bumped min go github action to 1.26.3

.github/workflows/release.yaml

@@ -19,9 +19,9 @@ jobs:
           node-version: 20.11.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '>=1.21.7'
+          go-version: '>=1.26.3'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

CHANGELOG.md

@@ -1,6 +1,355 @@
+## v0.22.43
+
+- (_Backported from v0.38.0_) Bumped min Go GitHub action version to 1.26.3 because it comes with some [minor bug and security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.26.3).
+
+
+## v0.22.42
+
+- (_Backported from v0.37.4_) Adjusted Bitbucket, GitHub, GitLab and Gitea/Forgejo OAuth2 providers to better reflect recent API updates and doc references.
+    _In case the userinfo data is not sufficient, some of the providers now send a separate list emails request in order to minimize eventual linking security issues caused by custom onpremise setups (e.g. Gitea/Forgejo allows skipping the email verification if an ENV variable is configured)._
+
+- (_Backported from v0.37.4_) ⚠️ Fixed a pre-hijacking OAuth2 linking vulnerability ([#7662](https://github.com/pocketbase/pocketbase/discussions/7662)).
+
+
+## v0.22.41
+
+- (_Backported from v0.36.9_) Updated the Discord `AuthUser.Name` field to use `global_name`.
+
+- (_Backported from v0.36.9_) Updated `modernc.org/sqlite` to v1.48.2 _(vfs and other error path related fixes)_.
+
+- (_Backported from v0.36.9_) Bumped min Go GitHub action version to 1.26.2 because it comes with several [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.26.2).
+
+
+## v0.22.40
+
+- (_Backported from v0.36.7_) Updated `modernc.org/sqlite` to v1.46.2 and SQLite 3.51.3.
+    _⚠️ SQLite 3.51.3 fixed a [database corruption bug](https://sqlite.org/wal.html#walresetbug) that is very unlikely to happen (with PocketBase even more so because we queue on app level all writes and explicit transactions through a single db connection), but still it is advised to upgrade._
+
+- (_Backported from v0.36.7_) Updated other minor Go and npm deps.
+    _The min Go version in the go.mod of the package was also bumped to Go 1.25.0 because some of the newer dep versions require it._
+
+
+## v0.22.39
+
+- (_Backported from v0.36.6_) Bumped min Go GitHub action version to 1.26.1 because it comes with some [minor bug and security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.26.1).
+
+
+## v0.22.38
+
+- (_Backported from v0.36.0_) Bumped min Go GitHub action version to 1.25.6 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.6).
+
+
+## v0.22.37
+
+- (_Backported from v0.34.1_) - Added missing `:` char to the autocomplete regex ([#7353](https://github.com/pocketbase/pocketbase/pull/7353)).
+
+- (_Backported from v0.34.1_) Bumped min Go GitHub action version to 1.25.5 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.5).
+    _The runner action was also updated to `actions/setup-go@v6` since the previous v5 Go source seems [no longer accessible](https://github.com/actions/setup-go/pull/665#issuecomment-3416693714)._
+
+
+## v0.22.36
+
+- (_Backported from v0.30.2_) Bumped min Go GitHub action version to 1.24.8 since it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.24.8+label%3ACherryPickApproved).
+
+
+## v0.22.35
+
+- (_Backported from v0.29.2_) Bumped min Go GitHub action version to 1.23.12 since it comes with some [minor fixes for the runtime and `database/sql` package](https://github.com/golang/go/issues?q=milestone%3AGo1.23.12+label%3ACherryPickApproved).
+
+
+## v0.22.34
+
+- (_Backported from v0.26.6_) Allow OIDC `email_verified` to be int or boolean string since some OIDC providers like AWS Cognito has non-standard userinfo response ([#6657](https://github.com/pocketbase/pocketbase/pull/6657)).
+
+
+## v0.22.33
+
+- (_Backported from v0.26.3_) Fixed and normalized logs error serialization across common types for more consistent logs error output ([#6631](https://github.com/pocketbase/pocketbase/issues/6631)).
+
+
+## v0.22.32
+
+- (_Backported from v0.26.2_) Updated `golang-jwt/jwt` dependency because it comes with a [minor security fix](https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp).
+
+
+## v0.22.31
+
+- (_Backported from v0.25.5_) Set the current working directory as a default goja script path when executing inline JS strings to allow `require(m)` traversing parent `node_modules` directories.
+
+
+## v0.22.30
+
+- (_Backported from v0.24.4_) Fixed fields extraction for view queries with nested comments ([#6309](https://github.com/pocketbase/pocketbase/discussions/6309)).
+
+- Bumped GitHub action min Go version to 1.23.5 as it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.23.5).
+
+
+## v0.22.29
+
+- (_Backported from v0.23.11_) Upgraded `golang.org/x/net` to 0.33.0 to fix [CVE-2024-45338](https://www.cve.org/CVERecord?id=CVE-2024-45338).
+  _PocketBase uses the vulnerable functions primarily for the auto html->text mail generation, but most applications shouldn't be affected unless you are manually embedding unrestricted user provided value in your mail templates._
+
+
+## v0.22.28
+
+- (_Backported from v0.23.10_) Renew the superuser file token cache when clicking on the thumb preview or download link ([#6137](https://github.com/pocketbase/pocketbase/discussions/6137)).
+
+- (_Backported from v0.23.10_) Upgraded `modernc.org/sqlite` to 1.34.3 to fix "disk io" error on arm64 systems.
+  _If you are extending PocketBase with Go and upgrading with `go get -u` make sure to manually set in your go.mod the `modernc.org/libc` indirect dependency to v1.55.3, aka. the exact same version the driver is using._
+
+
+## v0.22.27
+
+- Instead of unregistering the realtime client(s), just unset their auth state on delete of their related auth record so that the client(s) can receive the `delete` event ([#5898](https://github.com/pocketbase/pocketbase/issues/5898)).
+
+
+## v0.22.26
+
+- (_Backported from v0.23.0-rc_) Added manual WAL checkpoints before creating the zip backup to minimize copying unnecessary data.
+
+
+## v0.22.25
+
+- Refresh the old collections state in the Import UI after successful import submission ([#5861](https://github.com/pocketbase/pocketbase/issues/5861)).
+
+- Added randomized throttle on failed filter list requests as a very rudimentary measure since some security researches raised concern regarding the possibity of eventual side-channel attacks.
+
+
+## v0.22.24
+
+- Delete new uploaded record files in case of record DB persist error ([#5845](https://github.com/pocketbase/pocketbase/issues/5845)).
+
+
+## v0.22.23
+
+- Updated the hooks watcher to account for the case when hooksDir is a symlink ([#5789](https://github.com/pocketbase/pocketbase/issues/5789)).
+
+- _(Backported from v0.23.0-rc)_ Registered a default `http.Server.ErrorLog` handler to report general server connection errors as app Debug level logs (e.g. invalid TLS handshakes caused by bots trying to access your server via its IP or other similar errors).
+
+- Other minor fixes (updated npm dev deps to fix the vulnerabilities warning, added more user friendly realtime topic length error, regenerated JSVM types, etc.)
+
+
+## v0.22.22
+
+- Added deprecation log in case Instagram OAuth2 is used (_related to [#5652](https://github.com/pocketbase/pocketbase/discussions/5652)_).
+
+- Added `update` command warning to prevent unnecessary downloading PocketBase v0.23.0 since it will contain breaking changes.
+
+- Added global JSVM `toString()` helper (_successor of `readerToString()`_) to stringify any value (bool, number, multi-byte array, io.Reader, etc.).
+  _`readerToString` is still available but it is marked as deprecated. You can also use `toString` as replacement for  of `String.fromCharCode` to properly stringify multi-byte unicode characters like emojis._
+    ```js
+    decodeURIComponent(escape(String.fromCharCode(...bytes))) -> toString(bytes)
+    ```
+
+- Updated `aws-sdk-go-v2` and removed deprecated `WithEndpointResolverWithOptions`.
+
+- Backported some of the v0.23.0-rc form validators, fixes and tests.
+
+- Bumped GitHub action min Go version and dependencies.
+
+
+## v0.22.21
+
+- Lock the logs database during backup to prevent `database disk image is malformed` errors in case there is a log write running in the background ([#5541](https://github.com/pocketbase/pocketbase/discussions/5541)).
+
+
+## v0.22.20
+
+- Fixed the Admin UI `isEmpty` check to allow submitting zero uuid, datetime and date strings ([#5398](https://github.com/pocketbase/pocketbase/issues/5398)).
+
+- Updated goja and the other Go deps.
+
+
+## v0.22.19
+
+- Added additional parsing for the Apple OAuth2 `user` token response field to attempt returning the name of the authenticated user ([#5074](https://github.com/pocketbase/pocketbase/discussions/5074#discussioncomment-10317207)).
+  _Note that Apple only returns the user object the first time the user authorizes the app (at least based on [their docs](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292))._
+
+
+## v0.22.18
+
+- Improved files delete performance when using the local filesystem by adding a trailing slash to the `DeletePrefix` call to ensure that the list iterator will start "walking" from the prefix directory and not from its parent ([#5246](https://github.com/pocketbase/pocketbase/discussions/5246)).
+
+- Updated Go deps.
+
+
+## v0.22.17
+
+- Updated the `editor` field to use the latest TinyMCE 6.8.4 and enabled `convert_unsafe_embeds:true` by default per the security advisories.
+  _The Admin UI shouldn't be affected by the older TinyMCE because we don't use directly the vulnerable options/plugins and we have a default CSP, but it is recommended to update even just for silencing the CI/CD warnings._
+
+- Disabled mouse selection when changing the sidebar width.
+  _This should also fix the reported Firefox issue when the sidebar width "resets" on mouse release out of the page window._
+
+- Other minor improvements (updated the logs delete check and tests, normalized internal errors formatting, updated Go deps, etc.)
+
+
+## v0.22.16
+
+- Fixed the days calculation for triggering old logs deletion ([#5179](https://github.com/pocketbase/pocketbase/pull/5179); thanks @nehmeroumani).
+  _Note that the previous versions correctly delete only the logs older than the configured setting but due to the typo the delete query is invoked unnecessary on each logs batch write._
+
+
+## v0.22.15
+
+- Added mutex to `tests.TestMailer()` to minimize tests data race warnings ([#5157](https://github.com/pocketbase/pocketbase/issues/5157)).
+
+- Updated goja and the other Go dependencies.
+
+- Bumped the min Go version in the GitHub release action to Go 1.22.5 since it comes with [`net/http` security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.22.5).
+
+
+## v0.22.14
+
+- Added OAuth2 POST redirect support (in case of `response_mode=form_post`) to allow specifying scopes for the Apple OAuth2 integration.
+
+    Note 1: If you are using the "Manual code exchange" flow with Apple (aka. `authWithOAuth2Code()`), you need to either update your custom
+    redirect handler to accept POST requests OR if you want to keep the old behavior and don't need the Apple user's email - replace in the Apple authorization url `response_mode=form_post` back to `response_mode=query`.
+
+    Note 2: Existing users that have already logged in with Apple may need to revoke their access in order to see the email sharing options as shown in [this screenshot](https://github.com/pocketbase/pocketbase/discussions/5074#discussioncomment-9801855).
+    If you want to force the new consent screen you could register a new Apple OAuth2 app.
+
+- ⚠️ Fixed a security vulnerability related to the OAuth2 email autolinking (thanks to @dalurness for reporting it).
+
+    Just to be safe I've also published a [GitHub security advisory](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-m93w-4fxv-r35v) (_may take some time to show up in the related security databases_).
+
+    In order to be exploited you must have **both** OAuth2 and Password auth methods enabled.
+
+    A possible attack scenario could be:
+    - a malicious actor register with the targeted user's email (it is unverified)
+    - at some later point in time the targeted user stumble on your app and decides to sign-up with OAuth2 (_this step could be also initiated by the attacker by sending an invite email to the targeted user_)
+    - on successful OAuth2 auth we search for an existing PocketBase user matching with the OAuth2 user's email and associate them
+    - because we haven't changed the password of the existing PocketBase user during the linking, the malicious actor has access to the targeted user account and will be able to login with the initially created email/password
+
+    To prevent this for happening we now reset the password for this specific case if the previously created user wasn't verified (an exception to this is if the linking is explicit/manual, aka. when you send `Authorization:TOKEN` with the OAuth2 auth call).
+
+    Additionally to warn users we now send an email alert in case the user has logged in with password but has at least one OAuth2 account linked. It looks something like:
+
+    _Hello,
+    Just to let you know that someone has logged in to your Acme account using a password while you already have OAuth2 GitLab auth linked.
+    If you have recently signed in with a password, you may disregard this email.
+    **If you don't recognize the above action, you should immediately change your Acme account password.**
+    Thanks,
+    Acme team_
+
+    The flow will be further improved with the [ongoing refactoring](https://github.com/pocketbase/pocketbase/discussions/4355) and we will start sending emails for "unrecognized device" logins (OTP and MFA is already implemented and will be available with the next v0.23.0 release in the near future).
+
+
+## v0.22.13
+
+- Fixed rules inconsistency for text literals when inside parenthesis ([#5017](https://github.com/pocketbase/pocketbase/issues/5017)).
+
+- Updated Go deps.
+
+
+## v0.22.12
+
+- Fixed calendar picker grid layout misalignment on Firefox ([#4865](https://github.com/pocketbase/pocketbase/issues/4865)).
+
+- Updated Go deps and bumped the min Go version in the GitHub release action to Go 1.22.3 since it comes with [some minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.22.3).
+
+
+## v0.22.11
+
+- Load the full record in the relation picker edit panel ([#4857](https://github.com/pocketbase/pocketbase/issues/4857)).
+
+
+## v0.22.10
+
+- Updated the uploaded filename normalization to take double extensions in consideration ([#4824](https://github.com/pocketbase/pocketbase/issues/4824))
+
+- Added Collection models cache to help speed up the common List and View requests execution with ~25%.
+  _This was extracted from the ongoing work on [#4355](https://github.com/pocketbase/pocketbase/discussions/4355) and there are many other small optimizations already implemented but they will have to wait for the refactoring to be finalized._
+
+
+## v0.22.9
+
+- Fixed Admin UI OAuth2 "Clear all fields" btn action to properly unset all form fields ([#4737](https://github.com/pocketbase/pocketbase/issues/4737)).
+
+
+## v0.22.8
+
+- Fixed '~' auto wildcard wrapping when the param has escaped `%` character ([#4704](https://github.com/pocketbase/pocketbase/discussions/4704)).
+
+- Other minor UI improvements (added `aria-expanded=true/false` to the dropdown triggers, added contrasting border around the default mail template btn style, etc.).
+
+- Updated Go deps and bumped the min Go version in the GitHub release action to Go 1.22.2 since it comes with [some `net/http` security and bug fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.22.2).
+
+
+## v0.22.7
+
+- Replaced the default `s3blob` driver with a trimmed vendored version to reduce the binary size with ~10MB.
+  _It can be further reduced with another ~10MB once we replace entirely the `aws-sdk-go-v2` dependency but I stumbled on some edge cases related to the headers signing and for now is on hold._
+
+- Other minor improvements (updated GitLab OAuth2 provider logo [#4650](https://github.com/pocketbase/pocketbase/pull/4650), normalized error messages, updated npm dependencies, etc.)
+
+
+## v0.22.6
+
+- Admin UI accessibility improvements:
+  - Fixed the dropdowns tab/enter/space keyboard navigation ([#4607](https://github.com/pocketbase/pocketbase/issues/4607)).
+  - Added `role`, `aria-label`, `aria-hidden` attributes to some of the elements in attempt to better assist screen readers.
+
+
+## v0.22.5
+
+- Minor test helpers fixes ([#4600](https://github.com/pocketbase/pocketbase/issues/4600)):
+  - Call the `OnTerminate` hook on `TestApp.Cleanup()`.
+  - Automatically run the DB migrations on initializing the test app with `tests.NewTestApp()`.
+
+- Added more elaborate warning message when restoring a backup explaining how the operation works.
+
+- Skip irregular files (symbolic links, sockets, etc.) when restoring a backup zip from the Admin UI or calling `archive.Extract(src, dst)` because they come with too many edge cases and ambiguities.
+  <details>
+    <summary><b><i>More details</i></b></summary>
+
+    This was initially reported as security issue (_thanks Harvey Spec_) but in the PocketBase context it is not something that can be exploited without an admin intervention and since the general expectations are that the PocketBase admins can do anything and they are the one who manage their server, this should be treated with the same diligence when using `scp`/`rsync`/`rclone`/etc. with untrusted file sources.
+
+    It is not possible (_or at least I'm not aware how to do that easily_) to perform virus/malicious content scanning on the uploaded backup archive files and some caution is always required when using the Admin UI or running shell commands, hence the backup-restore warning text.
+
+    **Or in other words, if someone sends you a file and tell you to upload it to your server (either as backup zip or manually via scp) obviously you shouldn't do that unless you really trust them.**
+
+    PocketBase is like any other regular application that you run on your server and there is no builtin "sandbox" for what the PocketBase process can execute. This is left to the developers to restrict on application or OS level depending on their needs. If you are self-hosting PocketBase you usually don't have to do that, but if you are offering PocketBase as a service and allow strangers to run their own PocketBase instances on your server then you'll need to implement the isolation mechanisms on your own.
+  </details>
+
+
+## v0.22.4
+
+- Removed conflicting styles causing the detailed codeblock log data preview to not visualize properly ([#4505](https://github.com/pocketbase/pocketbase/pull/4505)).
+
+- Minor JSVM improvements:
+  - Added `$filesystem.fileFromUrl(url, optSecTimeout)` helper.
+  - Implemented the `FormData` interface and added support for sending `multipart/form-data` requests with `$http.send()` ([#4544](https://github.com/pocketbase/pocketbase/discussions/4544)).
+
+
+## v0.22.3
+
+- Fixed the z-index of the current admin dropdown on Safari ([#4492](https://github.com/pocketbase/pocketbase/issues/4492)).
+
+- Fixed `OnAfterApiError` debug log `nil` error reference ([#4498](https://github.com/pocketbase/pocketbase/issues/4498)).
+
+- Added the field name as part of the `@request.data.someRelField.*` join to handle the case when a collection has 2 or more relation fields pointing to the same place ([#4500](https://github.com/pocketbase/pocketbase/issues/4500)).
+
+- Updated Go deps and bumped the min Go version in the GitHub release action to Go 1.22.1 since it comes with [some security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.22.1).
+
+
+## v0.22.2
+
+- Fixed a small regression introduced with v0.22.0 that was causing some missing unknown fields to always return an error instead of applying the specific `nullifyMisingField` resolver option to the query.
+
+
+## v0.22.1
+
+- Fixed Admin UI record and collection panels not reinitializing properly on browser back/forward navigation ([#4462](https://github.com/pocketbase/pocketbase/issues/4462)).
+
+- Initialize `RecordAuthWithOAuth2Event.IsNewRecord` for the `OnRecordBeforeAuthWithOAuth2Request` hook ([#4437](https://github.com/pocketbase/pocketbase/discussions/4437)).
+
+- Added error checks to the autogenerated Go migrations ([#4448](https://github.com/pocketbase/pocketbase/issues/4448)).
+
+
 ## v0.22.0
 
-- Added Planning Center OAuth2 provider (thanks @alxjsn).
+- Added Planning Center OAuth2 provider ([#4393](https://github.com/pocketbase/pocketbase/pull/4393); thanks @alxjsn).
 
 - Admin UI improvements:
   - Autosync collection changes across multiple open browser tabs.
@@ -20,7 +369,7 @@
 
 - Added `jsvm.Config.OnInit` optional config function to allow registering custom Go bindings to the JSVM.
 
-- Added `@request.context` rule field that can be used to apply a different set of constrtaints based on the API rule execution context.
+- Added `@request.context` rule field that can be used to apply a different set of constraints based on the API rule execution context.
   For example, to disallow user creation by an OAuth2 auth, you could set for the users Create API rule `@request.context != "oauth2"`.
   The currently supported `@request.context` values are:
   ```
@@ -31,7 +380,7 @@
   ```
 
 - Adjusted the `cron.Start()` to start the ticker at the `00` second of the cron interval ([#4394](https://github.com/pocketbase/pocketbase/discussions/4394)).
-  _Note that the cron format has only minute granularity and there is still no guarantee that the sheduled job will be always executed at the `00` second._
+  _Note that the cron format has only minute granularity and there is still no guarantee that the scheduled job will be always executed at the `00` second._
 
 - Fixed auto backups cron not reloading properly after app settings change ([#4431](https://github.com/pocketbase/pocketbase/discussions/4431)).
 

CONTRIBUTING.md

@@ -10,7 +10,7 @@ This document describes how to prepare a PR for a change in the main repository.
 
 ## Prerequisites
 
-- Go 1.21+ (for making changes in the Go code)
+- Go 1.25+ (for making changes in the Go code)
 - Node 18+ (for making changes in the Admin UI)
 
 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:

README.md

@@ -46,7 +46,7 @@ your own custom app specific business logic and still have a single portable exe
 
 Here is a minimal example:
 
-0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.25+](https://go.dev/doc/install) (_if you haven't already_)
 
 1. Create a new project directory with the following `main.go` file inside it:
     ```go

apis/base.go

@@ -106,7 +106,7 @@ func InitApi(app core.App) (*echo.Echo, error) {
 
 		if hookErr == nil {
 			if err := app.OnAfterApiError().Trigger(event); err != nil {
-				app.Logger().Debug("OnAfterApiError failure", slog.String("error", hookErr.Error()))
+				app.Logger().Debug("OnAfterApiError failure", slog.String("error", err.Error()))
 			}
 		} else {
 			app.Logger().Debug("OnBeforeApiError error (truly rare case, eg. client already disconnected)", slog.String("error", hookErr.Error()))

apis/file.go

@@ -111,7 +111,7 @@ func (api *fileApi) download(c echo.Context) error {
 
 	options, ok := fileField.Options.(*schema.FileOptions)
 	if !ok {
-		return NewBadRequestError("", errors.New("Failed to load file options."))
+		return NewBadRequestError("", errors.New("failed to load file options"))
 	}
 
 	// check whether the request is authorized to view the protected file

apis/middlewares.go

@@ -261,7 +261,7 @@ func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.Midd
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			if param := c.PathParam("collection"); param != "" {
-				collection, err := app.Dao().FindCollectionByNameOrId(param)
+				collection, err := core.FindCachedCollectionByNameOrId(app, param)
 				if err != nil || collection == nil {
 					return NewNotFoundError("", err)
 				}

apis/realtime.go

@@ -245,7 +245,7 @@ func (api *realtimeApi) unregisterClientsByAuthModel(contextKey string, model mo
 		if clientModel != nil &&
 			clientModel.TableName() == model.TableName() &&
 			clientModel.GetId() == model.GetId() {
-			api.app.SubscriptionsBroker().Unregister(client.Id())
+			client.Unset(contextKey)
 		}
 	}
 
@@ -371,7 +371,7 @@ type recordData struct {
 func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dryCache bool) error {
 	collection := record.Collection()
 	if collection == nil {
-		return errors.New("[broadcastRecord] Record collection not set.")
+		return errors.New("[broadcastRecord] Record collection not set")
 	}
 
 	clients := api.app.SubscriptionsBroker().Clients()

apis/realtime_test.go

@@ -249,22 +249,48 @@ func TestRealtimeAuthRecordDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	authRecord1, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAuthRecordKey, authRecord)
-	testApp.SubscriptionsBroker().Register(client)
+	authRecord2, err := testApp.Dao().FindFirstRecordByData("users", "email", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAuthRecordKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// "delete" authRecord1
 	e := new(core.ModelEvent)
 	e.Dao = testApp.Dao()
-	e.Model = authRecord
+	e.Model = authRecord1
 	testApp.OnModelAfterDelete().Trigger(e)
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAuthRecordKey); auth == nil || auth.(*models.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 
@@ -307,22 +333,48 @@ func TestRealtimeAdminDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	admin1, err := testApp.Dao().FindAdminByEmail("test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAdminKey, admin)
-	testApp.SubscriptionsBroker().Register(client)
+	admin2, err := testApp.Dao().FindAdminByEmail("test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAdminKey, admin1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAdminKey, admin1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAdminKey, admin2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// "delete" admin1
 	e := new(core.ModelEvent)
 	e.Dao = testApp.Dao()
-	e.Model = admin
+	e.Model = admin1
 	testApp.OnModelAfterDelete().Trigger(e)
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAdminKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAdminKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAdminKey); auth == nil || auth.(*models.Admin).Id != admin2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 
@@ -394,16 +446,29 @@ func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
 
 	apis.InitApi(testApp)
 
-	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	authRecord1, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextAuthRecordKey, authRecord)
-	testApp.SubscriptionsBroker().Register(client)
+	authRecord2, err := testApp.Dao().FindFirstRecordByData("users", "email", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	// refetch the authRecord as CustomUser
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.ContextAuthRecordKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.ContextAuthRecordKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// refetch authRecord1 as CustomUser
 	customUser, err := findCustomUserByEmail(testApp.Dao(), "test@example.com")
 	if err != nil {
 		t.Fatal(err)
@@ -414,8 +479,20 @@ func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
-		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.ContextAuthRecordKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.ContextAuthRecordKey); auth == nil || auth.(*models.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
 	}
 }
 

apis/record_auth.go

@@ -7,19 +7,23 @@ import (
 	"log/slog"
 	"net/http"
 	"sort"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/oauth2"
 )
 
@@ -30,6 +34,7 @@ func bindRecordAuthApi(app core.App, rg *echo.Group) {
 
 	// global oauth2 subscription redirect handler
 	rg.GET("/oauth2-redirect", api.oauth2SubscriptionRedirect)
+	rg.POST("/oauth2-redirect", api.oauth2SubscriptionRedirect) // needed in case of response_mode=form_post
 
 	// common collection record related routes
 	subGroup := rg.Group(
@@ -146,7 +151,7 @@ func (api *recordAuthApi) authMethods(c echo.Context) error {
 		switch name {
 		case auth.NameApple:
 			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
-			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "query"))
+			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "form_post"))
 		}
 
 		if provider.PKCE() {
@@ -201,7 +206,6 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 	event.HttpContext = c
 	event.Collection = collection
 	event.ProviderName = form.Provider
-	event.IsNewRecord = false
 
 	form.SetBeforeNewRecordCreateFunc(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
 		return createForm.DrySubmit(func(txDao *daos.Dao) error {
@@ -248,6 +252,7 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 			event.Record = data.Record
 			event.OAuth2User = data.OAuth2User
 			event.ProviderClient = data.ProviderClient
+			event.IsNewRecord = data.Record == nil
 
 			return api.app.OnRecordBeforeAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
 				data.Record = e.Record
@@ -269,6 +274,14 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 				}
 
 				return api.app.OnRecordAfterAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+					// clear the lastLoginAlertSentAt field so that we can enforce password auth notifications
+					if !e.Record.LastLoginAlertSentAt().IsZero() {
+						e.Record.Set(schema.FieldNameLastLoginAlertSentAt, "")
+						if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+							api.app.Logger().Warn("Failed to reset lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+						}
+					}
+
 					return RecordAuthResponse(api.app, e.HttpContext, e.Record, meta)
 				})
 			})
@@ -304,6 +317,42 @@ func (api *recordAuthApi) authWithPassword(c echo.Context) error {
 					return NewBadRequestError("Failed to authenticate.", err)
 				}
 
+				// @todo remove after the refactoring
+				if collection.AuthOptions().AllowOAuth2Auth && e.Record.Email() != "" {
+					externalAuths, err := api.app.Dao().FindAllExternalAuthsByRecord(e.Record)
+					if err != nil {
+						return NewBadRequestError("Failed to authenticate.", err)
+					}
+					if len(externalAuths) > 0 {
+						lastLoginAlert := e.Record.LastLoginAlertSentAt().Time()
+
+						// send an email alert if the password auth is after OAuth2 auth (lastLoginAlert will be empty)
+						// or if it has been ~7 days since the last alert
+						if lastLoginAlert.IsZero() || time.Now().UTC().Sub(lastLoginAlert).Hours() > 168 {
+							providerNames := make([]string, len(externalAuths))
+							for i, ea := range externalAuths {
+								var name string
+								if provider, err := auth.NewProviderByName(ea.Provider); err == nil {
+									name = provider.DisplayName()
+								}
+								if name == "" {
+									name = ea.Provider
+								}
+								providerNames[i] = name
+							}
+
+							if err := mails.SendRecordPasswordLoginAlert(api.app, e.Record, providerNames...); err != nil {
+								return NewBadRequestError("Failed to authenticate.", err)
+							}
+
+							e.Record.SetLastLoginAlertSentAt(types.NowDateTime())
+							if err := api.app.Dao().SaveRecord(e.Record); err != nil {
+								api.app.Logger().Warn("Failed to update lastLoginAlertSentAt", "error", err, "recordId", e.Record.Id)
+							}
+						}
+					}
+				}
+
 				return api.app.OnRecordAfterAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
 					return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
 				})
@@ -664,36 +713,40 @@ const (
 	oauth2RedirectSuccessPath string = "../_/#/auth/oauth2-redirect-success"
 )
 
-type oauth2EventMessage struct {
-	State string `json:"state"`
-	Code  string `json:"code"`
-	Error string `json:"error,omitempty"`
+type oauth2RedirectData struct {
+	State string `form:"state" query:"state" json:"state"`
+	Code  string `form:"code" query:"code" json:"code"`
+	Error string `form:"error" query:"error" json:"error,omitempty"`
 }
 
 func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
-	state := c.QueryParam("state")
-	if state == "" {
-		api.app.Logger().Debug("Missing OAuth2 state parameter")
-		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+	redirectStatusCode := http.StatusTemporaryRedirect
+	if c.Request().Method != http.MethodGet {
+		redirectStatusCode = http.StatusSeeOther
 	}
 
-	client, err := api.app.SubscriptionsBroker().ClientById(state)
+	data := oauth2RedirectData{}
+	if err := c.Bind(&data); err != nil {
+		api.app.Logger().Debug("Failed to read OAuth2 redirect data", "error", err)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	if data.State == "" {
+		api.app.Logger().Debug("Missing OAuth2 state parameter")
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	client, err := api.app.SubscriptionsBroker().ClientById(data.State)
 	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
-		api.app.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", state)
-		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+		api.app.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", data.State)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
 	}
 	defer client.Unsubscribe(oauth2SubscriptionTopic)
 
-	data := oauth2EventMessage{
-		State: state,
-		Code:  c.QueryParam("code"),
-		Error: c.QueryParam("error"),
-	}
-
 	encodedData, err := json.Marshal(data)
 	if err != nil {
 		api.app.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
-		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
 	}
 
 	msg := subscriptions.Message{
@@ -705,8 +758,8 @@ func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
 
 	if data.Error != "" || data.Code == "" {
 		api.app.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
-		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+		return c.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
 	}
 
-	return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectSuccessPath)
+	return c.Redirect(redirectStatusCode, oauth2RedirectSuccessPath)
 }

apis/record_auth_test.go

@@ -237,6 +237,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
 				"OnRecordAfterAuthWithPasswordRequest":  1,
 				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
 			},
 		},
 
@@ -304,6 +307,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
 				"OnRecordAfterAuthWithPasswordRequest":  1,
 				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
 			},
 		},
 		{
@@ -328,6 +334,9 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnRecordBeforeAuthWithPasswordRequest": 1,
 				"OnRecordAfterAuthWithPasswordRequest":  1,
 				"OnRecordAuthRequest":                   1,
+				// lastLoginAlertSentAt update
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeUpdate": 1,
 			},
 		},
 
@@ -654,10 +663,13 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":                        1,
 				"OnModelBeforeUpdate":                       1,
+				"OnModelAfterUpdate":                        1,
 				"OnRecordBeforeConfirmPasswordResetRequest": 1,
 				"OnRecordAfterConfirmPasswordResetRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				user, err := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
@@ -761,10 +773,18 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 					t.Fatalf("Failed to fetch confirm password user: %v", err)
 				}
 
+				oldTokenKey := user.TokenKey()
+
 				// ensure that the user is already verified
 				user.SetVerified(true)
 				if err := app.Dao().WithoutHooks().SaveRecord(user); err != nil {
-					t.Fatalf("Failed to update user verified state")
+					t.Fatal("Failed to update user verified state")
+				}
+
+				// restore original token key that was reseted after the verified change
+				user.SetTokenKey(oldTokenKey)
+				if err := app.Dao().WithoutHooks().SaveRecord(user); err != nil {
+					t.Fatal("Failed to reset user tokenKey")
 				}
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
@@ -803,10 +823,13 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":                        1,
 				"OnModelBeforeUpdate":                       1,
+				"OnModelAfterUpdate":                        1,
 				"OnRecordBeforeConfirmPasswordResetRequest": 1,
 				"OnRecordAfterConfirmPasswordResetRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 		},
 	}
@@ -978,10 +1001,13 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":                       1,
 				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
 				"OnRecordBeforeConfirmVerificationRequest": 1,
 				"OnRecordAfterConfirmVerificationRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 		},
 		{
@@ -1028,10 +1054,13 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":                       1,
 				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
 				"OnRecordBeforeConfirmVerificationRequest": 1,
 				"OnRecordAfterConfirmVerificationRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 		},
 	}
@@ -1218,10 +1247,13 @@ func TestRecordAuthConfirmEmailChange(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":                      1,
 				"OnModelBeforeUpdate":                     1,
+				"OnModelAfterUpdate":                      1,
 				"OnRecordBeforeConfirmEmailChangeRequest": 1,
 				"OnRecordAfterConfirmEmailChangeRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 		},
 		{
@@ -1258,6 +1290,9 @@ func TestRecordAuthConfirmEmailChange(t *testing.T) {
 				"OnModelBeforeUpdate":                     1,
 				"OnRecordBeforeConfirmEmailChangeRequest": 1,
 				"OnRecordAfterConfirmEmailChangeRequest":  1,
+				// external auths deletion
+				"OnModelBeforeDelete": 2,
+				"OnModelAfterDelete":  2,
 			},
 		},
 	}
@@ -1703,6 +1738,28 @@ func TestRecordAuthOAuth2Redirect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Name:   "(POST) client with @oauth2 subscription",
+			Method: http.MethodPost,
+			Url:    "/api/oauth2-redirect",
+			Body:   strings.NewReader("code=123&state=" + clientStubs[7]["c3"].Id()),
+			RequestHeaders: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[7], map[string][]string{
+				"c3": {`"state":"` + clientStubs[7]["c3"].Id(), `"code":"123"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[7]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
 	}
 
 	for _, scenario := range scenarios {

apis/record_crud.go

@@ -1,9 +1,12 @@
 package apis
 
 import (
+	cryptoRand "crypto/rand"
 	"fmt"
 	"log/slog"
+	"math/big"
 	"net/http"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
@@ -71,7 +74,13 @@ func (api *recordApi) list(c echo.Context) error {
 
 	records := []*models.Record{}
 
-	result, err := searchProvider.ParseAndExec(c.QueryParams().Encode(), &records)
+	// note: in v0.23.0 this has been migrated as option check in the search.Provider
+	queryStr := c.QueryParams().Encode()
+	if len(queryStr) > 2048 {
+		return NewBadRequestError("query string is too large", nil)
+	}
+
+	result, err := searchProvider.ParseAndExec(queryStr, &records)
 	if err != nil {
 		return NewBadRequestError("", err)
 	}
@@ -91,10 +100,43 @@ func (api *recordApi) list(c echo.Context) error {
 			api.app.Logger().Debug("Failed to enrich list records", slog.String("error", err.Error()))
 		}
 
+		// note: in v0.23.0 this is combined with extra check for repeated attempts
+		//
+		// Add a randomized throttle in case of empty search filter attempts.
+		//
+		// This is just for extra precaution since security researches raised concern regarding the possibity of eventual
+		// timing attacks because the List API rule acts also as filter and executes in a single run with the client-side filters.
+		// This is by design and it is an accepted tradeoff between performance, usability and correctness.
+		//
+		// While technically the below doesn't fully guarantee protection against filter timing attacks, in practice combined with the network latency it makes them even less feasible.
+		// A properly configured rate limiter or individual fields Hidden checks are better suited if you are really concerned about eventual information disclosure by side-channel attacks.
+		//
+		// In all cases it doesn't really matter that much because it doesn't affect the builtin PocketBase security sensitive fields (e.g. password and tokenKey) since they
+		// are not client-side filterable and in the few places where they need to be compared against an external value, a constant time check is used.
+		if requestInfo.Admin == nil &&
+			(collection.ListRule != nil && *collection.ListRule != "") &&
+			(requestInfo.Query["filter"] != "") &&
+			len(e.Records) == 0 {
+			api.app.Logger().Debug("Randomized throttle because of failed filter search", "collectionId", collection.Id)
+			randomizedThrottle(100)
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
 	})
 }
 
+func randomizedThrottle(softMax int64) {
+	var timeout int64
+	randRange, err := cryptoRand.Int(cryptoRand.Reader, big.NewInt(softMax))
+	if err == nil {
+		timeout = randRange.Int64()
+	} else {
+		timeout = softMax
+	}
+
+	time.Sleep(time.Duration(timeout) * time.Millisecond)
+}
+
 func (api *recordApi) view(c echo.Context) error {
 	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
 	if collection == nil {
@@ -185,6 +227,11 @@ func (api *recordApi) create(c echo.Context) error {
 			return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 		}
 
+		// force unset the verified state to prevent ManageRule misuse
+		if !hasFullManageAccess {
+			testForm.Verified = false
+		}
+
 		createRuleFunc := func(q *dbx.SelectQuery) error {
 			if *collection.CreateRule == "" {
 				return nil // no create rule to resolve

apis/record_crud_test.go

@@ -1270,6 +1270,7 @@ func TestRecordCrudCreate(t *testing.T) {
 				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
 					t.Fatalf("failed to update demo3 collection create rule: %v", err)
 				}
+				core.ReloadCachedCollections(app)
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
@@ -1291,6 +1292,7 @@ func TestRecordCrudCreate(t *testing.T) {
 				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
 					t.Fatalf("failed to update demo3 collection create rule: %v", err)
 				}
+				core.ReloadCachedCollections(app)
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -1929,6 +1931,7 @@ func TestRecordCrudUpdate(t *testing.T) {
 				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
 					t.Fatalf("failed to update demo3 collection update rule: %v", err)
 				}
+				core.ReloadCachedCollections(app)
 			},
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
@@ -1950,6 +1953,7 @@ func TestRecordCrudUpdate(t *testing.T) {
 				if err := app.Dao().WithoutHooks().SaveCollection(collection); err != nil {
 					t.Fatalf("failed to update demo3 collection update rule: %v", err)
 				}
+				core.ReloadCachedCollections(app)
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{

apis/record_helpers.go

@@ -79,7 +79,7 @@ func RecordAuthResponse(
 	finalizers ...func(token string) error,
 ) error {
 	if !authRecord.Verified() && authRecord.Collection().AuthOptions().OnlyVerified {
-		return NewForbiddenError("Please verify your email first.", nil)
+		return NewForbiddenError("Please verify your account first.", nil)
 	}
 
 	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
@@ -154,7 +154,7 @@ func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defa
 	requestInfo := RequestInfo(c)
 
 	if err := autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo); err != nil {
-		return fmt.Errorf("Failed to resolve email visibility: %w", err)
+		return fmt.Errorf("failed to resolve email visibility: %w", err)
 	}
 
 	expands := defaultExpands
@@ -167,7 +167,7 @@ func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defa
 
 	errs := dao.ExpandRecords(records, expands, expandFetch(dao, requestInfo))
 	if len(errs) > 0 {
-		return fmt.Errorf("Failed to expand: %v", errs)
+		return fmt.Errorf("failed to expand: %v", errs)
 	}
 
 	return nil
@@ -185,7 +185,7 @@ func expandFetch(
 			}
 
 			if relCollection.ViewRule == nil {
-				return fmt.Errorf("Only admins can view collection %q records", relCollection.Name)
+				return fmt.Errorf("only admins can view collection %q records", relCollection.Name)
 			}
 
 			if *relCollection.ViewRule != "" {

apis/serve.go

@@ -159,6 +159,7 @@ func Serve(app core.App, config ServeConfig) (*http.Server, error) {
 		BaseContext: func(l net.Listener) context.Context {
 			return baseCtx
 		},
+		ErrorLog: log.New(&serverErrorLogWriter{app: app}, "", 0),
 	}
 
 	serveEvent := &core.ServeEvent{
@@ -275,3 +276,13 @@ func runMigrations(app core.App) error {
 
 	return nil
 }
+
+type serverErrorLogWriter struct {
+	app core.App
+}
+
+func (s *serverErrorLogWriter) Write(p []byte) (int, error) {
+	s.app.Logger().Debug(strings.TrimSpace(string(p)))
+
+	return len(p), nil
+}

core/base.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"syscall"
 	"time"
 
@@ -1161,7 +1162,9 @@ func (app *BaseApp) registerDefaultHooks() {
 	// try to delete the storage files from deleted Collection, Records, etc. model
 	app.OnModelAfterDelete().Add(func(e *ModelEvent) error {
 		if m, ok := e.Model.(models.FilesManager); ok && m.BaseFilesPath() != "" {
-			prefix := m.BaseFilesPath()
+			// ensure that there is a trailing slash so that the list iterator could start walking from the prefix
+			// (https://github.com/pocketbase/pocketbase/discussions/5246#discussioncomment-10128955)
+			prefix := strings.TrimRight(m.BaseFilesPath(), "/") + "/"
 
 			// run in the background for "optimistic" delete to avoid
 			// blocking the delete transaction
@@ -1182,6 +1185,8 @@ func (app *BaseApp) registerDefaultHooks() {
 	if err := app.initAutobackupHooks(); err != nil {
 		app.Logger().Error("Failed to init auto backup hooks", slog.String("error", err.Error()))
 	}
+
+	registerCachedCollectionsAppHooks(app)
 }
 
 // getLoggerMinLevel returns the logger min level based on the
@@ -1254,14 +1259,14 @@ func (app *BaseApp) initLogger() error {
 				return nil
 			})
 
+			// @todo replace with cron so that it doesn't rely on the logs write
+			//
 			// delete old logs
 			// ---
-			logsMaxDays := app.Settings().Logs.MaxDays
 			now := time.Now()
 			lastLogsDeletedAt := cast.ToTime(app.Store().Get("lastLogsDeletedAt"))
-			daysDiff := now.Sub(lastLogsDeletedAt).Hours() * 24
-			if daysDiff > float64(logsMaxDays) {
-				deleteErr := app.LogsDao().DeleteOldLogs(now.AddDate(0, 0, -1*logsMaxDays))
+			if now.Sub(lastLogsDeletedAt).Hours() >= 6 {
+				deleteErr := app.LogsDao().DeleteOldLogs(now.AddDate(0, 0, -1*app.Settings().Logs.MaxDays))
 				if deleteErr == nil {
 					app.Store().Set("lastLogsDeletedAt", now)
 				} else {
@@ -1279,7 +1284,7 @@ func (app *BaseApp) initLogger() error {
 		for {
 			select {
 			case <-done:
-				handler.WriteAll(ctx)
+				return
 			case <-ticker.C:
 				handler.WriteAll(ctx)
 			}
@@ -1289,8 +1294,13 @@ func (app *BaseApp) initLogger() error {
 	app.logger = slog.New(handler)
 
 	app.OnTerminate().PreAdd(func(e *TerminateEvent) error {
+		// write all remaining logs before ticker.Stop to avoid races with ResetBootstrap user calls
+		handler.WriteAll(context.Background())
+
 		ticker.Stop()
+
 		done <- true
+
 		return nil
 	})
 

core/base_backup.go

@@ -72,9 +72,15 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 	// Run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection).
 	// ---
 	tempPath := filepath.Join(localTempDir, "pb_backup_"+security.PseudorandomString(4))
-	createErr := app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
-		// @todo consider experimenting with temp switching the readonly pragma after the db interface change
-		return archive.Create(app.DataDir(), tempPath, exclude...)
+	createErr := app.Dao().RunInTransaction(func(dataTXDao *daos.Dao) error {
+		return app.LogsDao().RunInTransaction(func(logsTXDao *daos.Dao) error {
+			// run manual checkpoint and truncate the WAL files
+			// (errors are ignored because it is not that important and the PRAGMA may not be supported by the used driver)
+			dataTXDao.DB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+			logsTXDao.DB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+
+			return archive.Create(app.DataDir(), tempPath, exclude...)
+		})
 	})
 	if createErr != nil {
 		return createErr

core/base_test.go

@@ -1,12 +1,16 @@
 package core
 
 import (
+	"context"
+	"database/sql"
 	"fmt"
 	"log/slog"
 	"os"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/migrations"
 	"github.com/pocketbase/pocketbase/migrations/logs"
@@ -15,6 +19,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/migrate"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestNewBaseApp(t *testing.T) {
@@ -281,7 +286,7 @@ func TestBaseAppLoggerWrites(t *testing.T) {
 	}
 	defer cleanup()
 
-	threshold := 200
+	const logsThreshold = 200
 
 	totalLogs := func(app App, t *testing.T) int {
 		var total int
@@ -294,24 +299,22 @@ func TestBaseAppLoggerWrites(t *testing.T) {
 		return total
 	}
 
-	// disabled logs retention
-	{
+	t.Run("disabled logs retention", func(t *testing.T) {
 		app.Settings().Logs.MaxDays = 0
 
-		for i := 0; i < threshold+1; i++ {
+		for i := 0; i < logsThreshold+1; i++ {
 			app.Logger().Error("test")
 		}
 
 		if total := totalLogs(app, t); total != 0 {
 			t.Fatalf("Expected no logs, got %d", total)
 		}
-	}
+	})
 
-	// test batch logs writes
-	{
+	t.Run("test batch logs writes", func(t *testing.T) {
 		app.Settings().Logs.MaxDays = 1
 
-		for i := 0; i < threshold-1; i++ {
+		for i := 0; i < logsThreshold-1; i++ {
 			app.Logger().Error("test")
 		}
 
@@ -325,16 +328,102 @@ func TestBaseAppLoggerWrites(t *testing.T) {
 		// should be added for the next batch write
 		app.Logger().Error("test")
 
-		if total := totalLogs(app, t); total != threshold {
-			t.Fatalf("Expected %d logs, got %d", threshold, total)
+		if total := totalLogs(app, t); total != logsThreshold {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold, total)
 		}
 
 		// wait for ~3 secs to check the timer trigger
 		time.Sleep(3200 * time.Millisecond)
-		if total := totalLogs(app, t); total != threshold+1 {
-			t.Fatalf("Expected %d logs, got %d", threshold+1, total)
+		if total := totalLogs(app, t); total != logsThreshold+1 {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold+1, total)
 		}
-	}
+	})
+
+	t.Run("test batch logs delete", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 2
+
+		deleteQueries := 0
+
+		// reset
+		app.Store().Set("lastLogsDeletedAt", time.Now())
+		if err := app.LogsDao().DeleteOldLogs(time.Now()); err != nil {
+			t.Fatal(err)
+		}
+
+		db := app.LogsDao().NonconcurrentDB().(*dbx.DB)
+		db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+			if strings.Contains(sql, "DELETE") {
+				deleteQueries++
+			}
+		}
+
+		// trigger batch write (A)
+		expectedLogs := logsThreshold
+		for i := 0; i < expectedLogs; i++ {
+			app.Logger().Error("testA")
+		}
+
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write A] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		// mark the A inserted logs as 2-day expired
+		aExpiredDate, err := types.ParseDateTime(time.Now().AddDate(0, 0, -2))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = app.LogsDao().NonconcurrentDB().NewQuery("UPDATE _logs SET created={:date}, updated={:date}").Bind(dbx.Params{
+			"date": aExpiredDate.String(),
+		}).Execute()
+		if err != nil {
+			t.Fatalf("Failed to mock logs timestamp fields: %v", err)
+		}
+
+		// simulate recently deleted logs
+		app.Store().Set("lastLogsDeletedAt", time.Now().Add(-5*time.Hour))
+
+		// trigger batch write (B)
+		for i := 0; i < logsThreshold; i++ {
+			app.Logger().Error("testB")
+		}
+
+		expectedLogs = 2 * logsThreshold
+
+		// note: even though there are expired logs it shouldn't perform the delete operation because of the lastLogsDeledAt time
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write B] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		// mark the B inserted logs as 1-day expired to ensure that they will not be deleted
+		bExpiredDate, err := types.ParseDateTime(time.Now().AddDate(0, 0, -1))
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = app.LogsDao().NonconcurrentDB().NewQuery("UPDATE _logs SET created={:date}, updated={:date} where message='testB'").Bind(dbx.Params{
+			"date": bExpiredDate.String(),
+		}).Execute()
+		if err != nil {
+			t.Fatalf("Failed to mock logs timestamp fields: %v", err)
+		}
+
+		// should trigger delete on the next batch write
+		app.Store().Set("lastLogsDeletedAt", time.Now().Add(-6*time.Hour))
+
+		// trigger batch write (C)
+		for i := 0; i < logsThreshold; i++ {
+			app.Logger().Error("testC")
+		}
+
+		expectedLogs = 2 * logsThreshold // only B and C logs should remain
+
+		if total := totalLogs(app, t); total != expectedLogs {
+			t.Fatalf("[batch write C] Expected %d logs, got %d", expectedLogs, total)
+		}
+
+		if deleteQueries != 1 {
+			t.Fatalf("Expected DeleteOldLogs to be called %d, got %d", 1, deleteQueries)
+		}
+	})
 }
 
 func TestBaseAppRefreshSettingsLoggerMinLevelEnabled(t *testing.T) {

core/collections_cache.go

@@ -0,0 +1,72 @@
+package core
+
+// -------------------------------------------------------------------
+// This is a small optimization ported from the [ongoing refactoring branch](https://github.com/pocketbase/pocketbase/discussions/4355).
+//
+// @todo remove after the refactoring is finalized.
+// -------------------------------------------------------------------
+
+import (
+	"strings"
+
+	"github.com/pocketbase/pocketbase/models"
+)
+
+const storeCachedCollectionsKey = "@cachedCollectionsContext"
+
+func registerCachedCollectionsAppHooks(app App) {
+	collectionsChangeFunc := func(e *ModelEvent) error {
+		if _, ok := e.Model.(*models.Collection); !ok {
+			return nil
+		}
+
+		_ = ReloadCachedCollections(app)
+
+		return nil
+	}
+	app.OnModelAfterCreate().Add(collectionsChangeFunc)
+	app.OnModelAfterUpdate().Add(collectionsChangeFunc)
+	app.OnModelAfterDelete().Add(collectionsChangeFunc)
+	app.OnBeforeServe().Add(func(e *ServeEvent) error {
+		_ = ReloadCachedCollections(e.App)
+		return nil
+	})
+}
+
+func ReloadCachedCollections(app App) error {
+	collections := []*models.Collection{}
+
+	err := app.Dao().CollectionQuery().All(&collections)
+	if err != nil {
+		return err
+	}
+
+	app.Store().Set(storeCachedCollectionsKey, collections)
+
+	return nil
+}
+
+func FindCachedCollectionByNameOrId(app App, nameOrId string) (*models.Collection, error) {
+	// retrieve from the app cache
+	// ---
+	collections, _ := app.Store().Get(storeCachedCollectionsKey).([]*models.Collection)
+	for _, c := range collections {
+		if strings.EqualFold(c.Name, nameOrId) || c.Id == nameOrId {
+			return c, nil
+		}
+	}
+
+	// retrieve from the database
+	// ---
+	found, err := app.Dao().FindCollectionByNameOrId(nameOrId)
+	if err != nil {
+		return nil, err
+	}
+
+	err = ReloadCachedCollections(app)
+	if err != nil {
+		app.Logger().Warn("Failed to reload collections cache", "error", err)
+	}
+
+	return found, nil
+}

daos/admin.go

@@ -59,7 +59,7 @@ func (dao *Dao) FindAdminByToken(token string, baseTokenKey string) (*models.Adm
 	// check required claims
 	id, _ := unverifiedClaims["id"].(string)
 	if id == "" {
-		return nil, errors.New("Missing or invalid token claims.")
+		return nil, errors.New("missing or invalid token claims")
 	}
 
 	admin, err := dao.FindAdminById(id)
@@ -116,7 +116,7 @@ func (dao *Dao) DeleteAdmin(admin *models.Admin) error {
 	}
 
 	if total == 1 {
-		return errors.New("You cannot delete the only existing admin.")
+		return errors.New("you cannot delete the only existing admin")
 	}
 
 	return dao.Delete(admin)

daos/base.go

@@ -119,9 +119,9 @@ func (dao *Dao) FindById(m models.Model, id string) error {
 }
 
 type afterCallGroup struct {
-	Action   string
-	EventDao *Dao
 	Model    models.Model
+	EventDao *Dao
+	Action   string
 }
 
 // RunInTransaction wraps fn into a transaction.
@@ -169,19 +169,19 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 
 			if dao.AfterCreateFunc != nil {
 				txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"create", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "create"})
 					return nil
 				}
 			}
 			if dao.AfterUpdateFunc != nil {
 				txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"update", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "update"})
 					return nil
 				}
 			}
 			if dao.AfterDeleteFunc != nil {
 				txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) error {
-					afterCalls = append(afterCalls, afterCallGroup{"delete", eventDao, m})
+					afterCalls = append(afterCalls, afterCallGroup{m, eventDao, "delete"})
 					return nil
 				}
 			}

daos/collection.go

@@ -121,7 +121,7 @@ func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeI
 // - is referenced as part of a relation field in another collection
 func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 	if collection.System {
-		return fmt.Errorf("System collection %q cannot be deleted.", collection.Name)
+		return fmt.Errorf("system collection %q cannot be deleted", collection.Name)
 	}
 
 	// ensure that there aren't any existing references.
@@ -135,7 +135,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 		for ref := range result {
 			names = append(names, ref.Name)
 		}
-		return fmt.Errorf("The collection %q has external relation field references (%s).", collection.Name, strings.Join(names, ", "))
+		return fmt.Errorf("the collection %q has external relation field references (%s)", collection.Name, strings.Join(names, ", "))
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
@@ -152,7 +152,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 
 		// trigger views resave to check for dependencies
 		if err := txDao.resaveViewsWithChangedSchema(collection.Id); err != nil {
-			return fmt.Errorf("The collection has a view dependency - %w", err)
+			return fmt.Errorf("the collection has a view dependency - %w", err)
 		}
 
 		return txDao.Delete(collection)
@@ -227,7 +227,7 @@ func (dao *Dao) ImportCollections(
 	afterSync func(txDao *Dao, mappedImported, mappedExisting map[string]*models.Collection) error,
 ) error {
 	if len(importedCollections) == 0 {
-		return errors.New("No collections to import")
+		return errors.New("no collections to import")
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
@@ -285,7 +285,7 @@ func (dao *Dao) ImportCollections(
 				}
 
 				if existing.System {
-					return fmt.Errorf("System collection %q cannot be deleted.", existing.Name)
+					return fmt.Errorf("system collection %q cannot be deleted", existing.Name)
 				}
 
 				// delete the related records table or view

daos/record.go

@@ -40,16 +40,16 @@ func (dao *Dao) RecordQuery(collectionModelOrIdentifier any) *dbx.SelectQuery {
 		collection, collectionErr = dao.FindCollectionByNameOrId(c)
 		if collection != nil {
 			tableName = collection.Name
-		} else {
-			// update with some fake table name for easier debugging
-			tableName = "@@__missing_" + c
 		}
 	default:
-		// update with some fake table name for easier debugging
-		tableName = "@@__invalidCollectionModelOrIdentifier"
 		collectionErr = errors.New("unsupported collection identifier, must be collection model, id or name")
 	}
 
+	// update with some fake table name for easier debugging
+	if tableName == "" {
+		tableName = "@@__invalidCollectionModelOrIdentifier"
+	}
+
 	selectCols := fmt.Sprintf("%s.*", dao.DB().QuoteSimpleColumnName(tableName))
 
 	query := dao.DB().Select(selectCols).From(tableName)
@@ -430,7 +430,7 @@ func (dao *Dao) FindAuthRecordByToken(token string, baseTokenKey string) (*model
 	}
 
 	if !record.Collection().IsAuth() {
-		return nil, errors.New("The token is not associated to an auth collection record.")
+		return nil, errors.New("the token is not associated to an auth collection record")
 	}
 
 	verificationKey := record.TokenKey() + baseTokenKey
@@ -584,6 +584,8 @@ func (dao *Dao) CanAccessRecord(record *models.Record, requestInfo *models.Reque
 // If record.IsNew() is true, the method will perform a create, otherwise an update.
 // To explicitly mark a record for update you can use record.MarkAsNotNew().
 func (dao *Dao) SaveRecord(record *models.Record) error {
+	var needToDeleteExternalAuths bool
+
 	if record.Collection().IsAuth() {
 		if record.Username() == "" {
 			return errors.New("unable to save auth record without username")
@@ -604,9 +606,44 @@ func (dao *Dao) SaveRecord(record *models.Record) error {
 				return errors.New("the auth record ID must be unique across all auth collections")
 			}
 		}
+
+		if !record.IsNew() && record.Verified() {
+			lastSavedRecord, err := dao.FindRecordById(record.Collection().Id, record.Id)
+			if err != nil {
+				return err
+			}
+
+			// in case upgrading from "unverified" -> "verified" mark all pre-existing OAuth2 links
+			// for deletion since there is no reliable way to verify that they weren't created by an attacker
+			if !lastSavedRecord.Verified() && record.Verified() {
+				needToDeleteExternalAuths = true
+			}
+		}
 	}
 
-	return dao.Save(record)
+	if !needToDeleteExternalAuths {
+		return dao.Save(record)
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		externalAuths, err := txDao.FindAllExternalAuthsByRecord(record)
+		if err != nil {
+			return err
+		}
+		if len(externalAuths) > 0 {
+			// delete all pre-existing external auths
+			for _, ea := range externalAuths {
+				if err := txDao.DeleteExternalAuth(ea); err != nil {
+					return err
+				}
+			}
+
+			// force refresh tokens reset (if not already)
+			record.RefreshTokenKey()
+		}
+
+		return txDao.Save(record)
+	})
 }
 
 // DeleteRecord deletes the provided Record model.

daos/record_table_sync.go

@@ -37,6 +37,7 @@ func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldColle
 				cols[schema.FieldNamePasswordHash] = "TEXT NOT NULL"
 				cols[schema.FieldNameLastResetSentAt] = "TEXT DEFAULT '' NOT NULL"
 				cols[schema.FieldNameLastVerificationSentAt] = "TEXT DEFAULT '' NOT NULL"
+				cols[schema.FieldNameLastLoginAlertSentAt] = "TEXT DEFAULT '' NOT NULL"
 			}
 
 			// ensure that the new collection has an id

daos/record_table_sync_test.go

@@ -83,7 +83,7 @@ func TestSyncRecordTableSchema(t *testing.T) {
 			[]string{
 				"id", "created", "updated", "test",
 				"username", "email", "verified", "emailVisibility",
-				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt",
+				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt", "lastLoginAlertSentAt",
 			},
 			4,
 		},

daos/view.go

@@ -462,9 +462,9 @@ type identifiersParser struct {
 
 func (p *identifiersParser) parse(selectQuery string) error {
 	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
-	str = joinReplaceRegex.ReplaceAllString(str, " _join_ ")
-	str = discardReplaceRegex.ReplaceAllString(str, " _discard_ ")
 	str = commentsReplaceRegex.ReplaceAllString(str, "")
+	str = joinReplaceRegex.ReplaceAllString(str, " __pb_join__ ")
+	str = discardReplaceRegex.ReplaceAllString(str, " __pb_discard__ ")
 
 	tk := tokenizer.NewFromString(str)
 	tk.Separators(',', ' ', '\n', '\t')
@@ -499,7 +499,7 @@ func (p *identifiersParser) parse(selectQuery string) error {
 			skip = false
 			partType = "from"
 			activeBuilder = &fromParts
-		case "_join_":
+		case "__pb_join__":
 			skip = false
 
 			// the previous part was also a join
@@ -509,7 +509,7 @@ func (p *identifiersParser) parse(selectQuery string) error {
 
 			partType = "join"
 			activeBuilder = &joinParts
-		case "_discard_":
+		case "__pb_discard__":
 			// skip following tokens
 			skip = true
 		default:

daos/view_test.go

@@ -248,11 +248,21 @@ func TestCreateViewSchema(t *testing.T) {
 			`
 				select
 				-- test single line
-				id,
-				text,
+				demo1.id,
+				demo1.text,
 				/* multi
 					line comment */
-				url, created, updated from demo1
+				demo1.url, demo1.created, demo2.updated from demo1
+				-- comment before join
+				join demo2 ON (
+					-- comment inside join
+					demo2.id = demo1.id
+				)
+				-- comment before where
+				where (
+					-- comment inside where
+					demo2.id = demo1.id
+				)
 			`,
 			false,
 			map[string]string{

forms/realtime_subscribe.go

@@ -19,5 +19,9 @@ func NewRealtimeSubscribe() *RealtimeSubscribe {
 func (form *RealtimeSubscribe) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.ClientId, validation.Required, validation.Length(1, 255)),
+		validation.Field(&form.Subscriptions,
+			validation.Length(0, 1000),
+			validation.Each(validation.Length(0, 2500)),
+		),
 	)
 }

forms/realtime_subscribe_test.go

@@ -1,33 +1,96 @@
 package forms_test
 
 import (
+	"encoding/json"
+	"fmt"
 	"strings"
 	"testing"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
 )
 
 func TestRealtimeSubscribeValidate(t *testing.T) {
 	t.Parallel()
 
-	scenarios := []struct {
-		clientId    string
-		expectError bool
-	}{
-		{"", true},
-		{strings.Repeat("a", 256), true},
-		{"test", false},
+	validSubscriptionsLimit := make([]string, 1000)
+	for i := 0; i < len(validSubscriptionsLimit); i++ {
+		validSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
+	}
+	invalidSubscriptionsLimit := make([]string, 1001)
+	for i := 0; i < len(invalidSubscriptionsLimit); i++ {
+		invalidSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
 	}
 
-	for i, s := range scenarios {
-		form := forms.NewRealtimeSubscribe()
-		form.ClientId = s.clientId
+	scenarios := []struct {
+		name           string
+		data           string
+		expectedErrors []string
+	}{
+		{
+			"empty data",
+			`{}`,
+			[]string{"clientId"},
+		},
+		{
+			"clientId > max chars limit",
+			`{"clientId":"` + strings.Repeat("a", 256) + `"}`,
+			[]string{"clientId"},
+		},
+		{
+			"clientId <= max chars limit",
+			`{"clientId":"` + strings.Repeat("a", 255) + `"}`,
+			[]string{},
+		},
+		{
+			"total subscriptions > max limit",
+			`{"clientId":"test", "subscriptions":[` + strings.Join(invalidSubscriptionsLimit, ",") + `]}`,
+			[]string{"subscriptions"},
+		},
+		{
+			"total subscriptions <= max limit",
+			`{"clientId":"test", "subscriptions":[` + strings.Join(validSubscriptionsLimit, ",") + `]}`,
+			[]string{},
+		},
+		{
+			"single subscription > max limit",
+			`{"clientId":"test", "subscriptions":["abc", "` + strings.Repeat("a", 2501) + `"]}`,
+			[]string{"subscriptions"},
+		},
+		{
+			"single subscription <= max limit",
+			`{"clientId":"test", "subscriptions":["abc", "` + strings.Repeat("a", 2500) + `"]}`,
+			[]string{},
+		},
+	}
 
-		err := form.Validate()
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			form := forms.NewRealtimeSubscribe()
 
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
-		}
+			err := json.Unmarshal([]byte(s.data), &form)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			result := form.Validate()
+
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
+				return
+			}
+
+			// check errors
+			if len(errs) > len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got %v", s.expectedErrors, errs)
+			}
+			for _, k := range s.expectedErrors {
+				if _, ok := errs[k]; !ok {
+					t.Fatalf("Missing expected error key %q in %v", k, errs)
+				}
+			}
+		})
 	}
 }

forms/record_oauth2_login.go

@@ -129,6 +129,10 @@ func (form *RecordOAuth2Login) Submit(
 		return nil, nil, err
 	}
 
+	if form.Provider == auth.NameInstagram {
+		form.app.Logger().Warn("Instagram OAuth2 provider is deprecated and will stop working after December 4th. For more details please check https://github.com/pocketbase/pocketbase/discussions/5652.")
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -222,15 +226,11 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
 			// load custom data
 			createForm.LoadData(form.CreateData)
 
-			// load the OAuth2 profile data as fallback
-			if createForm.Email == "" {
-				createForm.Email = data.OAuth2User.Email
-			}
-			createForm.Verified = false
-			if createForm.Email == data.OAuth2User.Email {
-				// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
-				createForm.Verified = true
-			}
+			// load the OAuth2 user data
+			createForm.Email = data.OAuth2User.Email
+			createForm.Verified = true // mark as verified as long as it matches the OAuth2 data (even if the email is empty)
+
+			// generate a random password if not explicitly set
 			if createForm.Password == "" {
 				createForm.Password = security.RandomString(30)
 				createForm.PasswordConfirm = createForm.Password
@@ -247,6 +247,40 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
 				return err
 			}
 		} else {
+			isLoggedAuthRecord := form.loggedAuthRecord != nil &&
+				form.loggedAuthRecord.Id == data.Record.Id &&
+				form.loggedAuthRecord.Collection().Id == data.Record.Collection().Id
+
+			// set random password for users with unverified email
+			// (this is in case a malicious actor has registered via password using the user email)
+			if !isLoggedAuthRecord && data.Record.Email() != "" && !data.Record.Verified() {
+				data.Record.SetPassword(security.RandomString(30))
+				if err := txDao.SaveRecord(data.Record); err != nil {
+					return err
+				}
+			}
+
+			// prevent pre-hijacking with different OAuth2 provider
+			//
+			// delete all other previous OAuth2 record links for the cases
+			// when the user was precreated by malicious OAuth2 auth with custom payload data
+			//
+			// while this would be also done automatically on unverified -> verified upgrade,
+			// doing it manually here ensures that a single unverified record could have
+			// max 1 OAuth2 link to prevent further abuse when mixed with other auth flows
+			if !data.Record.Verified() {
+				externalAuths, err := txDao.FindAllExternalAuthsByRecord(data.Record)
+				if err != nil {
+					return err
+				}
+				for _, ea := range externalAuths {
+					if err := txDao.DeleteExternalAuth(ea); err != nil {
+						return err
+					}
+				}
+				data.ExternalAuth = nil // clear to allow recreate below
+			}
+
 			// update the existing auth record empty email if the data.OAuth2User has one
 			// (this is in case previously the auth record was created
 			// with an OAuth2 provider that didn't return an email address)

forms/record_upsert.go

@@ -756,6 +756,8 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 
 		dao := form.dao.Clone()
 
+		var uploaded []string
+
 		// upload new files (if any)
 		//
 		// note: executed after the default BeforeCreateFunc and BeforeUpdateFunc hook actions
@@ -765,7 +767,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		dao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 			newAction := func() error {
 				if m.TableName() == form.record.TableName() && m.GetId() == form.record.GetId() {
-					if err := form.processFilesToUpload(); err != nil {
+					var err error
+					uploaded, err = form.processFilesToUpload()
+					if err != nil {
 						return err
 					}
 				}
@@ -783,7 +787,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 		dao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 			newAction := func() error {
 				if m.TableName() == form.record.TableName() && m.GetId() == form.record.GetId() {
-					if err := form.processFilesToUpload(); err != nil {
+					var err error
+					uploaded, err = form.processFilesToUpload()
+					if err != nil {
 						return err
 					}
 				}
@@ -801,6 +807,9 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 
 		// persist the record model
 		if err := dao.SaveRecord(form.record); err != nil {
+			// cleanup - try to delete only the successfully uploaded files
+			form.deleteFilesByNamesList(uploaded)
+
 			return form.prepareError(err)
 		}
 
@@ -819,30 +828,30 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc[*models.Record]
 	}, interceptors...)
 }
 
-func (form *RecordUpsert) processFilesToUpload() error {
+func (form *RecordUpsert) processFilesToUpload() ([]string, error) {
 	if len(form.filesToUpload) == 0 {
-		return nil // no parsed file fields
+		return nil, nil // no parsed file fields
 	}
 
 	if !form.record.HasId() {
-		return errors.New("the record doesn't have an id")
+		return nil, errors.New("the record doesn't have an id")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	fsys, err := form.app.NewFilesystem()
 	if err != nil {
-		return err
+		return nil, err
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	var uploadErrors []error // list of upload errors
-	var uploaded []string    // list of uploaded file paths
+	var uploaded []string    // list of uploaded file names
 
 	for fieldKey := range form.filesToUpload {
 		for i, file := range form.filesToUpload[fieldKey] {
 			path := form.record.BaseFilesPath() + "/" + file.Name
-			if err := fs.UploadFile(file, path); err == nil {
+			if err := fsys.UploadFile(file, path); err == nil {
 				// keep track of the already uploaded file
-				uploaded = append(uploaded, path)
+				uploaded = append(uploaded, file.Name)
 			} else {
 				// store the upload error
 				uploadErrors = append(uploadErrors, fmt.Errorf("file %d: %v", i, err))
@@ -854,10 +863,10 @@ func (form *RecordUpsert) processFilesToUpload() error {
 		// cleanup - try to delete the successfully uploaded files (if any)
 		form.deleteFilesByNamesList(uploaded)
 
-		return fmt.Errorf("failed to upload all files: %v", uploadErrors)
+		return nil, fmt.Errorf("failed to upload all files: %v", uploadErrors)
 	}
 
-	return nil
+	return uploaded, nil
 }
 
 func (form *RecordUpsert) processFilesToDelete() (err error) {
@@ -876,24 +885,28 @@ func (form *RecordUpsert) deleteFilesByNamesList(filenames []string) ([]string,
 		return filenames, errors.New("the record doesn't have an id")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	isNew := form.record.IsNew()
+
+	baseDir := form.record.BaseFilesPath()
+
+	fsys, err := form.app.NewFilesystem()
 	if err != nil {
 		return filenames, err
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
 	var deleteErrors []error
 
 	for i := len(filenames) - 1; i >= 0; i-- {
 		filename := filenames[i]
-		path := form.record.BaseFilesPath() + "/" + filename
+		path := baseDir + "/" + filename
 
-		if err := fs.Delete(path); err == nil {
+		if err := fsys.Delete(path); err == nil {
 			// remove the deleted file from the list
 			filenames = append(filenames[:i], filenames[i+1:]...)
 
 			// try to delete the related file thumbs (if any)
-			fs.DeletePrefix(form.record.BaseFilesPath() + "/thumbs_" + filename + "/")
+			fsys.DeletePrefix(baseDir + "/thumbs_" + filename + "/")
 		} else {
 			// store the delete error
 			deleteErrors = append(deleteErrors, fmt.Errorf("file %d: %v", i, err))
@@ -904,6 +917,11 @@ func (form *RecordUpsert) deleteFilesByNamesList(filenames []string) ([]string,
 		return filenames, fmt.Errorf("failed to delete all files: %v", deleteErrors)
 	}
 
+	// cleanup empty dir for new records if there are no other files
+	if isNew && fsys.IsEmptyDir(baseDir) {
+		_ = fsys.Delete(baseDir)
+	}
+
 	return filenames, nil
 }
 

forms/record_upsert_test.go

@@ -619,6 +619,94 @@ func TestRecordUpsertSubmitInterceptors(t *testing.T) {
 	}
 }
 
+func TestRecordUpsertSubmitFailureFilesCleanup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.Dao().FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// ensure that there is a unique index constraint
+	collection.Indexes = append(collection.Indexes, `CREATE UNIQUE INDEX "idx_unique_demo3_title" on "demo3" ("title")`)
+	if err := app.Dao().SaveCollection(collection); err != nil {
+		t.Fatal(err)
+	}
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test1"), "new_test1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test1"), "new_test2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	uploadedFiles := []string{f1.Name, f2.Name}
+
+	existing, err := app.Dao().FindRecordById(collection.Id, "mk5fmymtx4wsprk")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		recordId string
+	}{
+		{""},
+		{"7nwo8tuiatetxdm"},
+		{"1tmknxy2868d869"},
+	}
+
+	for _, s := range scenarios {
+		sname := s.recordId
+		if sname == "" {
+			sname = "new"
+		}
+
+		t.Run(sname, func(t *testing.T) {
+			var originalFiles []string
+
+			var record *models.Record
+			if s.recordId == "" {
+				record = models.NewRecord(collection)
+			} else {
+				record, err = app.Dao().FindRecordById(collection.Id, s.recordId)
+				if err != nil {
+					t.Fatal(err)
+				}
+				originalFiles = record.GetStringSlice("files")
+			}
+
+			record.Set("title", existing.GetString("title"))
+
+			form := forms.NewRecordUpsert(app, record)
+
+			form.AddFiles("files", f1, f2)
+
+			err := form.Submit()
+			if err == nil {
+				t.Fatal("Expected form submit to fail")
+			}
+
+			// ensure that the original files still exists
+			for _, name := range originalFiles {
+				if !hasRecordFile(app, record, name) {
+					t.Fatalf("Missing original file %q", name)
+				}
+			}
+
+			// ensure that the new uploaded files were deleted
+			for _, name := range uploadedFiles {
+				if hasRecordFile(app, record, name) {
+					t.Fatalf("Expected file %q to be deleted", name)
+				}
+			}
+		})
+	}
+}
+
 func TestRecordUpsertWithCustomId(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/validators/record_data.go

@@ -2,6 +2,7 @@ package validators
 
 import (
 	"fmt"
+	"math"
 	"net/url"
 	"regexp"
 	"strings"
@@ -159,6 +160,10 @@ func (validator *RecordDataValidator) checkNumberValue(field *schema.SchemaField
 		return nil // nothing to check (skip zero-defaults)
 	}
 
+	if math.IsInf(val, 0) || math.IsNaN(val) {
+		return validation.NewError("validation_nan", "The submitted number is not properly formatted")
+	}
+
 	options, _ := field.Options.(*schema.NumberOptions)
 
 	if options.NoDecimal && val != float64(int64(val)) {

forms/validators/record_data_test.go

@@ -248,6 +248,16 @@ func TestRecordDataValidatorValidateNumber(t *testing.T) {
 			nil,
 			[]string{"field2"},
 		},
+		{
+			"(number) check infinities and NaN",
+			map[string]any{
+				"field1": "Inf",
+				"field2": "-Inf",
+				"field4": "NaN",
+			},
+			nil,
+			[]string{"field1", "field2", "field4"},
+		},
 		{
 			"(number) check min constraint",
 			map[string]any{

go.mod

@@ -1,95 +1,86 @@
 module github.com/pocketbase/pocketbase
 
-go 1.21
+go 1.25.0
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/aws/aws-sdk-go-v2 v1.25.2
-	github.com/aws/aws-sdk-go-v2/config v1.27.4
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.4
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.51.1
-	github.com/aws/smithy-go v1.20.1
+	github.com/aws/aws-sdk-go-v2 v1.32.6
+	github.com/aws/aws-sdk-go-v2/config v1.28.6
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.47
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0
+	github.com/aws/smithy-go v1.22.1
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.6.2
-	github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d
-	github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c
-	github.com/fatih/color v1.16.0
+	github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3
+	github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc
+	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/gabriel-vasile/mimetype v1.4.3
-	github.com/ganigeorgiev/fexpr v0.4.0
+	github.com/gabriel-vasile/mimetype v1.4.7
+	github.com/ganigeorgiev/fexpr v0.4.1
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
-	github.com/goccy/go-json v0.10.2
-	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/goccy/go-json v0.10.4
+	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/labstack/echo/v5 v5.0.0-20230722203903-ec5b858dab61
-	github.com/mattn/go-sqlite3 v1.14.22
-	github.com/pocketbase/dbx v1.10.1
-	github.com/pocketbase/tygoja v0.0.0-20240113091827-17918475d342
-	github.com/spf13/cast v1.6.0
-	github.com/spf13/cobra v1.8.0
-	gocloud.dev v0.36.0
-	golang.org/x/crypto v0.19.0
-	golang.org/x/net v0.21.0
-	golang.org/x/oauth2 v0.17.0
-	golang.org/x/sync v0.6.0
-	modernc.org/sqlite v1.29.2
+	github.com/mattn/go-sqlite3 v1.14.24
+	github.com/pocketbase/dbx v1.11.0
+	github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75
+	github.com/spf13/cast v1.7.1
+	github.com/spf13/cobra v1.8.1
+	gocloud.dev v0.40.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/net v0.50.0
+	golang.org/x/oauth2 v0.24.0
+	golang.org/x/sync v0.19.0
+	modernc.org/sqlite v1.48.2
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go v1.50.25 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.2 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.1 // indirect
-	github.com/dlclark/regexp2 v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.24.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 // indirect
+	github.com/dlclark/regexp2 v1.11.4 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/google/wire v0.6.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
-	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/image v0.15.0 // indirect
-	golang.org/x/mod v0.15.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.18.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/api v0.167.0 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c // indirect
-	google.golang.org/grpc v1.62.0 // indirect
-	google.golang.org/protobuf v1.32.0 // indirect
-	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
-	modernc.org/libc v1.41.0 // indirect
-	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.7.2 // indirect
-	modernc.org/strutil v1.2.0 // indirect
-	modernc.org/token v1.1.0 // indirect
+	golang.org/x/image v0.23.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
+	google.golang.org/api v0.213.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241216192217-9240e9c98484 // indirect
+	google.golang.org/grpc v1.69.2 // indirect
+	google.golang.org/protobuf v1.36.0 // indirect
+	modernc.org/libc v1.70.0 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -1,70 +1,72 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
-cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
-cloud.google.com/go/compute v1.23.4 h1:EBT9Nw4q3zyE7G45Wvv3MzolIrCJEuHys5muLY0wvAw=
-cloud.google.com/go/compute v1.23.4/go.mod h1:/EJMj55asU6kAFnuZET8zqgwgJ9FvXWXOkkfQZa4ioI=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
-cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
-cloud.google.com/go/storage v1.35.1 h1:B59ahL//eDfx2IIKFBeT5Atm9wnNmj3+8xG/W4WB//w=
-cloud.google.com/go/storage v1.35.1/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
+cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
+cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
+cloud.google.com/go/auth v0.13.0 h1:8Fu8TZy167JkW8Tj3q7dIkr2v4cndv41ouecJx0PAHs=
+cloud.google.com/go/auth v0.13.0/go.mod h1:COOjD9gwfKNKz+IIduatIhYJQIc0mG3H102r/EMxX6Q=
+cloud.google.com/go/auth/oauth2adapt v0.2.6 h1:V6a6XDu2lTwPZWOawrAa9HUK+DB2zfJyTuciBG5hFkU=
+cloud.google.com/go/auth/oauth2adapt v0.2.6/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
+cloud.google.com/go/iam v1.1.13 h1:7zWBXG9ERbMLrzQBRhFliAV+kjcRToDTgQT3CTwYyv4=
+cloud.google.com/go/iam v1.1.13/go.mod h1:K8mY0uSXwEXS30KrnVb+j54LB/ntfZu1dr+4zFMNbus=
+cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyXFs=
+cloud.google.com/go/storage v1.43.0/go.mod h1:ajvxEa7WmZS1PxvKRq4bq0tFT3vMd502JwstCcYv0Q0=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.50.25 h1:vhiHtLYybv1Nhx3Kv18BBC6L0aPJHaG9aeEsr92W99c=
-github.com/aws/aws-sdk-go v1.50.25/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/aws/aws-sdk-go-v2 v1.25.2 h1:/uiG1avJRgLGiQM9X3qJM8+Qa6KRGK5rRPuXE0HUM+w=
-github.com/aws/aws-sdk-go-v2 v1.25.2/go.mod h1:Evoc5AsmtveRt1komDwIsjHFyrP5tDuF1D1U+6z6pNo=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1 h1:gTK2uhtAPtFcdRRJilZPx8uJLL2J85xK11nKtWL0wfU=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.1/go.mod h1:sxpLb+nZk7tIfCWChfd+h4QwHNUR57d8hA1cleTkjJo=
-github.com/aws/aws-sdk-go-v2/config v1.27.4 h1:AhfWb5ZwimdsYTgP7Od8E9L1u4sKmDW2ZVeLcf2O42M=
-github.com/aws/aws-sdk-go-v2/config v1.27.4/go.mod h1:zq2FFXK3A416kiukwpsd+rD4ny6JC7QSkp4QdN1Mp2g=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.4 h1:h5Vztbd8qLppiPwX+y0Q6WiwMZgpd9keKe2EAENgAuI=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.4/go.mod h1:+30tpwrkOgvkJL1rUZuRLoxcJwtI/OkeBLYnHxJtVe0=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.2 h1:AK0J8iYBFeUk2Ax7O8YpLtFsfhdOByh2QIkHmigpRYk=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.15.2/go.mod h1:iRlGzMix0SExQEviAyptRWRGdYNo3+ufW/lCzvKVTUc=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.6 h1:prcsGA3onmpc7ea1W/m+SMj4uOn5vZ63uJp805UhJJs=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.6/go.mod h1:7eQrvATnVFDY0WfMYhfKkSQ1YtZlClT71fAAlsA1s34=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.2 h1:bNo4LagzUKbjdxE0tIcR9pMzLR2U/Tgie1Hq1HQ3iH8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.2/go.mod h1:wRQv0nN6v9wDXuWThpovGQjqF1HFdcgWjporw14lS8k=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.2 h1:EtOU5jsPdIQNP+6Q2C5e3d65NKT1PeCiQk+9OdzO12Q=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.2/go.mod h1:tyF5sKccmDz0Bv4NrstEr+/9YkSPJHrcO7UsUKf7pWM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.2 h1:en92G0Z7xlksoOylkUhuBSfJgijC7rHVLRdnIlHEs0E=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.2/go.mod h1:HgtQ/wN5G+8QSlK62lbOtNwQ3wTSByJ4wH2rCkPt+AE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 h1:EyBZibRTVAs6ECHZOw5/wlylS9OcTzwyjeQMudmREjE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1/go.mod h1:JKpmtYhhPs7D97NL/ltqz7yCkERFW5dOlHyVl66ZYF8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.2 h1:zSdTXYLwuXDNPUS+V41i1SFDXG7V0ITp0D9UT9Cvl18=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.2/go.mod h1:v8m8k+qVy95nYi7d56uP1QImleIIY25BPiNJYzPBdFE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.2 h1:5ffmXjPtwRExp1zc7gENLgCPyHFbhEPwVTkTiH9niSk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.2/go.mod h1:Ru7vg1iQ7cR4i7SZ/JTLYN9kaXtbL69UdgG0OQWQxW0=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.2 h1:1oY1AVEisRI4HNuFoLdRUB0hC63ylDAN6Me3MrfclEg=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.2/go.mod h1:KZ03VgvZwSjkT7fOetQ/wF3MZUvYFirlI1H5NklUNsY=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.51.1 h1:juZ+uGargZOrQGNxkVHr9HHR/0N+Yu8uekQnV7EAVRs=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.51.1/go.mod h1:SoR0c7Jnq8Tpmt0KSLXIavhjmaagRqQpe9r70W3POJg=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.1 h1:utEGkfdQ4L6YW/ietH7111ZYglLJvS+sLriHJ1NBJEQ=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.1/go.mod h1:RsYqzYr2F2oPDdpy+PdhephuZxTfjHQe7SOBcZGoAU8=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.1 h1:9/GylMS45hGGFCcMrUZDVayQE1jYSIN6da9jo7RAYIw=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.1/go.mod h1:YjAPFn4kGFqKC54VsHs5fn5B6d+PCY2tziEa3U/GB5Y=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.1 h1:3I2cBEYgKhrWlwyZgfpSO2BpaMY1LHPqXYk/QGlu2ew=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.1/go.mod h1:uQ7YYKZt3adCRrdCBREm1CD3efFLOUNH77MrUCvx5oA=
-github.com/aws/smithy-go v1.20.1 h1:4SZlSlMr36UEqC7XOyRVb27XMeZubNcBNN+9IgEPIQw=
-github.com/aws/smithy-go v1.20.1/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
+github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/aws/aws-sdk-go-v2 v1.32.6 h1:7BokKRgRPuGmKkFMhEg/jSul+tB9VvXhcViILtfG8b4=
+github.com/aws/aws-sdk-go-v2 v1.32.6/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
+github.com/aws/aws-sdk-go-v2/config v1.28.6 h1:D89IKtGrs/I3QXOLNTH93NJYtDhm8SYa9Q5CsPShmyo=
+github.com/aws/aws-sdk-go-v2/config v1.28.6/go.mod h1:GDzxJ5wyyFSCoLkS+UhGB0dArhb9mI+Co4dHtoTxbko=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.47 h1:48bA+3/fCdi2yAwVt+3COvmatZ6jUDNkDTIsqDiMUdw=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.47/go.mod h1:+KdckOejLW3Ks3b0E3b5rHsr2f9yuORBum0WPnE5o5w=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 h1:AmoU1pziydclFT/xRV+xXE/Vb8fttJCLRPv8oAkprc0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21/go.mod h1:AjUdLYe4Tgs6kpH4Bv7uMZo7pottoyHMn4eTcIcneaY=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43 h1:iLdpkYZ4cXIQMO7ud+cqMWR1xK5ESbt1rvN77tRi1BY=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43/go.mod h1:OgbsKPAswXDd5kxnR4vZov69p3oYjbvUyIRBAAV0y9o=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 h1:s/fF4+yDQDoElYhfIVvSNyeCydfbuTKzhxSXDXCPasU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25/go.mod h1:IgPfDv5jqFIzQSNbUEMoitNooSMXjRSDkhXv8jiROvU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 h1:ZntTCl5EsYnhN/IygQEUugpdwbhdkom9uHcbCftiGgA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25/go.mod h1:DBdPrgeocww+CSl1C8cEV8PN1mHMBhuCDLpXezyvWkE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25 h1:r67ps7oHCYnflpgDy2LZU0MAQtQbYIOqNNnqGO6xQkE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25/go.mod h1:GrGY+Q4fIokYLtjCVB/aFfCVL6hhGUFl8inD18fDalE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6 h1:HCpPsWqmYQieU7SS6E9HXfdAMSud0pteVXieJmcpIRI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6/go.mod h1:ngUiVRCco++u+soRRVBIvBZxSMMvOVMXA4PJ36JLfSw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6 h1:50+XsN70RS7dwJ2CkVNXzj7U2L1HKP8nqTd3XWEXBN4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6/go.mod h1:WqgLmwY7so32kG01zD8CPTJWVWM+TzJoOVHwTg4aPug=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6 h1:BbGDtTi0T1DYlmjBiCr/le3wzhA37O8QTC5/Ab8+EXk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6/go.mod h1:hLMJt7Q8ePgViKupeymbqI0la+t9/iYFBjxQCFwuAwI=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0 h1:nyuzXooUNJexRT0Oy0UQY6AhOzxPxhtt4DcBIHyCnmw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0/go.mod h1:sT/iQz8JK3u/5gZkT+Hmr7GzVZehUMkRZpOaAwYXeGY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.7 h1:rLnYAfXQ3YAccocshIH5mzNNwZBkBo+bP6EhIxak6Hw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.7/go.mod h1:ZHtuQJ6t9A/+YDuxOLnbryAmITtr8UysSny3qcyvJTc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 h1:JnhTZR3PiYDNKlXy50/pNeix9aGMo6lLpXwJ1mw8MD4=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6/go.mod h1:URronUEGfXZN1VpdktPSD1EkAL9mfrV+2F4sjH38qOY=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 h1:s4074ZO1Hk8qv65GqNXqDjmkf4HSQqJukaLuuW0TpDA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.2/go.mod h1:mVggCnIWoM09jP71Wh+ea7+5gAp53q+49wDFs1SW5z8=
+github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
+github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.2.0/go.mod h1:9+9sk7u7pGNWYMkh0hdiL++6OeibzJccyQU4p4MedaY=
-github.com/chzyer/readline v1.5.0/go.mod h1:x22KAscuvRqlLoK9CsoYsmxoXZMMFVyOl86cAH8qUic=
-github.com/chzyer/test v0.0.0-20210722231415-061457976a23/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -72,56 +74,51 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
-github.com/dlclark/regexp2 v1.4.1-0.20201116162257-a2a8dda75c91/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
-github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2 v1.10.0 h1:+/GIL799phkJqYW+3YbOd8LCcbHzT0Pbo8zl70MHsq0=
-github.com/dlclark/regexp2 v1.10.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
+github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
-github.com/dop251/goja v0.0.0-20211022113120-dc8c55024d06/go.mod h1:R9ET47fwRVRPZnOGvHxxhuZcbrMCuiqOz3Rlrh4KSnk=
-github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d h1:wi6jN5LVt/ljaBG4ue79Ekzb12QfJ52L9Q98tl8SWhw=
-github.com/dop251/goja v0.0.0-20231027120936-b396bb4c349d/go.mod h1:QMWlm50DNe14hD7t24KEqZuUdC9sOTy8W6XbCU1mlw4=
-github.com/dop251/goja_nodejs v0.0.0-20210225215109-d91c329300e7/go.mod h1:hn7BA7c8pLvoGndExHudxTDKZ84Pyvv+90pbBjbTz0Y=
-github.com/dop251/goja_nodejs v0.0.0-20211022123610-8dd9abb0616d/go.mod h1:DngW8aVqWbuLRMHItjPUyqdj+HWPvnQe8V8y1nDpIbM=
-github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c h1:hLoodLRD4KLWIH8eyAQCLcH8EqIrjac7fCkp/fHnvuQ=
-github.com/dop251/goja_nodejs v0.0.0-20231122114759-e84d9a924c5c/go.mod h1:bhGPmCgCCTSRfiMYWjpS46IDo9EUZXlsuUaPXSWGbv0=
+github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3 h1:MXsAuToxwsTn5BEEYm2DheqIiC4jWGmkEJ1uy+KFhvQ=
+github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
+github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc h1:MKYt39yZJi0Z9xEeRmDX2L4ocE0ETKcHKw6MVL3R+co=
+github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc/go.mod h1:VULptt4Q/fNzQUJlqY/GP3qHyU7ZH46mFkBZe0ZTokU=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
-github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
-github.com/ganigeorgiev/fexpr v0.4.0 h1:ojitI+VMNZX/odeNL1x3RzTTE8qAIVvnSSYPNAnQFDI=
-github.com/ganigeorgiev/fexpr v0.4.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
+github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
+github.com/ganigeorgiev/fexpr v0.4.1 h1:hpUgbUEEWIZhSDBtf4M9aUNfQQ0BZkGRaMePy7Gcx5k=
+github.com/ganigeorgiev/fexpr v0.4.1/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
-github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
-github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
-github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
-github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
+github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -133,60 +130,41 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-replayers/grpcreplay v1.1.0 h1:S5+I3zYyZ+GQz68OfbURDdt/+cSMqCK1wrvNx7WBzTE=
-github.com/google/go-replayers/grpcreplay v1.1.0/go.mod h1:qzAvJ8/wi57zq7gWqaE6AwLM6miiXUQwP1S+I9icmhk=
-github.com/google/go-replayers/httpreplay v1.2.0 h1:VM1wEyyjaoU53BwrOnaf9VhAyQQEEioJvFYxYcLRKzk=
-github.com/google/go-replayers/httpreplay v1.2.0/go.mod h1:WahEFFZZ7a1P4VM1qEeHy+tME4bwyqPcwWbNlUI1Mcg=
-github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
-github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/pprof v0.0.0-20230207041349-798e818bf904/go.mod h1:uglQLonpP8qtYCYyzA+8c/9qtqgA3qsXGYqCPKARAFg=
-github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ=
-github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
-github.com/google/subcommands v1.2.0/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
 github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
-github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUhuHF+DA=
-github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
+github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
+github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
-github.com/ianlancetaylor/demangle v0.0.0-20220319035150-800ac71e25c2/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/labstack/echo/v5 v5.0.0-20230722203903-ec5b858dab61 h1:FwuzbVh87iLiUQj1+uQUsuw9x5t9m5n5g7rG7o4svW4=
@@ -198,30 +176,29 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
-github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
+github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocketbase/dbx v1.10.1 h1:cw+vsyfCJD8YObOVeqb93YErnlxwYMkNZ4rwN0G0AaA=
-github.com/pocketbase/dbx v1.10.1/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/tygoja v0.0.0-20240113091827-17918475d342 h1:OcAwewen3hs/zY8i0syt8CcMTGBJhQwQRVDLcoQVXVk=
-github.com/pocketbase/tygoja v0.0.0-20240113091827-17918475d342/go.mod h1:dOJ+pCyqm/jRn5kO/TX598J0e5xGDcJAZerK5atCrKI=
+github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU=
+github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75 h1:XSbmekxgmbI2uPrre/nkCz7y8VsV652TPb3hAYzPb74=
+github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
-github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -241,38 +218,37 @@ github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.48.0 h1:P+/g8GpuJGYbOp2tAdKrIPUX9JO02q8Q0YNlHolpibA=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.48.0/go.mod h1:tIKj3DbO8N9Y2xo52og3irLsPI4GW02DSMtrVgNMgxg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0 h1:doUP+ExOpH3spVTLS0FcWGLnQrPct/hD/bCPbDRUEAU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0/go.mod h1:rdENBZMT2OE6Ne/KLwpiXudnAsbdrdBaqBvTN8M8BgA=
-go.opentelemetry.io/otel v1.23.0 h1:Df0pqjqExIywbMCMTxkAwzjLZtRf+bBKLbUcpxO2C9E=
-go.opentelemetry.io/otel v1.23.0/go.mod h1:YCycw9ZeKhcJFrb34iVSkyT0iczq/zYDtZYFufObyB0=
-go.opentelemetry.io/otel/metric v1.23.0 h1:pazkx7ss4LFVVYSxYew7L5I6qvLXHA0Ap2pwV+9Cnpo=
-go.opentelemetry.io/otel/metric v1.23.0/go.mod h1:MqUW2X2a6Q8RN96E2/nqNoT+z9BSms20Jb7Bbp+HiTo=
-go.opentelemetry.io/otel/trace v1.23.0 h1:37Ik5Ib7xfYVb4V1UtnT97T1jI+AoIYkJyPkuL4iJgI=
-go.opentelemetry.io/otel/trace v1.23.0/go.mod h1:GSGTbIClEsuZrGIzoEHqsVfxgn5UkggkflQwDScNUsk=
-gocloud.dev v0.36.0 h1:q5zoXux4xkOZP473e1EZbG8Gq9f0vlg1VNH5Du/ybus=
-gocloud.dev v0.36.0/go.mod h1:bLxah6JQVKBaIxzsr5BQLYB4IYdWHkMZdzCXlo6F0gg=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 h1:r6I7RJCN86bpD/FQwedZ0vSixDpwuWREjW9oRMsmqDc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
+go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
+go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
+go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
+go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+gocloud.dev v0.40.0 h1:f8LgP+4WDqOG/RXoUcyLpeIAGOcAbZrZbDQCUee10ng=
+gocloud.dev v0.40.0/go.mod h1:drz+VyYNBvrMTW0KZiBAYEdl8lbNZx+OQ7oQvdrFmSQ=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.15.0 h1:kOELfmgrmJlw4Cdb7g/QGuB3CvDrXbqEIww/pNtNBm8=
-golang.org/x/image v0.15.0/go.mod h1:HUYqC05R2ZcZ3ejNQsIHQDQiwWM4JBqmm6MKANTp4LE=
+golang.org/x/image v0.23.0 h1:HseQ7c2OpPKTPVzNjG5fwJsOTCiiwS4QdsYi5XU6H68=
+golang.org/x/image v0.23.0/go.mod h1:wJJBTdLfCCf3tiHa1fNxpZmUI4mmoZvwMCPP0ddoNKY=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -283,23 +259,17 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.17.0 h1:6m3ZPmLEFdVxKKWnKq4VqZ60gutO35zm+zrAHVmHyDQ=
-golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
+golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
+golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -307,39 +277,25 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
+golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -347,38 +303,33 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
-golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-google.golang.org/api v0.167.0 h1:CKHrQD1BLRii6xdkatBDXyKzM0mkawt2QP+H3LtPmSE=
-google.golang.org/api v0.167.0/go.mod h1:4FcBc686KFi7QI/U51/2GKKevfZMpM17sCdibqe/bSA=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+google.golang.org/api v0.213.0 h1:KmF6KaDyFqB417T68tMPbVmmwtIXs2VB60OJKIHB0xQ=
+google.golang.org/api v0.213.0/go.mod h1:V0T5ZhNUUNpYAlL306gFZPFt5F5D/IeyLoktduYYnvQ=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 h1:9+tzLLstTlPTRyJTh+ah5wIMsBW5c4tQwGTN3thOW9Y=
-google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:mqHbVIp48Muh7Ywss/AD6I5kNVKZMmAa/QEW58Gxp2s=
-google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014 h1:x9PwdEgd11LgK+orcck69WVRo7DezSO4VUMPI4xpc8A=
-google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014/go.mod h1:rbHMSEDyoYX62nRVLOCc4Qt1HbsdytAYoVwgjiOhF3I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c h1:NUsgEN92SQQqzfA+YtqYNqYmB3DMMYLlIwUZAQFVFbo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c/go.mod h1:H4O17MA/PE9BsGx3w+a+W2VOLLD1Qf7oJneAoU6WktY=
+google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988 h1:CT2Thj5AuPV9phrYMtzX11k+XkzMGfRAet42PmoTATM=
+google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988/go.mod h1:7uvplUBj4RjHAxIZ//98LzOvrQ04JBkaixRmCMI29hc=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 h1:M0KvPgPmDZHPlbRbaNU1APr28TvwvvdUPlSv7PUvy8g=
+google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241216192217-9240e9c98484 h1:Z7FRVJPSMaHQxD0uXU8WdgFh8PseLM8Q8NzhnpMrBhQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241216192217-9240e9c98484/go.mod h1:lcTa1sDdWEIHMWlITnIczmw5w60CF9ffkb8Z+DVmmjA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
-google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
+google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -388,16 +339,10 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
+google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -405,17 +350,31 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 h1:5D53IMaUuA5InSeMu9eJtlQXS2NxAhyWQvkKEgXZhHI=
-modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6/go.mod h1:Qz0X07sNOR1jWYCrJMEnbW/X55x206Q7Vt4mz6/wHp4=
-modernc.org/libc v1.41.0 h1:g9YAc6BkKlgORsUWj+JwqoB1wU3o4DE3bM3yvA3k+Gk=
-modernc.org/libc v1.41.0/go.mod h1:w0eszPsiXoOnoMJgrXjglgLuDy/bt5RR4y3QzUUeodY=
-modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
-modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
-modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
-modernc.org/sqlite v1.29.2 h1:xgBSyA3gemwgP31PWFfFjtBorQNYpeypGdoSDjXhrgI=
-modernc.org/sqlite v1.29.2/go.mod h1:hG41jCYxOAOoO6BRK66AdRlmOcDzXf7qnwlwjUIOqa0=
-modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
-modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
+modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.48.2 h1:5CnW4uP8joZtA0LedVqLbZV5GD7F/0x91AXeSyjoh5c=
+modernc.org/sqlite v1.48.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

mails/record.go

@@ -12,6 +12,43 @@ import (
 	"github.com/pocketbase/pocketbase/tools/mailer"
 )
 
+// @todo remove after the refactoring
+//
+// SendRecordPasswordLoginAlert sends a OAuth2 password login alert to the specified auth record.
+func SendRecordPasswordLoginAlert(app core.App, authRecord *models.Record, providerNames ...string) error {
+	params := struct {
+		AppName       string
+		AppUrl        string
+		Record        *models.Record
+		ProviderNames []string
+	}{
+		AppName:       app.Settings().Meta.AppName,
+		AppUrl:        app.Settings().Meta.AppUrl,
+		Record:        authRecord,
+		ProviderNames: providerNames,
+	}
+
+	mailClient := app.NewMailClient()
+
+	// resolve body template
+	body, renderErr := resolveTemplateContent(params, templates.Layout, templates.PasswordLoginAlertBody)
+	if renderErr != nil {
+		return renderErr
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: authRecord.Email()}},
+		Subject: "Password login alert",
+		HTML:    body,
+	}
+
+	return mailClient.Send(message)
+}
+
 // SendRecordPasswordReset sends a password reset request email to the specified user.
 func SendRecordPasswordReset(app core.App, authRecord *models.Record) error {
 	token, tokenErr := tokens.NewRecordResetPasswordToken(app, authRecord)

mails/record_test.go

@@ -8,6 +8,35 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestSendRecordPasswordLoginAlert(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// ensure that action url normalization will be applied
+	testApp.Settings().Meta.AppUrl = "http://localhost:8090////"
+
+	user, _ := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+
+	err := mails.SendRecordPasswordLoginAlert(testApp, user, "test1", "test2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend)
+	}
+
+	expectedParts := []string{"using a password", "OAuth2", "test1", "test2", "auth linked"}
+
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage.HTML, part) {
+			t.Fatalf("Couldn't find %s\n in\n %s", part, testApp.TestMailer.LastMessage.HTML)
+		}
+	}
+}
+
 func TestSendRecordPasswordReset(t *testing.T) {
 	t.Parallel()
 

mails/templates/layout.go

@@ -53,7 +53,7 @@ const Layout = `
         .btn {
             display: inline-block;
             vertical-align: top;
-            border: 0;
+            border: 1px solid #e5e5e5;
             cursor: pointer;
             color: #fff !important;
             background: #16161a !important;

mails/templates/password_login_alert.go

@@ -0,0 +1,30 @@
+package templates
+
+// Available variables:
+//
+// ```
+// Record        *models.Record
+// AppName       string
+// AppUrl        string
+// ProviderNames []string
+// ```
+const PasswordLoginAlertBody = `
+{{define "content"}}
+	<p>Hello,</p>
+	<p>
+		Just to let you know that someone has logged in to your {{.AppName}} account using a password while you already have
+		OAuth2
+		{{range $index, $provider := .ProviderNames }}
+			{{if $index}}|{{end}}
+		    {{ $provider }}
+		{{ end }}
+		auth linked.
+	</p>
+	<p>If you have recently signed in with a password, you may disregard this email.</p>
+	<p><strong>If you don't recognize the above action, you should immediately change your {{.AppName}} account password.</strong></p>
+	<p>
+	  Thanks,<br/>
+	  {{.AppName}} team
+	</p>
+{{end}}
+`

migrations/1718706525_add_login_alert_column.go

@@ -0,0 +1,56 @@
+package migrations
+
+import (
+	"slices"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// adds a "lastLoginAlertSentAt" column to all auth collection tables (if not already)
+func init() {
+	AppMigrations.Register(func(db dbx.Builder) error {
+		dao := daos.New(db)
+
+		collections := []*models.Collection{}
+		err := dao.CollectionQuery().AndWhere(dbx.HashExp{"type": models.CollectionTypeAuth}).All(&collections)
+		if err != nil {
+			return err
+		}
+
+		var needToResetTokens bool
+
+		for _, c := range collections {
+			columns, err := dao.TableColumns(c.Name)
+			if err != nil {
+				return err
+			}
+			if slices.Contains(columns, schema.FieldNameLastLoginAlertSentAt) {
+				continue // already inserted
+			}
+
+			_, err = db.AddColumn(c.Name, schema.FieldNameLastLoginAlertSentAt, "TEXT DEFAULT '' NOT NULL").Execute()
+			if err != nil {
+				return err
+			}
+
+			opts := c.AuthOptions()
+			if opts.AllowOAuth2Auth && (opts.AllowEmailAuth || opts.AllowUsernameAuth) {
+				needToResetTokens = true
+			}
+		}
+
+		settings, _ := dao.FindSettings()
+		if needToResetTokens && settings != nil {
+			settings.RecordAuthToken.Secret = security.RandomString(50)
+			if err := dao.SaveSettings(settings); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, nil)
+}

models/record.go

@@ -309,7 +309,7 @@ func (m *Record) Set(key string, value any) {
 			switch key {
 			case schema.FieldNameEmailVisibility, schema.FieldNameVerified:
 				v = cast.ToBool(value)
-			case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt:
+			case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt, schema.FieldNameLastLoginAlertSentAt:
 				v, _ = types.ParseDateTime(value)
 			case schema.FieldNameUsername, schema.FieldNameEmail, schema.FieldNameTokenKey, schema.FieldNamePasswordHash:
 				v = cast.ToString(value)
@@ -347,7 +347,7 @@ func (m *Record) Get(key string) any {
 			switch key {
 			case schema.FieldNameEmailVisibility, schema.FieldNameVerified:
 				v = cast.ToBool(v)
-			case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt:
+			case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt, schema.FieldNameLastLoginAlertSentAt:
 				v, _ = types.ParseDateTime(v)
 			case schema.FieldNameUsername, schema.FieldNameEmail, schema.FieldNameTokenKey, schema.FieldNamePasswordHash:
 				v = cast.ToString(v)
@@ -685,7 +685,7 @@ func (m *Record) getNormalizeDataValueForDB(key string) any {
 		switch key {
 		case schema.FieldNameEmailVisibility, schema.FieldNameVerified:
 			return m.GetBool(key)
-		case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt:
+		case schema.FieldNameLastResetSentAt, schema.FieldNameLastVerificationSentAt, schema.FieldNameLastLoginAlertSentAt:
 			return m.GetDateTime(key)
 		case schema.FieldNameUsername, schema.FieldNameEmail, schema.FieldNameTokenKey, schema.FieldNamePasswordHash:
 			return m.GetString(key)
@@ -898,6 +898,24 @@ func (m *Record) SetLastVerificationSentAt(dateTime types.DateTime) error {
 	return nil
 }
 
+// LastLoginAlertSentAt returns the "lastLoginAlertSentAt" auth record data value.
+func (m *Record) LastLoginAlertSentAt() types.DateTime {
+	return m.GetDateTime(schema.FieldNameLastLoginAlertSentAt)
+}
+
+// SetLastLoginAlertSentAt sets an "lastLoginAlertSentAt" auth record data value.
+//
+// Returns an error if the record is not from an auth collection.
+func (m *Record) SetLastLoginAlertSentAt(dateTime types.DateTime) error {
+	if !m.collection.IsAuth() {
+		return notAuthRecordErr
+	}
+
+	m.Set(schema.FieldNameLastLoginAlertSentAt, dateTime)
+
+	return nil
+}
+
 // PasswordHash returns the "passwordHash" auth record data value.
 func (m *Record) PasswordHash() string {
 	return m.GetString(schema.FieldNamePasswordHash)

models/record_test.go

@@ -1328,7 +1328,7 @@ func TestRecordColumnValueMap(t *testing.T) {
 		},
 		{
 			models.CollectionTypeAuth,
-			`{"created":"2022-01-01 10:00:30.123Z","email":"test_email","emailVisibility":true,"field1":"test","field2":"test.png","field3":["test1","test2"],"field4":["test11","test12"],"id":"test_id","lastResetSentAt":"2022-01-02 10:00:30.123Z","lastVerificationSentAt":"","passwordHash":"test_passwordHash","tokenKey":"test_tokenKey","updated":"","username":"test_username","verified":false}`,
+			`{"created":"2022-01-01 10:00:30.123Z","email":"test_email","emailVisibility":true,"field1":"test","field2":"test.png","field3":["test1","test2"],"field4":["test11","test12"],"id":"test_id","lastLoginAlertSentAt":"","lastResetSentAt":"2022-01-02 10:00:30.123Z","lastVerificationSentAt":"","passwordHash":"test_passwordHash","tokenKey":"test_tokenKey","updated":"","username":"test_username","verified":false}`,
 		},
 	}
 
@@ -1975,6 +1975,52 @@ func TestRecordRefreshTokenKey(t *testing.T) {
 	}
 }
 
+func TestRecordLastPasswordLoginAlertSentAt(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		collectionType string
+		expectError    bool
+	}{
+		{models.CollectionTypeBase, true},
+		{models.CollectionTypeAuth, false},
+	}
+
+	testValue, err := types.ParseDateTime("2022-01-01 00:00:00.123Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for i, s := range scenarios {
+		collection := &models.Collection{Type: s.collectionType}
+		m := models.NewRecord(collection)
+
+		if s.expectError {
+			if err := m.SetLastLoginAlertSentAt(testValue); err == nil {
+				t.Errorf("(%d) Expected error, got nil", i)
+			}
+			if v := m.LastLoginAlertSentAt(); !v.IsZero() {
+				t.Fatalf("(%d) Expected empty value, got %v", i, v)
+			}
+			// verify that nothing is stored in the record data slice
+			if v := m.Get(schema.FieldNameLastLoginAlertSentAt); v != nil {
+				t.Fatalf("(%d) Didn't expect data field %q: %v", i, schema.FieldNameLastLoginAlertSentAt, v)
+			}
+		} else {
+			if err := m.SetLastLoginAlertSentAt(testValue); err != nil {
+				t.Fatalf("(%d) Expected nil, got error %v", i, err)
+			}
+			if v := m.LastLoginAlertSentAt(); v != testValue {
+				t.Fatalf("(%d) Expected %v, got %v", i, testValue, v)
+			}
+			// verify that the field is stored in the record data slice
+			if v := m.Get(schema.FieldNameLastLoginAlertSentAt); v != testValue {
+				t.Fatalf("(%d) Expected data field value %v, got %v", i, testValue, v)
+			}
+		}
+	}
+}
+
 func TestRecordLastResetSentAt(t *testing.T) {
 	t.Parallel()
 

models/schema/schema_field.go

@@ -47,6 +47,7 @@ const (
 	FieldNamePasswordHash           string = "passwordHash"
 	FieldNameLastResetSentAt        string = "lastResetSentAt"
 	FieldNameLastVerificationSentAt string = "lastVerificationSentAt"
+	FieldNameLastLoginAlertSentAt   string = "lastLoginAlertSentAt"
 )
 
 // BaseModelFieldNames returns the field names that all models have (id, created, updated).
@@ -78,6 +79,7 @@ func AuthFieldNames() []string {
 		FieldNamePasswordHash,
 		FieldNameLastResetSentAt,
 		FieldNameLastVerificationSentAt,
+		FieldNameLastLoginAlertSentAt,
 	}
 }
 

models/schema/schema_field_test.go

@@ -31,7 +31,7 @@ func TestSystemFieldNames(t *testing.T) {
 
 func TestAuthFieldNames(t *testing.T) {
 	result := schema.AuthFieldNames()
-	expected := 8
+	expected := 9
 
 	if len(result) != expected {
 		t.Fatalf("Expected %d auth field names, got %d (%v)", expected, len(result), result)

models/settings/settings.go

@@ -463,7 +463,7 @@ type BackupsConfig struct {
 	// Leave it empty to disable the auto backups functionality.
 	Cron string `form:"cron" json:"cron"`
 
-	// CronMaxKeep is the the max number of cron generated backups to
+	// CronMaxKeep is the max number of cron generated backups to
 	// keep before removing older entries.
 	//
 	// This field works only when the cron config has valid cron expression.
@@ -653,7 +653,7 @@ func (c AuthProviderConfig) Validate() error {
 // SetupProvider loads the current AuthProviderConfig into the specified provider.
 func (c AuthProviderConfig) SetupProvider(provider auth.Provider) error {
 	if !c.Enabled {
-		return errors.New("The provider is not enabled.")
+		return errors.New("the provider is not enabled")
 	}
 
 	if c.ClientId != "" {

plugins/ghupdate/ghupdate.go

@@ -164,6 +164,11 @@ func (p *plugin) update(withBackup bool) error {
 		return nil
 	}
 
+	if compareVersions(strings.TrimPrefix(latest.Tag, "v"), "0.23.0") <= 0 {
+		color.Green("%s contains breaking changes and cannot be updated directly from v0.22.x. Please check the releases CHANGELOG for more details.", latest.Tag)
+		return nil
+	}
+
 	suffix := archiveSuffix(runtime.GOOS, runtime.GOARCH)
 	if suffix == "" {
 		return errors.New("unsupported platform")

plugins/ghupdate/ghupdate_test.go

@@ -21,6 +21,7 @@ func TestCompareVersions(t *testing.T) {
 		{"0.0.2", "0.0.1", -1},
 		{"0.16.2", "0.17.0", 1},
 		{"1.15.0", "0.16.1", -1},
+		{"1.2.9", "1.2.10", 1},
 		{"3.2", "4.0", 1},
 		{"3.2.4", "3.2.3", -1},
 	}

plugins/jsvm/binds.go

@@ -38,6 +38,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
 	"github.com/spf13/cobra"
 )
 
@@ -60,7 +61,7 @@ func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 
 		// register the hook to the loader
 		loader.Set(jsName, func(callback string, tags ...string) {
-			pr := goja.MustCompile("", "{("+callback+").apply(undefined, __args)}", true)
+			pr := goja.MustCompile(defaultScriptPath, "{("+callback+").apply(undefined, __args)}", true)
 
 			tagsAsValues := make([]reflect.Value, len(tags))
 			for i, tag := range tags {
@@ -113,7 +114,7 @@ func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 	var wasServeTriggered bool
 
 	loader.Set("cronAdd", func(jobId, cronExpr, handler string) {
-		pr := goja.MustCompile("", "{("+handler+").apply(undefined)}", true)
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler+").apply(undefined)}", true)
 
 		err := scheduler.Add(jobId, cronExpr, func() {
 			err := executors.run(func(executor *goja.Runtime) error {
@@ -122,7 +123,7 @@ func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 			})
 
 			if err != nil {
-				app.Logger().Debug(
+				app.Logger().Error(
 					"[cronAdd] failed to execute cron job",
 					slog.String("jobId", jobId),
 					slog.String("error", err.Error()),
@@ -214,7 +215,7 @@ func wrapHandler(executors *vmsPool, handler goja.Value) (echo.HandlerFunc, erro
 		// "native" handler - no need to wrap
 		return h, nil
 	case func(goja.FunctionCall) goja.Value, string:
-		pr := goja.MustCompile("", "{("+handler.String()+").apply(undefined, __args)}", true)
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler.String()+").apply(undefined, __args)}", true)
 
 		wrappedHandler := func(c echo.Context) error {
 			return executors.run(func(executor *goja.Runtime) error {
@@ -252,7 +253,7 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]echo.M
 			// "native" middleware - no need to wrap
 			wrappedMiddlewares[i] = v
 		case func(goja.FunctionCall) goja.Value, string:
-			pr := goja.MustCompile("", "{(("+m.String()+").apply(undefined, __args)).apply(undefined, __args2)}", true)
+			pr := goja.MustCompile(defaultScriptPath, "{(("+m.String()+").apply(undefined, __args)).apply(undefined, __args2)}", true)
 
 			wrappedMiddlewares[i] = func(next echo.HandlerFunc) echo.HandlerFunc {
 				return func(c echo.Context) error {
@@ -300,6 +301,34 @@ func baseBinds(vm *goja.Runtime) {
 		return string(bodyBytes), nil
 	})
 
+	vm.Set("toString", func(raw any, maxReaderBytes int) (string, error) {
+		switch v := raw.(type) {
+		case io.Reader:
+			if maxReaderBytes == 0 {
+				maxReaderBytes = rest.DefaultMaxMemory
+			}
+
+			limitReader := io.LimitReader(v, int64(maxReaderBytes))
+
+			bodyBytes, readErr := io.ReadAll(limitReader)
+			if readErr != nil {
+				return "", readErr
+			}
+
+			return string(bodyBytes), nil
+		default:
+			str, err := cast.ToStringE(v)
+			if err == nil {
+				return str, nil
+			}
+
+			// as a last attempt try to json encode the value
+			rawBytes, _ := json.Marshal(raw)
+
+			return string(rawBytes), nil
+		}
+	})
+
 	vm.Set("sleep", func(milliseconds int64) {
 		time.Sleep(time.Duration(milliseconds) * time.Millisecond)
 	})
@@ -534,6 +563,16 @@ func filesystemBinds(vm *goja.Runtime) {
 	obj.Set("fileFromPath", filesystem.NewFileFromPath)
 	obj.Set("fileFromBytes", filesystem.NewFileFromBytes)
 	obj.Set("fileFromMultipart", filesystem.NewFileFromMultipart)
+	obj.Set("fileFromUrl", func(url string, secTimeout int) (*filesystem.File, error) {
+		if secTimeout == 0 {
+			secTimeout = 120
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(secTimeout)*time.Second)
+		defer cancel()
+
+		return filesystem.NewFileFromUrl(ctx, url)
+	})
 }
 
 func filepathBinds(vm *goja.Runtime) {
@@ -640,34 +679,61 @@ func httpClientBinds(vm *goja.Runtime) {
 	obj := vm.NewObject()
 	vm.Set("$http", obj)
 
+	vm.Set("FormData", func(call goja.ConstructorCall) *goja.Object {
+		instance := FormData{}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
 	type sendResult struct {
-		StatusCode int                     `json:"statusCode"`
+		Json       any                     `json:"json"`
 		Headers    map[string][]string     `json:"headers"`
 		Cookies    map[string]*http.Cookie `json:"cookies"`
 		Raw        string                  `json:"raw"`
-		Json       any                     `json:"json"`
+		StatusCode int                     `json:"statusCode"`
 	}
 
 	type sendConfig struct {
+		// Deprecated: consider using Body instead
+		Data map[string]any
+
+		Body    any // raw string or FormData
+		Headers map[string]string
 		Method  string
 		Url     string
-		Body    string
-		Headers map[string]string
-		Timeout int            // seconds (default to 120)
-		Data    map[string]any // deprecated, consider using Body instead
+		Timeout int // seconds (default to 120)
 	}
 
 	obj.Set("send", func(params map[string]any) (*sendResult, error) {
-		rawParams, err := json.Marshal(params)
-		if err != nil {
-			return nil, err
-		}
-
 		config := sendConfig{
 			Method: "GET",
 		}
-		if err := json.Unmarshal(rawParams, &config); err != nil {
-			return nil, err
+
+		if v, ok := params["data"]; ok {
+			config.Data = cast.ToStringMap(v)
+		}
+
+		if v, ok := params["body"]; ok {
+			config.Body = v
+		}
+
+		if v, ok := params["headers"]; ok {
+			config.Headers = cast.ToStringMapString(v)
+		}
+
+		if v, ok := params["method"]; ok {
+			config.Method = cast.ToString(v)
+		}
+
+		if v, ok := params["url"]; ok {
+			config.Url = cast.ToString(v)
+		}
+
+		if v, ok := params["timeout"]; ok {
+			config.Timeout = cast.ToInt(v)
 		}
 
 		if config.Timeout <= 0 {
@@ -678,6 +744,7 @@ func httpClientBinds(vm *goja.Runtime) {
 		defer cancel()
 
 		var reqBody io.Reader
+		var contentType string
 
 		// legacy json body data
 		if len(config.Data) != 0 {
@@ -686,10 +753,19 @@ func httpClientBinds(vm *goja.Runtime) {
 				return nil, err
 			}
 			reqBody = bytes.NewReader(encoded)
-		}
+		} else {
+			switch v := config.Body.(type) {
+			case FormData:
+				body, mp, err := v.toMultipart()
+				if err != nil {
+					return nil, err
+				}
 
-		if config.Body != "" {
-			reqBody = strings.NewReader(config.Body)
+				reqBody = body
+				contentType = mp.FormDataContentType()
+			default:
+				reqBody = strings.NewReader(cast.ToString(config.Body))
+			}
 		}
 
 		req, err := http.NewRequestWithContext(ctx, strings.ToUpper(config.Method), config.Url, reqBody)
@@ -701,7 +777,15 @@ func httpClientBinds(vm *goja.Runtime) {
 			req.Header.Add(k, v)
 		}
 
-		// set default content-type header (if missing)
+		// set the explicit content type
+		// (overwriting the user provided header value if any)
+		if contentType != "" {
+			req.Header.Set("content-type", contentType)
+		}
+
+		// @todo consider removing during the refactoring
+		//
+		// fallback to json content-type
 		if req.Header.Get("content-type") == "" {
 			req.Header.Set("content-type", "application/json")
 		}

plugins/jsvm/binds_test.go

@@ -2,6 +2,7 @@ package jsvm
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"mime/multipart"
 	"net/http"
@@ -46,7 +47,7 @@ func TestBaseBindsCount(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 
-	testBindsCount(vm, "this", 17, t)
+	testBindsCount(vm, "this", 18, t)
 }
 
 func TestBaseBindsSleep(t *testing.T) {
@@ -91,6 +92,41 @@ func TestBaseBindsReaderToString(t *testing.T) {
 	}
 }
 
+func TestBaseBindsToString(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("scenarios", []struct {
+		Name     string
+		Value    any
+		Expected string
+	}{
+		{"null", nil, ""},
+		{"string", "test", "test"},
+		{"number", -12.4, "-12.4"},
+		{"bool", true, "true"},
+		{"arr", []int{1, 2, 3}, `[1,2,3]`},
+		{"obj", map[string]any{"test": 123}, `{"test":123}`},
+		{"reader", strings.NewReader("test"), "test"},
+		{"struct", struct {
+			Name    string
+			private string
+		}{Name: "123", private: "456"}, `{"Name":"123"}`},
+	})
+
+	_, err := vm.RunString(`
+		for (let s of scenarios) {
+			let result = toString(s.value)
+
+			if (result != s.expected) {
+				throw new Error('[' + s.name + '] Expected string ' + s.expected + ', got ' + result);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestBaseBindsCookie(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -890,13 +926,23 @@ func TestFilesystemBinds(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/error" {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		fmt.Fprintf(w, "test")
+	}))
+	defer srv.Close()
+
 	vm := goja.New()
 	vm.Set("mh", &multipart.FileHeader{Filename: "test"})
 	vm.Set("testFile", filepath.Join(app.DataDir(), "data.db"))
+	vm.Set("baseUrl", srv.URL)
 	baseBinds(vm)
 	filesystemBinds(vm)
 
-	testBindsCount(vm, "$filesystem", 3, t)
+	testBindsCount(vm, "$filesystem", 4, t)
 
 	// fileFromPath
 	{
@@ -939,6 +985,28 @@ func TestFilesystemBinds(t *testing.T) {
 			t.Fatalf("[fileFromMultipart] Expected file with name %q, got %v", file.OriginalName, file)
 		}
 	}
+
+	// fileFromUrl (success)
+	{
+		v, err := vm.RunString(`$filesystem.fileFromUrl(baseUrl + "/test")`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, _ := v.Export().(*filesystem.File)
+
+		if file == nil || file.OriginalName != "test" {
+			t.Fatalf("[fileFromUrl] Expected file with name %q, got %v", file.OriginalName, file)
+		}
+	}
+
+	// fileFromUrl (failure)
+	{
+		_, err := vm.RunString(`$filesystem.fileFromUrl(baseUrl + "/error")`)
+		if err == nil {
+			t.Fatal("Expected url fetch error")
+		}
+	}
 }
 
 func TestFormsBinds(t *testing.T) {
@@ -1121,6 +1189,7 @@ func TestHttpClientBindsCount(t *testing.T) {
 	vm := goja.New()
 	httpClientBinds(vm)
 
+	testBindsCount(vm, "this", 2, t) // + FormData
 	testBindsCount(vm, "$http", 1, t)
 }
 
@@ -1223,6 +1292,15 @@ func TestHttpClientBindsSend(t *testing.T) {
 			headers: {"content-type": "text/plain"},
 		})
 
+		// with FormData
+		const formData = new FormData()
+		formData.append("title", "123")
+		const test3 = $http.send({
+			url: testUrl,
+			body: formData,
+			headers: {"content-type": "text/plain"}, // should be ignored
+		})
+
 		const scenarios = [
 			[test0, {
 				"statusCode": "400",
@@ -1244,6 +1322,18 @@ func TestHttpClientBindsSend(t *testing.T) {
 				"json.method":               "GET",
 				"json.headers.content_type": "text/plain",
 			}],
+			[test3, {
+				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
+				"json.method":               "GET",
+				"json.body": [
+					"\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\n123\r\n--",
+				],
+				"json.headers.content_type": [
+					"multipart/form-data; boundary="
+				],
+			}],
 		]
 
 		for (let scenario of scenarios) {
@@ -1251,8 +1341,20 @@ func TestHttpClientBindsSend(t *testing.T) {
 			const expectations = scenario[1];
 
 			for (let key in expectations) {
-				if (getNestedVal(result, key) != expectations[key]) {
-					throw new Error('Expected ' + key + ' ' + expectations[key] + ', got: ' + result.raw);
+				const value = getNestedVal(result, key);
+				const expectation = expectations[key]
+				if (Array.isArray(expectation)) {
+					// check for partial match(es)
+					for (let exp of expectation) {
+						if (!value.includes(exp)) {
+							throw new Error('Expected ' + key + ' to contain ' + exp + ', got: ' + result.raw);
+						}
+					}
+				} else {
+					// check for direct match
+					if (value != expectation) {
+						throw new Error('Expected ' + key + ' ' + expectation + ', got: ' + result.raw);
+					}
 				}
 			}
 		}

plugins/jsvm/form_data.go

@@ -0,0 +1,149 @@
+package jsvm
+
+import (
+	"bytes"
+	"io"
+	"mime/multipart"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/spf13/cast"
+)
+
+// FormData represents an interface similar to the browser's [FormData].
+//
+// The value of each FormData entry must be a string or [*filesystem.File] instance.
+//
+// It is intended to be used together with the JSVM `$http.send` when
+// sending multipart/form-data requests.
+//
+// [FormData]: https://developer.mozilla.org/en-US/docs/Web/API/FormData.
+type FormData map[string][]any
+
+// Append appends a new value onto an existing key inside the current FormData,
+// or adds the key if it does not already exist.
+func (data FormData) Append(key string, value any) {
+	data[key] = append(data[key], value)
+}
+
+// Set sets a new value for an existing key inside the current FormData,
+// or adds the key/value if it does not already exist.
+func (data FormData) Set(key string, value any) {
+	data[key] = []any{value}
+}
+
+// Delete deletes a key and its value(s) from the current FormData.
+func (data FormData) Delete(key string) {
+	delete(data, key)
+}
+
+// Get returns the first value associated with a given key from
+// within the current FormData.
+//
+// If you expect multiple values and want all of them,
+// use the [FormData.GetAll] method instead.
+func (data FormData) Get(key string) any {
+	values, ok := data[key]
+	if !ok || len(values) == 0 {
+		return nil
+	}
+
+	return values[0]
+}
+
+// GetAll returns all the values associated with a given key
+// from within the current FormData.
+func (data FormData) GetAll(key string) []any {
+	values, ok := data[key]
+	if !ok {
+		return nil
+	}
+
+	return values
+}
+
+// Has returns whether a FormData object contains a certain key.
+func (data FormData) Has(key string) bool {
+	values, ok := data[key]
+
+	return ok && len(values) > 0
+}
+
+// Keys returns all keys contained in the current FormData.
+func (data FormData) Keys() []string {
+	result := make([]string, 0, len(data))
+
+	for k := range data {
+		result = append(result, k)
+	}
+
+	return result
+}
+
+// Keys returns all values contained in the current FormData.
+func (data FormData) Values() []any {
+	result := make([]any, 0, len(data))
+
+	for _, values := range data {
+		for _, v := range values {
+			result = append(result, v)
+		}
+	}
+
+	return result
+}
+
+// Entries returns a [key, value] slice pair for each FormData entry.
+func (data FormData) Entries() [][]any {
+	result := make([][]any, 0, len(data))
+
+	for k, values := range data {
+		for _, v := range values {
+			result = append(result, []any{k, v})
+		}
+	}
+
+	return result
+}
+
+// toMultipart converts the current FormData entries into multipart encoded data.
+func (data FormData) toMultipart() (*bytes.Buffer, *multipart.Writer, error) {
+	body := new(bytes.Buffer)
+
+	mp := multipart.NewWriter(body)
+	defer mp.Close()
+
+	for k, values := range data {
+		for _, rawValue := range values {
+			switch v := rawValue.(type) {
+			case *filesystem.File:
+				err := func() error {
+					mpw, err := mp.CreateFormFile(k, v.OriginalName)
+					if err != nil {
+						return err
+					}
+
+					file, err := v.Reader.Open()
+					if err != nil {
+						return err
+					}
+					defer file.Close()
+
+					if _, err := io.Copy(mpw, file); err != nil {
+						return err
+					}
+
+					return nil
+				}()
+				if err != nil {
+					return nil, nil, err
+				}
+			default:
+				if err := mp.WriteField(k, cast.ToString(v)); err != nil {
+					return nil, nil, err
+				}
+			}
+		}
+	}
+
+	return body, mp, nil
+}

plugins/jsvm/form_data_test.go

@@ -0,0 +1,225 @@
+package jsvm
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestFormDataAppendAndSet(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	data.Append("b", 3)
+	data.Append("b", 4)
+	data.Set("b", 5) // should overwrite the previous 2 calls
+
+	data.Set("c", 6)
+	data.Set("c", 7)
+
+	if len(data["a"]) != 2 {
+		t.Fatalf("Expected 2 'a' values, got %v", data["a"])
+	}
+	if data["a"][0] != 1 || data["a"][1] != 2 {
+		t.Fatalf("Expected 1 and 2 'a' key values, got %v", data["a"])
+	}
+
+	if len(data["b"]) != 1 {
+		t.Fatalf("Expected 1 'b' values, got %v", data["b"])
+	}
+	if data["b"][0] != 5 {
+		t.Fatalf("Expected 5 as 'b' key value, got %v", data["b"])
+	}
+
+	if len(data["c"]) != 1 {
+		t.Fatalf("Expected 1 'c' values, got %v", data["c"])
+	}
+	if data["c"][0] != 7 {
+		t.Fatalf("Expected 7 as 'c' key value, got %v", data["c"])
+	}
+}
+
+func TestFormDataDelete(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+	data.Append("b", 3)
+
+	data.Delete("missing") // should do nothing
+	data.Delete("a")
+
+	if len(data) != 1 {
+		t.Fatalf("Expected exactly 1 data remaining key, got %v", data)
+	}
+
+	if data["b"][0] != 3 {
+		t.Fatalf("Expected 3 as 'b' key value, got %v", data["b"])
+	}
+}
+
+func TestFormDataGet(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	if v := data.Get("missing"); v != nil {
+		t.Fatalf("Expected %v for key 'missing', got %v", nil, v)
+	}
+
+	if v := data.Get("a"); v != 1 {
+		t.Fatalf("Expected %v for key 'a', got %v", 1, v)
+	}
+}
+
+func TestFormDataGetAll(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	if v := data.GetAll("missing"); v != nil {
+		t.Fatalf("Expected %v for key 'a', got %v", nil, v)
+	}
+
+	values := data.GetAll("a")
+	if len(values) != 2 || values[0] != 1 || values[1] != 2 {
+		t.Fatalf("Expected 1 and 2 values, got %v", values)
+	}
+}
+
+func TestFormDataHas(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+
+	if v := data.Has("missing"); v {
+		t.Fatalf("Expected key 'missing' to not exist: %v", v)
+	}
+
+	if v := data.Has("a"); !v {
+		t.Fatalf("Expected key 'a' to exist: %v", v)
+	}
+}
+
+func TestFormDataKeys(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 1)
+	data.Append("c", 1)
+	data.Append("a", 1)
+
+	keys := data.Keys()
+
+	expectedKeys := []string{"a", "b", "c"}
+
+	for _, expected := range expectedKeys {
+		if !list.ExistInSlice(expected, keys) {
+			t.Fatalf("Expected key %s to exists in %v", expected, keys)
+		}
+	}
+}
+
+func TestFormDataValues(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 2)
+	data.Append("c", 3)
+	data.Append("a", 4)
+
+	values := data.Values()
+
+	expectedKeys := []any{1, 2, 3, 4}
+
+	for _, expected := range expectedKeys {
+		if !list.ExistInSlice(expected, values) {
+			t.Fatalf("Expected key %s to exists in %v", expected, values)
+		}
+	}
+}
+
+func TestFormDataEntries(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 2)
+	data.Append("c", 3)
+	data.Append("a", 4)
+
+	entries := data.Entries()
+
+	rawEntries, err := json.Marshal(entries)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(entries) != 4 {
+		t.Fatalf("Expected 4 entries")
+	}
+
+	expectedEntries := []string{`["a",1]`, `["a",4]`, `["b",2]`, `["c",3]`}
+	for _, expected := range expectedEntries {
+		if !bytes.Contains(rawEntries, []byte(expected)) {
+			t.Fatalf("Expected entry %s to exists in %s", expected, rawEntries)
+		}
+	}
+}
+
+func TestFormDataToMultipart(t *testing.T) {
+	t.Parallel()
+
+	f, err := filesystem.NewFileFromBytes([]byte("abc"), "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	data := FormData{}
+	data.Append("a", 1) // should be casted
+	data.Append("b", "test1")
+	data.Append("b", "test2")
+	data.Append("c", f)
+
+	body, mp, err := data.toMultipart()
+	if err != nil {
+		t.Fatal(err)
+	}
+	bodyStr := body.String()
+
+	// content type checks
+	contentType := mp.FormDataContentType()
+	expectedContentType := "multipart/form-data; boundary="
+	if !strings.Contains(contentType, expectedContentType) {
+		t.Fatalf("Expected to find content-type %s in %s", expectedContentType, contentType)
+	}
+
+	// body checks
+	expectedBodyParts := []string{
+		"Content-Disposition: form-data; name=\"a\"\r\n\r\n1",
+		"Content-Disposition: form-data; name=\"b\"\r\n\r\ntest1",
+		"Content-Disposition: form-data; name=\"b\"\r\n\r\ntest2",
+		"Content-Disposition: form-data; name=\"c\"; filename=\"test\"\r\nContent-Type: application/octet-stream\r\n\r\nabc",
+	}
+	for _, part := range expectedBodyParts {
+		if !strings.Contains(bodyStr, part) {
+			t.Fatalf("Expected to find %s in body\n%s", part, bodyStr)
+		}
+	}
+}

plugins/jsvm/internal/types/types.go

@@ -96,7 +96,7 @@ declare function routerAdd(
  * ` + "```" + `js
  * routerUse((next) => {
  *     return (c) => {
- *         console.log(c.Path())
+ *         console.log(c.path())
  *         return next(c)
  *     }
  * })
@@ -194,22 +194,34 @@ declare var $app: PocketBase
 declare var $template: template.Registry
 
 /**
- * readerToString reads the content of the specified io.Reader until
- * EOF or maxBytes are reached.
+ * This method is superseded by toString.
  *
- * If maxBytes is not specified it will read up to 32MB.
+ * @deprecated
+ * @group PocketBase
+ */
+declare function readerToString(reader: any, maxBytes?: number): string;
+
+/**
+ * toString stringifies the specified value.
  *
- * Note that after this call the reader can't be used anymore.
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have explicit string representation are json serialized.
  *
  * Example:
  *
  * ` + "```" + `js
- * const rawBody = readerToString(c.request().body)
+ * // io.Reader
+ * const ex1 = toString(e.request.body)
+ *
+ * // slice of bytes ("hello")
+ * const ex2 = toString([104 101 108 108 111])
  * ` + "```" + `
  *
  * @group PocketBase
  */
-declare function readerToString(reader: any, maxBytes?: number): string;
+declare function toString(val: any, maxBytes?: number): string;
 
 /**
  * sleep pauses the current goroutine for at least the specified user duration (in ms).
@@ -641,6 +653,22 @@ declare namespace $filesystem {
   let fileFromPath:      filesystem.newFileFromPath
   let fileFromBytes:     filesystem.newFileFromBytes
   let fileFromMultipart: filesystem.newFileFromMultipart
+
+  /**
+   * fileFromUrl creates a new File from the provided url by
+   * downloading the resource and creating a BytesReader.
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * // with default max timeout of 120sec
+   * const file1 = $filesystem.fileFromUrl("https://...")
+   *
+   * // with custom timeout of 15sec
+   * const file2 = $filesystem.fileFromUrl("https://...", 15)
+   * ` + "```" + `
+   */
+  export function fileFromUrl(url: string, secTimeout?: number): filesystem.File
 }
 
 // -------------------------------------------------------------------
@@ -697,7 +725,7 @@ declare namespace $os {
    * const cmd = $os.cmd('ls', '-sl')
    *
    * // execute the command and return its standard output as string
-   * const output = String.fromCharCode(...cmd.output());
+   * const output = toString(cmd.output());
    * ` + "```" + `
    */
   export let cmd: exec.command
@@ -988,6 +1016,12 @@ declare namespace $apis {
 // httpClientBinds
 // -------------------------------------------------------------------
 
+// extra FormData overload to prevent TS warnings when used with non File/Blob value.
+interface FormData {
+  append(key:string, value:any): void
+  set(key:string, value:any): void
+}
+
 /**
  * ` + "`" + `$http` + "`" + ` defines common methods for working with HTTP requests.
  *
@@ -1002,7 +1036,7 @@ declare namespace $http {
    * ` + "```" + `js
    * const res = $http.send({
    *     url:    "https://example.com",
-   *     data:   {"title": "test"}
+   *     body:   JSON.stringify({"title": "test"})
    *     method: "post",
    * })
    *
@@ -1015,7 +1049,7 @@ declare namespace $http {
    */
   function send(config: {
     url:      string,
-    body?:    string,
+    body?:    string|FormData,
     method?:  string, // default to "GET"
     headers?: { [key:string]: string },
     timeout?: number, // default to 120

plugins/jsvm/jsvm.go

@@ -35,9 +35,25 @@ import (
 	"github.com/pocketbase/pocketbase/tools/template"
 )
 
-const (
-	typesFileName = "types.d.ts"
-)
+const typesFileName = "types.d.ts"
+
+var defaultScriptPath = "pb.js"
+
+func init() {
+	// For backward compatibility and consistency with the Go exposed
+	// methods that accept relative paths (e.g. `$os.writeFile`),
+	// we define the "current JS module" as if it is a file in the current working directory
+	// (the filename itself doesn't really matter and in our case the hook handlers are executed as separate "programs").
+	//
+	// This is necessary for `require(module)` to properly traverse parents node_modules (goja_nodejs#95).
+	cwd, err := os.Getwd()
+	if err != nil {
+		// truly rare case, log just for debug purposes
+		color.Yellow("Failed to retrieve the current working directory: %v", err)
+	} else {
+		defaultScriptPath = filepath.Join(cwd, defaultScriptPath)
+	}
+}
 
 // Config defines the config options of the jsvm plugin.
 type Config struct {
@@ -187,7 +203,7 @@ func (p *plugin) registerMigrations() error {
 			p.config.OnInit(vm)
 		}
 
-		_, err := vm.RunString(string(content))
+		_, err := vm.RunScript(defaultScriptPath, string(content))
 		if err != nil {
 			return fmt.Errorf("failed to run migration %s: %w", file, err)
 		}
@@ -224,7 +240,7 @@ func (p *plugin) registerHooks() error {
 	// initialize the hooks dir watcher
 	if p.config.HooksWatch {
 		if err := p.watchHooks(); err != nil {
-			return err
+			color.Yellow("Unable to init hooks watcher: %v", err)
 		}
 	}
 
@@ -301,7 +317,7 @@ func (p *plugin) registerHooks() error {
 				}
 			}()
 
-			_, err := loader.RunString(string(content))
+			_, err := loader.RunScript(defaultScriptPath, string(content))
 			if err != nil {
 				panic(err)
 			}
@@ -344,13 +360,23 @@ func (p *plugin) normalizeServeExceptions(oldErrorHandler echo.HTTPErrorHandler)
 //
 // This method does nothing if the hooks directory is missing.
 func (p *plugin) watchHooks() error {
-	if _, err := os.Stat(p.config.HooksDir); err != nil {
+	watchDir := p.config.HooksDir
+
+	hooksDirInfo, err := os.Lstat(p.config.HooksDir)
+	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			return nil // no hooks dir to watch
 		}
 		return err
 	}
 
+	if hooksDirInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
+		watchDir, err = filepath.EvalSymlinks(p.config.HooksDir)
+		if err != nil {
+			return fmt.Errorf("failed to resolve hooksDir symlink: %w", err)
+		}
+	}
+
 	watcher, err := fsnotify.NewWatcher()
 	if err != nil {
 		return err
@@ -409,9 +435,9 @@ func (p *plugin) watchHooks() error {
 	// add directories to watch
 	//
 	// @todo replace once recursive watcher is added (https://github.com/fsnotify/fsnotify/issues/18)
-	dirsErr := filepath.Walk(p.config.HooksDir, func(path string, info fs.FileInfo, err error) error {
-		// ignore hidden directories and node_modules
-		if !info.IsDir() || info.Name() == "node_modules" || strings.HasPrefix(info.Name(), ".") {
+	dirsErr := filepath.WalkDir(watchDir, func(path string, entry fs.DirEntry, err error) error {
+		// ignore hidden directories, node_modules, symlinks, sockets, etc.
+		if !entry.IsDir() || entry.Name() == "node_modules" || strings.HasPrefix(entry.Name(), ".") {
 			return nil
 		}
 

plugins/migratecmd/migratecmd_test.go

@@ -532,19 +532,23 @@ func init() {
 		collection.DeleteRule = nil
 
 		options := map[string]any{}
-		json.Unmarshal([]byte(` + "`" + `{}` + "`" + `), &options)
+		if err := json.Unmarshal([]byte(` + "`" + `{}` + "`" + `), &options); err != nil {
+			return err
+		}
 		collection.SetOptions(options)
 
-		json.Unmarshal([]byte(` + "`" + `[
+		if err := json.Unmarshal([]byte(` + "`" + `[
 			"create index test1 on test456_update (f1_name)"
-		]` + "`" + `), &collection.Indexes)
+		]` + "`" + `), &collection.Indexes); err != nil {
+			return err
+		}
 
 		// remove
 		collection.Schema.RemoveField("f3_id")
 
 		// add
 		new_f4_name := &schema.SchemaField{}
-		json.Unmarshal([]byte(` + "`" + `{
+		if err := json.Unmarshal([]byte(` + "`" + `{
 			"system": false,
 			"id": "f4_id",
 			"name": "f4_name",
@@ -557,12 +561,14 @@ func init() {
 				"max": null,
 				"pattern": ` + "\"` + \"`\" + `test backtick` + \"`\" + `123\"" + `
 			}
-		}` + "`" + `), new_f4_name)
+		}` + "`" + `), new_f4_name); err != nil {
+			return err
+		}
 		collection.Schema.AddField(new_f4_name)
 
 		// update
 		edit_f2_name_new := &schema.SchemaField{}
-		json.Unmarshal([]byte(` + "`" + `{
+		if err := json.Unmarshal([]byte(` + "`" + `{
 			"system": false,
 			"id": "f2_id",
 			"name": "f2_name_new",
@@ -575,7 +581,9 @@ func init() {
 				"max": null,
 				"noDecimal": false
 			}
-		}` + "`" + `), edit_f2_name_new)
+		}` + "`" + `), edit_f2_name_new); err != nil {
+			return err
+		}
 		collection.Schema.AddField(edit_f2_name_new)
 
 		return dao.SaveCollection(collection)
@@ -600,7 +608,7 @@ func init() {
 		collection.DeleteRule = types.Pointer("id = \"3\"")
 
 		options := map[string]any{}
-		json.Unmarshal([]byte(` + "`" + `{
+		if err := json.Unmarshal([]byte(` + "`" + `{
 			"allowEmailAuth": false,
 			"allowOAuth2Auth": false,
 			"allowUsernameAuth": false,
@@ -610,16 +618,20 @@ func init() {
 			"onlyEmailDomains": null,
 			"onlyVerified": false,
 			"requireEmail": false
-		}` + "`" + `), &options)
+		}` + "`" + `), &options); err != nil {
+			return err
+		}
 		collection.SetOptions(options)
 
-		json.Unmarshal([]byte(` + "`" + `[
+		if err := json.Unmarshal([]byte(` + "`" + `[
 			"create index test1 on test456 (f1_name)"
-		]` + "`" + `), &collection.Indexes)
+		]` + "`" + `), &collection.Indexes); err != nil {
+			return err
+		}
 
 		// add
 		del_f3_name := &schema.SchemaField{}
-		json.Unmarshal([]byte(` + "`" + `{
+		if err := json.Unmarshal([]byte(` + "`" + `{
 			"system": false,
 			"id": "f3_id",
 			"name": "f3_name",
@@ -628,7 +640,9 @@ func init() {
 			"presentable": false,
 			"unique": false,
 			"options": {}
-		}` + "`" + `), del_f3_name)
+		}` + "`" + `), del_f3_name); err != nil {
+			return err
+		}
 		collection.Schema.AddField(del_f3_name)
 
 		// remove
@@ -636,7 +650,7 @@ func init() {
 
 		// update
 		edit_f2_name_new := &schema.SchemaField{}
-		json.Unmarshal([]byte(` + "`" + `{
+		if err := json.Unmarshal([]byte(` + "`" + `{
 			"system": false,
 			"id": "f2_id",
 			"name": "f2_name",
@@ -649,7 +663,9 @@ func init() {
 				"max": null,
 				"noDecimal": false
 			}
-		}` + "`" + `), edit_f2_name_new)
+		}` + "`" + `), edit_f2_name_new); err != nil {
+			return err
+		}
 		collection.Schema.AddField(edit_f2_name_new)
 
 		return dao.SaveCollection(collection)

plugins/migratecmd/templates.go

@@ -598,11 +598,11 @@ func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection)
 	}
 	if !bytes.Equal(rawNewOptions, rawOldOptions) {
 		upParts = append(upParts, "options := map[string]any{}")
-		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawNewOptions))))
+		upParts = append(upParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawNewOptions)))))
 		upParts = append(upParts, fmt.Sprintf("%s.SetOptions(options)\n", varName))
 		// ---
 		downParts = append(downParts, "options := map[string]any{}")
-		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawOldOptions))))
+		downParts = append(downParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawOldOptions)))))
 		downParts = append(downParts, fmt.Sprintf("%s.SetOptions(options)\n", varName))
 	}
 
@@ -616,9 +616,9 @@ func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection)
 		return "", err
 	}
 	if !bytes.Equal(rawNewIndexes, rawOldIndexes) {
-		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s.Indexes)\n", escapeBacktick(string(rawNewIndexes)), varName))
+		upParts = append(upParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s.Indexes)", escapeBacktick(string(rawNewIndexes)), varName))+"\n")
 		// ---
-		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s.Indexes)\n", escapeBacktick(string(rawOldIndexes)), varName))
+		downParts = append(downParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s.Indexes)", escapeBacktick(string(rawOldIndexes)), varName))+"\n")
 	}
 
 	// Schema
@@ -641,7 +641,7 @@ func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection)
 
 		downParts = append(downParts, "// add")
 		downParts = append(downParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
-		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar))
+		downParts = append(downParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar)))
 		downParts = append(downParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
 	}
 
@@ -660,7 +660,7 @@ func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection)
 
 		upParts = append(upParts, "// add")
 		upParts = append(upParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
-		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar))
+		upParts = append(upParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar)))
 		upParts = append(upParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
 
 		downParts = append(downParts, "// remove")
@@ -692,12 +692,12 @@ func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection)
 
 		upParts = append(upParts, "// update")
 		upParts = append(upParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
-		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar))
+		upParts = append(upParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar)))
 		upParts = append(upParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
 
 		downParts = append(downParts, "// update")
 		downParts = append(downParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
-		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar))
+		downParts = append(downParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar)))
 		downParts = append(downParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
 	}
 	// ---------------------------------------------------------------
@@ -791,3 +791,7 @@ func marhshalWithoutEscape(v any, prefix string, indent string) ([]byte, error)
 func escapeBacktick(v string) string {
 	return strings.ReplaceAll(v, "`", "` + \"`\" + `")
 }
+
+func goErrIf(v string) string {
+	return "if err := " + v + "; err != nil {\n\t\t\treturn err\n\t\t}"
+}

resolvers/record_field_resolve_runner.go

@@ -305,30 +305,33 @@ func (r *runner) processRequestInfoRelationField(dataField *schema.SchemaField)
 	}
 
 	r.activeCollectionName = dataRelCollection.Name
-	r.activeTableAlias = inflector.Columnify("__data_" + dataRelCollection.Name)
+	r.activeTableAlias = inflector.Columnify("__data_" + dataRelCollection.Name + "_" + dataField.Name)
 
 	// join the data rel collection to the main collection
 	r.resolver.registerJoin(
-		inflector.Columnify(r.activeCollectionName),
+		r.activeCollectionName,
 		r.activeTableAlias,
 		dbx.In(
-			fmt.Sprintf("[[%s.id]]", inflector.Columnify(r.activeTableAlias)),
+			fmt.Sprintf("[[%s.id]]", r.activeTableAlias),
 			list.ToInterfaceSlice(dataRelIds)...,
 		),
 	)
 
-	if options.MaxSelect == nil || *options.MaxSelect != 1 {
+	if options.IsMultiple() {
 		r.withMultiMatch = true
 	}
 
 	// join the data rel collection to the multi-match subquery
-	r.multiMatchActiveTableAlias = inflector.Columnify("__data_mm_" + dataRelCollection.Name)
+	r.multiMatchActiveTableAlias = inflector.Columnify("__data_mm_" + dataRelCollection.Name + "_" + dataField.Name)
 	r.multiMatch.joins = append(
 		r.multiMatch.joins,
 		&join{
-			tableName:  inflector.Columnify(r.activeCollectionName),
+			tableName:  r.activeCollectionName,
 			tableAlias: r.multiMatchActiveTableAlias,
-			on:         dbx.In(r.multiMatchActiveTableAlias+".id", list.ToInterfaceSlice(dataRelIds)...),
+			on: dbx.In(
+				fmt.Sprintf("[[%s.id]]", r.multiMatchActiveTableAlias),
+				list.ToInterfaceSlice(dataRelIds)...,
+			),
 		},
 	)
 
@@ -514,17 +517,31 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 		if field == nil {
 			parts := viaRegex.FindStringSubmatch(prop)
 			if len(parts) != 3 {
-				return nil, fmt.Errorf("field %q is not a valid back relation", prop)
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("failed to resolve field %q", prop)
 			}
 
 			backCollection, err := r.resolver.loadCollection(parts[1])
 			if err != nil {
-				return nil, fmt.Errorf("failed to resolve field %q", prop)
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("failed to load back relation field %q collection", prop)
 			}
+
 			backField := backCollection.Schema.GetFieldByName(parts[2])
-			if backField == nil || backField.Type != schema.FieldTypeRelation {
-				return nil, fmt.Errorf("invalid or missing back relation field %q", parts[2])
+			if backField == nil {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("missing back relation field %q", parts[2])
 			}
+			if backField.Type != schema.FieldTypeRelation {
+				return nil, fmt.Errorf("invalid back relation field %q", parts[2])
+			}
+
 			backField.InitOptions()
 			backFieldOptions, ok := backField.Options.(*schema.RelationOptions)
 			if !ok {
@@ -629,7 +646,7 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 
 		relCollection, relErr := r.resolver.loadCollection(options.CollectionId)
 		if relErr != nil {
-			return nil, fmt.Errorf("failed to find field %q collection", prop)
+			return nil, fmt.Errorf("failed to load field %q collection", prop)
 		}
 
 		cleanFieldName := inflector.Columnify(field.Name)

tests/app.go

@@ -9,8 +9,12 @@ import (
 	"runtime"
 	"sync"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/migrate"
 )
 
 // TestApp is a wrapper app instance used for testing.
@@ -36,9 +40,13 @@ type TestApp struct {
 //
 // After this call, the app instance shouldn't be used anymore.
 func (t *TestApp) Cleanup() {
-	t.ResetEventCalls()
-	t.ResetBootstrapState()
-	t.TestMailer.Reset()
+	t.OnTerminate().Trigger(&core.TerminateEvent{App: t}, func(e *core.TerminateEvent) error {
+		t.TestMailer.Reset()
+		t.ResetEventCalls()
+		t.ResetBootstrapState()
+
+		return nil
+	})
 
 	if t.DataDir() != "" {
 		os.RemoveAll(t.DataDir())
@@ -115,6 +123,11 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 		return nil, err
 	}
 
+	// apply any missing migrations
+	if err := runMigrations(app); err != nil {
+		return nil, err
+	}
+
 	// force disable request logs because the logs db call execute in a separate
 	// go routine and it is possible to panic due to earlier api test completion.
 	app.Settings().Logs.MaxDays = 0
@@ -545,3 +558,33 @@ func copyFile(src string, dest string) error {
 
 	return nil
 }
+
+// @todo replace with app.RunMigrations on merge with the refactoring.
+func runMigrations(app core.App) error {
+	connections := []struct {
+		db             *dbx.DB
+		migrationsList migrate.MigrationsList
+	}{
+		{
+			db:             app.DB(),
+			migrationsList: migrations.AppMigrations,
+		},
+		{
+			db:             app.LogsDB(),
+			migrationsList: logs.LogsMigrations,
+		},
+	}
+
+	for _, c := range connections {
+		runner, err := migrate.NewRunner(c.db, c.migrationsList)
+		if err != nil {
+			return err
+		}
+
+		if _, err := runner.Up(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

tests/mailer.go

@@ -1,6 +1,8 @@
 package tests
 
 import (
+	"sync"
+
 	"github.com/pocketbase/pocketbase/tools/mailer"
 )
 
@@ -8,6 +10,8 @@ var _ mailer.Mailer = (*TestMailer)(nil)
 
 // TestMailer is a mock `mailer.Mailer` implementation.
 type TestMailer struct {
+	mux sync.Mutex
+
 	TotalSend   int
 	LastMessage mailer.Message
 
@@ -17,6 +21,9 @@ type TestMailer struct {
 
 // Reset clears any previously test collected data.
 func (tm *TestMailer) Reset() {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
 	tm.TotalSend = 0
 	tm.LastMessage = mailer.Message{}
 	tm.SentMessages = nil
@@ -24,6 +31,9 @@ func (tm *TestMailer) Reset() {
 
 // Send implements `mailer.Mailer` interface.
 func (tm *TestMailer) Send(m *mailer.Message) error {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
 	tm.TotalSend++
 	tm.LastMessage = *m
 	tm.SentMessages = append(tm.SentMessages, tm.LastMessage)

tokens/record.go

@@ -12,7 +12,7 @@ import (
 // NewRecordAuthToken generates and returns a new auth record authentication token.
 func NewRecordAuthToken(app core.App, record *models.Record) (string, error) {
 	if !record.Collection().IsAuth() {
-		return "", errors.New("The record is not from an auth collection.")
+		return "", errors.New("the record is not from an auth collection")
 	}
 
 	return security.NewJWT(
@@ -29,7 +29,7 @@ func NewRecordAuthToken(app core.App, record *models.Record) (string, error) {
 // NewRecordVerifyToken generates and returns a new record verification token.
 func NewRecordVerifyToken(app core.App, record *models.Record) (string, error) {
 	if !record.Collection().IsAuth() {
-		return "", errors.New("The record is not from an auth collection.")
+		return "", errors.New("the record is not from an auth collection")
 	}
 
 	return security.NewJWT(
@@ -47,7 +47,7 @@ func NewRecordVerifyToken(app core.App, record *models.Record) (string, error) {
 // NewRecordResetPasswordToken generates and returns a new auth record password reset request token.
 func NewRecordResetPasswordToken(app core.App, record *models.Record) (string, error) {
 	if !record.Collection().IsAuth() {
-		return "", errors.New("The record is not from an auth collection.")
+		return "", errors.New("the record is not from an auth collection")
 	}
 
 	return security.NewJWT(
@@ -80,7 +80,7 @@ func NewRecordChangeEmailToken(app core.App, record *models.Record, newEmail str
 // NewRecordFileToken generates and returns a new record private file access token.
 func NewRecordFileToken(app core.App, record *models.Record) (string, error) {
 	if !record.Collection().IsAuth() {
-		return "", errors.New("The record is not from an auth collection.")
+		return "", errors.New("the record is not from an auth collection")
 	}
 
 	return security.NewJWT(

tools/archive/create_test.go

@@ -48,7 +48,7 @@ func TestCreateSuccess(t *testing.T) {
 		t.Fatalf("Expected zip with name %q, got %q", zipName, name)
 	}
 
-	expectedSize := int64(405)
+	expectedSize := int64(544)
 	if size := info.Size(); size != expectedSize {
 		t.Fatalf("Expected zip with size %d, got %d", expectedSize, size)
 	}
@@ -116,5 +116,10 @@ func createTestDir(t *testing.T) string {
 		f.Close()
 	}
 
+	// symbolic link
+	if err := os.Symlink(filepath.Join(dir, "test"), filepath.Join(dir, "test_symlink")); err != nil {
+		t.Fatal(err)
+	}
+
 	return dir
 }

tools/archive/extract.go

@@ -9,7 +9,11 @@ import (
 	"strings"
 )
 
-// Extract extracts the zip archive at src to dest.
+// Extract extracts the zip archive at "src" to "dest".
+//
+// Note that only dirs and regular files will be extracted.
+// Symbolic links, named pipes, sockets, or any other irregular files
+// are skipped because they come with too many edge cases and ambiguities.
 func Extract(src, dest string) error {
 	zr, err := zip.OpenReader(src)
 	if err != nil {
@@ -46,11 +50,12 @@ func extractFile(zipFile *zip.File, basePath string) error {
 	}
 	defer r.Close()
 
+	// allow only dirs or regular files
 	if zipFile.FileInfo().IsDir() {
 		if err := os.MkdirAll(path, os.ModePerm); err != nil {
 			return err
 		}
-	} else {
+	} else if zipFile.FileInfo().Mode().IsRegular() {
 		// ensure that the file path directories are created
 		if err := os.MkdirAll(filepath.Dir(path), os.ModePerm); err != nil {
 			return err

tools/archive/extract_test.go

@@ -37,7 +37,7 @@ func TestExtractSuccess(t *testing.T) {
 	defer os.RemoveAll(extractedPath)
 
 	// zip testDir content (with exclude)
-	if err := archive.Create(testDir, zipPath, "a/b/c", "test", "sub2"); err != nil {
+	if err := archive.Create(testDir, zipPath, "a/b/c", "test2", "sub2"); err != nil {
 		t.Fatalf("Failed to create archive: %v", err)
 	}
 
@@ -64,8 +64,9 @@ func TestExtractSuccess(t *testing.T) {
 		t.Fatalf("Failed to read the extracted dir: %v", walkErr)
 	}
 
+	// (note: symbolic links and other regular files should be missing)
 	expectedFiles := []string{
-		filepath.Join(extractedPath, "test2"),
+		filepath.Join(extractedPath, "test"),
 		filepath.Join(extractedPath, "a/test"),
 		filepath.Join(extractedPath, "a/b/sub1"),
 	}

tools/auth/apple.go

@@ -39,7 +39,7 @@ func NewAppleProvider() *Apple {
 			ctx:         context.Background(),
 			displayName: "Apple",
 			pkce:        true,
-			scopes:      nil, // custom scopes are currently not supported since they require a POST redirect
+			scopes:      []string{"name", "email"},
 			authUrl:     "https://appleid.apple.com/auth/authorize",
 			tokenUrl:    "https://appleid.apple.com/auth/token",
 		},
@@ -63,8 +63,15 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Id            string `json:"sub"`
+		Name          string `json:"name"`
 		Email         string `json:"email"`
 		EmailVerified any    `json:"email_verified"` // could be string or bool
+		User          struct {
+			Name struct {
+				FirstName string `json:"firstName"`
+				LastName  string `json:"lastName"`
+			} `json:"name"`
+		} `json:"user"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -72,6 +79,7 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user := &AuthUser{
 		Id:           extracted.Id,
+		Name:         extracted.Name,
 		RawUser:      rawUser,
 		AccessToken:  token.AccessToken,
 		RefreshToken: token.RefreshToken,
@@ -83,6 +91,10 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		user.Email = extracted.Email
 	}
 
+	if user.Name == "" {
+		user.Name = strings.TrimSpace(extracted.User.Name.FirstName + " " + extracted.User.Name.LastName)
+	}
+
 	return user, nil
 }
 
@@ -98,6 +110,18 @@ func (p *Apple) FetchRawUserData(token *oauth2.Token) ([]byte, error) {
 		return nil, err
 	}
 
+	// Apple only returns the user object the first time the user authorizes the app
+	// https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292
+	rawUser, _ := token.Extra("user").(string)
+	if rawUser != "" {
+		user := map[string]any{}
+		err = json.Unmarshal([]byte(rawUser), &user)
+		if err != nil {
+			return nil, err
+		}
+		claims["user"] = user
+	}
+
 	return json.Marshal(claims)
 }
 

tools/auth/bitbucket.go

@@ -114,8 +114,9 @@ func (p *Bitbucket) fetchPrimaryEmail(token *oauth2.Token) (string, error) {
 
 	expected := struct {
 		Values []struct {
-			Email     string `json:"email"`
-			IsPrimary bool   `json:"is_primary"`
+			Email       string `json:"email"`
+			IsPrimary   bool   `json:"is_primary"`
+			IsConfirmed bool   `json:"is_confirmed"`
 		} `json:"values"`
 	}{}
 	if err := json.Unmarshal(data, &expected); err != nil {
@@ -123,7 +124,7 @@ func (p *Bitbucket) fetchPrimaryEmail(token *oauth2.Token) (string, error) {
 	}
 
 	for _, v := range expected.Values {
-		if v.IsPrimary {
+		if v.IsPrimary && v.IsConfirmed {
 			return v.Email, nil
 		}
 	}

tools/auth/discord.go

@@ -36,7 +36,7 @@ func NewDiscordProvider() *Discord {
 
 // FetchAuthUser returns an AuthUser instance from Discord's user api.
 //
-// API reference:  https://discord.com/developers/docs/resources/user#user-object
+// API reference: https://discord.com/developers/docs/resources/user#user-object
 func (p *Discord) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	data, err := p.FetchRawUserData(token)
 	if err != nil {
@@ -50,6 +50,7 @@ func (p *Discord) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Id            string `json:"id"`
+		GlobalName    string `json:"global_name"`
 		Username      string `json:"username"`
 		Discriminator string `json:"discriminator"`
 		Avatar        string `json:"avatar"`
@@ -64,12 +65,22 @@ func (p *Discord) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	// https://discord.com/developers/docs/reference#image-formatting
 	avatarUrl := fmt.Sprintf("https://cdn.discordapp.com/avatars/%s/%s.png", extracted.Id, extracted.Avatar)
 
-	// Concatenate the user's username and discriminator into a single username string
-	username := fmt.Sprintf("%s#%s", extracted.Username, extracted.Discriminator)
+	name := extracted.GlobalName
+	if name == "" {
+		// fallback to username+discriminator
+		//
+		// Note: Discord migrated to unique usernames without discriminators.
+		// Legacy accounts still have a non-zero discriminator (e.g. "1234").
+		// See https://support.discord.com/hc/en-us/articles/12620128861463-New-Usernames-Display-Names.
+		name = extracted.Username
+		if extracted.Discriminator != "" && extracted.Discriminator != "0" {
+			name += "#" + extracted.Discriminator
+		}
+	}
 
 	user := &AuthUser{
 		Id:           extracted.Id,
-		Name:         username,
+		Name:         name,
 		Username:     extracted.Username,
 		AvatarUrl:    avatarUrl,
 		RawUser:      rawUser,

tools/auth/gitea.go

@@ -3,6 +3,8 @@ package auth
 import (
 	"context"
 	"encoding/json"
+	"fmt"
+	"io"
 	"strconv"
 
 	"github.com/pocketbase/pocketbase/tools/types"
@@ -47,11 +49,10 @@ func (p *Gitea) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id        int    `json:"id"`
 		Name      string `json:"full_name"`
 		Username  string `json:"login"`
-		Email     string `json:"email"`
 		AvatarUrl string `json:"avatar_url"`
+		Id        int    `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -61,14 +62,65 @@ func (p *Gitea) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Id:           strconv.Itoa(extracted.Id),
 		Name:         extracted.Name,
 		Username:     extracted.Username,
-		Email:        extracted.Email,
 		AvatarUrl:    extracted.AvatarUrl,
 		RawUser:      rawUser,
 		AccessToken:  token.AccessToken,
 		RefreshToken: token.RefreshToken,
 	}
 
+	email, err := p.fetchVerifiedPrimaryEmail(token)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch primary email: %w", err)
+	}
+	user.Email = email
+
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
 	return user, nil
 }
+
+// fetchVerifiedPrimaryEmail sends an API request to retrieve the verified
+// primary email, in case "Keep my email address private" was set.
+//
+// NB! This method can succeed and still return an empty email.
+// Error responses that are result of insufficient scopes permissions are ignored.
+//
+// API reference: https://codeberg.org/api/swagger#/user/userListEmails
+func (p *Gitea) fetchVerifiedPrimaryEmail(token *oauth2.Token) (string, error) {
+	client := p.Client(token)
+
+	response, err := client.Get(p.userApiUrl + "/emails")
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+
+	// ignore common http errors caused by insufficient scope permissions
+	// (the email field is optional, aka. return the auth user without it)
+	if response.StatusCode == 401 || response.StatusCode == 403 || response.StatusCode == 404 {
+		return "", nil
+	}
+
+	content, err := io.ReadAll(response.Body)
+	if err != nil {
+		return "", err
+	}
+
+	emails := []struct {
+		Email    string
+		Verified bool
+		Primary  bool
+	}{}
+	if err := json.Unmarshal(content, &emails); err != nil {
+		return "", err
+	}
+
+	// extract the verified primary email
+	for _, email := range emails {
+		if email.Verified && email.Primary {
+			return email.Email, nil
+		}
+	}
+
+	return "", nil
+}

tools/auth/github.go

@@ -50,10 +50,9 @@ func (p *Github) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Login     string `json:"login"`
-		Id        int    `json:"id"`
 		Name      string `json:"name"`
-		Email     string `json:"email"`
 		AvatarUrl string `json:"avatar_url"`
+		Id        int    `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -63,7 +62,6 @@ func (p *Github) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Id:           strconv.Itoa(extracted.Id),
 		Name:         extracted.Name,
 		Username:     extracted.Login,
-		Email:        extracted.Email,
 		AvatarUrl:    extracted.AvatarUrl,
 		RawUser:      rawUser,
 		AccessToken:  token.AccessToken,
@@ -72,15 +70,11 @@ func (p *Github) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
-	// in case user has set "Keep my email address private", send an
-	// **optional** API request to retrieve the verified primary email
-	if user.Email == "" {
-		email, err := p.fetchPrimaryEmail(token)
-		if err != nil {
-			return nil, err
-		}
-		user.Email = email
+	email, err := p.fetchPrimaryEmail(token)
+	if err != nil {
+		return nil, err
 	}
+	user.Email = email
 
 	return user, nil
 }

tools/auth/gitlab.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"strconv"
+	"time"
 
 	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/oauth2"
@@ -34,7 +35,7 @@ func NewGitlabProvider() *Gitlab {
 
 // FetchAuthUser returns an AuthUser instance based the Gitlab's user api.
 //
-// API reference: https://docs.gitlab.com/ee/api/users.html#for-admin
+// API reference: https://docs.gitlab.com/api/users/#retrieve-the-current-user
 func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	data, err := p.FetchRawUserData(token)
 	if err != nil {
@@ -47,11 +48,12 @@ func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id        int    `json:"id"`
-		Name      string `json:"name"`
-		Username  string `json:"username"`
-		Email     string `json:"email"`
-		AvatarUrl string `json:"avatar_url"`
+		Id          int    `json:"id"`
+		Name        string `json:"name"`
+		Username    string `json:"username"`
+		Email       string `json:"email"`
+		AvatarUrl   string `json:"avatar_url"`
+		ConfirmedAt string `json:"confirmed_at"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -61,7 +63,6 @@ func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Id:           strconv.Itoa(extracted.Id),
 		Name:         extracted.Name,
 		Username:     extracted.Username,
-		Email:        extracted.Email,
 		AvatarUrl:    extracted.AvatarUrl,
 		RawUser:      rawUser,
 		AccessToken:  token.AccessToken,
@@ -70,5 +71,10 @@ func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
+	confirmedAt, err := time.Parse(time.RFC3339, extracted.ConfirmedAt)
+	if err == nil && !confirmedAt.IsZero() {
+		user.Email = extracted.Email
+	}
+
 	return user, nil
 }

tools/auth/oidc.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 
 	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
 	"golang.org/x/oauth2"
 )
 
@@ -52,7 +53,7 @@ func (p *OIDC) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Username      string `json:"preferred_username"`
 		Picture       string `json:"picture"`
 		Email         string `json:"email"`
-		EmailVerified bool   `json:"email_verified"`
+		EmailVerified any    `json:"email_verified"` // see #6657
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -70,7 +71,7 @@ func (p *OIDC) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
-	if extracted.EmailVerified {
+	if cast.ToBool(extracted.EmailVerified) {
 		user.Email = extracted.Email
 	}
 

tools/cron/cron.go

@@ -27,6 +27,7 @@ type Cron struct {
 	startTimer *time.Timer
 	jobs       map[string]*job
 	interval   time.Duration
+	tickerDone chan bool
 
 	sync.RWMutex
 }
@@ -38,9 +39,10 @@ type Cron struct {
 // You can change the default timezone with Cron.SetTimezone().
 func New() *Cron {
 	return &Cron{
-		interval: 1 * time.Minute,
-		timezone: time.UTC,
-		jobs:     map[string]*job{},
+		interval:   1 * time.Minute,
+		timezone:   time.UTC,
+		jobs:       map[string]*job{},
+		tickerDone: make(chan bool),
 	}
 }
 
@@ -142,6 +144,7 @@ func (c *Cron) Stop() {
 		return // already stopped
 	}
 
+	c.tickerDone <- true
 	c.ticker.Stop()
 	c.ticker = nil
 }
@@ -168,8 +171,13 @@ func (c *Cron) Start() {
 
 		// run after each tick
 		go func() {
-			for t := range c.ticker.C {
-				c.runDue(t)
+			for {
+				select {
+				case <-c.tickerDone:
+					return
+				case t := <-c.ticker.C:
+					c.runDue(t)
+				}
 			}
 		}()
 	})

tools/filesystem/file.go

@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"os"
 	"path"
-	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -172,12 +171,16 @@ var extInvalidCharsRegex = regexp.MustCompile(`[^\w\.\*\-\+\=\#]+`)
 func normalizeName(fr FileReader, name string) string {
 	// extension
 	// ---
-	originalExt := filepath.Ext(name)
+	originalExt := extractExtension(name)
 	cleanExt := extInvalidCharsRegex.ReplaceAllString(originalExt, "")
 	if cleanExt == "" {
 		// try to detect the extension from the file content
 		cleanExt, _ = detectExtension(fr)
 	}
+	if extLength := len(cleanExt); extLength > 20 {
+		// keep only the last 20 characters (it is multibyte safe after the regex replace)
+		cleanExt = "." + cleanExt[extLength-20:]
+	}
 
 	// name
 	// ---
@@ -198,15 +201,41 @@ func normalizeName(fr FileReader, name string) string {
 	)
 }
 
+// extractExtension extracts the extension (with leading dot) from name.
+//
+// This differ from filepath.Ext() by supporting double extensions (eg. ".tar.gz").
+//
+// Returns an empty string if no match is found.
+//
+// Example:
+// extractExtension("test.txt")      // .txt
+// extractExtension("test.tar.gz")   // .tar.gz
+// extractExtension("test.a.tar.gz") // .tar.gz
+func extractExtension(name string) string {
+	primaryDot := strings.LastIndex(name, ".")
+
+	if primaryDot == -1 {
+		return ""
+	}
+
+	// look for secondary extension
+	secondaryDot := strings.LastIndex(name[:primaryDot], ".")
+	if secondaryDot >= 0 {
+		return name[secondaryDot:]
+	}
+
+	return name[primaryDot:]
+}
+
+// detectExtension tries to detect the extension from file mime type.
 func detectExtension(fr FileReader) (string, error) {
-	// try to detect the extension from the mime type
 	r, err := fr.Open()
 	if err != nil {
 		return "", err
 	}
 	defer r.Close()
 
-	mt, _ := mimetype.DetectReader(r)
+	mt, err := mimetype.DetectReader(r)
 	if err != nil {
 		return "", err
 	}

tools/filesystem/file_test.go

@@ -8,6 +8,8 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/labstack/echo/v5"
@@ -35,7 +37,7 @@ func TestNewFileFromPath(t *testing.T) {
 	if f.OriginalName != originalName {
 		t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
 	}
-	if match, _ := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
 		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
 	}
 	if f.Size != 73 {
@@ -69,7 +71,7 @@ func TestNewFileFromBytes(t *testing.T) {
 	if f.OriginalName != originalName {
 		t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
 	}
-	if match, _ := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
 		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
 	}
 }
@@ -95,12 +97,12 @@ func TestNewFileFromMultipart(t *testing.T) {
 	}
 
 	originalNamePattern := regexp.QuoteMeta("tmpfile-") + `\w+` + regexp.QuoteMeta(".txt")
-	if match, _ := regexp.Match(originalNamePattern, []byte(f.OriginalName)); !match {
+	if match, err := regexp.Match(originalNamePattern, []byte(f.OriginalName)); !match {
 		t.Fatalf("Expected OriginalName to match %v, got %q (%v)", originalNamePattern, f.OriginalName, err)
 	}
 
 	normalizedNamePattern := regexp.QuoteMeta("tmpfile_") + `\w+\_\w{10}` + regexp.QuoteMeta(".txt")
-	if match, _ := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
 		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
 	}
 
@@ -164,7 +166,7 @@ func TestNewFileFromUrlTimeout(t *testing.T) {
 		if f.OriginalName != originalName {
 			t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
 		}
-		if match, _ := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+		if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
 			t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
 		}
 		if f.Size != 4 {
@@ -175,3 +177,31 @@ func TestNewFileFromUrlTimeout(t *testing.T) {
 		}
 	}
 }
+
+func TestFileNameNormalizations(t *testing.T) {
+	scenarios := []struct {
+		name    string
+		pattern string
+	}{
+		{"", `^\w{10}_\w{10}\.txt$`},
+		{".png", `^\w{10}_\w{10}\.png$`},
+		{".tar.gz", `^\w{10}_\w{10}\.tar\.gz$`},
+		{"a.tar.gz", `^a\w{10}_\w{10}\.tar\.gz$`},
+		{"a.b.c.d.tar.gz", `^a_b_c_d_\w{10}\.tar\.gz$`},
+		{"abcd", `^abcd_\w{10}\.txt$`},
+		{"a  b! c d  . 456", `^a_b_c_d_\w{10}\.456$`},                                        // normalize spaces
+		{strings.Repeat("a", 101) + "." + strings.Repeat("b", 21), `^a{100}_\w{10}\.b{20}$`}, // name and extension length trim
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i)+"_"+s.name, func(t *testing.T) {
+			f, err := filesystem.NewFileFromBytes([]byte("abc"), s.name)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if match, err := regexp.Match(s.pattern, []byte(f.Name)); !match {
+				t.Fatalf("Expected Name to match %v, got %q (%v)", s.pattern, f.Name, err)
+			}
+		})
+	}
+}

tools/filesystem/filesystem.go

@@ -8,7 +8,6 @@ import (
 	"mime/multipart"
 	"net/http"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -21,10 +20,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/disintegration/imaging"
 	"github.com/gabriel-vasile/mimetype"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3lite"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"gocloud.dev/blob"
 	"gocloud.dev/blob/fileblob"
-	"gocloud.dev/blob/s3blob"
 )
 
 var gcpIgnoreHeaders = []string{"Accept-Encoding"}
@@ -49,25 +48,23 @@ func NewS3(
 
 	cred := credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")
 
-	cfg, err := config.LoadDefaultConfig(ctx,
+	cfg, err := config.LoadDefaultConfig(
+		ctx,
 		config.WithCredentialsProvider(cred),
 		config.WithRegion(region),
-		config.WithEndpointResolverWithOptions(aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
-			// ensure that the endpoint has url scheme for
-			// backward compatibility with v1 of the aws sdk
-			prefixedEndpoint := endpoint
-			if !strings.Contains(endpoint, "://") {
-				prefixedEndpoint = "https://" + endpoint
-			}
-
-			return aws.Endpoint{URL: prefixedEndpoint, SigningRegion: region}, nil
-		})),
 	)
 	if err != nil {
 		return nil, err
 	}
 
 	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
+		// ensure that the endpoint has url scheme for
+		// backward compatibility with v1 of the aws sdk
+		if !strings.Contains(endpoint, "://") {
+			endpoint = "https://" + endpoint
+		}
+		o.BaseEndpoint = aws.String(endpoint)
+
 		o.UsePathStyle = s3ForcePathStyle
 
 		// Google Cloud Storage alters the Accept-Encoding header,
@@ -78,7 +75,7 @@ func NewS3(
 		}
 	})
 
-	bucket, err := s3blob.OpenBucketV2(ctx, client, bucketName, nil)
+	bucket, err := s3lite.OpenBucketV2(ctx, client, bucketName, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -277,16 +274,25 @@ func (s *System) Delete(fileKey string) error {
 }
 
 // DeletePrefix deletes everything starting with the specified prefix.
+//
+// The prefix could be subpath (ex. "/a/b/") or filename prefix (ex. "/a/b/file_").
 func (s *System) DeletePrefix(prefix string) []error {
 	failed := []error{}
 
 	if prefix == "" {
-		failed = append(failed, errors.New("Prefix mustn't be empty."))
+		failed = append(failed, errors.New("prefix mustn't be empty"))
 		return failed
 	}
 
 	dirsMap := map[string]struct{}{}
-	dirsMap[prefix] = struct{}{}
+
+	var isPrefixDir bool
+
+	// treat the prefix as directory only if it ends with trailing slash
+	if strings.HasSuffix(prefix, "/") {
+		isPrefixDir = true
+		dirsMap[strings.TrimRight(prefix, "/")] = struct{}{}
+	}
 
 	// delete all files with the prefix
 	// ---
@@ -304,8 +310,11 @@ func (s *System) DeletePrefix(prefix string) []error {
 
 		if err := s.Delete(obj.Key); err != nil {
 			failed = append(failed, err)
-		} else {
-			dirsMap[path.Dir(obj.Key)] = struct{}{}
+		} else if isPrefixDir {
+			slashIdx := strings.LastIndex(obj.Key, "/")
+			if slashIdx > -1 {
+				dirsMap[obj.Key[:slashIdx]] = struct{}{}
+			}
 		}
 	}
 	// ---
@@ -335,6 +344,26 @@ func (s *System) DeletePrefix(prefix string) []error {
 	return failed
 }
 
+// Checks if the provided dir prefix doesn't have any files.
+//
+// A trailing slash will be appended to a non-empty dir string argument
+// to ensure that the checked prefix is a "directory".
+//
+// Returns "false" in case the has at least one file, otherwise - "true".
+func (s *System) IsEmptyDir(dir string) bool {
+	if dir != "" && !strings.HasSuffix(dir, "/") {
+		dir += "/"
+	}
+
+	iter := s.bucket.List(&blob.ListOptions{
+		Prefix: dir,
+	})
+
+	_, err := iter.Next(s.ctx)
+
+	return err == io.EOF
+}
+
 var inlineServeContentTypes = []string{
 	// image
 	"image/png", "image/jpg", "image/jpeg", "image/gif", "image/webp", "image/x-icon", "image/bmp",
@@ -422,7 +451,7 @@ var ThumbSizeRegex = regexp.MustCompile(`^(\d+)x(\d+)(t|b|f)?$`)
 func (s *System) CreateThumb(originalKey string, thumbKey, thumbSize string) error {
 	sizeParts := ThumbSizeRegex.FindStringSubmatch(thumbSize)
 	if len(sizeParts) != 4 {
-		return errors.New("Thumb size must be in WxH, WxHt, WxHb or WxHf format.")
+		return errors.New("thumb size must be in WxH, WxHt, WxHb or WxHf format")
 	}
 
 	width, _ := strconv.Atoi(sizeParts[1])
@@ -430,7 +459,7 @@ func (s *System) CreateThumb(originalKey string, thumbKey, thumbSize string) err
 	resizeType := sizeParts[3]
 
 	if width == 0 && height == 0 {
-		return errors.New("Thumb width and height cannot be zero at the same time.")
+		return errors.New("thumb width and height cannot be zero at the same time")
 	}
 
 	// fetch the original

tools/filesystem/filesystem_test.go

@@ -101,7 +101,7 @@ func TestFileSystemDelete(t *testing.T) {
 	}
 }
 
-func TestFileSystemDeletePrefix(t *testing.T) {
+func TestFileSystemDeletePrefixWithoutTrailingSlash(t *testing.T) {
 	dir := createTestDir(t)
 	defer os.RemoveAll(dir)
 
@@ -115,7 +115,7 @@ func TestFileSystemDeletePrefix(t *testing.T) {
 		t.Fatal("Expected error, got nil", errs)
 	}
 
-	if errs := fs.DeletePrefix("missing/"); len(errs) != 0 {
+	if errs := fs.DeletePrefix("missing"); len(errs) != 0 {
 		t.Fatalf("Not existing prefix shouldn't error, got %v", errs)
 	}
 
@@ -123,13 +123,85 @@ func TestFileSystemDeletePrefix(t *testing.T) {
 		t.Fatalf("Expected nil, got errors %v", errs)
 	}
 
-	// ensure that the test/ files are deleted
+	// ensure that the test/* files are deleted
 	if exists, _ := fs.Exists("test/sub1.txt"); exists {
 		t.Fatalf("Expected test/sub1.txt to be deleted")
 	}
 	if exists, _ := fs.Exists("test/sub2.txt"); exists {
 		t.Fatalf("Expected test/sub2.txt to be deleted")
 	}
+
+	// the test directory should remain since the prefix didn't have trailing slash
+	if _, err := os.Stat(filepath.Join(dir, "test")); os.IsNotExist(err) {
+		t.Fatal("Expected the prefix dir to remain")
+	}
+}
+
+func TestFileSystemDeletePrefixWithTrailingSlash(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fs, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fs.Close()
+
+	if errs := fs.DeletePrefix("missing/"); len(errs) != 0 {
+		t.Fatalf("Not existing prefix shouldn't error, got %v", errs)
+	}
+
+	if errs := fs.DeletePrefix("test/"); len(errs) != 0 {
+		t.Fatalf("Expected nil, got errors %v", errs)
+	}
+
+	// ensure that the test/* files are deleted
+	if exists, _ := fs.Exists("test/sub1.txt"); exists {
+		t.Fatalf("Expected test/sub1.txt to be deleted")
+	}
+	if exists, _ := fs.Exists("test/sub2.txt"); exists {
+		t.Fatalf("Expected test/sub2.txt to be deleted")
+	}
+
+	// the test directory should be also deleted since the prefix has trailing slash
+	if _, err := os.Stat(filepath.Join(dir, "test")); !os.IsNotExist(err) {
+		t.Fatal("Expected the prefix dir to be deleted")
+	}
+}
+
+func TestFileSystemIsEmptyDir(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		dir      string
+		expected bool
+	}{
+		{"", false}, // special case that shouldn't be suffixed with delimiter to search for any files within the bucket
+		{"/", true},
+		{"missing", true},
+		{"missing/", true},
+		{"test", false},
+		{"test/", false},
+		{"empty", true},
+		{"empty/", true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.dir, func(t *testing.T) {
+			result := fsys.IsEmptyDir(s.dir)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
 }
 
 func TestFileSystemUploadMultipart(t *testing.T) {

tools/filesystem/internal/s3lite/s3lite.go

@@ -0,0 +1,918 @@
+// This is a trimmed version of the original go-cloud/s3blob driver
+// to avoid loading both aws-sdk-go and aws-sdk-go-v2 dependencies.
+// It helps reducing the final binary with ~11MB.
+//
+// In the future this may get replaced entirely with an even slimmer
+// version without relying on aws-sdk-go-v2.
+//
+//--------------------------------------------------------------------
+//
+// Copyright 2018 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package s3blob provides a blob implementation that uses S3. Use OpenBucket
+// to construct a *blob.Bucket.
+//
+// # URLs
+//
+// For blob.OpenBucket, s3blob registers for the scheme "s3".
+// The default URL opener will use an AWS session with the default credentials
+// and configuration; see https://docs.aws.amazon.com/sdk-for-go/api/aws/session/
+// for more details.
+// Use "awssdk=v1" or "awssdk=v2" to force a specific AWS SDK version.
+// To customize the URL opener, or for more details on the URL format,
+// see URLOpener.
+// See https://gocloud.dev/concepts/urls/ for background information.
+//
+// # Escaping
+//
+// Go CDK supports all UTF-8 strings; to make this work with services lacking
+// full UTF-8 support, strings must be escaped (during writes) and unescaped
+// (during reads). The following escapes are performed for s3blob:
+//   - Blob keys: ASCII characters 0-31 are escaped to "__0x<hex>__".
+//     Additionally, the "/" in "../" is escaped in the same way.
+//   - Metadata keys: Escaped using URL encoding, then additionally "@:=" are
+//     escaped using "__0x<hex>__". These characters were determined by
+//     experimentation.
+//   - Metadata values: Escaped using URL encoding.
+//
+// # As
+//
+// s3blob exposes the following types for As:
+//   - Bucket: (V1) *s3.S3; (V2) *s3v2.Client
+//   - Error: (V1) awserr.Error; (V2) any error type returned by the service, notably smithy.APIError
+//   - ListObject: (V1) s3.Object for objects, s3.CommonPrefix for "directories"; (V2) typesv2.Object for objects, typesv2.CommonPrefix for "directories"
+//   - ListOptions.BeforeList: (V1) *s3.ListObjectsV2Input or *s3.ListObjectsInput
+//     when Options.UseLegacyList == true; (V2) *s3v2.ListObjectsV2Input or *[]func(*s3v2.Options), or *s3v2.ListObjectsInput
+//     when Options.UseLegacyList == true
+//   - Reader: (V1) s3.GetObjectOutput; (V2) s3v2.GetObjectInput
+//   - ReaderOptions.BeforeRead: (V1) *s3.GetObjectInput; (V2) *s3v2.GetObjectInput or *[]func(*s3v2.Options)
+//   - Attributes: (V1) s3.HeadObjectOutput; (V2)s3v2.HeadObjectOutput
+//   - CopyOptions.BeforeCopy: *(V1) s3.CopyObjectInput; (V2) s3v2.CopyObjectInput
+//   - WriterOptions.BeforeWrite: (V1) *s3manager.UploadInput, *s3manager.Uploader; (V2) *s3v2.PutObjectInput, *s3v2manager.Uploader
+//   - SignedURLOptions.BeforeSign:
+//     (V1) *s3.GetObjectInput; (V2) *s3v2.GetObjectInput, when Options.Method == http.MethodGet, or
+//     (V1) *s3.PutObjectInput; (V2) *s3v2.PutObjectInput, when Options.Method == http.MethodPut, or
+//     (V1) *s3.DeleteObjectInput; (V2) [not supported] when Options.Method == http.MethodDelete
+
+package s3lite
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+
+	awsv2 "github.com/aws/aws-sdk-go-v2/aws"
+	s3managerv2 "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	s3v2 "github.com/aws/aws-sdk-go-v2/service/s3"
+	typesv2 "github.com/aws/aws-sdk-go-v2/service/s3/types"
+
+	"github.com/aws/smithy-go"
+	"gocloud.dev/blob"
+	"gocloud.dev/blob/driver"
+	"gocloud.dev/gcerrors"
+)
+
+// -------------------------------------------------------------------
+
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// HexEscape returns s, with all runes for which shouldEscape returns true
+// escaped to "__0xXXX__", where XXX is the hex representation of the rune
+// value. For example, " " would escape to "__0x20__".
+//
+// Non-UTF-8 strings will have their non-UTF-8 characters escaped to
+// unicode.ReplacementChar; the original value is lost. Please file an
+// issue if you need non-UTF8 support.
+//
+// Note: shouldEscape takes the whole string as a slice of runes and an
+// index. Passing it a single byte or a single rune doesn't provide
+// enough context for some escape decisions; for example, the caller might
+// want to escape the second "/" in "//" but not the first one.
+// We pass a slice of runes instead of the string or a slice of bytes
+// because some decisions will be made on a rune basis (e.g., encode
+// all non-ASCII runes).
+func HexEscape(s string, shouldEscape func(s []rune, i int) bool) string {
+	// Do a first pass to see which runes (if any) need escaping.
+	runes := []rune(s)
+	var toEscape []int
+	for i := range runes {
+		if shouldEscape(runes, i) {
+			toEscape = append(toEscape, i)
+		}
+	}
+	if len(toEscape) == 0 {
+		return s
+	}
+	// Each escaped rune turns into at most 14 runes ("__0x7fffffff__"),
+	// so allocate an extra 13 for each. We'll reslice at the end
+	// if we didn't end up using them.
+	escaped := make([]rune, len(runes)+13*len(toEscape))
+	n := 0 // current index into toEscape
+	j := 0 // current index into escaped
+	for i, r := range runes {
+		if n < len(toEscape) && i == toEscape[n] {
+			// We were asked to escape this rune.
+			for _, x := range fmt.Sprintf("__%#x__", r) {
+				escaped[j] = x
+				j++
+			}
+			n++
+		} else {
+			escaped[j] = r
+			j++
+		}
+	}
+	return string(escaped[0:j])
+}
+
+// unescape tries to unescape starting at r[i].
+// It returns a boolean indicating whether the unescaping was successful,
+// and (if true) the unescaped rune and the last index of r that was used
+// during unescaping.
+func unescape(r []rune, i int) (bool, rune, int) {
+	// Look for "__0x".
+	if r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '0' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != 'x' {
+		return false, 0, 0
+	}
+	i++
+	// Capture the digits until the next "_" (if any).
+	var hexdigits []rune
+	for ; i < len(r) && r[i] != '_'; i++ {
+		hexdigits = append(hexdigits, r[i])
+	}
+	// Look for the trailing "__".
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	// Parse the hex digits into an int32.
+	retval, err := strconv.ParseInt(string(hexdigits), 16, 32)
+	if err != nil {
+		return false, 0, 0
+	}
+	return true, rune(retval), i
+}
+
+// HexUnescape reverses HexEscape.
+func HexUnescape(s string) string {
+	var unescaped []rune
+	runes := []rune(s)
+	for i := 0; i < len(runes); i++ {
+		if ok, newR, newI := unescape(runes, i); ok {
+			// We unescaped some runes starting at i, resulting in the
+			// unescaped rune newR. The last rune used was newI.
+			if unescaped == nil {
+				// This is the first rune we've encountered that
+				// needed unescaping. Allocate a buffer and copy any
+				// previous runes.
+				unescaped = make([]rune, i)
+				copy(unescaped, runes)
+			}
+			unescaped = append(unescaped, newR)
+			i = newI
+		} else if unescaped != nil {
+			unescaped = append(unescaped, runes[i])
+		}
+	}
+	if unescaped == nil {
+		return s
+	}
+	return string(unescaped)
+}
+
+// URLEscape uses url.PathEscape to escape s.
+func URLEscape(s string) string {
+	return url.PathEscape(s)
+}
+
+// URLUnescape reverses URLEscape using url.PathUnescape. If the unescape
+// returns an error, it returns s.
+func URLUnescape(s string) string {
+	if u, err := url.PathUnescape(s); err == nil {
+		return u
+	}
+	return s
+}
+
+// -------------------------------------------------------------------
+
+const defaultPageSize = 1000
+
+// Options sets options for constructing a *blob.Bucket backed by fileblob.
+type Options struct {
+	// UseLegacyList forces the use of ListObjects instead of ListObjectsV2.
+	// Some S3-compatible services (like CEPH) do not currently support
+	// ListObjectsV2.
+	UseLegacyList bool
+}
+
+// openBucket returns an S3 Bucket.
+func openBucket(ctx context.Context, useV2 bool, clientV2 *s3v2.Client, bucketName string, opts *Options) (*bucket, error) {
+	if bucketName == "" {
+		return nil, errors.New("s3blob.OpenBucket: bucketName is required")
+	}
+	if opts == nil {
+		opts = &Options{}
+	}
+	if clientV2 == nil {
+		return nil, errors.New("s3blob.OpenBucketV2: client is required")
+	}
+	return &bucket{
+		useV2:         useV2,
+		name:          bucketName,
+		clientV2:      clientV2,
+		useLegacyList: opts.UseLegacyList,
+	}, nil
+}
+
+// OpenBucketV2 returns a *blob.Bucket backed by S3, using AWS SDK v2.
+func OpenBucketV2(ctx context.Context, client *s3v2.Client, bucketName string, opts *Options) (*blob.Bucket, error) {
+	drv, err := openBucket(ctx, true, client, bucketName, opts)
+	if err != nil {
+		return nil, err
+	}
+	return blob.NewBucket(drv), nil
+}
+
+// reader reads an S3 object. It implements io.ReadCloser.
+type reader struct {
+	useV2 bool
+	body  io.ReadCloser
+	attrs driver.ReaderAttributes
+	rawV2 *s3v2.GetObjectOutput
+}
+
+func (r *reader) Read(p []byte) (int, error) {
+	return r.body.Read(p)
+}
+
+// Close closes the reader itself. It must be called when done reading.
+func (r *reader) Close() error {
+	return r.body.Close()
+}
+
+func (r *reader) As(i interface{}) bool {
+	p, ok := i.(*s3v2.GetObjectOutput)
+	if !ok {
+		return false
+	}
+	*p = *r.rawV2
+	return true
+}
+
+func (r *reader) Attributes() *driver.ReaderAttributes {
+	return &r.attrs
+}
+
+// writer writes an S3 object, it implements io.WriteCloser.
+type writer struct {
+	// Ends of an io.Pipe, created when the first byte is written.
+	pw *io.PipeWriter
+	pr *io.PipeReader
+
+	// Alternatively, upload is set to true when Upload was
+	// used to upload data.
+	upload bool
+
+	ctx   context.Context
+	useV2 bool
+
+	// v2
+	uploaderV2 *s3managerv2.Uploader
+	reqV2      *s3v2.PutObjectInput
+
+	donec chan struct{} // closed when done writing
+	// The following fields will be written before donec closes:
+	err error
+}
+
+// Write appends p to w.pw. User must call Close to close the w after done writing.
+func (w *writer) Write(p []byte) (int, error) {
+	// Avoid opening the pipe for a zero-length write;
+	// the concrete can do these for empty blobs.
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if w.pw == nil {
+		// We'll write into pw and use pr as an io.Reader for the
+		// Upload call to S3.
+		w.pr, w.pw = io.Pipe()
+		w.open(w.pr, true)
+	}
+	return w.pw.Write(p)
+}
+
+// Upload reads from r. Per the driver, it is guaranteed to be the only
+// write call for this writer.
+func (w *writer) Upload(r io.Reader) error {
+	w.upload = true
+	w.open(r, false)
+	return nil
+}
+
+// r may be nil if we're Closing and no data was written.
+// If closePipeOnError is true, w.pr will be closed if there's an
+// error uploading to S3.
+func (w *writer) open(r io.Reader, closePipeOnError bool) {
+	// This goroutine will keep running until Close, unless there's an error.
+	go func() {
+		defer close(w.donec)
+
+		if r == nil {
+			// AWS doesn't like a nil Body.
+			r = http.NoBody
+		}
+		var err error
+		w.reqV2.Body = r
+		_, err = w.uploaderV2.Upload(w.ctx, w.reqV2)
+		if err != nil {
+			if closePipeOnError {
+				w.pr.CloseWithError(err)
+				w.pr = nil
+			}
+			w.err = err
+		}
+	}()
+}
+
+// Close completes the writer and closes it. Any error occurring during write
+// will be returned. If a writer is closed before any Write is called, Close
+// will create an empty file at the given key.
+func (w *writer) Close() error {
+	if !w.upload {
+		if w.pr != nil {
+			defer w.pr.Close()
+		}
+		if w.pw == nil {
+			// We never got any bytes written. We'll write an http.NoBody.
+			w.open(nil, false)
+		} else if err := w.pw.Close(); err != nil {
+			return err
+		}
+	}
+	<-w.donec
+	return w.err
+}
+
+// bucket represents an S3 bucket and handles read, write and delete operations.
+type bucket struct {
+	name          string
+	useV2         bool
+	clientV2      *s3v2.Client
+	useLegacyList bool
+}
+
+func (b *bucket) Close() error {
+	return nil
+}
+
+func (b *bucket) ErrorCode(err error) gcerrors.ErrorCode {
+	var code string
+	var ae smithy.APIError
+	var oe *smithy.OperationError
+	if errors.As(err, &oe) && strings.Contains(oe.Error(), "301") {
+		// V2 returns an OperationError with a missing redirect for invalid buckets.
+		code = "NoSuchBucket"
+	} else if errors.As(err, &ae) {
+		code = ae.ErrorCode()
+	} else {
+		return gcerrors.Unknown
+	}
+	switch {
+	case code == "NoSuchBucket" || code == "NoSuchKey" || code == "NotFound":
+		return gcerrors.NotFound
+	default:
+		return gcerrors.Unknown
+	}
+}
+
+// ListPaged implements driver.ListPaged.
+func (b *bucket) ListPaged(ctx context.Context, opts *driver.ListOptions) (*driver.ListPage, error) {
+	pageSize := opts.PageSize
+	if pageSize == 0 {
+		pageSize = defaultPageSize
+	}
+	in := &s3v2.ListObjectsV2Input{
+		Bucket:  awsv2.String(b.name),
+		MaxKeys: awsv2.Int32(int32(pageSize)),
+	}
+	if len(opts.PageToken) > 0 {
+		in.ContinuationToken = awsv2.String(string(opts.PageToken))
+	}
+	if opts.Prefix != "" {
+		in.Prefix = awsv2.String(escapeKey(opts.Prefix))
+	}
+	if opts.Delimiter != "" {
+		in.Delimiter = awsv2.String(escapeKey(opts.Delimiter))
+	}
+	resp, err := b.listObjectsV2(ctx, in, opts)
+	if err != nil {
+		return nil, err
+	}
+	page := driver.ListPage{}
+	if resp.NextContinuationToken != nil {
+		page.NextPageToken = []byte(*resp.NextContinuationToken)
+	}
+	if n := len(resp.Contents) + len(resp.CommonPrefixes); n > 0 {
+		page.Objects = make([]*driver.ListObject, n)
+		for i, obj := range resp.Contents {
+			obj := obj
+			page.Objects[i] = &driver.ListObject{
+				Key:     unescapeKey(awsv2.ToString(obj.Key)),
+				ModTime: *obj.LastModified,
+				Size:    awsv2.ToInt64(obj.Size),
+				MD5:     eTagToMD5(obj.ETag),
+				AsFunc: func(i interface{}) bool {
+					p, ok := i.(*typesv2.Object)
+					if !ok {
+						return false
+					}
+					*p = obj
+					return true
+				},
+			}
+		}
+		for i, prefix := range resp.CommonPrefixes {
+			prefix := prefix
+			page.Objects[i+len(resp.Contents)] = &driver.ListObject{
+				Key:   unescapeKey(awsv2.ToString(prefix.Prefix)),
+				IsDir: true,
+				AsFunc: func(i interface{}) bool {
+					p, ok := i.(*typesv2.CommonPrefix)
+					if !ok {
+						return false
+					}
+					*p = prefix
+					return true
+				},
+			}
+		}
+		if len(resp.Contents) > 0 && len(resp.CommonPrefixes) > 0 {
+			// S3 gives us blobs and "directories" in separate lists; sort them.
+			sort.Slice(page.Objects, func(i, j int) bool {
+				return page.Objects[i].Key < page.Objects[j].Key
+			})
+		}
+	}
+	return &page, nil
+}
+
+func (b *bucket) listObjectsV2(ctx context.Context, in *s3v2.ListObjectsV2Input, opts *driver.ListOptions) (*s3v2.ListObjectsV2Output, error) {
+	if !b.useLegacyList {
+		var varopt []func(*s3v2.Options)
+		if opts.BeforeList != nil {
+			asFunc := func(i interface{}) bool {
+				if p, ok := i.(**s3v2.ListObjectsV2Input); ok {
+					*p = in
+					return true
+				}
+				if p, ok := i.(**[]func(*s3v2.Options)); ok {
+					*p = &varopt
+					return true
+				}
+				return false
+			}
+			if err := opts.BeforeList(asFunc); err != nil {
+				return nil, err
+			}
+		}
+		return b.clientV2.ListObjectsV2(ctx, in, varopt...)
+	}
+
+	// Use the legacy ListObjects request.
+	legacyIn := &s3v2.ListObjectsInput{
+		Bucket:       in.Bucket,
+		Delimiter:    in.Delimiter,
+		EncodingType: in.EncodingType,
+		Marker:       in.ContinuationToken,
+		MaxKeys:      in.MaxKeys,
+		Prefix:       in.Prefix,
+		RequestPayer: in.RequestPayer,
+	}
+	if opts.BeforeList != nil {
+		asFunc := func(i interface{}) bool {
+			p, ok := i.(**s3v2.ListObjectsInput)
+			if !ok {
+				return false
+			}
+			*p = legacyIn
+			return true
+		}
+		if err := opts.BeforeList(asFunc); err != nil {
+			return nil, err
+		}
+	}
+	legacyResp, err := b.clientV2.ListObjects(ctx, legacyIn)
+	if err != nil {
+		return nil, err
+	}
+
+	var nextContinuationToken *string
+	if legacyResp.NextMarker != nil {
+		nextContinuationToken = legacyResp.NextMarker
+	} else if awsv2.ToBool(legacyResp.IsTruncated) {
+		nextContinuationToken = awsv2.String(awsv2.ToString(legacyResp.Contents[len(legacyResp.Contents)-1].Key))
+	}
+	return &s3v2.ListObjectsV2Output{
+		CommonPrefixes:        legacyResp.CommonPrefixes,
+		Contents:              legacyResp.Contents,
+		NextContinuationToken: nextContinuationToken,
+	}, nil
+}
+
+// As implements driver.As.
+func (b *bucket) As(i interface{}) bool {
+	p, ok := i.(**s3v2.Client)
+	if !ok {
+		return false
+	}
+	*p = b.clientV2
+	return true
+}
+
+// As implements driver.ErrorAs.
+func (b *bucket) ErrorAs(err error, i interface{}) bool {
+	return errors.As(err, i)
+}
+
+// Attributes implements driver.Attributes.
+func (b *bucket) Attributes(ctx context.Context, key string) (*driver.Attributes, error) {
+	key = escapeKey(key)
+	in := &s3v2.HeadObjectInput{
+		Bucket: awsv2.String(b.name),
+		Key:    awsv2.String(key),
+	}
+	resp, err := b.clientV2.HeadObject(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+
+	md := make(map[string]string, len(resp.Metadata))
+	for k, v := range resp.Metadata {
+		// See the package comments for more details on escaping of metadata
+		// keys & values.
+		md[HexUnescape(URLUnescape(k))] = URLUnescape(v)
+	}
+	return &driver.Attributes{
+		CacheControl:       awsv2.ToString(resp.CacheControl),
+		ContentDisposition: awsv2.ToString(resp.ContentDisposition),
+		ContentEncoding:    awsv2.ToString(resp.ContentEncoding),
+		ContentLanguage:    awsv2.ToString(resp.ContentLanguage),
+		ContentType:        awsv2.ToString(resp.ContentType),
+		Metadata:           md,
+		// CreateTime not supported; left as the zero time.
+		ModTime: awsv2.ToTime(resp.LastModified),
+		Size:    awsv2.ToInt64(resp.ContentLength),
+		MD5:     eTagToMD5(resp.ETag),
+		ETag:    awsv2.ToString(resp.ETag),
+		AsFunc: func(i interface{}) bool {
+			p, ok := i.(*s3v2.HeadObjectOutput)
+			if !ok {
+				return false
+			}
+			*p = *resp
+			return true
+		},
+	}, nil
+}
+
+// NewRangeReader implements driver.NewRangeReader.
+func (b *bucket) NewRangeReader(ctx context.Context, key string, offset, length int64, opts *driver.ReaderOptions) (driver.Reader, error) {
+	key = escapeKey(key)
+	var byteRange *string
+	if offset > 0 && length < 0 {
+		byteRange = awsv2.String(fmt.Sprintf("bytes=%d-", offset))
+	} else if length == 0 {
+		// AWS doesn't support a zero-length read; we'll read 1 byte and then
+		// ignore it in favor of http.NoBody below.
+		byteRange = awsv2.String(fmt.Sprintf("bytes=%d-%d", offset, offset))
+	} else if length >= 0 {
+		byteRange = awsv2.String(fmt.Sprintf("bytes=%d-%d", offset, offset+length-1))
+	}
+	in := &s3v2.GetObjectInput{
+		Bucket: awsv2.String(b.name),
+		Key:    awsv2.String(key),
+		Range:  byteRange,
+	}
+	var varopt []func(*s3v2.Options)
+	if opts.BeforeRead != nil {
+		asFunc := func(i interface{}) bool {
+			if p, ok := i.(**s3v2.GetObjectInput); ok {
+				*p = in
+				return true
+			}
+			if p, ok := i.(**[]func(*s3v2.Options)); ok {
+				*p = &varopt
+				return true
+			}
+			return false
+		}
+		if err := opts.BeforeRead(asFunc); err != nil {
+			return nil, err
+		}
+	}
+	resp, err := b.clientV2.GetObject(ctx, in, varopt...)
+	if err != nil {
+		return nil, err
+	}
+	body := resp.Body
+	if length == 0 {
+		body = http.NoBody
+	}
+	return &reader{
+		useV2: true,
+		body:  body,
+		attrs: driver.ReaderAttributes{
+			ContentType: awsv2.ToString(resp.ContentType),
+			ModTime:     awsv2.ToTime(resp.LastModified),
+			Size:        getSize(awsv2.ToInt64(resp.ContentLength), awsv2.ToString(resp.ContentRange)),
+		},
+		rawV2: resp,
+	}, nil
+}
+
+// etagToMD5 processes an ETag header and returns an MD5 hash if possible.
+// S3's ETag header is sometimes a quoted hexstring of the MD5. Other times,
+// notably when the object was uploaded in multiple parts, it is not.
+// We do the best we can.
+// Some links about ETag:
+// https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html
+// https://github.com/aws/aws-sdk-net/issues/815
+// https://teppen.io/2018/06/23/aws_s3_etags/
+func eTagToMD5(etag *string) []byte {
+	if etag == nil {
+		// No header at all.
+		return nil
+	}
+	// Strip the expected leading and trailing quotes.
+	quoted := *etag
+	if len(quoted) < 2 || quoted[0] != '"' || quoted[len(quoted)-1] != '"' {
+		return nil
+	}
+	unquoted := quoted[1 : len(quoted)-1]
+	// Un-hex; we return nil on error. In particular, we'll get an error here
+	// for multi-part uploaded blobs, whose ETag will contain a "-" and so will
+	// never be a legal hex encoding.
+	md5, err := hex.DecodeString(unquoted)
+	if err != nil {
+		return nil
+	}
+	return md5
+}
+
+func getSize(contentLength int64, contentRange string) int64 {
+	// Default size to ContentLength, but that's incorrect for partial-length reads,
+	// where ContentLength refers to the size of the returned Body, not the entire
+	// size of the blob. ContentRange has the full size.
+	size := contentLength
+	if contentRange != "" {
+		// Sample: bytes 10-14/27 (where 27 is the full size).
+		parts := strings.Split(contentRange, "/")
+		if len(parts) == 2 {
+			if i, err := strconv.ParseInt(parts[1], 10, 64); err == nil {
+				size = i
+			}
+		}
+	}
+	return size
+}
+
+// escapeKey does all required escaping for UTF-8 strings to work with S3.
+func escapeKey(key string) string {
+	return HexEscape(key, func(r []rune, i int) bool {
+		c := r[i]
+		switch {
+		// S3 doesn't handle these characters (determined via experimentation).
+		case c < 32:
+			return true
+		// For "../", escape the trailing slash.
+		case i > 1 && c == '/' && r[i-1] == '.' && r[i-2] == '.':
+			return true
+		}
+		return false
+	})
+}
+
+// unescapeKey reverses escapeKey.
+func unescapeKey(key string) string {
+	return HexUnescape(key)
+}
+
+// NewTypedWriter implements driver.NewTypedWriter.
+func (b *bucket) NewTypedWriter(ctx context.Context, key string, contentType string, opts *driver.WriterOptions) (driver.Writer, error) {
+	key = escapeKey(key)
+	uploaderV2 := s3managerv2.NewUploader(b.clientV2, func(u *s3managerv2.Uploader) {
+		if opts.BufferSize != 0 {
+			u.PartSize = int64(opts.BufferSize)
+		}
+		if opts.MaxConcurrency != 0 {
+			u.Concurrency = opts.MaxConcurrency
+		}
+	})
+	md := make(map[string]string, len(opts.Metadata))
+	for k, v := range opts.Metadata {
+		// See the package comments for more details on escaping of metadata
+		// keys & values.
+		k = HexEscape(url.PathEscape(k), func(runes []rune, i int) bool {
+			c := runes[i]
+			return c == '@' || c == ':' || c == '='
+		})
+		md[k] = url.PathEscape(v)
+	}
+	reqV2 := &s3v2.PutObjectInput{
+		Bucket:      awsv2.String(b.name),
+		ContentType: awsv2.String(contentType),
+		Key:         awsv2.String(key),
+		Metadata:    md,
+	}
+	if opts.CacheControl != "" {
+		reqV2.CacheControl = awsv2.String(opts.CacheControl)
+	}
+	if opts.ContentDisposition != "" {
+		reqV2.ContentDisposition = awsv2.String(opts.ContentDisposition)
+	}
+	if opts.ContentEncoding != "" {
+		reqV2.ContentEncoding = awsv2.String(opts.ContentEncoding)
+	}
+	if opts.ContentLanguage != "" {
+		reqV2.ContentLanguage = awsv2.String(opts.ContentLanguage)
+	}
+	if len(opts.ContentMD5) > 0 {
+		reqV2.ContentMD5 = awsv2.String(base64.StdEncoding.EncodeToString(opts.ContentMD5))
+	}
+	if opts.BeforeWrite != nil {
+		asFunc := func(i interface{}) bool {
+			// Note that since the Go CDK Blob
+			// abstraction does not expose AWS's
+			// Uploader concept, there does not
+			// appear to be any utility in
+			// exposing the options list to the v2
+			// Uploader's Upload() method.
+			// Instead, applications can
+			// manipulate the exposed *Uploader
+			// directly, including by setting
+			// ClientOptions if needed.
+			if p, ok := i.(**s3managerv2.Uploader); ok {
+				*p = uploaderV2
+				return true
+			}
+			if p, ok := i.(**s3v2.PutObjectInput); ok {
+				*p = reqV2
+				return true
+			}
+			return false
+		}
+		if err := opts.BeforeWrite(asFunc); err != nil {
+			return nil, err
+		}
+	}
+	return &writer{
+		ctx:        ctx,
+		useV2:      true,
+		uploaderV2: uploaderV2,
+		reqV2:      reqV2,
+		donec:      make(chan struct{}),
+	}, nil
+}
+
+// Copy implements driver.Copy.
+func (b *bucket) Copy(ctx context.Context, dstKey, srcKey string, opts *driver.CopyOptions) error {
+	dstKey = escapeKey(dstKey)
+	srcKey = escapeKey(srcKey)
+	input := &s3v2.CopyObjectInput{
+		Bucket:     awsv2.String(b.name),
+		CopySource: awsv2.String(b.name + "/" + srcKey),
+		Key:        awsv2.String(dstKey),
+	}
+	if opts.BeforeCopy != nil {
+		asFunc := func(i interface{}) bool {
+			switch v := i.(type) {
+			case **s3v2.CopyObjectInput:
+				*v = input
+				return true
+			}
+			return false
+		}
+		if err := opts.BeforeCopy(asFunc); err != nil {
+			return err
+		}
+	}
+	_, err := b.clientV2.CopyObject(ctx, input)
+	return err
+}
+
+// Delete implements driver.Delete.
+func (b *bucket) Delete(ctx context.Context, key string) error {
+	if _, err := b.Attributes(ctx, key); err != nil {
+		return err
+	}
+	key = escapeKey(key)
+	input := &s3v2.DeleteObjectInput{
+		Bucket: awsv2.String(b.name),
+		Key:    awsv2.String(key),
+	}
+	_, err := b.clientV2.DeleteObject(ctx, input)
+	return err
+}
+
+func (b *bucket) SignedURL(ctx context.Context, key string, opts *driver.SignedURLOptions) (string, error) {
+	key = escapeKey(key)
+	switch opts.Method {
+	case http.MethodGet:
+		in := &s3v2.GetObjectInput{
+			Bucket: awsv2.String(b.name),
+			Key:    awsv2.String(key),
+		}
+		if opts.BeforeSign != nil {
+			asFunc := func(i interface{}) bool {
+				v, ok := i.(**s3v2.GetObjectInput)
+				if ok {
+					*v = in
+				}
+				return ok
+			}
+			if err := opts.BeforeSign(asFunc); err != nil {
+				return "", err
+			}
+		}
+		p, err := s3v2.NewPresignClient(b.clientV2, s3v2.WithPresignExpires(opts.Expiry)).PresignGetObject(ctx, in)
+		if err != nil {
+			return "", err
+		}
+		return p.URL, nil
+	case http.MethodPut:
+		in := &s3v2.PutObjectInput{
+			Bucket: awsv2.String(b.name),
+			Key:    awsv2.String(key),
+		}
+		if opts.EnforceAbsentContentType || opts.ContentType != "" {
+			// https://github.com/aws/aws-sdk-go-v2/issues/1475
+			return "", errors.New("s3blob: AWS SDK v2 does not supported enforcing ContentType in SignedURLs for PUT")
+		}
+		if opts.BeforeSign != nil {
+			asFunc := func(i interface{}) bool {
+				v, ok := i.(**s3v2.PutObjectInput)
+				if ok {
+					*v = in
+				}
+				return ok
+			}
+			if err := opts.BeforeSign(asFunc); err != nil {
+				return "", err
+			}
+		}
+		p, err := s3v2.NewPresignClient(b.clientV2, s3v2.WithPresignExpires(opts.Expiry)).PresignPutObject(ctx, in)
+		if err != nil {
+			return "", err
+		}
+		return p.URL, nil
+	}
+	return "", fmt.Errorf("unsupported Method %q", opts.Method)
+}

tools/logger/batch_handler.go

@@ -2,9 +2,12 @@ package logger
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"log/slog"
 	"sync"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -251,14 +254,73 @@ func (h *BatchHandler) resolveAttr(data map[string]any, attr slog.Attr) error {
 			data[attr.Key] = groupData
 		}
 	default:
-		v := attr.Value.Any()
-
-		if err, ok := v.(error); ok {
-			data[attr.Key] = err.Error()
-		} else {
-			data[attr.Key] = v
-		}
+		data[attr.Key] = normalizeLogAttrValue(attr.Value.Any())
 	}
 
 	return nil
 }
+
+func normalizeLogAttrValue(rawAttrValue any) any {
+	switch attrV := rawAttrValue.(type) {
+	case validation.Errors:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]validation.Error:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]error:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]any:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			switch vv := v.(type) {
+			case error:
+				out[k] = serializeLogError(vv)
+			default:
+				out[k] = normalizeLogAttrValue(vv)
+			}
+		}
+		return out
+	case error:
+		// check for wrapped validation.Errors
+		var ve validation.Errors
+		if errors.As(attrV, &ve) {
+			out := make(map[string]any, len(ve))
+			for k, v := range ve {
+				out[k] = serializeLogError(v)
+			}
+			return map[string]any{
+				"data": out,
+				"raw":  serializeLogError(attrV),
+			}
+		}
+		return serializeLogError(attrV)
+	default:
+		return attrV
+	}
+}
+
+func serializeLogError(err error) any {
+	if err == nil {
+		return nil
+	}
+
+	// prioritize a json structured format (e.g. validation.Errors)
+	jsonErr, ok := err.(json.Marshaler)
+	if ok {
+		return jsonErr
+	}
+
+	// fallback to its original string representation
+	return err.Error()
+}

tools/logger/batch_handler_test.go

@@ -7,6 +7,8 @@ import (
 	"log/slog"
 	"testing"
 	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 )
 
 func TestNewBatchHandlerPanic(t *testing.T) {
@@ -283,14 +285,45 @@ func TestBatchHandlerAttrsFormat(t *testing.T) {
 	h1.Handle(ctx, record)
 	h2.Handle(ctx, record)
 
+	// errors serialization checks
+	errorsRecord := slog.NewRecord(time.Now(), slog.LevelError, "details", 0)
+	errorsRecord.Add("validation.Errors", validation.Errors{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	})
+	errorsRecord.Add("wrapped_validation.Errors", fmt.Errorf("wrapped: %w", validation.Errors{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	}))
+	errorsRecord.Add("map[string]any", map[string]any{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+		"c": "test_any",
+		"d": map[string]any{
+			"nestedA": validation.NewError("nested_code", "nested_message"),
+			"nestedB": errors.New("nested_plain"),
+		},
+	})
+	errorsRecord.Add("map[string]error", map[string]error{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	})
+	errorsRecord.Add("map[string]validation.Error", map[string]validation.Error{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": nil,
+	})
+	errorsRecord.Add("plain_error", errors.New("plain"))
+	h0.Handle(ctx, errorsRecord)
+
 	expected := []string{
 		`{"name":"test"}`,
 		`{"a":1,"b":"123","name":"test"}`,
 		`{"a":1,"b":"123","sub":{"c":3,"d":{"d.1":1},"e":"example error","name":"test"}}`,
+		`{"map[string]any":{"a":"validation_message","b":"plain","c":"test_any","d":{"nestedA":"nested_message","nestedB":"nested_plain"}},"map[string]error":{"a":"validation_message","b":"plain"},"map[string]validation.Error":{"a":"validation_message","b":null},"plain_error":"plain","validation.Errors":{"a":"validation_message","b":"plain"},"wrapped_validation.Errors":{"data":{"a":"validation_message","b":"plain"},"raw":"wrapped: a: validation_message; b: plain."}}`,
 	}
 
 	if len(beforeLogs) != len(expected) {
-		t.Fatalf("Expected %d logs, got %d", len(beforeLogs), len(expected))
+		t.Fatalf("Expected %d logs, got %d", len(expected), len(beforeLogs))
 	}
 
 	for i, data := range expected {

tools/mailer/sendmail.go

@@ -74,5 +74,5 @@ func findSendmailPath() (string, error) {
 		}
 	}
 
-	return "", errors.New("Failed to locate a sendmail executable path.")
+	return "", errors.New("failed to locate a sendmail executable path")
 }

tools/rest/json_serializer_test.go

@@ -54,14 +54,6 @@ func TestSerialize(t *testing.T) {
 			"fields=missing",
 			`{"a":1,"b":2,"c":"test"}`,
 		},
-		{
-			"<200 response",
-			rest.Serializer{},
-			199,
-			map[string]any{"a": 1, "b": 2, "c": "test"},
-			"fields=missing",
-			`{"a":1,"b":2,"c":"test"}`,
-		},
 		{
 			"non map response",
 			rest.Serializer{},

tools/rest/multi_binder.go

@@ -6,10 +6,11 @@ import (
 	"io"
 	"net/http"
 	"reflect"
+	"regexp"
+	"strconv"
 	"strings"
 
 	"github.com/labstack/echo/v5"
-	"github.com/spf13/cast"
 )
 
 // MultipartJsonKey is the key for the special multipart/form-data
@@ -144,12 +145,16 @@ func bindFormData(c echo.Context, i any) error {
 	return echo.BindBody(c, i)
 }
 
+var inferNumberCharsRegex = regexp.MustCompile(`^[\-\.\d]+$`)
+
 // In order to support more seamlessly both json and multipart/form-data requests,
 // the following normalization rules are applied for plain multipart string values:
-// - "true" is converted to the json `true`
-// - "false" is converted to the json `false`
-// - numeric (non-scientific) strings are converted to json number
-// - any other string (empty string too) is left as it is
+//   - "true" is converted to the json "true"
+//   - "false" is converted to the json "false"
+//   - numeric strings are converted to json number ONLY if the resulted
+//     minimal number string representation is the same as the provided raw string
+//     (aka. scientific notations, "Infinity", "0.0", "0001", etc. are kept as string)
+//   - any other string (empty string too) is left as it is
 func normalizeMultipartValue(raw string) any {
 	switch raw {
 	case "":
@@ -159,8 +164,12 @@ func normalizeMultipartValue(raw string) any {
 	case "false":
 		return false
 	default:
-		if raw[0] == '-' || (raw[0] >= '0' && raw[0] <= '9') {
-			if v, err := cast.ToFloat64E(raw); err == nil {
+		// try to convert to number
+		//
+		// note: expects the provided raw string to match exactly with the minimal string representation of the parsed float
+		if raw[0] == '-' || (raw[0] >= '0' && raw[0] <= '9') && inferNumberCharsRegex.Match([]byte(raw)) {
+			v, err := strconv.ParseFloat(raw, 64)
+			if err == nil && strconv.FormatFloat(v, 'f', -1, 64) == raw {
 				return v
 			}
 		}

tools/search/filter.go

@@ -432,16 +432,15 @@ func mergeParams(params ...dbx.Params) dbx.Params {
 }
 
 // wrapLikeParams wraps each provided param value string with `%`
-// if the string doesn't contains the `%` char (including its escape sequence).
+// if the param doesn't contain an explicit wildcard (`%`) character already.
 func wrapLikeParams(params dbx.Params) dbx.Params {
 	result := dbx.Params{}
 
 	for k, v := range params {
 		vStr := cast.ToString(v)
-		if !strings.Contains(vStr, "%") {
-			for i := 0; i < len(dbx.DefaultLikeEscape); i += 2 {
-				vStr = strings.ReplaceAll(vStr, dbx.DefaultLikeEscape[i], dbx.DefaultLikeEscape[i+1])
-			}
+		if !containsUnescapedChar(vStr, '%') {
+			// note: this is done to minimize the breaking changes and to preserve the original autoescape behavior
+			vStr = escapeUnescapedChars(vStr, '\\', '%', '_')
 			vStr = "%" + vStr + "%"
 		}
 		result[k] = vStr
@@ -450,6 +449,63 @@ func wrapLikeParams(params dbx.Params) dbx.Params {
 	return result
 }
 
+func escapeUnescapedChars(str string, escapeChars ...rune) string {
+	rs := []rune(str)
+	total := len(rs)
+	result := make([]rune, 0, total)
+
+	var match bool
+
+	for i := total - 1; i >= 0; i-- {
+		if match {
+			// check if already escaped
+			if rs[i] != '\\' {
+				result = append(result, '\\')
+			}
+			match = false
+		} else {
+			for _, ec := range escapeChars {
+				if rs[i] == ec {
+					match = true
+					break
+				}
+			}
+		}
+
+		result = append(result, rs[i])
+
+		// in case the matching char is at the beginning
+		if i == 0 && match {
+			result = append(result, '\\')
+		}
+	}
+
+	// reverse
+	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
+		result[i], result[j] = result[j], result[i]
+	}
+
+	return string(result)
+}
+
+func containsUnescapedChar(str string, ch rune) bool {
+	var prev rune
+
+	for _, c := range str {
+		if c == ch && prev != '\\' {
+			return true
+		}
+
+		if c == '\\' && prev == '\\' {
+			prev = rune(0) // reset escape sequence
+		} else {
+			prev = c
+		}
+	}
+
+	return false
+}
+
 // -------------------------------------------------------------------
 
 var _ dbx.Expression = (*opExpr)(nil)

tools/search/filter_test.go

@@ -238,3 +238,68 @@ func TestFilterDataBuildExprWithParams(t *testing.T) {
 		t.Fatalf("Expected query \n%s, \ngot \n%s", expectedQuery, calledQueries[0])
 	}
 }
+
+func TestLikeParamsWrapping(t *testing.T) {
+	// create a dummy db
+	sqlDB, err := sql.Open("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	db := dbx.NewFromDB(sqlDB, "sqlite")
+
+	calledQueries := []string{}
+	db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	resolver := search.NewSimpleFieldResolver(`^test\w+$`)
+
+	filter := search.FilterData(`
+		test1 ~ {:p1} ||
+		test2 ~ {:p2} ||
+		test3 ~ {:p3} ||
+		test4 ~ {:p4} ||
+		test5 ~ {:p5} ||
+		test6 ~ {:p6} ||
+		test7 ~ {:p7} ||
+		test8 ~ {:p8} ||
+		test9 ~ {:p9} ||
+		test10 ~ {:p10} ||
+		test11 ~ {:p11} ||
+		test12 ~ {:p12}
+	`)
+
+	replacements := []dbx.Params{
+		{"p1": `abc`},
+		{"p2": `ab%c`},
+		{"p3": `ab\%c`},
+		{"p4": `%ab\%c`},
+		{"p5": `ab\\%c`},
+		{"p6": `ab\\\%c`},
+		{"p7": `ab_c`},
+		{"p8": `ab\_c`},
+		{"p9": `%ab_c`},
+		{"p10": `ab\c`},
+		{"p11": `_ab\c_`},
+		{"p12": `ab\c%`},
+	}
+
+	expr, err := filter.BuildExpr(resolver, replacements...)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	db.Select().Where(expr).Build().Execute()
+
+	if len(calledQueries) != 1 {
+		t.Fatalf("Expected 1 query, got %d", len(calledQueries))
+	}
+
+	expectedQuery := `SELECT * WHERE ([[test1]] LIKE '%abc%' ESCAPE '\' OR [[test2]] LIKE 'ab%c' ESCAPE '\' OR [[test3]] LIKE 'ab\\%c' ESCAPE '\' OR [[test4]] LIKE '%ab\\%c' ESCAPE '\' OR [[test5]] LIKE 'ab\\\\%c' ESCAPE '\' OR [[test6]] LIKE 'ab\\\\\\%c' ESCAPE '\' OR [[test7]] LIKE '%ab\_c%' ESCAPE '\' OR [[test8]] LIKE '%ab\\\_c%' ESCAPE '\' OR [[test9]] LIKE '%ab_c' ESCAPE '\' OR [[test10]] LIKE '%ab\\c%' ESCAPE '\' OR [[test11]] LIKE '%\_ab\\c\_%' ESCAPE '\' OR [[test12]] LIKE 'ab\\c%' ESCAPE '\')`
+	if expectedQuery != calledQueries[0] {
+		t.Fatalf("Expected query \n%s, \ngot \n%s", expectedQuery, calledQueries[0])
+	}
+}

tools/search/simple_field_resolver.go

@@ -76,7 +76,7 @@ func (r *SimpleFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
 // Returns error if `field` is not in `r.allowedFields`.
 func (r *SimpleFieldResolver) Resolve(field string) (*ResolverResult, error) {
 	if !list.ExistInSliceWithRegex(field, r.allowedFields) {
-		return nil, fmt.Errorf("Failed to resolve field %q.", field)
+		return nil, fmt.Errorf("failed to resolve field %q", field)
 	}
 
 	parts := strings.Split(field, ".")

tools/security/encrypt.go

@@ -8,7 +8,9 @@ import (
 	"io"
 )
 
-// Encrypt encrypts data with key (must be valid 32 char aes key).
+// Encrypt encrypts "data" with the specified "key" (must be valid 32 char AES key).
+//
+// This method uses AES-256-GCM block cypher mode.
 func Encrypt(data []byte, key string) (string, error) {
 	block, err := aes.NewCipher([]byte(key))
 	if err != nil {
@@ -34,7 +36,9 @@ func Encrypt(data []byte, key string) (string, error) {
 	return result, nil
 }
 
-// Decrypt decrypts encrypted text with key (must be valid 32 chars aes key).
+// Decrypt decrypts encrypted text with key (must be valid 32 chars AES key).
+//
+// This method uses AES-256-GCM block cypher mode.
 func Decrypt(cipherText string, key string) ([]byte, error) {
 	block, err := aes.NewCipher([]byte(key))
 	if err != nil {

tools/security/jwt.go

@@ -39,7 +39,7 @@ func ParseJWT(token string, verificationKey string) (jwt.MapClaims, error) {
 		return claims, nil
 	}
 
-	return nil, errors.New("Unable to parse token.")
+	return nil, errors.New("unable to parse token")
 }
 
 // NewJWT generates and returns new HS256 signed JWT.

tools/subscriptions/client.go

@@ -37,7 +37,7 @@ type Client interface {
 	// Channel returns the client's communication channel.
 	Channel() chan Message
 
-	// Subscriptions returns a shallow copy of the the client subscriptions matching the prefixes.
+	// Subscriptions returns a shallow copy of the client subscriptions matching the prefixes.
 	// If no prefix is specified, returns all subscriptions.
 	Subscriptions(prefixes ...string) map[string]SubscriptionOptions
 
@@ -123,7 +123,7 @@ func (c *DefaultClient) Channel() chan Message {
 
 // Subscriptions implements the [Client.Subscriptions] interface method.
 //
-// It returns a shallow copy of the the client subscriptions matching the prefixes.
+// It returns a shallow copy of the client subscriptions matching the prefixes.
 // If no prefix is specified, returns all subscriptions.
 func (c *DefaultClient) Subscriptions(prefixes ...string) map[string]SubscriptionOptions {
 	c.mux.RLock()

tools/types/json_array.go

@@ -41,7 +41,7 @@ func (m *JsonArray[T]) Scan(value any) error {
 	case string:
 		data = []byte(v)
 	default:
-		return fmt.Errorf("Failed to unmarshal JsonArray value: %q.", value)
+		return fmt.Errorf("failed to unmarshal JsonArray value: %q", value)
 	}
 
 	if len(data) == 0 {

tools/types/json_map.go

@@ -56,7 +56,7 @@ func (m *JsonMap) Scan(value any) error {
 	case string:
 		data = []byte(v)
 	default:
-		return fmt.Errorf("Failed to unmarshal JsonMap value: %q.", value)
+		return fmt.Errorf("failed to unmarshal JsonMap value: %q", value)
 	}
 
 	if len(data) == 0 {

ui/.env

@@ -9,4 +9,4 @@ PB_DOCS_URL            = "https://pocketbase.io/docs/"
 PB_JS_SDK_URL          = "https://github.com/pocketbase/js-sdk"
 PB_DART_SDK_URL        = "https://github.com/pocketbase/dart-sdk"
 PB_RELEASES            = "https://github.com/pocketbase/pocketbase/releases"
-PB_VERSION             = "v0.22.0"
+PB_VERSION             = "v0.22.43"

ui/dist/assets/AuthMethodsDocs-CB1jQk7j.js

@@ -1,4 +1,4 @@
-import{S as Se,i as ye,s as Ae,O as G,e as c,v as w,b as k,c as se,f as p,g as d,h as a,m as ae,w as U,P as ve,Q as Te,k as je,R as Be,n as Oe,t as W,a as V,o as u,d as ne,C as Fe,A as Qe,q as L,r as Ne,N as qe}from"./index-EDzELPnf.js";import{S as He}from"./SdkTabs-kh3uN9zO.js";import{F as Ke}from"./FieldsQueryParam-DzH1jTTy.js";function Ce(n,l,o){const s=n.slice();return s[5]=l[o],s}function Pe(n,l,o){const s=n.slice();return s[5]=l[o],s}function $e(n,l){let o,s=l[5].code+"",_,f,i,h;function m(){return l[4](l[5])}return{key:n,first:null,c(){o=c("button"),_=w(s),f=k(),p(o,"class","tab-item"),L(o,"active",l[1]===l[5].code),this.first=o},m(v,C){d(v,o,C),a(o,_),a(o,f),i||(h=Ne(o,"click",m),i=!0)},p(v,C){l=v,C&4&&s!==(s=l[5].code+"")&&U(_,s),C&6&&L(o,"active",l[1]===l[5].code)},d(v){v&&u(o),i=!1,h()}}}function Me(n,l){let o,s,_,f;return s=new qe({props:{content:l[5].body}}),{key:n,first:null,c(){o=c("div"),se(s.$$.fragment),_=k(),p(o,"class","tab-item"),L(o,"active",l[1]===l[5].code),this.first=o},m(i,h){d(i,o,h),ae(s,o,null),a(o,_),f=!0},p(i,h){l=i;const m={};h&4&&(m.content=l[5].body),s.$set(m),(!f||h&6)&&L(o,"active",l[1]===l[5].code)},i(i){f||(W(s.$$.fragment,i),f=!0)},o(i){V(s.$$.fragment,i),f=!1},d(i){i&&u(o),ne(s)}}}function ze(n){var be,ke;let l,o,s=n[0].name+"",_,f,i,h,m,v,C,q=n[0].name+"",E,ie,I,P,J,T,Y,$,H,ce,K,j,re,R,z=n[0].name+"",X,de,Z,B,x,M,ee,ue,te,A,le,O,oe,S,F,g=[],he=new Map,me,Q,b=[],fe=new Map,y;P=new He({props:{js:`
+import{S as Se,i as ye,s as Te,O as G,b as d,d as se,t as U,a as W,r as V,Q as ve,R as je,g as Ae,T as Be,e as Oe,f as u,h as a,m as ae,n as c,u as w,k,c as ne,o as p,C as Fe,p as Qe,w as L,x as Ne,N as He}from"./index-Cp1ITsy4.js";import{S as Ke}from"./SdkTabs-CC2VqpMG.js";import{F as qe}from"./FieldsQueryParam-BH5ZNe0x.js";function Ce(n,l,o){const s=n.slice();return s[5]=l[o],s}function Pe(n,l,o){const s=n.slice();return s[5]=l[o],s}function $e(n,l){let o,s=l[5].code+"",_,f,i,h;function m(){return l[4](l[5])}return{key:n,first:null,c(){o=c("button"),_=w(s),f=k(),p(o,"class","tab-item"),L(o,"active",l[1]===l[5].code),this.first=o},m(v,C){u(v,o,C),a(o,_),a(o,f),i||(h=Ne(o,"click",m),i=!0)},p(v,C){l=v,C&4&&s!==(s=l[5].code+"")&&V(_,s),C&6&&L(o,"active",l[1]===l[5].code)},d(v){v&&d(o),i=!1,h()}}}function Me(n,l){let o,s,_,f;return s=new He({props:{content:l[5].body}}),{key:n,first:null,c(){o=c("div"),ne(s.$$.fragment),_=k(),p(o,"class","tab-item"),L(o,"active",l[1]===l[5].code),this.first=o},m(i,h){u(i,o,h),ae(s,o,null),a(o,_),f=!0},p(i,h){l=i;const m={};h&4&&(m.content=l[5].body),s.$set(m),(!f||h&6)&&L(o,"active",l[1]===l[5].code)},i(i){f||(W(s.$$.fragment,i),f=!0)},o(i){U(s.$$.fragment,i),f=!1},d(i){i&&d(o),se(s)}}}function ze(n){var be,ke;let l,o,s=n[0].name+"",_,f,i,h,m,v,C,H=n[0].name+"",E,ie,I,P,J,j,Y,$,K,ce,q,A,re,R,z=n[0].name+"",X,de,Z,B,x,M,ee,ue,te,T,le,O,oe,S,F,g=[],he=new Map,me,Q,b=[],fe=new Map,y;P=new Ke({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${n[3]}');
@@ -14,7 +14,7 @@ import{S as Se,i as ye,s as Ae,O as G,e as c,v as w,b as k,c as se,f as p,g as d
         ...
 
         final result = await pb.collection('${(ke=n[0])==null?void 0:ke.name}').listAuthMethods();
-    `}}),A=new Ke({});let D=G(n[2]);const pe=e=>e[5].code;for(let e=0;e<D.length;e+=1){let t=Pe(n,D,e),r=pe(t);he.set(r,g[e]=$e(r,t))}let N=G(n[2]);const _e=e=>e[5].code;for(let e=0;e<N.length;e+=1){let t=Ce(n,N,e),r=_e(t);fe.set(r,b[e]=Me(r,t))}return{c(){l=c("h3"),o=w("List auth methods ("),_=w(s),f=w(")"),i=k(),h=c("div"),m=c("p"),v=w("Returns a public list with all allowed "),C=c("strong"),E=w(q),ie=w(" authentication methods."),I=k(),se(P.$$.fragment),J=k(),T=c("h6"),T.textContent="API details",Y=k(),$=c("div"),H=c("strong"),H.textContent="GET",ce=k(),K=c("div"),j=c("p"),re=w("/api/collections/"),R=c("strong"),X=w(z),de=w("/auth-methods"),Z=k(),B=c("div"),B.textContent="Query parameters",x=k(),M=c("table"),ee=c("thead"),ee.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr>',ue=k(),te=c("tbody"),se(A.$$.fragment),le=k(),O=c("div"),O.textContent="Responses",oe=k(),S=c("div"),F=c("div");for(let e=0;e<g.length;e+=1)g[e].c();me=k(),Q=c("div");for(let e=0;e<b.length;e+=1)b[e].c();p(l,"class","m-b-sm"),p(h,"class","content txt-lg m-b-sm"),p(T,"class","m-b-xs"),p(H,"class","label label-primary"),p(K,"class","content"),p($,"class","alert alert-info"),p(B,"class","section-title"),p(M,"class","table-compact table-border m-b-base"),p(O,"class","section-title"),p(F,"class","tabs-header compact combined left"),p(Q,"class","tabs-content"),p(S,"class","tabs")},m(e,t){d(e,l,t),a(l,o),a(l,_),a(l,f),d(e,i,t),d(e,h,t),a(h,m),a(m,v),a(m,C),a(C,E),a(m,ie),d(e,I,t),ae(P,e,t),d(e,J,t),d(e,T,t),d(e,Y,t),d(e,$,t),a($,H),a($,ce),a($,K),a(K,j),a(j,re),a(j,R),a(R,X),a(j,de),d(e,Z,t),d(e,B,t),d(e,x,t),d(e,M,t),a(M,ee),a(M,ue),a(M,te),ae(A,te,null),d(e,le,t),d(e,O,t),d(e,oe,t),d(e,S,t),a(S,F);for(let r=0;r<g.length;r+=1)g[r]&&g[r].m(F,null);a(S,me),a(S,Q);for(let r=0;r<b.length;r+=1)b[r]&&b[r].m(Q,null);y=!0},p(e,[t]){var ge,we;(!y||t&1)&&s!==(s=e[0].name+"")&&U(_,s),(!y||t&1)&&q!==(q=e[0].name+"")&&U(E,q);const r={};t&9&&(r.js=`
+    `}}),T=new qe({});let D=G(n[2]);const pe=e=>e[5].code;for(let e=0;e<D.length;e+=1){let t=Pe(n,D,e),r=pe(t);he.set(r,g[e]=$e(r,t))}let N=G(n[2]);const _e=e=>e[5].code;for(let e=0;e<N.length;e+=1){let t=Ce(n,N,e),r=_e(t);fe.set(r,b[e]=Me(r,t))}return{c(){l=c("h3"),o=w("List auth methods ("),_=w(s),f=w(")"),i=k(),h=c("div"),m=c("p"),v=w("Returns a public list with all allowed "),C=c("strong"),E=w(H),ie=w(" authentication methods."),I=k(),ne(P.$$.fragment),J=k(),j=c("h6"),j.textContent="API details",Y=k(),$=c("div"),K=c("strong"),K.textContent="GET",ce=k(),q=c("div"),A=c("p"),re=w("/api/collections/"),R=c("strong"),X=w(z),de=w("/auth-methods"),Z=k(),B=c("div"),B.textContent="Query parameters",x=k(),M=c("table"),ee=c("thead"),ee.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr>',ue=k(),te=c("tbody"),ne(T.$$.fragment),le=k(),O=c("div"),O.textContent="Responses",oe=k(),S=c("div"),F=c("div");for(let e=0;e<g.length;e+=1)g[e].c();me=k(),Q=c("div");for(let e=0;e<b.length;e+=1)b[e].c();p(l,"class","m-b-sm"),p(h,"class","content txt-lg m-b-sm"),p(j,"class","m-b-xs"),p(K,"class","label label-primary"),p(q,"class","content"),p($,"class","alert alert-info"),p(B,"class","section-title"),p(M,"class","table-compact table-border m-b-base"),p(O,"class","section-title"),p(F,"class","tabs-header compact combined left"),p(Q,"class","tabs-content"),p(S,"class","tabs")},m(e,t){u(e,l,t),a(l,o),a(l,_),a(l,f),u(e,i,t),u(e,h,t),a(h,m),a(m,v),a(m,C),a(C,E),a(m,ie),u(e,I,t),ae(P,e,t),u(e,J,t),u(e,j,t),u(e,Y,t),u(e,$,t),a($,K),a($,ce),a($,q),a(q,A),a(A,re),a(A,R),a(R,X),a(A,de),u(e,Z,t),u(e,B,t),u(e,x,t),u(e,M,t),a(M,ee),a(M,ue),a(M,te),ae(T,te,null),u(e,le,t),u(e,O,t),u(e,oe,t),u(e,S,t),a(S,F);for(let r=0;r<g.length;r+=1)g[r]&&g[r].m(F,null);a(S,me),a(S,Q);for(let r=0;r<b.length;r+=1)b[r]&&b[r].m(Q,null);y=!0},p(e,[t]){var ge,we;(!y||t&1)&&s!==(s=e[0].name+"")&&V(_,s),(!y||t&1)&&H!==(H=e[0].name+"")&&V(E,H);const r={};t&9&&(r.js=`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${e[3]}');
@@ -30,7 +30,7 @@ import{S as Se,i as ye,s as Ae,O as G,e as c,v as w,b as k,c as se,f as p,g as d
         ...
 
         final result = await pb.collection('${(we=e[0])==null?void 0:we.name}').listAuthMethods();
-    `),P.$set(r),(!y||t&1)&&z!==(z=e[0].name+"")&&U(X,z),t&6&&(D=G(e[2]),g=ve(g,t,pe,1,e,D,he,F,Te,$e,null,Pe)),t&6&&(N=G(e[2]),je(),b=ve(b,t,_e,1,e,N,fe,Q,Be,Me,null,Ce),Oe())},i(e){if(!y){W(P.$$.fragment,e),W(A.$$.fragment,e);for(let t=0;t<N.length;t+=1)W(b[t]);y=!0}},o(e){V(P.$$.fragment,e),V(A.$$.fragment,e);for(let t=0;t<b.length;t+=1)V(b[t]);y=!1},d(e){e&&(u(l),u(i),u(h),u(I),u(J),u(T),u(Y),u($),u(Z),u(B),u(x),u(M),u(le),u(O),u(oe),u(S)),ne(P,e),ne(A);for(let t=0;t<g.length;t+=1)g[t].d();for(let t=0;t<b.length;t+=1)b[t].d()}}}function De(n,l,o){let s,{collection:_}=l,f=200,i=[];const h=m=>o(1,f=m.code);return n.$$set=m=>{"collection"in m&&o(0,_=m.collection)},o(3,s=Fe.getApiExampleUrl(Qe.baseUrl)),o(2,i=[{code:200,body:`
+    `),P.$set(r),(!y||t&1)&&z!==(z=e[0].name+"")&&V(X,z),t&6&&(D=G(e[2]),g=ve(g,t,pe,1,e,D,he,F,je,$e,null,Pe)),t&6&&(N=G(e[2]),Ae(),b=ve(b,t,_e,1,e,N,fe,Q,Be,Me,null,Ce),Oe())},i(e){if(!y){W(P.$$.fragment,e),W(T.$$.fragment,e);for(let t=0;t<N.length;t+=1)W(b[t]);y=!0}},o(e){U(P.$$.fragment,e),U(T.$$.fragment,e);for(let t=0;t<b.length;t+=1)U(b[t]);y=!1},d(e){e&&(d(l),d(i),d(h),d(I),d(J),d(j),d(Y),d($),d(Z),d(B),d(x),d(M),d(le),d(O),d(oe),d(S)),se(P,e),se(T);for(let t=0;t<g.length;t+=1)g[t].d();for(let t=0;t<b.length;t+=1)b[t].d()}}}function De(n,l,o){let s,{collection:_}=l,f=200,i=[];const h=m=>o(1,f=m.code);return n.$$set=m=>{"collection"in m&&o(0,_=m.collection)},o(3,s=Fe.getApiExampleUrl(Qe.baseUrl)),o(2,i=[{code:200,body:`
                 {
                   "usernamePassword": true,
                   "emailPassword": true,
@@ -61,4 +61,4 @@ import{S as Se,i as ye,s as Ae,O as G,e as c,v as w,b as k,c as se,f as p,g as d
                     }
                   ]
                 }
-            `}]),[_,f,i,s,h]}class Ve extends Se{constructor(l){super(),ye(this,l,De,ze,Ae,{collection:0})}}export{Ve as default};
+            `}]),[_,f,i,s,h]}class Ve extends Se{constructor(l){super(),ye(this,l,De,ze,Te,{collection:0})}}export{Ve as default};

ui/dist/assets/AuthRefreshDocs-D6iytw6U.js

@@ -1,4 +1,4 @@
-import{S as je,i as xe,s as Je,N as Ue,O as J,e as s,v as k,b as p,c as K,f as b,g as d,h as o,m as I,w as de,P as Ee,Q as Ke,k as Ie,R as We,n as Ge,t as N,a as V,o as u,d as W,C as Le,A as Xe,q as G,r as Ye}from"./index-EDzELPnf.js";import{S as Ze}from"./SdkTabs-kh3uN9zO.js";import{F as et}from"./FieldsQueryParam-DzH1jTTy.js";function Ne(r,l,a){const n=r.slice();return n[5]=l[a],n}function Ve(r,l,a){const n=r.slice();return n[5]=l[a],n}function ze(r,l){let a,n=l[5].code+"",m,_,i,h;function g(){return l[4](l[5])}return{key:r,first:null,c(){a=s("button"),m=k(n),_=p(),b(a,"class","tab-item"),G(a,"active",l[1]===l[5].code),this.first=a},m(v,w){d(v,a,w),o(a,m),o(a,_),i||(h=Ye(a,"click",g),i=!0)},p(v,w){l=v,w&4&&n!==(n=l[5].code+"")&&de(m,n),w&6&&G(a,"active",l[1]===l[5].code)},d(v){v&&u(a),i=!1,h()}}}function Qe(r,l){let a,n,m,_;return n=new Ue({props:{content:l[5].body}}),{key:r,first:null,c(){a=s("div"),K(n.$$.fragment),m=p(),b(a,"class","tab-item"),G(a,"active",l[1]===l[5].code),this.first=a},m(i,h){d(i,a,h),I(n,a,null),o(a,m),_=!0},p(i,h){l=i;const g={};h&4&&(g.content=l[5].body),n.$set(g),(!_||h&6)&&G(a,"active",l[1]===l[5].code)},i(i){_||(N(n.$$.fragment,i),_=!0)},o(i){V(n.$$.fragment,i),_=!1},d(i){i&&u(a),W(n)}}}function tt(r){var De,Fe;let l,a,n=r[0].name+"",m,_,i,h,g,v,w,B,X,S,z,ue,Q,M,pe,Y,U=r[0].name+"",Z,he,fe,j,ee,D,te,T,oe,be,F,C,le,me,ae,_e,f,ke,R,ge,ve,$e,se,ye,ne,Se,we,Te,re,Ce,Pe,A,ie,O,ce,P,H,y=[],Re=new Map,Ae,E,$=[],qe=new Map,q;v=new Ze({props:{js:`
+import{S as Ue,i as je,s as Je,N as Qe,O as J,b as d,d as K,t as N,a as V,r as de,Q as Ee,R as Ke,g as Ie,T as We,e as Ge,f as u,h as o,m as I,n as s,u as k,k as p,c as W,o as b,C as Le,p as Xe,w as G,x as Ye}from"./index-Cp1ITsy4.js";import{S as Ze}from"./SdkTabs-CC2VqpMG.js";import{F as et}from"./FieldsQueryParam-BH5ZNe0x.js";function Ne(r,l,a){const n=r.slice();return n[5]=l[a],n}function Ve(r,l,a){const n=r.slice();return n[5]=l[a],n}function xe(r,l){let a,n=l[5].code+"",m,_,i,h;function g(){return l[4](l[5])}return{key:r,first:null,c(){a=s("button"),m=k(n),_=p(),b(a,"class","tab-item"),G(a,"active",l[1]===l[5].code),this.first=a},m(v,w){u(v,a,w),o(a,m),o(a,_),i||(h=Ye(a,"click",g),i=!0)},p(v,w){l=v,w&4&&n!==(n=l[5].code+"")&&de(m,n),w&6&&G(a,"active",l[1]===l[5].code)},d(v){v&&d(a),i=!1,h()}}}function ze(r,l){let a,n,m,_;return n=new Qe({props:{content:l[5].body}}),{key:r,first:null,c(){a=s("div"),W(n.$$.fragment),m=p(),b(a,"class","tab-item"),G(a,"active",l[1]===l[5].code),this.first=a},m(i,h){u(i,a,h),I(n,a,null),o(a,m),_=!0},p(i,h){l=i;const g={};h&4&&(g.content=l[5].body),n.$set(g),(!_||h&6)&&G(a,"active",l[1]===l[5].code)},i(i){_||(V(n.$$.fragment,i),_=!0)},o(i){N(n.$$.fragment,i),_=!1},d(i){i&&d(a),K(n)}}}function tt(r){var De,Fe;let l,a,n=r[0].name+"",m,_,i,h,g,v,w,M,X,S,x,ue,z,q,pe,Y,Q=r[0].name+"",Z,he,fe,U,ee,D,te,T,oe,be,F,C,le,me,ae,_e,f,ke,P,ge,ve,$e,se,ye,ne,Se,we,Te,re,Ce,Re,A,ie,O,ce,R,H,y=[],Pe=new Map,Ae,E,$=[],Be=new Map,B;v=new Ze({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${r[3]}');
@@ -24,15 +24,15 @@ import{S as je,i as xe,s as Je,N as Ue,O as J,e as s,v as k,b as p,c as K,f as b
         print(pb.authStore.isValid);
         print(pb.authStore.token);
         print(pb.authStore.model.id);
-    `}}),R=new Ue({props:{content:"?expand=relField1,relField2.subRelField"}}),A=new et({props:{prefix:"record."}});let x=J(r[2]);const Be=e=>e[5].code;for(let e=0;e<x.length;e+=1){let t=Ve(r,x,e),c=Be(t);Re.set(c,y[e]=ze(c,t))}let L=J(r[2]);const Me=e=>e[5].code;for(let e=0;e<L.length;e+=1){let t=Ne(r,L,e),c=Me(t);qe.set(c,$[e]=Qe(c,t))}return{c(){l=s("h3"),a=k("Auth refresh ("),m=k(n),_=k(")"),i=p(),h=s("div"),h.innerHTML=`<p>Returns a new auth response (token and record data) for an
+    `}}),P=new Qe({props:{content:"?expand=relField1,relField2.subRelField"}}),A=new et({props:{prefix:"record."}});let j=J(r[2]);const Me=e=>e[5].code;for(let e=0;e<j.length;e+=1){let t=Ve(r,j,e),c=Me(t);Pe.set(c,y[e]=xe(c,t))}let L=J(r[2]);const qe=e=>e[5].code;for(let e=0;e<L.length;e+=1){let t=Ne(r,L,e),c=qe(t);Be.set(c,$[e]=ze(c,t))}return{c(){l=s("h3"),a=k("Auth refresh ("),m=k(n),_=k(")"),i=p(),h=s("div"),h.innerHTML=`<p>Returns a new auth response (token and record data) for an
         <strong>already authenticated record</strong>.</p> <p><em>This method is usually called by users on page/screen reload to ensure that the previously stored
-            data in <code>pb.authStore</code> is still valid and up-to-date.</em></p>`,g=p(),K(v.$$.fragment),w=p(),B=s("h6"),B.textContent="API details",X=p(),S=s("div"),z=s("strong"),z.textContent="POST",ue=p(),Q=s("div"),M=s("p"),pe=k("/api/collections/"),Y=s("strong"),Z=k(U),he=k("/auth-refresh"),fe=p(),j=s("p"),j.innerHTML="Requires record <code>Authorization:TOKEN</code> header",ee=p(),D=s("div"),D.textContent="Query parameters",te=p(),T=s("table"),oe=s("thead"),oe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',be=p(),F=s("tbody"),C=s("tr"),le=s("td"),le.textContent="expand",me=p(),ae=s("td"),ae.innerHTML='<span class="label">String</span>',_e=p(),f=s("td"),ke=k(`Auto expand record relations. Ex.:
-                `),K(R.$$.fragment),ge=k(`
+            data in <code>pb.authStore</code> is still valid and up-to-date.</em></p>`,g=p(),W(v.$$.fragment),w=p(),M=s("h6"),M.textContent="API details",X=p(),S=s("div"),x=s("strong"),x.textContent="POST",ue=p(),z=s("div"),q=s("p"),pe=k("/api/collections/"),Y=s("strong"),Z=k(Q),he=k("/auth-refresh"),fe=p(),U=s("p"),U.innerHTML="Requires record <code>Authorization:TOKEN</code> header",ee=p(),D=s("div"),D.textContent="Query parameters",te=p(),T=s("table"),oe=s("thead"),oe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',be=p(),F=s("tbody"),C=s("tr"),le=s("td"),le.textContent="expand",me=p(),ae=s("td"),ae.innerHTML='<span class="label">String</span>',_e=p(),f=s("td"),ke=k(`Auto expand record relations. Ex.:
+                `),W(P.$$.fragment),ge=k(`
                 Supports up to 6-levels depth nested relations expansion. `),ve=s("br"),$e=k(`
                 The expanded relations will be appended to the record under the
                 `),se=s("code"),se.textContent="expand",ye=k(" property (eg. "),ne=s("code"),ne.textContent='"expand": {"relField1": {...}, ...}',Se=k(`).
                 `),we=s("br"),Te=k(`
-                Only the relations to which the request user has permissions to `),re=s("strong"),re.textContent="view",Ce=k(" will be expanded."),Pe=p(),K(A.$$.fragment),ie=p(),O=s("div"),O.textContent="Responses",ce=p(),P=s("div"),H=s("div");for(let e=0;e<y.length;e+=1)y[e].c();Ae=p(),E=s("div");for(let e=0;e<$.length;e+=1)$[e].c();b(l,"class","m-b-sm"),b(h,"class","content txt-lg m-b-sm"),b(B,"class","m-b-xs"),b(z,"class","label label-primary"),b(Q,"class","content"),b(j,"class","txt-hint txt-sm txt-right"),b(S,"class","alert alert-success"),b(D,"class","section-title"),b(T,"class","table-compact table-border m-b-base"),b(O,"class","section-title"),b(H,"class","tabs-header compact combined left"),b(E,"class","tabs-content"),b(P,"class","tabs")},m(e,t){d(e,l,t),o(l,a),o(l,m),o(l,_),d(e,i,t),d(e,h,t),d(e,g,t),I(v,e,t),d(e,w,t),d(e,B,t),d(e,X,t),d(e,S,t),o(S,z),o(S,ue),o(S,Q),o(Q,M),o(M,pe),o(M,Y),o(Y,Z),o(M,he),o(S,fe),o(S,j),d(e,ee,t),d(e,D,t),d(e,te,t),d(e,T,t),o(T,oe),o(T,be),o(T,F),o(F,C),o(C,le),o(C,me),o(C,ae),o(C,_e),o(C,f),o(f,ke),I(R,f,null),o(f,ge),o(f,ve),o(f,$e),o(f,se),o(f,ye),o(f,ne),o(f,Se),o(f,we),o(f,Te),o(f,re),o(f,Ce),o(F,Pe),I(A,F,null),d(e,ie,t),d(e,O,t),d(e,ce,t),d(e,P,t),o(P,H);for(let c=0;c<y.length;c+=1)y[c]&&y[c].m(H,null);o(P,Ae),o(P,E);for(let c=0;c<$.length;c+=1)$[c]&&$[c].m(E,null);q=!0},p(e,[t]){var Oe,He;(!q||t&1)&&n!==(n=e[0].name+"")&&de(m,n);const c={};t&9&&(c.js=`
+                Only the relations to which the request user has permissions to `),re=s("strong"),re.textContent="view",Ce=k(" will be expanded."),Re=p(),W(A.$$.fragment),ie=p(),O=s("div"),O.textContent="Responses",ce=p(),R=s("div"),H=s("div");for(let e=0;e<y.length;e+=1)y[e].c();Ae=p(),E=s("div");for(let e=0;e<$.length;e+=1)$[e].c();b(l,"class","m-b-sm"),b(h,"class","content txt-lg m-b-sm"),b(M,"class","m-b-xs"),b(x,"class","label label-primary"),b(z,"class","content"),b(U,"class","txt-hint txt-sm txt-right"),b(S,"class","alert alert-success"),b(D,"class","section-title"),b(T,"class","table-compact table-border m-b-base"),b(O,"class","section-title"),b(H,"class","tabs-header compact combined left"),b(E,"class","tabs-content"),b(R,"class","tabs")},m(e,t){u(e,l,t),o(l,a),o(l,m),o(l,_),u(e,i,t),u(e,h,t),u(e,g,t),I(v,e,t),u(e,w,t),u(e,M,t),u(e,X,t),u(e,S,t),o(S,x),o(S,ue),o(S,z),o(z,q),o(q,pe),o(q,Y),o(Y,Z),o(q,he),o(S,fe),o(S,U),u(e,ee,t),u(e,D,t),u(e,te,t),u(e,T,t),o(T,oe),o(T,be),o(T,F),o(F,C),o(C,le),o(C,me),o(C,ae),o(C,_e),o(C,f),o(f,ke),I(P,f,null),o(f,ge),o(f,ve),o(f,$e),o(f,se),o(f,ye),o(f,ne),o(f,Se),o(f,we),o(f,Te),o(f,re),o(f,Ce),o(F,Re),I(A,F,null),u(e,ie,t),u(e,O,t),u(e,ce,t),u(e,R,t),o(R,H);for(let c=0;c<y.length;c+=1)y[c]&&y[c].m(H,null);o(R,Ae),o(R,E);for(let c=0;c<$.length;c+=1)$[c]&&$[c].m(E,null);B=!0},p(e,[t]){var Oe,He;(!B||t&1)&&n!==(n=e[0].name+"")&&de(m,n);const c={};t&9&&(c.js=`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${e[3]}');
@@ -58,7 +58,7 @@ import{S as je,i as xe,s as Je,N as Ue,O as J,e as s,v as k,b as p,c as K,f as b
         print(pb.authStore.isValid);
         print(pb.authStore.token);
         print(pb.authStore.model.id);
-    `),v.$set(c),(!q||t&1)&&U!==(U=e[0].name+"")&&de(Z,U),t&6&&(x=J(e[2]),y=Ee(y,t,Be,1,e,x,Re,H,Ke,ze,null,Ve)),t&6&&(L=J(e[2]),Ie(),$=Ee($,t,Me,1,e,L,qe,E,We,Qe,null,Ne),Ge())},i(e){if(!q){N(v.$$.fragment,e),N(R.$$.fragment,e),N(A.$$.fragment,e);for(let t=0;t<L.length;t+=1)N($[t]);q=!0}},o(e){V(v.$$.fragment,e),V(R.$$.fragment,e),V(A.$$.fragment,e);for(let t=0;t<$.length;t+=1)V($[t]);q=!1},d(e){e&&(u(l),u(i),u(h),u(g),u(w),u(B),u(X),u(S),u(ee),u(D),u(te),u(T),u(ie),u(O),u(ce),u(P)),W(v,e),W(R),W(A);for(let t=0;t<y.length;t+=1)y[t].d();for(let t=0;t<$.length;t+=1)$[t].d()}}}function ot(r,l,a){let n,{collection:m}=l,_=200,i=[];const h=g=>a(1,_=g.code);return r.$$set=g=>{"collection"in g&&a(0,m=g.collection)},r.$$.update=()=>{r.$$.dirty&1&&a(2,i=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:Le.dummyCollectionRecord(m)},null,2)},{code:401,body:`
+    `),v.$set(c),(!B||t&1)&&Q!==(Q=e[0].name+"")&&de(Z,Q),t&6&&(j=J(e[2]),y=Ee(y,t,Me,1,e,j,Pe,H,Ke,xe,null,Ve)),t&6&&(L=J(e[2]),Ie(),$=Ee($,t,qe,1,e,L,Be,E,We,ze,null,Ne),Ge())},i(e){if(!B){V(v.$$.fragment,e),V(P.$$.fragment,e),V(A.$$.fragment,e);for(let t=0;t<L.length;t+=1)V($[t]);B=!0}},o(e){N(v.$$.fragment,e),N(P.$$.fragment,e),N(A.$$.fragment,e);for(let t=0;t<$.length;t+=1)N($[t]);B=!1},d(e){e&&(d(l),d(i),d(h),d(g),d(w),d(M),d(X),d(S),d(ee),d(D),d(te),d(T),d(ie),d(O),d(ce),d(R)),K(v,e),K(P),K(A);for(let t=0;t<y.length;t+=1)y[t].d();for(let t=0;t<$.length;t+=1)$[t].d()}}}function ot(r,l,a){let n,{collection:m}=l,_=200,i=[];const h=g=>a(1,_=g.code);return r.$$set=g=>{"collection"in g&&a(0,m=g.collection)},r.$$.update=()=>{r.$$.dirty&1&&a(2,i=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:Le.dummyCollectionRecord(m)},null,2)},{code:401,body:`
                 {
                   "code": 401,
                   "message": "The request requires valid record authorization token to be set.",
@@ -76,4 +76,4 @@ import{S as je,i as xe,s as Je,N as Ue,O as J,e as s,v as k,b as p,c as K,f as b
                   "message": "Missing auth record context.",
                   "data": {}
                 }
-            `}])},a(3,n=Le.getApiExampleUrl(Xe.baseUrl)),[m,_,i,n,h]}class nt extends je{constructor(l){super(),xe(this,l,ot,tt,Je,{collection:0})}}export{nt as default};
+            `}])},a(3,n=Le.getApiExampleUrl(Xe.baseUrl)),[m,_,i,n,h]}class nt extends Ue{constructor(l){super(),je(this,l,ot,tt,Je,{collection:0})}}export{nt as default};

ui/dist/assets/AuthWithOAuth2Docs-HefFfecy.js

@@ -1,4 +1,4 @@
-import{S as Ee,i as Je,s as Ne,N as Le,O as z,e as o,v as k,b as h,c as I,f as p,g as r,h as a,m as K,w as pe,P as Ue,Q as Qe,k as xe,R as ze,n as Ie,t as L,a as E,o as c,d as G,C as Be,A as Ke,q as X,r as Ge}from"./index-EDzELPnf.js";import{S as Xe}from"./SdkTabs-kh3uN9zO.js";import{F as Ye}from"./FieldsQueryParam-DzH1jTTy.js";function Fe(s,l,n){const i=s.slice();return i[5]=l[n],i}function He(s,l,n){const i=s.slice();return i[5]=l[n],i}function je(s,l){let n,i=l[5].code+"",f,g,d,m;function _(){return l[4](l[5])}return{key:s,first:null,c(){n=o("button"),f=k(i),g=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(v,O){r(v,n,O),a(n,f),a(n,g),d||(m=Ge(n,"click",_),d=!0)},p(v,O){l=v,O&4&&i!==(i=l[5].code+"")&&pe(f,i),O&6&&X(n,"active",l[1]===l[5].code)},d(v){v&&c(n),d=!1,m()}}}function Ve(s,l){let n,i,f,g;return i=new Le({props:{content:l[5].body}}),{key:s,first:null,c(){n=o("div"),I(i.$$.fragment),f=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(d,m){r(d,n,m),K(i,n,null),a(n,f),g=!0},p(d,m){l=d;const _={};m&4&&(_.content=l[5].body),i.$set(_),(!g||m&6)&&X(n,"active",l[1]===l[5].code)},i(d){g||(L(i.$$.fragment,d),g=!0)},o(d){E(i.$$.fragment,d),g=!1},d(d){d&&c(n),G(i)}}}function Ze(s){let l,n,i=s[0].name+"",f,g,d,m,_,v,O,P,Y,A,J,me,N,R,be,Z,Q=s[0].name+"",ee,fe,te,M,ae,W,le,U,ne,S,oe,ge,B,y,se,ke,ie,_e,b,ve,C,we,$e,Oe,re,Ae,ce,Se,ye,Te,de,Ce,qe,q,ue,F,he,T,H,$=[],De=new Map,Pe,j,w=[],Re=new Map,D;v=new Xe({props:{js:`
+import{S as xe,i as Ee,s as Je,N as Le,O as z,b as r,d as I,t as L,a as x,r as pe,Q as Ue,R as Ne,g as Qe,T as ze,e as Ie,f as c,h as a,m as K,n as o,u as k,k as h,c as G,o as p,C as Be,p as Ke,w as X,x as Ge}from"./index-Cp1ITsy4.js";import{S as Xe}from"./SdkTabs-CC2VqpMG.js";import{F as Ye}from"./FieldsQueryParam-BH5ZNe0x.js";function Fe(s,l,n){const i=s.slice();return i[5]=l[n],i}function He(s,l,n){const i=s.slice();return i[5]=l[n],i}function je(s,l){let n,i=l[5].code+"",f,g,d,b;function _(){return l[4](l[5])}return{key:s,first:null,c(){n=o("button"),f=k(i),g=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(v,O){c(v,n,O),a(n,f),a(n,g),d||(b=Ge(n,"click",_),d=!0)},p(v,O){l=v,O&4&&i!==(i=l[5].code+"")&&pe(f,i),O&6&&X(n,"active",l[1]===l[5].code)},d(v){v&&r(n),d=!1,b()}}}function Ve(s,l){let n,i,f,g;return i=new Le({props:{content:l[5].body}}),{key:s,first:null,c(){n=o("div"),G(i.$$.fragment),f=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(d,b){c(d,n,b),K(i,n,null),a(n,f),g=!0},p(d,b){l=d;const _={};b&4&&(_.content=l[5].body),i.$set(_),(!g||b&6)&&X(n,"active",l[1]===l[5].code)},i(d){g||(x(i.$$.fragment,d),g=!0)},o(d){L(i.$$.fragment,d),g=!1},d(d){d&&r(n),I(i)}}}function Ze(s){let l,n,i=s[0].name+"",f,g,d,b,_,v,O,P,Y,A,E,be,J,R,me,Z,N=s[0].name+"",ee,fe,te,M,ae,W,le,U,ne,S,oe,ge,B,y,se,ke,ie,_e,m,ve,C,we,$e,Oe,re,Ae,ce,Se,ye,Te,de,Ce,qe,q,ue,F,he,T,H,$=[],De=new Map,Pe,j,w=[],Re=new Map,D;v=new Xe({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${s[3]}');
@@ -45,18 +45,18 @@ import{S as Ee,i as Je,s as Ne,N as Le,O as z,e as o,v as k,b as h,c as I,f as p
 
         // "logout" the last authenticated model
         pb.authStore.clear();
-    `}}),C=new Le({props:{content:"?expand=relField1,relField2.subRelField"}}),q=new Ye({props:{prefix:"record."}});let x=z(s[2]);const Me=e=>e[5].code;for(let e=0;e<x.length;e+=1){let t=He(s,x,e),u=Me(t);De.set(u,$[e]=je(u,t))}let V=z(s[2]);const We=e=>e[5].code;for(let e=0;e<V.length;e+=1){let t=Fe(s,V,e),u=We(t);Re.set(u,w[e]=Ve(u,t))}return{c(){l=o("h3"),n=k("Auth with OAuth2 ("),f=k(i),g=k(")"),d=h(),m=o("div"),m.innerHTML=`<p>Authenticate with an OAuth2 provider and returns a new auth token and record data.</p> <p>For more details please check the
+    `}}),C=new Le({props:{content:"?expand=relField1,relField2.subRelField"}}),q=new Ye({props:{prefix:"record."}});let Q=z(s[2]);const Me=e=>e[5].code;for(let e=0;e<Q.length;e+=1){let t=He(s,Q,e),u=Me(t);De.set(u,$[e]=je(u,t))}let V=z(s[2]);const We=e=>e[5].code;for(let e=0;e<V.length;e+=1){let t=Fe(s,V,e),u=We(t);Re.set(u,w[e]=Ve(u,t))}return{c(){l=o("h3"),n=k("Auth with OAuth2 ("),f=k(i),g=k(")"),d=h(),b=o("div"),b.innerHTML=`<p>Authenticate with an OAuth2 provider and returns a new auth token and record data.</p> <p>For more details please check the
         <a href="https://pocketbase.io/docs/authentication/#oauth2-integration" target="_blank" rel="noopener noreferrer">OAuth2 integration documentation
-        </a>.</p>`,_=h(),I(v.$$.fragment),O=h(),P=o("h6"),P.textContent="API details",Y=h(),A=o("div"),J=o("strong"),J.textContent="POST",me=h(),N=o("div"),R=o("p"),be=k("/api/collections/"),Z=o("strong"),ee=k(Q),fe=k("/auth-with-oauth2"),te=h(),M=o("div"),M.textContent="Body Parameters",ae=h(),W=o("table"),W.innerHTML=`<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>provider</span></div></td> <td><span class="label">String</span></td> <td>The name of the OAuth2 client provider (eg. &quot;google&quot;).</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>code</span></div></td> <td><span class="label">String</span></td> <td>The authorization code returned from the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>codeVerifier</span></div></td> <td><span class="label">String</span></td> <td>The code verifier sent with the initial request as part of the code_challenge.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>redirectUrl</span></div></td> <td><span class="label">String</span></td> <td>The redirect url sent with the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-warning">Optional</span> <span>createData</span></div></td> <td><span class="label">Object</span></td> <td><p>Optional data that will be used when creating the auth record on OAuth2 sign-up.</p> <p>The created auth record must comply with the same requirements and validations in the
+        </a>.</p>`,_=h(),G(v.$$.fragment),O=h(),P=o("h6"),P.textContent="API details",Y=h(),A=o("div"),E=o("strong"),E.textContent="POST",be=h(),J=o("div"),R=o("p"),me=k("/api/collections/"),Z=o("strong"),ee=k(N),fe=k("/auth-with-oauth2"),te=h(),M=o("div"),M.textContent="Body Parameters",ae=h(),W=o("table"),W.innerHTML=`<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>provider</span></div></td> <td><span class="label">String</span></td> <td>The name of the OAuth2 client provider (eg. &quot;google&quot;).</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>code</span></div></td> <td><span class="label">String</span></td> <td>The authorization code returned from the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>codeVerifier</span></div></td> <td><span class="label">String</span></td> <td>The code verifier sent with the initial request as part of the code_challenge.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>redirectUrl</span></div></td> <td><span class="label">String</span></td> <td>The redirect url sent with the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-warning">Optional</span> <span>createData</span></div></td> <td><span class="label">Object</span></td> <td><p>Optional data that will be used when creating the auth record on OAuth2 sign-up.</p> <p>The created auth record must comply with the same requirements and validations in the
                     regular <strong>create</strong> action.
                     <br/> <em>The data can only be in <code>json</code>, aka. <code>multipart/form-data</code> and files
-                        upload currently are not supported during OAuth2 sign-ups.</em></p></td></tr></tbody>`,le=h(),U=o("div"),U.textContent="Query parameters",ne=h(),S=o("table"),oe=o("thead"),oe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',ge=h(),B=o("tbody"),y=o("tr"),se=o("td"),se.textContent="expand",ke=h(),ie=o("td"),ie.innerHTML='<span class="label">String</span>',_e=h(),b=o("td"),ve=k(`Auto expand record relations. Ex.:
-                `),I(C.$$.fragment),we=k(`
+                        upload currently are not supported during OAuth2 sign-ups.</em></p></td></tr></tbody>`,le=h(),U=o("div"),U.textContent="Query parameters",ne=h(),S=o("table"),oe=o("thead"),oe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',ge=h(),B=o("tbody"),y=o("tr"),se=o("td"),se.textContent="expand",ke=h(),ie=o("td"),ie.innerHTML='<span class="label">String</span>',_e=h(),m=o("td"),ve=k(`Auto expand record relations. Ex.:
+                `),G(C.$$.fragment),we=k(`
                 Supports up to 6-levels depth nested relations expansion. `),$e=o("br"),Oe=k(`
                 The expanded relations will be appended to the record under the
                 `),re=o("code"),re.textContent="expand",Ae=k(" property (eg. "),ce=o("code"),ce.textContent='"expand": {"relField1": {...}, ...}',Se=k(`).
                 `),ye=o("br"),Te=k(`
-                Only the relations to which the request user has permissions to `),de=o("strong"),de.textContent="view",Ce=k(" will be expanded."),qe=h(),I(q.$$.fragment),ue=h(),F=o("div"),F.textContent="Responses",he=h(),T=o("div"),H=o("div");for(let e=0;e<$.length;e+=1)$[e].c();Pe=h(),j=o("div");for(let e=0;e<w.length;e+=1)w[e].c();p(l,"class","m-b-sm"),p(m,"class","content txt-lg m-b-sm"),p(P,"class","m-b-xs"),p(J,"class","label label-primary"),p(N,"class","content"),p(A,"class","alert alert-success"),p(M,"class","section-title"),p(W,"class","table-compact table-border m-b-base"),p(U,"class","section-title"),p(S,"class","table-compact table-border m-b-base"),p(F,"class","section-title"),p(H,"class","tabs-header compact combined left"),p(j,"class","tabs-content"),p(T,"class","tabs")},m(e,t){r(e,l,t),a(l,n),a(l,f),a(l,g),r(e,d,t),r(e,m,t),r(e,_,t),K(v,e,t),r(e,O,t),r(e,P,t),r(e,Y,t),r(e,A,t),a(A,J),a(A,me),a(A,N),a(N,R),a(R,be),a(R,Z),a(Z,ee),a(R,fe),r(e,te,t),r(e,M,t),r(e,ae,t),r(e,W,t),r(e,le,t),r(e,U,t),r(e,ne,t),r(e,S,t),a(S,oe),a(S,ge),a(S,B),a(B,y),a(y,se),a(y,ke),a(y,ie),a(y,_e),a(y,b),a(b,ve),K(C,b,null),a(b,we),a(b,$e),a(b,Oe),a(b,re),a(b,Ae),a(b,ce),a(b,Se),a(b,ye),a(b,Te),a(b,de),a(b,Ce),a(B,qe),K(q,B,null),r(e,ue,t),r(e,F,t),r(e,he,t),r(e,T,t),a(T,H);for(let u=0;u<$.length;u+=1)$[u]&&$[u].m(H,null);a(T,Pe),a(T,j);for(let u=0;u<w.length;u+=1)w[u]&&w[u].m(j,null);D=!0},p(e,[t]){(!D||t&1)&&i!==(i=e[0].name+"")&&pe(f,i);const u={};t&9&&(u.js=`
+                Only the relations to which the request user has permissions to `),de=o("strong"),de.textContent="view",Ce=k(" will be expanded."),qe=h(),G(q.$$.fragment),ue=h(),F=o("div"),F.textContent="Responses",he=h(),T=o("div"),H=o("div");for(let e=0;e<$.length;e+=1)$[e].c();Pe=h(),j=o("div");for(let e=0;e<w.length;e+=1)w[e].c();p(l,"class","m-b-sm"),p(b,"class","content txt-lg m-b-sm"),p(P,"class","m-b-xs"),p(E,"class","label label-primary"),p(J,"class","content"),p(A,"class","alert alert-success"),p(M,"class","section-title"),p(W,"class","table-compact table-border m-b-base"),p(U,"class","section-title"),p(S,"class","table-compact table-border m-b-base"),p(F,"class","section-title"),p(H,"class","tabs-header compact combined left"),p(j,"class","tabs-content"),p(T,"class","tabs")},m(e,t){c(e,l,t),a(l,n),a(l,f),a(l,g),c(e,d,t),c(e,b,t),c(e,_,t),K(v,e,t),c(e,O,t),c(e,P,t),c(e,Y,t),c(e,A,t),a(A,E),a(A,be),a(A,J),a(J,R),a(R,me),a(R,Z),a(Z,ee),a(R,fe),c(e,te,t),c(e,M,t),c(e,ae,t),c(e,W,t),c(e,le,t),c(e,U,t),c(e,ne,t),c(e,S,t),a(S,oe),a(S,ge),a(S,B),a(B,y),a(y,se),a(y,ke),a(y,ie),a(y,_e),a(y,m),a(m,ve),K(C,m,null),a(m,we),a(m,$e),a(m,Oe),a(m,re),a(m,Ae),a(m,ce),a(m,Se),a(m,ye),a(m,Te),a(m,de),a(m,Ce),a(B,qe),K(q,B,null),c(e,ue,t),c(e,F,t),c(e,he,t),c(e,T,t),a(T,H);for(let u=0;u<$.length;u+=1)$[u]&&$[u].m(H,null);a(T,Pe),a(T,j);for(let u=0;u<w.length;u+=1)w[u]&&w[u].m(j,null);D=!0},p(e,[t]){(!D||t&1)&&i!==(i=e[0].name+"")&&pe(f,i);const u={};t&9&&(u.js=`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${e[3]}');
@@ -103,7 +103,7 @@ import{S as Ee,i as Je,s as Ne,N as Le,O as z,e as o,v as k,b as h,c as I,f as p
 
         // "logout" the last authenticated model
         pb.authStore.clear();
-    `),v.$set(u),(!D||t&1)&&Q!==(Q=e[0].name+"")&&pe(ee,Q),t&6&&(x=z(e[2]),$=Ue($,t,Me,1,e,x,De,H,Qe,je,null,He)),t&6&&(V=z(e[2]),xe(),w=Ue(w,t,We,1,e,V,Re,j,ze,Ve,null,Fe),Ie())},i(e){if(!D){L(v.$$.fragment,e),L(C.$$.fragment,e),L(q.$$.fragment,e);for(let t=0;t<V.length;t+=1)L(w[t]);D=!0}},o(e){E(v.$$.fragment,e),E(C.$$.fragment,e),E(q.$$.fragment,e);for(let t=0;t<w.length;t+=1)E(w[t]);D=!1},d(e){e&&(c(l),c(d),c(m),c(_),c(O),c(P),c(Y),c(A),c(te),c(M),c(ae),c(W),c(le),c(U),c(ne),c(S),c(ue),c(F),c(he),c(T)),G(v,e),G(C),G(q);for(let t=0;t<$.length;t+=1)$[t].d();for(let t=0;t<w.length;t+=1)w[t].d()}}}function et(s,l,n){let i,{collection:f}=l,g=200,d=[];const m=_=>n(1,g=_.code);return s.$$set=_=>{"collection"in _&&n(0,f=_.collection)},s.$$.update=()=>{s.$$.dirty&1&&n(2,d=[{code:200,body:JSON.stringify({token:"JWT_AUTH_TOKEN",record:Be.dummyCollectionRecord(f),meta:{id:"abc123",name:"John Doe",username:"john.doe",email:"test@example.com",avatarUrl:"https://example.com/avatar.png",accessToken:"...",refreshToken:"...",rawUser:{}}},null,2)},{code:400,body:`
+    `),v.$set(u),(!D||t&1)&&N!==(N=e[0].name+"")&&pe(ee,N),t&6&&(Q=z(e[2]),$=Ue($,t,Me,1,e,Q,De,H,Ne,je,null,He)),t&6&&(V=z(e[2]),Qe(),w=Ue(w,t,We,1,e,V,Re,j,ze,Ve,null,Fe),Ie())},i(e){if(!D){x(v.$$.fragment,e),x(C.$$.fragment,e),x(q.$$.fragment,e);for(let t=0;t<V.length;t+=1)x(w[t]);D=!0}},o(e){L(v.$$.fragment,e),L(C.$$.fragment,e),L(q.$$.fragment,e);for(let t=0;t<w.length;t+=1)L(w[t]);D=!1},d(e){e&&(r(l),r(d),r(b),r(_),r(O),r(P),r(Y),r(A),r(te),r(M),r(ae),r(W),r(le),r(U),r(ne),r(S),r(ue),r(F),r(he),r(T)),I(v,e),I(C),I(q);for(let t=0;t<$.length;t+=1)$[t].d();for(let t=0;t<w.length;t+=1)w[t].d()}}}function et(s,l,n){let i,{collection:f}=l,g=200,d=[];const b=_=>n(1,g=_.code);return s.$$set=_=>{"collection"in _&&n(0,f=_.collection)},s.$$.update=()=>{s.$$.dirty&1&&n(2,d=[{code:200,body:JSON.stringify({token:"JWT_AUTH_TOKEN",record:Be.dummyCollectionRecord(f),meta:{id:"abc123",name:"John Doe",username:"john.doe",email:"test@example.com",avatarUrl:"https://example.com/avatar.png",accessToken:"...",refreshToken:"...",rawUser:{}}},null,2)},{code:400,body:`
                 {
                   "code": 400,
                   "message": "An error occurred while submitting the form.",
@@ -114,4 +114,4 @@ import{S as Ee,i as Je,s as Ne,N as Le,O as z,e as o,v as k,b as h,c as I,f as p
                     }
                   }
                 }
-            `}])},n(3,i=Be.getApiExampleUrl(Ke.baseUrl)),[f,g,d,i,m]}class nt extends Ee{constructor(l){super(),Je(this,l,et,Ze,Ne,{collection:0})}}export{nt as default};
+            `}])},n(3,i=Be.getApiExampleUrl(Ke.baseUrl)),[f,g,d,i,b]}class nt extends xe{constructor(l){super(),Ee(this,l,et,Ze,Je,{collection:0})}}export{nt as default};

ui/dist/assets/AuthWithPasswordDocs-CnFr3-7m.js

@@ -1,4 +1,4 @@
-import{S as wt,i as yt,s as $t,N as vt,O as oe,e as n,v as p,b as d,c as ne,f as m,g as r,h as t,m as se,w as De,P as pt,Q as Pt,k as Rt,R as At,n as Ct,t as Z,a as x,o as c,d as ie,C as ft,A as Ot,q as re,r as Tt}from"./index-EDzELPnf.js";import{S as Ut}from"./SdkTabs-kh3uN9zO.js";import{F as Mt}from"./FieldsQueryParam-DzH1jTTy.js";function ht(s,l,a){const i=s.slice();return i[8]=l[a],i}function bt(s,l,a){const i=s.slice();return i[8]=l[a],i}function Dt(s){let l;return{c(){l=p("email")},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function Et(s){let l;return{c(){l=p("username")},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function Wt(s){let l;return{c(){l=p("username/email")},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function mt(s){let l;return{c(){l=n("strong"),l.textContent="username"},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function _t(s){let l;return{c(){l=p("or")},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function kt(s){let l;return{c(){l=n("strong"),l.textContent="email"},m(a,i){r(a,l,i)},d(a){a&&c(l)}}}function gt(s,l){let a,i=l[8].code+"",g,b,f,u;function _(){return l[7](l[8])}return{key:s,first:null,c(){a=n("button"),g=p(i),b=d(),m(a,"class","tab-item"),re(a,"active",l[3]===l[8].code),this.first=a},m(R,A){r(R,a,A),t(a,g),t(a,b),f||(u=Tt(a,"click",_),f=!0)},p(R,A){l=R,A&16&&i!==(i=l[8].code+"")&&De(g,i),A&24&&re(a,"active",l[3]===l[8].code)},d(R){R&&c(a),f=!1,u()}}}function St(s,l){let a,i,g,b;return i=new vt({props:{content:l[8].body}}),{key:s,first:null,c(){a=n("div"),ne(i.$$.fragment),g=d(),m(a,"class","tab-item"),re(a,"active",l[3]===l[8].code),this.first=a},m(f,u){r(f,a,u),se(i,a,null),t(a,g),b=!0},p(f,u){l=f;const _={};u&16&&(_.content=l[8].body),i.$set(_),(!b||u&24)&&re(a,"active",l[3]===l[8].code)},i(f){b||(Z(i.$$.fragment,f),b=!0)},o(f){x(i.$$.fragment,f),b=!1},d(f){f&&c(a),ie(i)}}}function Lt(s){var rt,ct;let l,a,i=s[0].name+"",g,b,f,u,_,R,A,C,q,Ee,ce,T,de,N,ue,U,ee,We,te,I,Le,pe,le=s[0].name+"",fe,qe,he,V,be,M,me,Be,Q,D,_e,Fe,ke,He,$,Ye,ge,Se,ve,Ne,we,ye,j,$e,E,Pe,Ie,J,W,Re,Ve,Ae,Qe,k,je,B,Je,Ke,ze,Ce,Ge,Oe,Xe,Ze,xe,Te,et,tt,F,Ue,K,Me,L,z,O=[],lt=new Map,at,G,S=[],ot=new Map,H;function nt(e,o){if(e[1]&&e[2])return Wt;if(e[1])return Et;if(e[2])return Dt}let Y=nt(s),P=Y&&Y(s);T=new Ut({props:{js:`
+import{S as wt,i as yt,s as $t,N as vt,O as oe,b as r,d as ne,t as Z,a as x,r as De,Q as pt,R as Pt,g as Rt,T as Ct,e as Ot,f as c,h as t,m as se,n,u as p,k as d,c as ie,o as m,C as ft,p as Tt,w as re,x as At}from"./index-Cp1ITsy4.js";import{S as Ut}from"./SdkTabs-CC2VqpMG.js";import{F as Mt}from"./FieldsQueryParam-BH5ZNe0x.js";function ht(s,l,a){const i=s.slice();return i[8]=l[a],i}function bt(s,l,a){const i=s.slice();return i[8]=l[a],i}function Dt(s){let l;return{c(){l=p("email")},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function Et(s){let l;return{c(){l=p("username")},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function Wt(s){let l;return{c(){l=p("username/email")},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function mt(s){let l;return{c(){l=n("strong"),l.textContent="username"},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function _t(s){let l;return{c(){l=p("or")},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function kt(s){let l;return{c(){l=n("strong"),l.textContent="email"},m(a,i){c(a,l,i)},d(a){a&&r(l)}}}function gt(s,l){let a,i=l[8].code+"",g,b,f,u;function _(){return l[7](l[8])}return{key:s,first:null,c(){a=n("button"),g=p(i),b=d(),m(a,"class","tab-item"),re(a,"active",l[3]===l[8].code),this.first=a},m(R,C){c(R,a,C),t(a,g),t(a,b),f||(u=At(a,"click",_),f=!0)},p(R,C){l=R,C&16&&i!==(i=l[8].code+"")&&De(g,i),C&24&&re(a,"active",l[3]===l[8].code)},d(R){R&&r(a),f=!1,u()}}}function St(s,l){let a,i,g,b;return i=new vt({props:{content:l[8].body}}),{key:s,first:null,c(){a=n("div"),ie(i.$$.fragment),g=d(),m(a,"class","tab-item"),re(a,"active",l[3]===l[8].code),this.first=a},m(f,u){c(f,a,u),se(i,a,null),t(a,g),b=!0},p(f,u){l=f;const _={};u&16&&(_.content=l[8].body),i.$set(_),(!b||u&24)&&re(a,"active",l[3]===l[8].code)},i(f){b||(x(i.$$.fragment,f),b=!0)},o(f){Z(i.$$.fragment,f),b=!1},d(f){f&&r(a),ne(i)}}}function Lt(s){var rt,ct;let l,a,i=s[0].name+"",g,b,f,u,_,R,C,O,B,Ee,ce,A,de,N,ue,U,ee,We,te,I,Le,pe,le=s[0].name+"",fe,Be,he,V,be,M,me,qe,Q,D,_e,Fe,ke,He,$,Ye,ge,Se,ve,Ne,we,ye,j,$e,E,Pe,Ie,J,W,Re,Ve,Ce,Qe,k,je,q,Je,Ke,ze,Oe,Ge,Te,Xe,Ze,xe,Ae,et,tt,F,Ue,K,Me,L,z,T=[],lt=new Map,at,G,S=[],ot=new Map,H;function nt(e,o){if(e[1]&&e[2])return Wt;if(e[1])return Et;if(e[2])return Dt}let Y=nt(s),P=Y&&Y(s);A=new Ut({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${s[6]}');
@@ -36,17 +36,17 @@ import{S as wt,i as yt,s as $t,N as vt,O as oe,e as n,v as p,b as d,c as ne,f as
 
         // "logout" the last authenticated account
         pb.authStore.clear();
-    `}});let v=s[1]&&mt(),w=s[1]&&s[2]&&_t(),y=s[2]&&kt();B=new vt({props:{content:"?expand=relField1,relField2.subRelField"}}),F=new Mt({props:{prefix:"record."}});let ae=oe(s[4]);const st=e=>e[8].code;for(let e=0;e<ae.length;e+=1){let o=bt(s,ae,e),h=st(o);lt.set(h,O[e]=gt(h,o))}let X=oe(s[4]);const it=e=>e[8].code;for(let e=0;e<X.length;e+=1){let o=ht(s,X,e),h=it(o);ot.set(h,S[e]=St(h,o))}return{c(){l=n("h3"),a=p("Auth with password ("),g=p(i),b=p(")"),f=d(),u=n("div"),_=n("p"),R=p(`Returns new auth token and account data by a combination of
-        `),A=n("strong"),P&&P.c(),C=p(`
-        and `),q=n("strong"),q.textContent="password",Ee=p("."),ce=d(),ne(T.$$.fragment),de=d(),N=n("h6"),N.textContent="API details",ue=d(),U=n("div"),ee=n("strong"),ee.textContent="POST",We=d(),te=n("div"),I=n("p"),Le=p("/api/collections/"),pe=n("strong"),fe=p(le),qe=p("/auth-with-password"),he=d(),V=n("div"),V.textContent="Body Parameters",be=d(),M=n("table"),me=n("thead"),me.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr>',Be=d(),Q=n("tbody"),D=n("tr"),_e=n("td"),_e.innerHTML='<div class="inline-flex"><span class="label label-success">Required</span> <span>identity</span></div>',Fe=d(),ke=n("td"),ke.innerHTML='<span class="label">String</span>',He=d(),$=n("td"),Ye=p(`The
+    `}});let v=s[1]&&mt(),w=s[1]&&s[2]&&_t(),y=s[2]&&kt();q=new vt({props:{content:"?expand=relField1,relField2.subRelField"}}),F=new Mt({props:{prefix:"record."}});let ae=oe(s[4]);const st=e=>e[8].code;for(let e=0;e<ae.length;e+=1){let o=bt(s,ae,e),h=st(o);lt.set(h,T[e]=gt(h,o))}let X=oe(s[4]);const it=e=>e[8].code;for(let e=0;e<X.length;e+=1){let o=ht(s,X,e),h=it(o);ot.set(h,S[e]=St(h,o))}return{c(){l=n("h3"),a=p("Auth with password ("),g=p(i),b=p(")"),f=d(),u=n("div"),_=n("p"),R=p(`Returns new auth token and account data by a combination of
+        `),C=n("strong"),P&&P.c(),O=p(`
+        and `),B=n("strong"),B.textContent="password",Ee=p("."),ce=d(),ie(A.$$.fragment),de=d(),N=n("h6"),N.textContent="API details",ue=d(),U=n("div"),ee=n("strong"),ee.textContent="POST",We=d(),te=n("div"),I=n("p"),Le=p("/api/collections/"),pe=n("strong"),fe=p(le),Be=p("/auth-with-password"),he=d(),V=n("div"),V.textContent="Body Parameters",be=d(),M=n("table"),me=n("thead"),me.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr>',qe=d(),Q=n("tbody"),D=n("tr"),_e=n("td"),_e.innerHTML='<div class="inline-flex"><span class="label label-success">Required</span> <span>identity</span></div>',Fe=d(),ke=n("td"),ke.innerHTML='<span class="label">String</span>',He=d(),$=n("td"),Ye=p(`The
                 `),v&&v.c(),ge=d(),w&&w.c(),Se=d(),y&&y.c(),ve=p(`
-                of the record to authenticate.`),Ne=d(),we=n("tr"),we.innerHTML='<td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The auth record password.</td>',ye=d(),j=n("div"),j.textContent="Query parameters",$e=d(),E=n("table"),Pe=n("thead"),Pe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',Ie=d(),J=n("tbody"),W=n("tr"),Re=n("td"),Re.textContent="expand",Ve=d(),Ae=n("td"),Ae.innerHTML='<span class="label">String</span>',Qe=d(),k=n("td"),je=p(`Auto expand record relations. Ex.:
-                `),ne(B.$$.fragment),Je=p(`
+                of the record to authenticate.`),Ne=d(),we=n("tr"),we.innerHTML='<td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The auth record password.</td>',ye=d(),j=n("div"),j.textContent="Query parameters",$e=d(),E=n("table"),Pe=n("thead"),Pe.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',Ie=d(),J=n("tbody"),W=n("tr"),Re=n("td"),Re.textContent="expand",Ve=d(),Ce=n("td"),Ce.innerHTML='<span class="label">String</span>',Qe=d(),k=n("td"),je=p(`Auto expand record relations. Ex.:
+                `),ie(q.$$.fragment),Je=p(`
                 Supports up to 6-levels depth nested relations expansion. `),Ke=n("br"),ze=p(`
                 The expanded relations will be appended to the record under the
-                `),Ce=n("code"),Ce.textContent="expand",Ge=p(" property (eg. "),Oe=n("code"),Oe.textContent='"expand": {"relField1": {...}, ...}',Xe=p(`).
+                `),Oe=n("code"),Oe.textContent="expand",Ge=p(" property (eg. "),Te=n("code"),Te.textContent='"expand": {"relField1": {...}, ...}',Xe=p(`).
                 `),Ze=n("br"),xe=p(`
-                Only the relations to which the request user has permissions to `),Te=n("strong"),Te.textContent="view",et=p(" will be expanded."),tt=d(),ne(F.$$.fragment),Ue=d(),K=n("div"),K.textContent="Responses",Me=d(),L=n("div"),z=n("div");for(let e=0;e<O.length;e+=1)O[e].c();at=d(),G=n("div");for(let e=0;e<S.length;e+=1)S[e].c();m(l,"class","m-b-sm"),m(u,"class","content txt-lg m-b-sm"),m(N,"class","m-b-xs"),m(ee,"class","label label-primary"),m(te,"class","content"),m(U,"class","alert alert-success"),m(V,"class","section-title"),m(M,"class","table-compact table-border m-b-base"),m(j,"class","section-title"),m(E,"class","table-compact table-border m-b-base"),m(K,"class","section-title"),m(z,"class","tabs-header compact combined left"),m(G,"class","tabs-content"),m(L,"class","tabs")},m(e,o){r(e,l,o),t(l,a),t(l,g),t(l,b),r(e,f,o),r(e,u,o),t(u,_),t(_,R),t(_,A),P&&P.m(A,null),t(_,C),t(_,q),t(_,Ee),r(e,ce,o),se(T,e,o),r(e,de,o),r(e,N,o),r(e,ue,o),r(e,U,o),t(U,ee),t(U,We),t(U,te),t(te,I),t(I,Le),t(I,pe),t(pe,fe),t(I,qe),r(e,he,o),r(e,V,o),r(e,be,o),r(e,M,o),t(M,me),t(M,Be),t(M,Q),t(Q,D),t(D,_e),t(D,Fe),t(D,ke),t(D,He),t(D,$),t($,Ye),v&&v.m($,null),t($,ge),w&&w.m($,null),t($,Se),y&&y.m($,null),t($,ve),t(Q,Ne),t(Q,we),r(e,ye,o),r(e,j,o),r(e,$e,o),r(e,E,o),t(E,Pe),t(E,Ie),t(E,J),t(J,W),t(W,Re),t(W,Ve),t(W,Ae),t(W,Qe),t(W,k),t(k,je),se(B,k,null),t(k,Je),t(k,Ke),t(k,ze),t(k,Ce),t(k,Ge),t(k,Oe),t(k,Xe),t(k,Ze),t(k,xe),t(k,Te),t(k,et),t(J,tt),se(F,J,null),r(e,Ue,o),r(e,K,o),r(e,Me,o),r(e,L,o),t(L,z);for(let h=0;h<O.length;h+=1)O[h]&&O[h].m(z,null);t(L,at),t(L,G);for(let h=0;h<S.length;h+=1)S[h]&&S[h].m(G,null);H=!0},p(e,[o]){var dt,ut;(!H||o&1)&&i!==(i=e[0].name+"")&&De(g,i),Y!==(Y=nt(e))&&(P&&P.d(1),P=Y&&Y(e),P&&(P.c(),P.m(A,null)));const h={};o&97&&(h.js=`
+                Only the relations to which the request user has permissions to `),Ae=n("strong"),Ae.textContent="view",et=p(" will be expanded."),tt=d(),ie(F.$$.fragment),Ue=d(),K=n("div"),K.textContent="Responses",Me=d(),L=n("div"),z=n("div");for(let e=0;e<T.length;e+=1)T[e].c();at=d(),G=n("div");for(let e=0;e<S.length;e+=1)S[e].c();m(l,"class","m-b-sm"),m(u,"class","content txt-lg m-b-sm"),m(N,"class","m-b-xs"),m(ee,"class","label label-primary"),m(te,"class","content"),m(U,"class","alert alert-success"),m(V,"class","section-title"),m(M,"class","table-compact table-border m-b-base"),m(j,"class","section-title"),m(E,"class","table-compact table-border m-b-base"),m(K,"class","section-title"),m(z,"class","tabs-header compact combined left"),m(G,"class","tabs-content"),m(L,"class","tabs")},m(e,o){c(e,l,o),t(l,a),t(l,g),t(l,b),c(e,f,o),c(e,u,o),t(u,_),t(_,R),t(_,C),P&&P.m(C,null),t(_,O),t(_,B),t(_,Ee),c(e,ce,o),se(A,e,o),c(e,de,o),c(e,N,o),c(e,ue,o),c(e,U,o),t(U,ee),t(U,We),t(U,te),t(te,I),t(I,Le),t(I,pe),t(pe,fe),t(I,Be),c(e,he,o),c(e,V,o),c(e,be,o),c(e,M,o),t(M,me),t(M,qe),t(M,Q),t(Q,D),t(D,_e),t(D,Fe),t(D,ke),t(D,He),t(D,$),t($,Ye),v&&v.m($,null),t($,ge),w&&w.m($,null),t($,Se),y&&y.m($,null),t($,ve),t(Q,Ne),t(Q,we),c(e,ye,o),c(e,j,o),c(e,$e,o),c(e,E,o),t(E,Pe),t(E,Ie),t(E,J),t(J,W),t(W,Re),t(W,Ve),t(W,Ce),t(W,Qe),t(W,k),t(k,je),se(q,k,null),t(k,Je),t(k,Ke),t(k,ze),t(k,Oe),t(k,Ge),t(k,Te),t(k,Xe),t(k,Ze),t(k,xe),t(k,Ae),t(k,et),t(J,tt),se(F,J,null),c(e,Ue,o),c(e,K,o),c(e,Me,o),c(e,L,o),t(L,z);for(let h=0;h<T.length;h+=1)T[h]&&T[h].m(z,null);t(L,at),t(L,G);for(let h=0;h<S.length;h+=1)S[h]&&S[h].m(G,null);H=!0},p(e,[o]){var dt,ut;(!H||o&1)&&i!==(i=e[0].name+"")&&De(g,i),Y!==(Y=nt(e))&&(P&&P.d(1),P=Y&&Y(e),P&&(P.c(),P.m(C,null)));const h={};o&97&&(h.js=`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${e[6]}');
@@ -84,7 +84,7 @@ import{S as wt,i as yt,s as $t,N as vt,O as oe,e as n,v as p,b as d,c as ne,f as
 
         // "logout" the last authenticated account
         pb.authStore.clear();
-    `),T.$set(h),(!H||o&1)&&le!==(le=e[0].name+"")&&De(fe,le),e[1]?v||(v=mt(),v.c(),v.m($,ge)):v&&(v.d(1),v=null),e[1]&&e[2]?w||(w=_t(),w.c(),w.m($,Se)):w&&(w.d(1),w=null),e[2]?y||(y=kt(),y.c(),y.m($,ve)):y&&(y.d(1),y=null),o&24&&(ae=oe(e[4]),O=pt(O,o,st,1,e,ae,lt,z,Pt,gt,null,bt)),o&24&&(X=oe(e[4]),Rt(),S=pt(S,o,it,1,e,X,ot,G,At,St,null,ht),Ct())},i(e){if(!H){Z(T.$$.fragment,e),Z(B.$$.fragment,e),Z(F.$$.fragment,e);for(let o=0;o<X.length;o+=1)Z(S[o]);H=!0}},o(e){x(T.$$.fragment,e),x(B.$$.fragment,e),x(F.$$.fragment,e);for(let o=0;o<S.length;o+=1)x(S[o]);H=!1},d(e){e&&(c(l),c(f),c(u),c(ce),c(de),c(N),c(ue),c(U),c(he),c(V),c(be),c(M),c(ye),c(j),c($e),c(E),c(Ue),c(K),c(Me),c(L)),P&&P.d(),ie(T,e),v&&v.d(),w&&w.d(),y&&y.d(),ie(B),ie(F);for(let o=0;o<O.length;o+=1)O[o].d();for(let o=0;o<S.length;o+=1)S[o].d()}}}function qt(s,l,a){let i,g,b,f,{collection:u}=l,_=200,R=[];const A=C=>a(3,_=C.code);return s.$$set=C=>{"collection"in C&&a(0,u=C.collection)},s.$$.update=()=>{var C,q;s.$$.dirty&1&&a(2,g=(C=u==null?void 0:u.options)==null?void 0:C.allowEmailAuth),s.$$.dirty&1&&a(1,b=(q=u==null?void 0:u.options)==null?void 0:q.allowUsernameAuth),s.$$.dirty&6&&a(5,f=b&&g?"YOUR_USERNAME_OR_EMAIL":b?"YOUR_USERNAME":"YOUR_EMAIL"),s.$$.dirty&1&&a(4,R=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:ft.dummyCollectionRecord(u)},null,2)},{code:400,body:`
+    `),A.$set(h),(!H||o&1)&&le!==(le=e[0].name+"")&&De(fe,le),e[1]?v||(v=mt(),v.c(),v.m($,ge)):v&&(v.d(1),v=null),e[1]&&e[2]?w||(w=_t(),w.c(),w.m($,Se)):w&&(w.d(1),w=null),e[2]?y||(y=kt(),y.c(),y.m($,ve)):y&&(y.d(1),y=null),o&24&&(ae=oe(e[4]),T=pt(T,o,st,1,e,ae,lt,z,Pt,gt,null,bt)),o&24&&(X=oe(e[4]),Rt(),S=pt(S,o,it,1,e,X,ot,G,Ct,St,null,ht),Ot())},i(e){if(!H){x(A.$$.fragment,e),x(q.$$.fragment,e),x(F.$$.fragment,e);for(let o=0;o<X.length;o+=1)x(S[o]);H=!0}},o(e){Z(A.$$.fragment,e),Z(q.$$.fragment,e),Z(F.$$.fragment,e);for(let o=0;o<S.length;o+=1)Z(S[o]);H=!1},d(e){e&&(r(l),r(f),r(u),r(ce),r(de),r(N),r(ue),r(U),r(he),r(V),r(be),r(M),r(ye),r(j),r($e),r(E),r(Ue),r(K),r(Me),r(L)),P&&P.d(),ne(A,e),v&&v.d(),w&&w.d(),y&&y.d(),ne(q),ne(F);for(let o=0;o<T.length;o+=1)T[o].d();for(let o=0;o<S.length;o+=1)S[o].d()}}}function Bt(s,l,a){let i,g,b,f,{collection:u}=l,_=200,R=[];const C=O=>a(3,_=O.code);return s.$$set=O=>{"collection"in O&&a(0,u=O.collection)},s.$$.update=()=>{var O,B;s.$$.dirty&1&&a(2,g=(O=u==null?void 0:u.options)==null?void 0:O.allowEmailAuth),s.$$.dirty&1&&a(1,b=(B=u==null?void 0:u.options)==null?void 0:B.allowUsernameAuth),s.$$.dirty&6&&a(5,f=b&&g?"YOUR_USERNAME_OR_EMAIL":b?"YOUR_USERNAME":"YOUR_EMAIL"),s.$$.dirty&1&&a(4,R=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:ft.dummyCollectionRecord(u)},null,2)},{code:400,body:`
                 {
                   "code": 400,
                   "message": "Failed to authenticate.",
@@ -95,4 +95,4 @@ import{S as wt,i as yt,s as $t,N as vt,O as oe,e as n,v as p,b as d,c as ne,f as
                     }
                   }
                 }
-            `}])},a(6,i=ft.getApiExampleUrl(Ot.baseUrl)),[u,b,g,_,R,f,i,A]}class Yt extends wt{constructor(l){super(),yt(this,l,qt,Lt,$t,{collection:0})}}export{Yt as default};
+            `}])},a(6,i=ft.getApiExampleUrl(Tt.baseUrl)),[u,b,g,_,R,f,i,C]}class Yt extends wt{constructor(l){super(),yt(this,l,Bt,Lt,$t,{collection:0})}}export{Yt as default};

ui/dist/assets/ConfirmEmailChangeDocs-BqhG1YVa.js

@@ -1,4 +1,4 @@
-import{S as Pe,i as Se,s as Oe,O as Y,e as r,v,b as k,c as Ce,f as b,g as d,h as n,m as $e,w as j,P as _e,Q as ye,k as Re,R as Te,n as Ae,t as ee,a as te,o as m,d as we,C as Ee,A as qe,q as H,r as Be,N as Ue}from"./index-EDzELPnf.js";import{S as De}from"./SdkTabs-kh3uN9zO.js";function he(o,l,s){const a=o.slice();return a[5]=l[s],a}function ke(o,l,s){const a=o.slice();return a[5]=l[s],a}function ge(o,l){let s,a=l[5].code+"",_,u,i,p;function f(){return l[4](l[5])}return{key:o,first:null,c(){s=r("button"),_=v(a),u=k(),b(s,"class","tab-item"),H(s,"active",l[1]===l[5].code),this.first=s},m(C,$){d(C,s,$),n(s,_),n(s,u),i||(p=Be(s,"click",f),i=!0)},p(C,$){l=C,$&4&&a!==(a=l[5].code+"")&&j(_,a),$&6&&H(s,"active",l[1]===l[5].code)},d(C){C&&m(s),i=!1,p()}}}function ve(o,l){let s,a,_,u;return a=new Ue({props:{content:l[5].body}}),{key:o,first:null,c(){s=r("div"),Ce(a.$$.fragment),_=k(),b(s,"class","tab-item"),H(s,"active",l[1]===l[5].code),this.first=s},m(i,p){d(i,s,p),$e(a,s,null),n(s,_),u=!0},p(i,p){l=i;const f={};p&4&&(f.content=l[5].body),a.$set(f),(!u||p&6)&&H(s,"active",l[1]===l[5].code)},i(i){u||(ee(a.$$.fragment,i),u=!0)},o(i){te(a.$$.fragment,i),u=!1},d(i){i&&m(s),we(a)}}}function Ne(o){var pe,fe;let l,s,a=o[0].name+"",_,u,i,p,f,C,$,D=o[0].name+"",F,le,se,I,L,w,Q,y,z,P,N,ae,K,R,ne,G,M=o[0].name+"",J,oe,V,T,X,A,Z,E,x,S,q,g=[],ie=new Map,ce,B,h=[],re=new Map,O;w=new De({props:{js:`
+import{S as Se,i as Oe,s as Pe,O as Y,b as d,d as Ce,t as ee,a as te,r as j,Q as _e,R as ye,g as Re,T as Te,e as Ee,f as m,h as n,m as $e,n as r,u as v,k,c as we,o as b,C as qe,p as Ae,w as H,x as Be,N as Ue}from"./index-Cp1ITsy4.js";import{S as De}from"./SdkTabs-CC2VqpMG.js";function he(o,l,s){const a=o.slice();return a[5]=l[s],a}function ke(o,l,s){const a=o.slice();return a[5]=l[s],a}function ge(o,l){let s,a=l[5].code+"",_,u,i,p;function f(){return l[4](l[5])}return{key:o,first:null,c(){s=r("button"),_=v(a),u=k(),b(s,"class","tab-item"),H(s,"active",l[1]===l[5].code),this.first=s},m(C,$){m(C,s,$),n(s,_),n(s,u),i||(p=Be(s,"click",f),i=!0)},p(C,$){l=C,$&4&&a!==(a=l[5].code+"")&&j(_,a),$&6&&H(s,"active",l[1]===l[5].code)},d(C){C&&d(s),i=!1,p()}}}function ve(o,l){let s,a,_,u;return a=new Ue({props:{content:l[5].body}}),{key:o,first:null,c(){s=r("div"),we(a.$$.fragment),_=k(),b(s,"class","tab-item"),H(s,"active",l[1]===l[5].code),this.first=s},m(i,p){m(i,s,p),$e(a,s,null),n(s,_),u=!0},p(i,p){l=i;const f={};p&4&&(f.content=l[5].body),a.$set(f),(!u||p&6)&&H(s,"active",l[1]===l[5].code)},i(i){u||(te(a.$$.fragment,i),u=!0)},o(i){ee(a.$$.fragment,i),u=!1},d(i){i&&d(s),Ce(a)}}}function Ne(o){var pe,fe;let l,s,a=o[0].name+"",_,u,i,p,f,C,$,D=o[0].name+"",F,le,se,I,L,w,Q,y,z,S,N,ae,K,R,ne,G,M=o[0].name+"",J,oe,V,T,X,E,Z,q,x,O,A,g=[],ie=new Map,ce,B,h=[],re=new Map,P;w=new De({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${o[3]}');
@@ -21,7 +21,7 @@ import{S as Pe,i as Se,s as Oe,O as Y,e as r,v,b as k,c as Ce,f as b,g as d,h as
           'YOUR_PASSWORD',
         );
     `}});let W=Y(o[2]);const de=e=>e[5].code;for(let e=0;e<W.length;e+=1){let t=ke(o,W,e),c=de(t);ie.set(c,g[e]=ge(c,t))}let U=Y(o[2]);const me=e=>e[5].code;for(let e=0;e<U.length;e+=1){let t=he(o,U,e),c=me(t);re.set(c,h[e]=ve(c,t))}return{c(){l=r("h3"),s=v("Confirm email change ("),_=v(a),u=v(")"),i=k(),p=r("div"),f=r("p"),C=v("Confirms "),$=r("strong"),F=v(D),le=v(" email change request."),se=k(),I=r("p"),I.textContent=`After this request all previously issued tokens for the specific record will be automatically
-        invalidated.`,L=k(),Ce(w.$$.fragment),Q=k(),y=r("h6"),y.textContent="API details",z=k(),P=r("div"),N=r("strong"),N.textContent="POST",ae=k(),K=r("div"),R=r("p"),ne=v("/api/collections/"),G=r("strong"),J=v(M),oe=v("/confirm-email-change"),V=k(),T=r("div"),T.textContent="Body Parameters",X=k(),A=r("table"),A.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>token</span></div></td> <td><span class="label">String</span></td> <td>The token from the change email request email.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The account password to confirm the email change.</td></tr></tbody>',Z=k(),E=r("div"),E.textContent="Responses",x=k(),S=r("div"),q=r("div");for(let e=0;e<g.length;e+=1)g[e].c();ce=k(),B=r("div");for(let e=0;e<h.length;e+=1)h[e].c();b(l,"class","m-b-sm"),b(p,"class","content txt-lg m-b-sm"),b(y,"class","m-b-xs"),b(N,"class","label label-primary"),b(K,"class","content"),b(P,"class","alert alert-success"),b(T,"class","section-title"),b(A,"class","table-compact table-border m-b-base"),b(E,"class","section-title"),b(q,"class","tabs-header compact combined left"),b(B,"class","tabs-content"),b(S,"class","tabs")},m(e,t){d(e,l,t),n(l,s),n(l,_),n(l,u),d(e,i,t),d(e,p,t),n(p,f),n(f,C),n(f,$),n($,F),n(f,le),n(p,se),n(p,I),d(e,L,t),$e(w,e,t),d(e,Q,t),d(e,y,t),d(e,z,t),d(e,P,t),n(P,N),n(P,ae),n(P,K),n(K,R),n(R,ne),n(R,G),n(G,J),n(R,oe),d(e,V,t),d(e,T,t),d(e,X,t),d(e,A,t),d(e,Z,t),d(e,E,t),d(e,x,t),d(e,S,t),n(S,q);for(let c=0;c<g.length;c+=1)g[c]&&g[c].m(q,null);n(S,ce),n(S,B);for(let c=0;c<h.length;c+=1)h[c]&&h[c].m(B,null);O=!0},p(e,[t]){var ue,be;(!O||t&1)&&a!==(a=e[0].name+"")&&j(_,a),(!O||t&1)&&D!==(D=e[0].name+"")&&j(F,D);const c={};t&9&&(c.js=`
+        invalidated.`,L=k(),we(w.$$.fragment),Q=k(),y=r("h6"),y.textContent="API details",z=k(),S=r("div"),N=r("strong"),N.textContent="POST",ae=k(),K=r("div"),R=r("p"),ne=v("/api/collections/"),G=r("strong"),J=v(M),oe=v("/confirm-email-change"),V=k(),T=r("div"),T.textContent="Body Parameters",X=k(),E=r("table"),E.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>token</span></div></td> <td><span class="label">String</span></td> <td>The token from the change email request email.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The account password to confirm the email change.</td></tr></tbody>',Z=k(),q=r("div"),q.textContent="Responses",x=k(),O=r("div"),A=r("div");for(let e=0;e<g.length;e+=1)g[e].c();ce=k(),B=r("div");for(let e=0;e<h.length;e+=1)h[e].c();b(l,"class","m-b-sm"),b(p,"class","content txt-lg m-b-sm"),b(y,"class","m-b-xs"),b(N,"class","label label-primary"),b(K,"class","content"),b(S,"class","alert alert-success"),b(T,"class","section-title"),b(E,"class","table-compact table-border m-b-base"),b(q,"class","section-title"),b(A,"class","tabs-header compact combined left"),b(B,"class","tabs-content"),b(O,"class","tabs")},m(e,t){m(e,l,t),n(l,s),n(l,_),n(l,u),m(e,i,t),m(e,p,t),n(p,f),n(f,C),n(f,$),n($,F),n(f,le),n(p,se),n(p,I),m(e,L,t),$e(w,e,t),m(e,Q,t),m(e,y,t),m(e,z,t),m(e,S,t),n(S,N),n(S,ae),n(S,K),n(K,R),n(R,ne),n(R,G),n(G,J),n(R,oe),m(e,V,t),m(e,T,t),m(e,X,t),m(e,E,t),m(e,Z,t),m(e,q,t),m(e,x,t),m(e,O,t),n(O,A);for(let c=0;c<g.length;c+=1)g[c]&&g[c].m(A,null);n(O,ce),n(O,B);for(let c=0;c<h.length;c+=1)h[c]&&h[c].m(B,null);P=!0},p(e,[t]){var ue,be;(!P||t&1)&&a!==(a=e[0].name+"")&&j(_,a),(!P||t&1)&&D!==(D=e[0].name+"")&&j(F,D);const c={};t&9&&(c.js=`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${e[3]}');
@@ -43,7 +43,7 @@ import{S as Pe,i as Se,s as Oe,O as Y,e as r,v,b as k,c as Ce,f as b,g as d,h as
           'TOKEN',
           'YOUR_PASSWORD',
         );
-    `),w.$set(c),(!O||t&1)&&M!==(M=e[0].name+"")&&j(J,M),t&6&&(W=Y(e[2]),g=_e(g,t,de,1,e,W,ie,q,ye,ge,null,ke)),t&6&&(U=Y(e[2]),Re(),h=_e(h,t,me,1,e,U,re,B,Te,ve,null,he),Ae())},i(e){if(!O){ee(w.$$.fragment,e);for(let t=0;t<U.length;t+=1)ee(h[t]);O=!0}},o(e){te(w.$$.fragment,e);for(let t=0;t<h.length;t+=1)te(h[t]);O=!1},d(e){e&&(m(l),m(i),m(p),m(L),m(Q),m(y),m(z),m(P),m(V),m(T),m(X),m(A),m(Z),m(E),m(x),m(S)),we(w,e);for(let t=0;t<g.length;t+=1)g[t].d();for(let t=0;t<h.length;t+=1)h[t].d()}}}function Ke(o,l,s){let a,{collection:_}=l,u=204,i=[];const p=f=>s(1,u=f.code);return o.$$set=f=>{"collection"in f&&s(0,_=f.collection)},s(3,a=Ee.getApiExampleUrl(qe.baseUrl)),s(2,i=[{code:204,body:"null"},{code:400,body:`
+    `),w.$set(c),(!P||t&1)&&M!==(M=e[0].name+"")&&j(J,M),t&6&&(W=Y(e[2]),g=_e(g,t,de,1,e,W,ie,A,ye,ge,null,ke)),t&6&&(U=Y(e[2]),Re(),h=_e(h,t,me,1,e,U,re,B,Te,ve,null,he),Ee())},i(e){if(!P){te(w.$$.fragment,e);for(let t=0;t<U.length;t+=1)te(h[t]);P=!0}},o(e){ee(w.$$.fragment,e);for(let t=0;t<h.length;t+=1)ee(h[t]);P=!1},d(e){e&&(d(l),d(i),d(p),d(L),d(Q),d(y),d(z),d(S),d(V),d(T),d(X),d(E),d(Z),d(q),d(x),d(O)),Ce(w,e);for(let t=0;t<g.length;t+=1)g[t].d();for(let t=0;t<h.length;t+=1)h[t].d()}}}function Ke(o,l,s){let a,{collection:_}=l,u=204,i=[];const p=f=>s(1,u=f.code);return o.$$set=f=>{"collection"in f&&s(0,_=f.collection)},s(3,a=qe.getApiExampleUrl(Ae.baseUrl)),s(2,i=[{code:204,body:"null"},{code:400,body:`
                 {
                   "code": 400,
                   "message": "Failed to authenticate.",
@@ -54,4 +54,4 @@ import{S as Pe,i as Se,s as Oe,O as Y,e as r,v,b as k,c as Ce,f as b,g as d,h as
                     }
                   }
                 }
-            `}]),[_,u,i,a,p]}class Ye extends Pe{constructor(l){super(),Se(this,l,Ke,Ne,Oe,{collection:0})}}export{Ye as default};
+            `}]),[_,u,i,a,p]}class Ye extends Se{constructor(l){super(),Oe(this,l,Ke,Ne,Pe,{collection:0})}}export{Ye as default};