching the new settings
+		createdBefore := time.Now().AddDate(0, 0, -1*form.Settings.Logs.MaxDays).UTC().Format(types.DefaultDateLayout)
+		expr := dbx.NewExp("[[created]] <= {:date} OR [[level]] < {:level}", dbx.Params{
+			"date":  createdBefore,
+			"level": form.Settings.Logs.MinLevel,
+		})
+		form.app.LogsDao().NonconcurrentDB().Delete((&models.Log{}).TableName(), expr).Execute()
+
+		// no logs are allowed -> try to reclaim preserved disk space after the previous delete operation
 		if form.Settings.Logs.MaxDays == 0 {
-			// no logs are allowed -> reclaim preserved disk space after the previous delete operation
 			form.app.LogsDao().Vacuum()
 		}