updated changelog

CHANGELOG.md

@@ -1,3 +1,92 @@
+## v0.24.1
+
+- Added missing time macros in the UI autocomplete.
+
+- Fixed JSVM types for structs and functions with multiple generic parameters.
+
+
+## v0.24.0
+
+- ⚠️ Removed the "dry submit" when executing the collections Create API rule
+    (you can find more details why this change was introduced and how it could affect your app in https://github.com/pocketbase/pocketbase/discussions/6073).
+    For most users it should be non-breaking change, BUT if you have Create API rules that uses self-references or view counters you may have to adjust them manually.
+    With this change the "multi-match" operators are also normalized in case the targeted collection doesn't have any records
+    (_or in other words, `@collection.example.someField != "test"` will result to `true` if `example` collection has no records because it satisfies the condition that all available "example" records mustn't have `someField` equal to "test"_).
+    As a side-effect of all of the above minor changes, the record create API performance has been also improved ~4x times in high concurrent scenarios (500 concurrent clients inserting total of 50k records - [old (58.409064001s)](https://github.com/pocketbase/benchmarks/blob/54140be5fb0102f90034e1370c7f168fbcf0ddf0/results/hetzner_cax41_cgo.md#creating-50000-posts100k-reqs50000-conc500-rulerequestauthid----requestdatapublicisset--true) vs [new (13.580098262s)](https://github.com/pocketbase/benchmarks/blob/7df0466ac9bd62fe0a1056270d20ef82012f0234/results/hetzner_cax41_cgo.md#creating-50000-posts100k-reqs50000-conc500-rulerequestauthid----requestbodypublicisset--true)).
+
+- ⚠️ Changed the type definition of `store.Store[T any]` to `store.Store[K comparable, T any]` to allow support for custom store key types.
+    For most users it should be non-breaking change, BUT if you are calling `store.New[any](nil)` instances you'll have to specify the store key type, aka. `store.New[string, any](nil)`.
+
+- Added `@yesterday` and `@tomorrow` datetime filter macros.
+
+- Added `:lower` filter modifier (e.g. `title:lower = "lorem"`).
+
+- Added `mailer.Message.InlineAttachments` field for attaching inline files to an email (_aka. `cid` links_).
+
+- Added cache for the JSVM `arrayOf(m)`, `DynamicModel`, etc. dynamic `reflect` created types.
+
+- Added auth collection select for the settings "Send test email" popup ([#6166](https://github.com/pocketbase/pocketbase/issues/6166)).
+
+- Added `record.SetRandomPassword()` to simplify random password generation usually used in the OAuth2 or OTP record creation flows.
+    _The generated ~30 chars random password is assigned directly as bcrypt hash and ignores the `password` field plain value validators like min/max length or regex pattern._
+
+- Added option to list and trigger the registered app level cron jobs via the Web API and UI.
+
+- Added extra validators for the collection field `int64` options (e.g. `FileField.MaxSize`) restricting them to the max safe JSON number (2^53-1).
+
+- Added option to unset/overwrite the default PocketBase superuser installer using `ServeEvent.InstallerFunc`.
+
+- Added `app.FindCachedCollectionReferences(collection, excludeIds)` to speedup records cascade delete almost twice for projects with many collections.
+
+- Added `tests.NewTestAppWithConfig(config)` helper if you need more control over the test configurations like `IsDev`, the number of allowed connections, etc.
+
+- Invalidate all record tokens when the auth record email is changed programmatically or by a superuser ([#5964](https://github.com/pocketbase/pocketbase/issues/5964)).
+
+- Eagerly interrupt waiting for the email alert send in case it takes longer than 15s.
+
+- Normalized the hidden fields filter checks and allow targetting hidden fields in the List API rule.
+
+- Fixed "Unique identify fields" input not refreshing on unique indexes change ([#6184](https://github.com/pocketbase/pocketbase/issues/6184)).
+
+
+## v0.23.12
+
+- Added warning logs in case of mismatched `modernc.org/sqlite` and `modernc.org/libc` versions ([#6136](https://github.com/pocketbase/pocketbase/issues/6136#issuecomment-2556336962)).
+
+- Skipped the default body size limit middleware for the backup upload endpoint ([#6152](https://github.com/pocketbase/pocketbase/issues/6152)).
+
+
+## v0.23.11
+
+- Upgraded `golang.org/x/net` to 0.33.0 to fix [CVE-2024-45338](https://www.cve.org/CVERecord?id=CVE-2024-45338).
+  _PocketBase uses the vulnerable functions primarily for the auto html->text mail generation, but most applications shouldn't be affected unless you are manually embedding unrestricted user provided value in your mail templates._
+
+
+## v0.23.10
+
+- Renew the superuser file token cache when clicking on the thumb preview or download link ([#6137](https://github.com/pocketbase/pocketbase/discussions/6137)).
+
+- Upgraded `modernc.org/sqlite` to 1.34.3 to fix "disk io" error on arm64 systems.
+    _If you are extending PocketBase with Go and upgrading with `go get -u` make sure to manually set in your go.mod the `modernc.org/libc` indirect dependency to v1.55.3, aka. the exact same version the driver is using._
+
+
+## v0.23.9
+
+- Replaced `strconv.Itoa` with `strconv.FormatInt` to avoid the int64->int conversion overflow on 32-bit platforms ([#6132](https://github.com/pocketbase/pocketbase/discussions/6132)).
+
+
+## v0.23.8
+
+- Fixed Model->Record and Model->Collection hook events sync for nested and/or inner-hook transactions ([#6122](https://github.com/pocketbase/pocketbase/discussions/6122)).
+
+- Other minor improvements (updated Go and npm deps, added extra escaping for the default mail record params in case the emails are stored as html files, fixed code comment typos, etc.).
+
+
+## v0.23.7
+
+- Fixed JSVM exception -> Go error unwrapping when throwing errors from non-request hooks ([#6102](https://github.com/pocketbase/pocketbase/discussions/6102)).
+
+
 ## v0.23.6
 
 - Fixed `$filesystem.fileFromURL` documentation and generated type ([#6058](https://github.com/pocketbase/pocketbase/issues/6058)).
@@ -17,7 +106,7 @@
 
 - Other minor fixes (comment typos, JSVM types update).
 
-- Updated Go deps and the min Go releleaser GitHub action version to 1.23.4.
+- Updated Go deps and the min Go release GitHub action version to 1.23.4.
 
 
 ## v0.23.4

CHANGELOG_16_22.md

@@ -2,6 +2,20 @@
 > For the most recent versions, please refer to [CHANGELOG.md](./CHANGELOG.md)
 ---
 
+## v0.22.29
+
+- (_Backported from v0.23.11_) Upgraded `golang.org/x/net` to 0.33.0 to fix [CVE-2024-45338](https://www.cve.org/CVERecord?id=CVE-2024-45338).
+  _PocketBase uses the vulnerable functions primarily for the auto html->text mail generation, but most applications shouldn't be affected unless you are manually embedding unrestricted user provided value in your mail templates._
+
+
+## v0.22.28
+
+- (_Backported from v0.23.10_) Renew the superuser file token cache when clicking on the thumb preview or download link ([#6137](https://github.com/pocketbase/pocketbase/discussions/6137)).
+
+- (_Backported from v0.23.10_) Upgraded `modernc.org/sqlite` to 1.34.3 to fix "disk io" error on arm64 systems.
+  _If you are extending PocketBase with Go and upgrading with `go get -u` make sure to manually set in your go.mod the `modernc.org/libc` indirect dependency to v1.55.3, aka. the exact same version the driver is using._
+
+
 ## v0.22.27
 
 - Instead of unregistering the realtime clients, we now just unset their auth state on delete of the related auth record so that the clients can receive the `delete` event ([#5898](https://github.com/pocketbase/pocketbase/issues/5898)).

apis/backup.go

@@ -18,7 +18,7 @@ func bindBackupApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
 	sub := rg.Group("/backups")
 	sub.GET("", backupsList).Bind(RequireSuperuserAuth())
 	sub.POST("", backupCreate).Bind(RequireSuperuserAuth())
-	sub.POST("/upload", backupUpload).Bind(RequireSuperuserAuth())
+	sub.POST("/upload", backupUpload).Bind(BodyLimit(0), RequireSuperuserAuth())
 	sub.GET("/{key}", backupDownload) // relies on superuser file token
 	sub.DELETE("/{key}", backupDelete).Bind(RequireSuperuserAuth())
 	sub.POST("/{key}/restore", backupRestore).Bind(RequireSuperuserAuth())

apis/backup_test.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 	"gocloud.dev/blob"
@@ -346,6 +347,19 @@ func TestBackupUpload(t *testing.T) {
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{"*": 0},
 		},
+		{
+			Name:   "ensure that the default body limit is skipped",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bytes.NewBuffer(make([]byte, apis.DefaultMaxBodySize+100)),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:     400, // it doesn't matter as long as it is not 413
+			ExpectedContent:    []string{`"data":{`},
+			NotExpectedContent: []string{"entity too large"},
+			ExpectedEvents:     map[string]int{"*": 0},
+		},
 	}
 
 	for _, scenario := range scenarios {

apis/base.go

@@ -41,6 +41,7 @@ func NewRouter(app core.App) (*router.Router[*core.RequestEvent], error) {
 	bindRecordAuthApi(app, apiGroup)
 	bindLogsApi(app, apiGroup)
 	bindBackupApi(app, apiGroup)
+	bindCronApi(app, apiGroup)
 	bindFileApi(app, apiGroup)
 	bindBatchApi(app, apiGroup)
 	bindRealtimeApi(app, apiGroup)

apis/cron.go

@@ -0,0 +1,59 @@
+package apis
+
+import (
+	"net/http"
+	"slices"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+// bindCronApi registers the crons api endpoint.
+func bindCronApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/crons").Bind(RequireSuperuserAuth())
+	subGroup.GET("", cronsList)
+	subGroup.POST("/{id}", cronRun)
+}
+
+func cronsList(e *core.RequestEvent) error {
+	jobs := e.App.Cron().Jobs()
+
+	slices.SortStableFunc(jobs, func(a, b *cron.Job) int {
+		if strings.HasPrefix(a.Id(), "__pb") {
+			return 1
+		}
+		if strings.HasPrefix(b.Id(), "__pb") {
+			return -1
+		}
+		return strings.Compare(a.Id(), b.Id())
+	})
+
+	return e.JSON(http.StatusOK, jobs)
+}
+
+func cronRun(e *core.RequestEvent) error {
+	cronId := e.Request.PathValue("id")
+
+	var foundJob *cron.Job
+
+	jobs := e.App.Cron().Jobs()
+	for _, j := range jobs {
+		if j.Id() == cronId {
+			foundJob = j
+			break
+		}
+	}
+
+	if foundJob == nil {
+		return e.NotFoundError("Missing or invalid cron job", nil)
+	}
+
+	routine.FireAndForget(func() {
+		foundJob.Run()
+	})
+
+	return e.NoContent(http.StatusNoContent)
+}

apis/cron_test.go

@@ -0,0 +1,149 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spf13/cast"
+)
+
+func TestCronsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/crons",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (empty list)",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Cron().RemoveAll()
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`[]`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`{"id":"__pbLogsCleanup__","expression":"0 */6 * * *"}`,
+				`{"id":"__pbDBOptimize__","expression":"0 0 * * *"}`,
+				`{"id":"__pbMFACleanup__","expression":"0 * * * *"}`,
+				`{"id":"__pbOTPCleanup__","expression":"0 * * * *"}`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCronsRun(t *testing.T) {
+	t.Parallel()
+
+	beforeTestFunc := func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+		app.Cron().Add("test", "* * * * *", func() {
+			app.Store().Set("testJobCalls", cast.ToInt(app.Store().Get("testJobCalls"))+1)
+		})
+	}
+
+	expectedCalls := func(expected int) func(t testing.TB, app *tests.TestApp, res *http.Response) {
+		return func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			total := cast.ToInt(app.Store().Get("testJobCalls"))
+			if total != expected {
+				t.Fatalf("Expected total testJobCalls %d, got %d", expected, total)
+			}
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/crons/test",
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/crons/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing job)",
+			Method: http.MethodPost,
+			URL:    "/api/crons/missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing job)",
+			Method: http.MethodPost,
+			URL:    "/api/crons/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:          50 * time.Millisecond,
+			BeforeTestFunc: beforeTestFunc,
+			AfterTestFunc:  expectedCalls(1),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/installer.go

@@ -5,37 +5,31 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"os/exec"
-	"runtime"
 	"strings"
 	"time"
 
 	"github.com/fatih/color"
-	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 )
 
-// @todo consider combining with the installer specific hooks after refactoring cmd
-func loadInstaller(app core.App, dashboardURL string) error {
-	if !needInstallerSuperuser(app) {
-		return nil
-	}
-
-	installerRecord, err := findOrCreateInstallerSuperuser(app)
-	if err != nil {
-		return err
-	}
-
-	token, err := installerRecord.NewStaticAuthToken(30 * time.Minute)
+// DefaultInstallerFunc is the default PocketBase installer function.
+//
+// It will attempt to open a link in the browser (with a short-lived auth
+// token for the systemSuperuser) to the installer UI so that users can
+// create their own custom superuser record.
+//
+// See https://github.com/pocketbase/pocketbase/discussions/5814.
+func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL string) error {
+	token, err := systemSuperuser.NewStaticAuthToken(30 * time.Minute)
 	if err != nil {
 		return err
 	}
 
 	// launch url (ignore errors and always print a help text as fallback)
-	url := fmt.Sprintf("%s/#/pbinstal/%s", strings.TrimRight(dashboardURL, "/"), token)
-	_ = launchURL(url)
+	url := fmt.Sprintf("%s/_/#/pbinstal/%s", strings.TrimRight(baseURL, "/"), token)
+	_ = osutils.LaunchURL(url)
 	color.Magenta("\n(!) Launch the URL below in the browser if it hasn't been open already to create your first superuser account:")
 	color.New(color.Bold).Add(color.FgCyan).Println(url)
 	color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", os.Args[0])
@@ -43,6 +37,23 @@ func loadInstaller(app core.App, dashboardURL string) error {
 	return nil
 }
 
+func loadInstaller(
+	app core.App,
+	baseURL string,
+	installerFunc func(app core.App, systemSuperuser *core.Record, baseURL string) error,
+) error {
+	if installerFunc == nil || !needInstallerSuperuser(app) {
+		return nil
+	}
+
+	superuser, err := findOrCreateInstallerSuperuser(app)
+	if err != nil {
+		return err
+	}
+
+	return installerFunc(app, superuser, baseURL)
+}
+
 func needInstallerSuperuser(app core.App) bool {
 	total, err := app.CountRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{
 		"email": core.DefaultInstallerEmail,
@@ -65,7 +76,7 @@ func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
 
 		record = core.NewRecord(col)
 		record.SetEmail(core.DefaultInstallerEmail)
-		record.SetPassword(security.RandomString(30))
+		record.SetRandomPassword()
 
 		err = app.Save(record)
 		if err != nil {
@@ -75,20 +86,3 @@ func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
 
 	return record, nil
 }
-
-func launchURL(url string) error {
-	if err := is.URL.Validate(url); err != nil {
-		return err
-	}
-
-	switch runtime.GOOS {
-	case "darwin":
-		return exec.Command("open", url).Start()
-	case "windows":
-		// not sure if this is the best command but seems to be the most reliable based on the comments in
-		// https://stackoverflow.com/questions/3739327/launching-a-website-via-the-windows-commandline#answer-49115945
-		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
-	default: // linux, freebsd, etc.
-		return exec.Command("xdg-open", url).Start()
-	}
-}

apis/middlewares_rate_limit.go

@@ -111,7 +111,7 @@ func checkCollectionRateLimit(e *core.RequestEvent, collection *core.Collection,
 //
 //nolint:unused
 func isClientRateLimited(e *core.RequestEvent, rtId string) bool {
-	rateLimiters, ok := e.App.Store().Get(rateLimitersStoreKey).(*store.Store[*rateLimiter])
+	rateLimiters, ok := e.App.Store().Get(rateLimitersStoreKey).(*store.Store[string, *rateLimiter])
 	if !ok || rateLimiters == nil {
 		return false
 	}
@@ -146,7 +146,7 @@ func checkRateLimit(e *core.RequestEvent, rtId string, rule core.RateLimitRule)
 
 	rateLimiters := e.App.Store().GetOrSet(rateLimitersStoreKey, func() any {
 		return initRateLimitersStore(e.App)
-	}).(*store.Store[*rateLimiter])
+	}).(*store.Store[string, *rateLimiter])
 	if rateLimiters == nil {
 		e.App.Logger().Warn("Failed to retrieve app rate limiters store")
 		return nil
@@ -198,9 +198,9 @@ func destroyRateLimitersStore(app core.App) {
 	app.Store().Remove(rateLimitersStoreKey)
 }
 
-func initRateLimitersStore(app core.App) *store.Store[*rateLimiter] {
+func initRateLimitersStore(app core.App) *store.Store[string, *rateLimiter] {
 	app.Cron().Add(rateLimitersCronKey, "2 * * * *", func() { // offset a little since too many cleanup tasks execute at 00
-		limitersStore, ok := app.Store().Get(rateLimitersStoreKey).(*store.Store[*rateLimiter])
+		limitersStore, ok := app.Store().Get(rateLimitersStoreKey).(*store.Store[string, *rateLimiter])
 		if !ok {
 			return
 		}
@@ -225,7 +225,7 @@ func initRateLimitersStore(app core.App) *store.Store[*rateLimiter] {
 		},
 	})
 
-	return store.New[*rateLimiter](nil)
+	return store.New[string, *rateLimiter](nil)
 }
 
 func newRateLimiter(maxAllowed int, intervalInSec int64, minDeleteIntervalInSec int64) *rateLimiter {

apis/record_auth_email_change_confirm.go

@@ -38,9 +38,8 @@ func recordConfirmEmailChange(e *core.RequestEvent) error {
 	event.NewEmail = newEmail
 
 	return e.App.OnRecordConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeRequestEvent) error {
-		authRecord.Set(core.FieldNameEmail, e.NewEmail)
-		authRecord.Set(core.FieldNameVerified, true)
-		authRecord.RefreshTokenKey() // invalidate old tokens
+		e.Record.SetEmail(e.NewEmail)
+		e.Record.SetVerified(true)
 
 		if err := e.App.Save(e.Record); err != nil {
 			return firstApiError(err, e.BadRequestError("Failed to confirm email change.", err))

apis/record_auth_password_reset_confirm.go

@@ -47,12 +47,12 @@ func recordConfirmPasswordReset(e *core.RequestEvent) error {
 			}
 		}
 
-		err = form.app.Save(authRecord)
+		err = e.App.Save(authRecord)
 		if err != nil {
 			return firstApiError(err, e.BadRequestError("Failed to set new password.", err))
 		}
 
-		form.app.Store().Remove(getPasswordResetResendKey(authRecord))
+		e.App.Store().Remove(getPasswordResetResendKey(authRecord))
 
 		return e.NoContent(http.StatusNoContent)
 	})

apis/record_auth_password_reset_confirm_test.go

@@ -186,11 +186,20 @@ func TestRecordConfirmPasswordReset(t *testing.T) {
 					t.Fatal("Expected the user to be unverified")
 				}
 
+				oldTokenKey := user.TokenKey()
+
 				// manually change the email to check whether the verified state will be updated
 				user.SetEmail("test_update@example.com")
-				if err := app.Save(user); err != nil {
+				if err = app.Save(user); err != nil {
 					t.Fatalf("Failed to update user test email: %v", err)
 				}
+
+				// resave with the old token key since the email change above
+				// would change it and will make the password token invalid
+				user.SetTokenKey(oldTokenKey)
+				if err = app.Save(user); err != nil {
+					t.Fatalf("Failed to restore original user tokenKey: %v", err)
+				}
 			},
 			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
 				_, err := app.FindAuthRecordByToken(

apis/record_auth_with_oauth2.go

@@ -16,7 +16,6 @@ import (
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
-	"github.com/pocketbase/pocketbase/tools/security"
 	"golang.org/x/oauth2"
 )
 
@@ -224,12 +223,6 @@ func oauth2Submit(e *core.RecordAuthWithOAuth2RequestEvent, optExternalAuth *cor
 
 			payload[core.FieldNameEmail] = e.OAuth2User.Email
 
-			// set a random password if none is set
-			if v, _ := payload[core.FieldNamePassword].(string); v == "" {
-				payload[core.FieldNamePassword] = security.RandomString(30)
-				payload[core.FieldNamePassword+"Confirm"] = payload[core.FieldNamePassword]
-			}
-
 			// map known fields (unless the field was explicitly submitted as part of CreateData)
 			if _, ok := payload[e.Collection.OAuth2.MappedFields.Id]; !ok && e.Collection.OAuth2.MappedFields.Id != "" {
 				payload[e.Collection.OAuth2.MappedFields.Id] = e.OAuth2User.Id
@@ -292,7 +285,7 @@ func oauth2Submit(e *core.RecordAuthWithOAuth2RequestEvent, optExternalAuth *cor
 			// set random password for users with unverified email
 			// (this is in case a malicious actor has registered previously with the user email)
 			if !isLoggedAuthRecord && e.Record.Email() != "" && !e.Record.Verified() {
-				e.Record.SetPassword(security.RandomString(30))
+				e.Record.SetRandomPassword()
 				needUpdate = true
 			}
 

apis/record_auth_with_oauth2_test.go

@@ -558,12 +558,21 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 					t.Fatalf("Expected password %q to be valid", "1234567890")
 				}
 
+				oldTokenKey := user.TokenKey()
+
 				// manually unset the user email
 				user.SetEmail("")
-				if err := app.Save(user); err != nil {
+				if err = app.Save(user); err != nil {
 					t.Fatal(err)
 				}
 
+				// resave with the old token key since the email change above
+				// would change it and will make the password token invalid
+				user.SetTokenKey(oldTokenKey)
+				if err = app.Save(user); err != nil {
+					t.Fatalf("Failed to restore original user tokenKey: %v", err)
+				}
+
 				// register the test provider
 				auth.Providers["test"] = func() auth.Provider {
 					return &oauth2MockProvider{
@@ -949,6 +958,8 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				"createData": {
 					"email": "invalid",
 					"emailVisibility": true,
+					"password": "1234567890",
+					"passwordConfirm": "1234567890",
 					"name": "test_name",
 					"username": "test_username",
 					"rel": "0yxhwia2amd8gec"
@@ -1018,6 +1029,16 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				"OnModelValidate":  4,
 				"OnRecordValidate": 4,
 			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindFirstRecordByData("users", "username", "test_username")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+			},
 		},
 		{
 			Name:   "creating user (with mapped OAuth2 fields and avatarURL->file field)",

apis/record_auth_with_otp.go

@@ -85,12 +85,7 @@ func recordAuthWithOTP(e *core.RequestEvent) error {
 			e.App.Logger().Error("Failed to delete used OTP", "error", err, "otpId", e.OTP.Id)
 		}
 
-		err = RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOTP, nil)
-		if err != nil {
-			return err
-		}
-
-		return nil
+		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOTP, nil)
 	})
 }
 

apis/record_crud.go

@@ -13,9 +13,11 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/router"
 	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
 )
 
 // bindRecordCrudApi registers the record crud api endpoints and
@@ -57,23 +59,27 @@ func recordsList(e *core.RequestEvent) error {
 		return err
 	}
 
-	fieldsResolver := core.NewRecordFieldResolver(
-		e.App,
-		collection,
-		requestInfo,
-		// hidden fields are searchable only by superusers
-		requestInfo.HasSuperuserAuth(),
-	)
+	query := e.App.RecordQuery(collection)
 
-	searchProvider := search.NewProvider(fieldsResolver).
-		Query(e.App.RecordQuery(collection))
+	fieldsResolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
 
-	if !requestInfo.HasSuperuserAuth() && collection.ListRule != nil {
-		searchProvider.AddFilter(search.FilterData(*collection.ListRule))
+	if !requestInfo.HasSuperuserAuth() && collection.ListRule != nil && *collection.ListRule != "" {
+		expr, err := search.FilterData(*collection.ListRule).BuildExpr(fieldsResolver)
+		if err != nil {
+			return err
+		}
+		query.AndWhere(expr)
+
+		// will be applied by the search provider right before executing the query
+		// fieldsResolver.UpdateQuery(query)
 	}
 
-	records := []*core.Record{}
+	// hidden fields are searchable only by superusers
+	fieldsResolver.SetAllowHiddenFields(requestInfo.HasSuperuserAuth())
 
+	searchProvider := search.NewProvider(fieldsResolver).Query(query)
+
+	records := []*core.Record{}
 	result, err := searchProvider.ParseAndExec(e.Request.URL.Query().Encode(), &records)
 	if err != nil {
 		return firstApiError(err, e.BadRequestError("", err))
@@ -92,9 +98,9 @@ func recordsList(e *core.RequestEvent) error {
 
 		// Add a randomized throttle in case of too many empty search filter attempts.
 		//
-		// This is just for extra precaution since security researches raised concern regarding the possibity of eventual
+		// This is just for extra precaution since security researches raised concern regarding the possibility of eventual
 		// timing attacks because the List API rule acts also as filter and executes in a single run with the client-side filters.
-		// This is by design and it is an accepted tradeoff between performance, usability and correctness.
+		// This is by design and it is an accepted trade off between performance, usability and correctness.
 		//
 		// While technically the below doesn't fully guarantee protection against filter timing attacks, in practice combined with the network latency it makes them even less feasible.
 		// A properly configured rate limiter or individual fields Hidden checks are better suited if you are really concerned about eventual information disclosure by side-channel attacks.
@@ -107,7 +113,7 @@ func recordsList(e *core.RequestEvent) error {
 			len(e.Records) == 0 &&
 			checkRateLimit(e.RequestEvent, "@pb_list_timing_check_"+collection.Id, listTimingRateLimitRule) != nil {
 			e.App.Logger().Debug("Randomized throttle because of too many failed searches", "collectionId", collection.Id)
-			randomizedThrottle(100)
+			randomizedThrottle(150)
 		}
 
 		return e.JSON(http.StatusOK, e.Result)
@@ -218,6 +224,16 @@ func recordCreate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 			return firstApiError(err, e.BadRequestError("Failed to read the submitted data.", err))
 		}
 
+		// set a random password for the OAuth2 ignoring its plain password validators
+		var skipPlainPasswordRecordValidators bool
+		if requestInfo.Context == core.RequestInfoContextOAuth2 {
+			if _, ok := data[core.FieldNamePassword]; !ok {
+				data[core.FieldNamePassword] = security.RandomString(30)
+				data[core.FieldNamePassword+"Confirm"] = data[core.FieldNamePassword]
+				skipPlainPasswordRecordValidators = true
+			}
+		}
+
 		// replace modifiers fields so that the resolved value is always
 		// available when accessing requestInfo.Body
 		requestInfo.Body = data
@@ -228,6 +244,13 @@ func recordCreate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 		}
 		form.Load(data)
 
+		if skipPlainPasswordRecordValidators {
+			// unset the plain value to skip the plain password field validators
+			if raw, ok := record.GetRaw(core.FieldNamePassword).(*core.PasswordFieldValue); ok {
+				raw.Plain = ""
+			}
+		}
+
 		var isOptFinalizerCalled bool
 
 		event := new(core.RecordRequestEvent)
@@ -241,57 +264,74 @@ func recordCreate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 
 			// temporary save the record and check it against the create and manage rules
 			if !hasSuperuserAuth && e.Collection.CreateRule != nil {
-				// temporary grant manager access level
-				form.GrantManagerAccess()
+				dummyRecord := e.Record.Clone()
 
-				// manually unset the verified field to prevent manage API rule misuse in case the rule relies on it
-				initialVerified := e.Record.Verified()
-				if initialVerified {
-					e.Record.SetVerified(false)
+				dummyRandomPart := "__pb_create__" + security.PseudorandomString(6)
+
+				// set an id if it doesn't have already
+				// (the value doesn't matter; it is used only to minimize the breaking changes with earlier versions)
+				if dummyRecord.Id == "" {
+					dummyRecord.Id = "__temp_id__" + dummyRandomPart
 				}
 
-				createRuleFunc := func(q *dbx.SelectQuery) error {
-					if *e.Collection.CreateRule == "" {
-						return nil // no create rule to resolve
-					}
+				// unset the verified field to prevent manage API rule misuse in case the rule relies on it
+				dummyRecord.SetVerified(false)
 
-					resolver := core.NewRecordFieldResolver(e.App, e.Collection, requestInfo, true)
-					expr, err := search.FilterData(*e.Collection.CreateRule).BuildExpr(resolver)
+				// export the dummy record data into db params
+				dummyExport, err := dummyRecord.DBExport(e.App)
+				if err != nil {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("dummy DBExport error: %w", err))
+				}
+
+				dummyParams := make(dbx.Params, len(dummyExport))
+				selects := make([]string, 0, len(dummyExport))
+				var param string
+				for k, v := range dummyExport {
+					k = inflector.Columnify(k) // columnify is just as extra measure in case of custom fields
+					param = "__pb_create__" + k
+					dummyParams[param] = v
+					selects = append(selects, "{:"+param+"} AS [["+k+"]]")
+				}
+
+				// shallow clone the current collection
+				dummyCollection := *e.Collection
+				dummyCollection.Id += dummyRandomPart
+				dummyCollection.Name += inflector.Columnify(dummyRandomPart)
+
+				withFrom := fmt.Sprintf("WITH {{%s}} as (SELECT %s)", dummyCollection.Name, strings.Join(selects, ","))
+
+				// check non-empty create rule
+				if *dummyCollection.CreateRule != "" {
+					ruleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+
+					resolver := core.NewRecordFieldResolver(e.App, &dummyCollection, requestInfo, true)
+
+					expr, err := search.FilterData(*dummyCollection.CreateRule).BuildExpr(resolver)
 					if err != nil {
-						return err
+						return e.BadRequestError("Failed to create record", fmt.Errorf("create rule build expression failure: %w", err))
 					}
-					resolver.UpdateQuery(q)
-					q.AndWhere(expr)
+					ruleQuery.AndWhere(expr)
 
-					return nil
+					resolver.UpdateQuery(ruleQuery)
+
+					var exists bool
+					err = ruleQuery.Limit(1).Row(&exists)
+					if err != nil || !exists {
+						return e.BadRequestError("Failed to create record", fmt.Errorf("create rule failure: %w", err))
+					}
 				}
 
-				testErr := form.DrySubmit(func(txApp core.App, drySavedRecord *core.Record) error {
-					foundRecord, err := txApp.FindRecordById(drySavedRecord.Collection(), drySavedRecord.Id, createRuleFunc)
-					if err != nil {
-						return fmt.Errorf("DrySubmit create rule failure: %w", err)
-					}
-
-					// reset the form access level in case it satisfies the Manage API rule
-					if !hasAuthManageAccess(txApp, requestInfo, foundRecord) {
-						form.ResetAccess()
-					}
-
-					return nil
-				})
-				if testErr != nil {
-					return e.BadRequestError("Failed to create record.", testErr)
-				}
-
-				// restore initial verified state (it will be further validated on submit)
-				if initialVerified != e.Record.Verified() {
-					e.Record.SetVerified(initialVerified)
+				// check for manage rule access
+				manageRuleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+				if !form.HasManageAccess() &&
+					hasAuthManageAccess(e.App, requestInfo, &dummyCollection, manageRuleQuery) {
+					form.GrantManagerAccess()
 				}
 			}
 
 			err := form.Submit()
 			if err != nil {
-				return firstApiError(err, e.BadRequestError("Failed to create record.", err))
+				return firstApiError(err, e.BadRequestError("Failed to create record", err))
 			}
 
 			err = EnrichRecord(e.RequestEvent, e.Record)
@@ -411,7 +451,12 @@ func recordUpdate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 		hookErr := e.App.OnRecordUpdateRequest().Trigger(event, func(e *core.RecordRequestEvent) error {
 			form.SetApp(e.App)
 			form.SetRecord(e.Record)
-			if !form.HasManageAccess() && hasAuthManageAccess(e.App, requestInfo, e.Record) {
+
+			manageRuleQuery := e.App.DB().Select("(1)").From(e.Collection.Name).AndWhere(dbx.HashExp{
+				e.Collection.Name + ".id": e.Record.Id,
+			})
+			if !form.HasManageAccess() &&
+				hasAuthManageAccess(e.App, requestInfo, e.Collection, manageRuleQuery) {
 				form.GrantManagerAccess()
 			}
 
@@ -644,3 +689,39 @@ func extractUploadedFiles(re *core.RequestEvent, collection *core.Collection, pr
 
 	return result, nil
 }
+
+// hasAuthManageAccess checks whether the client is allowed to have
+// [forms.RecordUpsert] auth management permissions
+// (e.g. allowing to change system auth fields without oldPassword).
+func hasAuthManageAccess(app core.App, requestInfo *core.RequestInfo, collection *core.Collection, query *dbx.SelectQuery) bool {
+	if !collection.IsAuth() {
+		return false
+	}
+
+	manageRule := collection.ManageRule
+
+	if manageRule == nil || *manageRule == "" {
+		return false // only for superusers (manageRule can't be empty)
+	}
+
+	if requestInfo == nil || requestInfo.Auth == nil {
+		return false // no auth record
+	}
+
+	resolver := core.NewRecordFieldResolver(app, collection, requestInfo, true)
+
+	expr, err := search.FilterData(*manageRule).BuildExpr(resolver)
+	if err != nil {
+		app.Logger().Error("Manage rule build expression error", "error", err, "collectionId", collection.Id)
+		return false
+	}
+	query.AndWhere(expr)
+
+	resolver.UpdateQuery(query)
+
+	var exists bool
+
+	err = query.Limit(1).Row(&exists)
+
+	return err == nil && exists
+}

apis/record_crud_test.go

@@ -259,6 +259,47 @@ func TestRecordCrudList(t *testing.T) {
 				"OnRecordEnrich":       4,
 			},
 		},
+		{
+			Name:   "authenticated regular record that matches the collection list rule with hidden field",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				col.ListRule = types.Pointer("title ~ 'test'")
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":4`,
+				`"items":[{`,
+				`"id":"1tmknxy2868d869"`,
+				`"id":"lcl9d87w22ml6jy"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"mk5fmymtx4wsprk"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       4,
+			},
+		},
 		{
 			Name:   "authenticated regular record filtering with a hidden field",
 			Method: http.MethodGet,
@@ -1747,11 +1788,16 @@ func TestRecordCrudCreate(t *testing.T) {
 				`"code":"validation_not_unique"`,
 			},
 			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnRecordCreateRequest": 1,
-				// validate events are not fired because the unique check will fail during dry submit
-				// "OnModelValidate":  1,
-				// "OnRecordValidate": 1,
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelCreateExecute":     1,
+				"OnModelAfterCreateError":  1,
+				"OnModelValidate":          1,
+				"OnRecordCreate":           1,
+				"OnRecordCreateExecute":    1,
+				"OnRecordAfterCreateError": 1,
+				"OnRecordValidate":         1,
 			},
 		},
 		{

apis/record_helpers.go

@@ -6,11 +6,13 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -479,40 +481,6 @@ func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *
 	return nil
 }
 
-// hasAuthManageAccess checks whether the client is allowed to have
-// [forms.RecordUpsert] auth management permissions
-// (e.g. allowing to change system auth fields without oldPassword).
-func hasAuthManageAccess(app core.App, requestInfo *core.RequestInfo, record *core.Record) bool {
-	if !record.Collection().IsAuth() {
-		return false
-	}
-
-	manageRule := record.Collection().ManageRule
-
-	if manageRule == nil || *manageRule == "" {
-		return false // only for superusers (manageRule can't be empty)
-	}
-
-	if requestInfo == nil || requestInfo.Auth == nil {
-		return false // no auth record
-	}
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		resolver := core.NewRecordFieldResolver(app, record.Collection(), requestInfo, true)
-		expr, err := search.FilterData(*manageRule).BuildExpr(resolver)
-		if err != nil {
-			return err
-		}
-		resolver.UpdateQuery(q)
-		q.AndWhere(expr)
-		return nil
-	}
-
-	_, findErr := app.FindRecordById(record.Collection().Id, record.Id, ruleFunc)
-
-	return findErr == nil
-}
-
 var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
 var superuserOnlyRuleFields = []string{"@collection.", "@request."}
 
@@ -603,8 +571,28 @@ func authAlert(e *core.RequestEvent, authRecord *core.Record) error {
 	}
 
 	// send email alert for the new origin auth (skip first login)
+	//
+	// Note: The "fake" timeout is a temp solution to avoid blocking
+	//       for too long when the SMTP server is not accessible, due
+	//       to the lack of context cancellation support in the underlying
+	//       mailer and net/smtp package.
+	//       The goroutine technically "leaks" but we assume that the OS will
+	//       terminate the connection after some time (usually after 3-4 mins).
 	if !isFirstLogin && currentOrigin.IsNew() && authRecord.Email() != "" {
-		if err := mails.SendRecordAuthAlert(e.App, authRecord); err != nil {
+		mailSent := make(chan error, 1)
+
+		timer := time.AfterFunc(15*time.Second, func() {
+			mailSent <- errors.New("auth alert mail send wait timeout reached")
+		})
+
+		routine.FireAndForget(func() {
+			err := mails.SendRecordAuthAlert(e.App, authRecord)
+			timer.Stop()
+			mailSent <- err
+		})
+
+		err = <-mailSent
+		if err != nil {
 			return err
 		}
 	}

apis/serve.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
-	"fmt"
 	"log"
 	"net"
 	"net/http"
@@ -17,6 +16,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/ui"
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
@@ -158,6 +158,7 @@ func Serve(app core.App, config ServeConfig) error {
 	serveEvent.Router = pbRouter
 	serveEvent.Server = server
 	serveEvent.CertManager = certManager
+	serveEvent.InstallerFunc = DefaultInstallerFunc
 
 	var listener net.Listener
 
@@ -204,6 +205,8 @@ func Serve(app core.App, config ServeConfig) error {
 	}()
 	// ---------------------------------------------------------------
 
+	var baseURL string
+
 	// trigger the OnServe hook and start the tcp listener
 	serveHookErr := app.OnServe().Trigger(serveEvent, func(e *core.ServeEvent) error {
 		handler, err := e.Router.BuildMux()
@@ -213,10 +216,20 @@ func Serve(app core.App, config ServeConfig) error {
 
 		e.Server.Handler = handler
 
-		addr := e.Server.Addr
+		if config.HttpsAddr == "" {
+			baseURL = "http://" + serverAddrToHost(serveEvent.Server.Addr)
+		} else {
+			baseURL = "https://"
+			if len(config.CertificateDomains) > 0 {
+				baseURL += config.CertificateDomains[0]
+			} else {
+				baseURL += serverAddrToHost(serveEvent.Server.Addr)
+			}
+		}
 
-		// fallback similar to the std Server.ListenAndServe/ListenAndServeTLS
+		addr := e.Server.Addr
 		if addr == "" {
+			// fallback similar to the std Server.ListenAndServe/ListenAndServeTLS
 			if config.HttpsAddr != "" {
 				addr = ":https"
 			} else {
@@ -224,11 +237,22 @@ func Serve(app core.App, config ServeConfig) error {
 			}
 		}
 
-		var lnErr error
+		listener, err = net.Listen("tcp", addr)
+		if err != nil {
+			return err
+		}
 
-		listener, lnErr = net.Listen("tcp", addr)
+		if e.InstallerFunc != nil {
+			app := e.App
+			installerFunc := e.InstallerFunc
+			routine.FireAndForget(func() {
+				if err := loadInstaller(app, baseURL, installerFunc); err != nil {
+					app.Logger().Warn("Failed to initialize installer", "error", err)
+				}
+			})
+		}
 
-		return lnErr
+		return nil
 	})
 	if serveHookErr != nil {
 		return serveHookErr
@@ -238,17 +262,6 @@ func Serve(app core.App, config ServeConfig) error {
 		return errors.New("The OnServe finalizer wasn't invoked. Did you forget to call the ServeEvent.Next() method?")
 	}
 
-	schema := "http"
-	addr := server.Addr
-	if config.HttpsAddr != "" {
-		schema = "https"
-		if len(config.CertificateDomains) > 0 {
-			addr = config.CertificateDomains[0]
-		}
-	}
-	baseURL := fmt.Sprintf("%s://%s", schema, addr)
-	dashboardURL := fmt.Sprintf("%s/_", baseURL)
-
 	if config.ShowStartBanner {
 		date := new(strings.Builder)
 		log.New(date, "", log.LstdFlags).Print()
@@ -262,16 +275,9 @@ func Serve(app core.App, config ServeConfig) error {
 
 		regular := color.New()
 		regular.Printf("├─ REST API:  %s\n", color.CyanString("%s/api/", baseURL))
-		regular.Printf("└─ Dashboard: %s\n", color.CyanString("%s/", dashboardURL))
+		regular.Printf("└─ Dashboard: %s\n", color.CyanString("%s/_/", baseURL))
 	}
 
-	go func() {
-		installerErr := loadInstaller(app, dashboardURL)
-		if installerErr != nil {
-			app.Logger().Warn("Failed to initialize installer", "error", installerErr)
-		}
-	}()
-
 	var serveErr error
 	if config.HttpsAddr != "" {
 		if config.HttpAddr != "" {
@@ -280,10 +286,10 @@ func Serve(app core.App, config ServeConfig) error {
 		}
 
 		// start HTTPS server
-		serveErr = server.ServeTLS(listener, "", "")
+		serveErr = serveEvent.Server.ServeTLS(listener, "", "")
 	} else {
 		// OR start HTTP server
-		serveErr = server.Serve(listener)
+		serveErr = serveEvent.Server.Serve(listener)
 	}
 	if serveErr != nil && !errors.Is(serveErr, http.ErrServerClosed) {
 		return serveErr
@@ -292,6 +298,14 @@ func Serve(app core.App, config ServeConfig) error {
 	return nil
 }
 
+// serverAddrToHost loosely converts http.Server.Addr string into a host to print.
+func serverAddrToHost(addr string) string {
+	if addr == "" || strings.HasSuffix(addr, ":http") || strings.HasSuffix(addr, ":https") {
+		return "127.0.0.1"
+	}
+	return addr
+}
+
 type serverErrorLogWriter struct {
 	app core.App
 }

core/app.go

@@ -71,7 +71,7 @@ type App interface {
 	Settings() *Settings
 
 	// Store returns the app runtime store.
-	Store() *store.Store[any]
+	Store() *store.Store[string, any]
 
 	// Cron returns the app cron instance.
 	Cron() *cron.Cron
@@ -369,16 +369,9 @@ type App interface {
 	//   - If you are updating a Collection in a transaction and then call this method before commit,
 	//     it'll return the cached Collection state and not the one from the uncommitted transaction.
 	//   - The cache is automatically updated on collections db change (create/update/delete).
-	//     To manually reload the cache you can call [App.ReloadCachedCollections()]
+	//     To manually reload the cache you can call [App.ReloadCachedCollections]
 	FindCachedCollectionByNameOrId(nameOrId string) (*Collection, error)
 
-	// IsCollectionNameUnique checks that there is no existing collection
-	// with the provided name (case insensitive!).
-	//
-	// Note: case insensitive check because the name is used also as
-	// table name for the records.
-	IsCollectionNameUnique(name string, excludeIds ...string) bool
-
 	// FindCollectionReferences returns information for all relation
 	// fields referencing the provided collection.
 	//
@@ -387,6 +380,32 @@ type App interface {
 	// as the excludeIds argument.
 	FindCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error)
 
+	// FindCachedCollectionReferences is similar to [App.FindCollectionReferences]
+	// but retrieves the Collection from the app cache instead of making a db call.
+	//
+	// NB! This method is suitable for read-only Collection operations.
+	//
+	// If you plan making changes to the returned Collection model,
+	// use [App.FindCollectionReferences] instead.
+	//
+	// Caveats:
+	//
+	//   - The returned Collection should be used only for read-only operations.
+	//     Avoid directly modifying the returned cached Collection as it will affect
+	//     the global cached value even if you don't persist the changes in the database!
+	//   - If you are updating a Collection in a transaction and then call this method before commit,
+	//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+	//   - The cache is automatically updated on collections db change (create/update/delete).
+	//     To manually reload the cache you can call [App.ReloadCachedCollections].
+	FindCachedCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error)
+
+	// IsCollectionNameUnique checks that there is no existing collection
+	// with the provided name (case insensitive!).
+	//
+	// Note: case insensitive check because the name is used also as
+	// table name for the records.
+	IsCollectionNameUnique(name string, excludeIds ...string) bool
+
 	// TruncateCollection deletes all records associated with the provided collection.
 	//
 	// The truncate operation is executed in a single transaction,

core/base.go

@@ -70,7 +70,7 @@ var _ App = (*BaseApp)(nil)
 type BaseApp struct {
 	config              *BaseAppConfig
 	txInfo              *txAppInfo
-	store               *store.Store[any]
+	store               *store.Store[string, any]
 	cron                *cron.Cron
 	settings            *Settings
 	subscriptionsBroker *subscriptions.Broker
@@ -194,7 +194,7 @@ type BaseApp struct {
 func NewBaseApp(config BaseAppConfig) *BaseApp {
 	app := &BaseApp{
 		settings:            newDefaultSettings(),
-		store:               store.New[any](nil),
+		store:               store.New[string, any](nil),
 		cron:                cron.New(),
 		subscriptionsBroker: subscriptions.NewBroker(),
 		config:              &config,
@@ -532,7 +532,7 @@ func (app *BaseApp) Settings() *Settings {
 }
 
 // Store returns the app runtime store.
-func (app *BaseApp) Store() *store.Store[any] {
+func (app *BaseApp) Store() *store.Store[string, any] {
 	return app.store
 }
 
@@ -601,6 +601,14 @@ func (app *BaseApp) NewMailClient() mailer.Mailer {
 							fmt.Fprintf(mailLog, "├─ Attachments: %v\n", attachmentKeys)
 						}
 
+						if len(ae.Message.InlineAttachments) > 0 {
+							attachmentKeys := make([]string, 0, len(ae.Message.InlineAttachments))
+							for k := range ae.Message.InlineAttachments {
+								attachmentKeys = append(attachmentKeys, k)
+							}
+							fmt.Fprintf(mailLog, "├─ InlineAttachments: %v\n", attachmentKeys)
+						}
+
 						const indentation = "        "
 						if ae.Message.Text != "" {
 							textParts := strings.Split(strings.TrimSpace(ae.Message.Text), "\n")

core/base_backup.go

@@ -142,6 +142,10 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 //
 // If a failure occure during the restore process the dir changes are reverted.
 // If for whatever reason the revert is not possible, it panics.
+//
+// Note that if your pb_data has custom network mounts as subdirectories, then
+// it is possible the restore to fail during the `os.Rename` operations
+// (see https://github.com/pocketbase/pocketbase/issues/4647).
 func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 	if app.Store().Has(StoreKeyActiveBackup) {
 		return errors.New("try again later - another backup/restore operation has already been started")
@@ -162,6 +166,13 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 			return errors.New("restore is not supported on Windows")
 		}
 
+		// make sure that the special temp directory exists
+		// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+		localTempDir := filepath.Join(e.App.DataDir(), LocalTempDirName)
+		if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
+			return fmt.Errorf("failed to create a temp dir: %w", err)
+		}
+
 		fsys, err := e.App.NewBackupsFilesystem()
 		if err != nil {
 			return err
@@ -170,57 +181,71 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 		fsys.SetContext(e.Context)
 
-		// fetch the backup file in a temp location
-		br, err := fsys.GetFile(name)
-		if err != nil {
-			return err
-		}
-		defer br.Close()
-
-		// make sure that the special temp directory exists
-		// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
-		localTempDir := filepath.Join(e.App.DataDir(), LocalTempDirName)
-		if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
-			return fmt.Errorf("failed to create a temp dir: %w", err)
+		if ok, _ := fsys.Exists(name); !ok {
+			return fmt.Errorf("missing or invalid backup file %q to restore", name)
 		}
 
-		// create a temp zip file from the blob.Reader and try to extract it
-		tempZip, err := os.CreateTemp(localTempDir, "pb_restore_zip")
-		if err != nil {
-			return err
-		}
-		defer os.Remove(tempZip.Name())
-
-		if _, err := io.Copy(tempZip, br); err != nil {
-			return err
-		}
-
-		extractedDataDir := filepath.Join(localTempDir, "pb_restore_"+security.PseudorandomString(4))
+		extractedDataDir := filepath.Join(localTempDir, "pb_restore_"+security.PseudorandomString(8))
 		defer os.RemoveAll(extractedDataDir)
-		if err := archive.Extract(tempZip.Name(), extractedDataDir); err != nil {
-			return err
+
+		// extract the zip
+		if e.App.Settings().Backups.S3.Enabled {
+			br, err := fsys.GetFile(name)
+			if err != nil {
+				return err
+			}
+			defer br.Close()
+
+			// create a temp zip file from the blob.Reader and try to extract it
+			tempZip, err := os.CreateTemp(localTempDir, "pb_restore_zip")
+			if err != nil {
+				return err
+			}
+			defer os.Remove(tempZip.Name())
+			defer tempZip.Close() // note: this technically shouldn't be necessary but it is here to workaround platforms discrepancies
+
+			_, err = io.Copy(tempZip, br)
+			if err != nil {
+				return err
+			}
+
+			err = archive.Extract(tempZip.Name(), extractedDataDir)
+			if err != nil {
+				return err
+			}
+
+			// remove the temp zip file since we no longer need it
+			// (this is in case the app restarts and the defer calls are not called)
+			_ = tempZip.Close()
+			err = os.Remove(tempZip.Name())
+			if err != nil {
+				e.App.Logger().Warn(
+					"[RestoreBackup] Failed to remove the temp zip backup file",
+					slog.String("file", tempZip.Name()),
+					slog.String("error", err.Error()),
+				)
+			}
+		} else {
+			// manually construct the local path to avoid creating a copy of the zip file
+			// since the blob reader currently doesn't implement ReaderAt
+			zipPath := filepath.Join(app.DataDir(), LocalBackupsDirName, filepath.Base(name))
+
+			err = archive.Extract(zipPath, extractedDataDir)
+			if err != nil {
+				return err
+			}
 		}
 
-		// ensure that a database file exists
+		// ensure that at least a database file exists
 		extractedDB := filepath.Join(extractedDataDir, "data.db")
 		if _, err := os.Stat(extractedDB); err != nil {
 			return fmt.Errorf("data.db file is missing or invalid: %w", err)
 		}
 
-		// remove the extracted zip file since we no longer need it
-		// (this is in case the app restarts and the defer calls are not called)
-		if err := os.Remove(tempZip.Name()); err != nil {
-			e.App.Logger().Debug(
-				"[RestoreBackup] Failed to remove the temp zip backup file",
-				slog.String("file", tempZip.Name()),
-				slog.String("error", err.Error()),
-			)
-		}
-
 		// move the current pb_data content to a special temp location
 		// that will hold the old data between dirs replace
 		// (the temp dir will be automatically removed on the next app start)
-		oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(4))
+		oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(8))
 		if err := osutils.MoveDirContent(e.App.DataDir(), oldTempDataDir, e.Exclude...); err != nil {
 			return fmt.Errorf("failed to move the current pb_data content to a temp location: %w", err)
 		}
@@ -257,7 +282,7 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 
 // registerAutobackupHooks registers the autobackup app serve hooks.
 func (app *BaseApp) registerAutobackupHooks() {
-	const jobId = "__auto_pb_backup__"
+	const jobId = "__pbAutoBackup__"
 
 	loadJob := func() {
 		rawSchedule := app.Settings().Backups.Cron

core/collection_model.go

@@ -35,10 +35,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionValidate().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionValidate().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -50,10 +53,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionCreate().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionCreate().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -65,10 +71,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionCreateExecute().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionCreateExecute().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -80,10 +89,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionAfterCreateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionAfterCreateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -95,10 +107,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelErrorEvent) error {
 			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnCollectionAfterCreateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+				err := me.App.OnCollectionAfterCreateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
 					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -110,10 +125,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionUpdate().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionUpdate().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -125,10 +143,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionUpdateExecute().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionUpdateExecute().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -140,10 +161,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionAfterUpdateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionAfterUpdateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -155,10 +179,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelErrorEvent) error {
 			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnCollectionAfterUpdateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+				err := me.App.OnCollectionAfterUpdateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
 					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -170,10 +197,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionDelete().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionDelete().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -185,10 +215,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionDeleteExecute().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionDeleteExecute().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -200,10 +233,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelEvent) error {
 			if ce, ok := newCollectionEventFromModelEvent(me); ok {
-				return me.App.OnCollectionAfterDeleteSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+				err := me.App.OnCollectionAfterDeleteSuccess().Trigger(ce, func(ce *CollectionEvent) error {
 					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
 					return me.Next()
 				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
 			}
 
 			return me.Next()
@@ -215,10 +251,13 @@ func (app *BaseApp) registerCollectionHooks() {
 		Id: systemHookIdCollection,
 		Func: func(me *ModelErrorEvent) error {
 			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnCollectionAfterDeleteError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+				err := me.App.OnCollectionAfterDeleteError().Trigger(ce, func(ce *CollectionErrorEvent) error {
 					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
 			}
 
 			return me.Next()

core/collection_query.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/pocketbase/dbx"
@@ -75,16 +76,16 @@ func (app *BaseApp) FindCollectionByNameOrId(nameOrId string) (*Collection, erro
 	return m, nil
 }
 
-// FindCachedCollectionByNameOrId is similar to [App.FindCollectionByNameOrId]
+// FindCachedCollectionByNameOrId is similar to [BaseApp.FindCollectionByNameOrId]
 // but retrieves the Collection from the app cache instead of making a db call.
 //
 // NB! This method is suitable for read-only Collection operations.
 //
 // Returns [sql.ErrNoRows] if no Collection is found for consistency
-// with the [App.FindCollectionByNameOrId] method.
+// with the [BaseApp.FindCollectionByNameOrId] method.
 //
 // If you plan making changes to the returned Collection model,
-// use [App.FindCollectionByNameOrId] instead.
+// use [BaseApp.FindCollectionByNameOrId] instead.
 //
 // Caveats:
 //
@@ -94,7 +95,7 @@ func (app *BaseApp) FindCollectionByNameOrId(nameOrId string) (*Collection, erro
 //   - If you are updating a Collection in a transaction and then call this method before commit,
 //     it'll return the cached Collection state and not the one from the uncommitted transaction.
 //   - The cache is automatically updated on collections db change (create/update/delete).
-//     To manually reload the cache you can call [App.ReloadCachedCollections()]
+//     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
 func (app *BaseApp) FindCachedCollectionByNameOrId(nameOrId string) (*Collection, error) {
 	collections, _ := app.Store().Get(StoreKeyCachedCollections).([]*Collection)
 	if collections == nil {
@@ -111,30 +112,6 @@ func (app *BaseApp) FindCachedCollectionByNameOrId(nameOrId string) (*Collection
 	return nil, sql.ErrNoRows
 }
 
-// IsCollectionNameUnique checks that there is no existing collection
-// with the provided name (case insensitive!).
-//
-// Note: case insensitive check because the name is used also as
-// table name for the records.
-func (app *BaseApp) IsCollectionNameUnique(name string, excludeIds ...string) bool {
-	if name == "" {
-		return false
-	}
-
-	query := app.CollectionQuery().
-		Select("count(*)").
-		AndWhere(dbx.NewExp("LOWER([[name]])={:name}", dbx.Params{"name": strings.ToLower(name)})).
-		Limit(1)
-
-	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
-		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
-	}
-
-	var exists bool
-
-	return query.Row(&exists) == nil && !exists
-}
-
 // FindCollectionReferences returns information for all relation fields
 // referencing the provided collection.
 //
@@ -168,6 +145,72 @@ func (app *BaseApp) FindCollectionReferences(collection *Collection, excludeIds
 	return result, nil
 }
 
+// FindCachedCollectionReferences is similar to [BaseApp.FindCollectionReferences]
+// but retrieves the Collection from the app cache instead of making a db call.
+//
+// NB! This method is suitable for read-only Collection operations.
+//
+// If you plan making changes to the returned Collection model,
+// use [BaseApp.FindCollectionReferences] instead.
+//
+// Caveats:
+//
+//   - The returned Collection should be used only for read-only operations.
+//     Avoid directly modifying the returned cached Collection as it will affect
+//     the global cached value even if you don't persist the changes in the database!
+//   - If you are updating a Collection in a transaction and then call this method before commit,
+//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+//   - The cache is automatically updated on collections db change (create/update/delete).
+//     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+func (app *BaseApp) FindCachedCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error) {
+	collections, _ := app.Store().Get(StoreKeyCachedCollections).([]*Collection)
+	if collections == nil {
+		// cache is not initialized yet (eg. run in a system migration)
+		return app.FindCollectionReferences(collection, excludeIds...)
+	}
+
+	result := map[*Collection][]Field{}
+
+	for _, c := range collections {
+		if slices.Contains(excludeIds, c.Id) {
+			continue
+		}
+
+		for _, rawField := range c.Fields {
+			f, ok := rawField.(*RelationField)
+			if ok && f.CollectionId == collection.Id {
+				result[c] = append(result[c], f)
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// IsCollectionNameUnique checks that there is no existing collection
+// with the provided name (case insensitive!).
+//
+// Note: case insensitive check because the name is used also as
+// table name for the records.
+func (app *BaseApp) IsCollectionNameUnique(name string, excludeIds ...string) bool {
+	if name == "" {
+		return false
+	}
+
+	query := app.CollectionQuery().
+		Select("count(*)").
+		AndWhere(dbx.NewExp("LOWER([[name]])={:name}", dbx.Params{"name": strings.ToLower(name)})).
+		Limit(1)
+
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
+
+	var exists bool
+
+	return query.Row(&exists) == nil && !exists
+}
+
 // TruncateCollection deletes all records associated with the provided collection.
 //
 // The truncate operation is executed in a single transaction,

core/collection_query_test.go

@@ -208,34 +208,6 @@ func TestFindCachedCollectionByNameOrId(t *testing.T) {
 	run(false)
 }
 
-func TestIsCollectionNameUnique(t *testing.T) {
-	t.Parallel()
-
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		name      string
-		excludeId string
-		expected  bool
-	}{
-		{"", "", false},
-		{"demo1", "", false},
-		{"Demo1", "", false},
-		{"new", "", true},
-		{"demo1", "wsmn24bux7wo113", true},
-	}
-
-	for i, s := range scenarios {
-		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
-			result := app.IsCollectionNameUnique(s.name, s.excludeId)
-			if result != s.expected {
-				t.Errorf("Expected %v, got %v", s.expected, result)
-			}
-		})
-	}
-}
-
 func TestFindCollectionReferences(t *testing.T) {
 	t.Parallel()
 
@@ -288,6 +260,115 @@ func TestFindCollectionReferences(t *testing.T) {
 	}
 }
 
+func TestFindCachedCollectionReferences(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalQueries := 0
+	app.DB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		totalQueries++
+	}
+
+	run := func(withCache bool) {
+		var expectedTotalQueries int
+
+		if withCache {
+			err := app.ReloadCachedCollections()
+			if err != nil {
+				t.Fatal(err)
+			}
+		} else {
+			app.Store().Reset(nil)
+			expectedTotalQueries = 1
+		}
+
+		totalQueries = 0
+
+		result, err := app.FindCachedCollectionReferences(
+			collection,
+			collection.Id,
+			// test whether "nonempty" exclude ids condition will be skipped
+			"",
+			"",
+		)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(result) != 1 {
+			t.Fatalf("Expected 1 collection, got %d: %v", len(result), result)
+		}
+
+		expectedFields := []string{
+			"rel_one_no_cascade",
+			"rel_one_no_cascade_required",
+			"rel_one_cascade",
+			"rel_one_unique",
+			"rel_many_no_cascade",
+			"rel_many_no_cascade_required",
+			"rel_many_cascade",
+			"rel_many_unique",
+		}
+
+		for col, fields := range result {
+			if col.Name != "demo4" {
+				t.Fatalf("Expected collection demo4, got %s", col.Name)
+			}
+			if len(fields) != len(expectedFields) {
+				t.Fatalf("Expected fields %v, got %v", expectedFields, fields)
+			}
+			for i, f := range fields {
+				if !slices.Contains(expectedFields, f.GetName()) {
+					t.Fatalf("[%d] Didn't expect field %v", i, f)
+				}
+			}
+		}
+
+		if totalQueries != expectedTotalQueries {
+			t.Fatalf("Expected %d totalQueries, got %d", expectedTotalQueries, totalQueries)
+		}
+	}
+
+	run(true)
+
+	run(false)
+}
+
+func TestIsCollectionNameUnique(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name      string
+		excludeId string
+		expected  bool
+	}{
+		{"", "", false},
+		{"demo1", "", false},
+		{"Demo1", "", false},
+		{"new", "", true},
+		{"demo1", "wsmn24bux7wo113", true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
+			result := app.IsCollectionNameUnique(s.name, s.excludeId)
+			if result != s.expected {
+				t.Errorf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
 func TestFindCollectionTruncate(t *testing.T) {
 	t.Parallel()
 

core/db.go

@@ -59,7 +59,7 @@ func GenerateDefaultRandomId() string {
 
 // crc32Checksum generates a stringified crc32 checksum from the provided plain string.
 func crc32Checksum(str string) string {
-	return strconv.Itoa(int(crc32.ChecksumIEEE([]byte(str))))
+	return strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(str))), 10)
 }
 
 // ModelQuery creates a new preconfigured select app.DB() query with preset

core/db_tx_test.go

@@ -168,16 +168,28 @@ func TestTransactionHooksCallsOnSuccess(t *testing.T) {
 	})
 
 	app.OnModelAfterCreateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
 		afterCreateHookCalls++
 		return e.Next()
 	})
 
 	app.OnModelAfterUpdateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
 		afterUpdateHookCalls++
 		return e.Next()
 	})
 
 	app.OnModelAfterDeleteSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
 		afterDeleteHookCalls++
 		return e.Next()
 	})
@@ -233,3 +245,169 @@ func TestTransactionHooksCallsOnSuccess(t *testing.T) {
 		t.Errorf("Expected afterDeleteHookCalls to be called 1 time, got %d", afterDeleteHookCalls)
 	}
 }
+
+func TestTransactionFromInnerCreateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordCreateExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterCreateSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	collection, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(collection)
+
+	record.Set("title", "test_inner_tx")
+
+	if err = app.Save(record); err != nil {
+		t.Fatalf("Create failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordCreateExecute":      1,
+		"OnRecordAfterCreateSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}
+
+func TestTransactionFromInnerUpdateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordUpdateExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterUpdateSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	existingModel, err := app.FindFirstRecordByFilter("demo2", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = app.Save(existingModel); err != nil {
+		t.Fatalf("Update failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordUpdateExecute":      1,
+		"OnRecordAfterUpdateSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}
+
+func TestTransactionFromInnerDeleteHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordDeleteExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterDeleteSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	existingModel, err := app.FindFirstRecordByFilter("demo2", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = app.Delete(existingModel); err != nil {
+		t.Fatalf("Delete failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordDeleteExecute":      1,
+		"OnRecordAfterDeleteSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}

core/event_request.go

@@ -82,7 +82,7 @@ func (e *RequestEvent) HasSuperuserAuth() bool {
 // RequestInfo parses the current request into RequestInfo instance.
 //
 // Note that the returned result is cached to avoid copying the request data multiple times
-// but the auth state and other common store items are always refreshed in case they were changed my another handler.
+// but the auth state and other common store items are always refreshed in case they were changed by another handler.
 func (e *RequestEvent) RequestInfo() (*RequestInfo, error) {
 	e.mu.Lock()
 	defer e.mu.Unlock()

core/events.go

@@ -103,6 +103,22 @@ type ServeEvent struct {
 	Router      *router.Router[*RequestEvent]
 	Server      *http.Server
 	CertManager *autocert.Manager
+
+	// InstallerFunc is the "installer" function that is called after
+	// successful server tcp bind but only if there is no explicit
+	// superuser record created yet.
+	//
+	// It runs in a separate goroutine and its default value is [apis.DefaultInstallerFunc].
+	//
+	// It receives a system superuser record as argument that you can use to generate
+	// a short-lived auth token (e.g. systemSuperuser.NewStaticAuthToken(30 * time.Minute))
+	// and concatenate it as query param for your installer page
+	// (if you are using the client-side SDKs, you can then load the
+	// token with pb.authStore.save(token) and perform any Web API request
+	// e.g. creating a new superuser).
+	//
+	// Set it to nil if you want to skip the installer.
+	InstallerFunc func(app App, systemSuperuser *Record, baseURL string) error
 }
 
 // -------------------------------------------------------------------
@@ -173,8 +189,8 @@ type ModelEvent struct {
 }
 
 type ModelErrorEvent struct {
-	ModelEvent
 	Error error
+	ModelEvent
 }
 
 // -------------------------------------------------------------------
@@ -196,8 +212,8 @@ type RecordEvent struct {
 }
 
 type RecordErrorEvent struct {
-	RecordEvent
 	Error error
+	RecordEvent
 }
 
 func syncModelEventWithRecordEvent(me *ModelEvent, re *RecordEvent) {
@@ -216,6 +232,12 @@ func syncModelEventWithRecordEvent(me *ModelEvent, re *RecordEvent) {
 	// }
 }
 
+func syncRecordEventWithModelEvent(re *RecordEvent, me *ModelEvent) {
+	re.App = me.App
+	re.Context = me.Context
+	re.Type = me.Type
+}
+
 func newRecordEventFromModelEvent(me *ModelEvent) (*RecordEvent, bool) {
 	record, ok := me.Model.(*Record)
 	if !ok {
@@ -253,6 +275,11 @@ func syncModelErrorEventWithRecordErrorEvent(me *ModelErrorEvent, re *RecordErro
 	me.Error = re.Error
 }
 
+func syncRecordErrorEventWithModelErrorEvent(re *RecordErrorEvent, me *ModelErrorEvent) {
+	syncRecordEventWithModelEvent(&re.RecordEvent, &me.ModelEvent)
+	me.Error = re.Error
+}
+
 // -------------------------------------------------------------------
 // Collection events data
 // -------------------------------------------------------------------
@@ -272,8 +299,8 @@ type CollectionEvent struct {
 }
 
 type CollectionErrorEvent struct {
-	CollectionEvent
 	Error error
+	CollectionEvent
 }
 
 func syncModelEventWithCollectionEvent(me *ModelEvent, ce *CollectionEvent) {
@@ -283,6 +310,15 @@ func syncModelEventWithCollectionEvent(me *ModelEvent, ce *CollectionEvent) {
 	me.Model = ce.Collection
 }
 
+func syncCollectionEventWithModelEvent(ce *CollectionEvent, me *ModelEvent) {
+	ce.App = me.App
+	ce.Context = me.Context
+	ce.Type = me.Type
+	if c, ok := me.Model.(*Collection); ok {
+		ce.Collection = c
+	}
+}
+
 func newCollectionEventFromModelEvent(me *ModelEvent) (*CollectionEvent, bool) {
 	record, ok := me.Model.(*Collection)
 	if !ok {
@@ -316,6 +352,11 @@ func syncModelErrorEventWithCollectionErrorEvent(me *ModelErrorEvent, ce *Collec
 	me.Error = ce.Error
 }
 
+func syncCollectionErrorEventWithModelErrorEvent(ce *CollectionErrorEvent, me *ModelErrorEvent) {
+	syncCollectionEventWithModelEvent(&ce.CollectionEvent, &me.ModelEvent)
+	me.Error = ce.Error
+}
+
 // -------------------------------------------------------------------
 // File API events data
 // -------------------------------------------------------------------

core/field.go

@@ -13,6 +13,8 @@ import (
 
 var fieldNameRegex = regexp.MustCompile(`^\w+$`)
 
+const maxSafeJSONInt int64 = 1<<53 - 1
+
 // Commonly used field names.
 const (
 	FieldNameId              = "id"

core/field_editor.go

@@ -47,7 +47,7 @@ type EditorField struct {
 
 	// ---
 
-	// MaxSize specifies the maximum size of the allowed field value (in bytes).
+	// MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
 	//
 	// If zero, a default limit of ~5MB is applied.
 	MaxSize int64 `form:"maxSize" json:"maxSize"`
@@ -148,7 +148,7 @@ func (f *EditorField) ValidateSettings(ctx context.Context, app App, collection
 	return validation.ValidateStruct(f,
 		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
 		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
-		validation.Field(&f.MaxSize, validation.Min(0)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
 	)
 }
 

core/field_editor_test.go

@@ -206,6 +206,17 @@ func TestEditorFieldValidateSettings(t *testing.T) {
 			},
 			[]string{},
 		},
+		{
+			"MaxSize > safe json int",
+			func() *core.EditorField {
+				return &core.EditorField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
 	}
 
 	for _, s := range scenarios {

core/field_file.go

@@ -94,7 +94,7 @@ type FileField struct {
 
 	// ---
 
-	// MaxSize specifies the maximum size of a single uploaded file (in bytes).
+	// MaxSize specifies the maximum size of a single uploaded file (in bytes and up to 2^53-1).
 	//
 	// If zero, a default limit of 5MB is applied.
 	MaxSize int64 `form:"maxSize" json:"maxSize"`
@@ -223,8 +223,8 @@ func (f *FileField) ValidateSettings(ctx context.Context, app App, collection *C
 	return validation.ValidateStruct(f,
 		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
 		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
-		validation.Field(&f.MaxSelect, validation.Min(0)),
-		validation.Field(&f.MaxSize, validation.Min(0)),
+		validation.Field(&f.MaxSelect, validation.Min(0), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
 		validation.Field(&f.Thumbs, validation.Each(
 			validation.NotIn("0x0", "0x0t", "0x0b", "0x0f"),
 			validation.Match(filesystem.ThumbSizeRegex),

core/field_file_test.go

@@ -539,6 +539,50 @@ func TestFileFieldValidateSettings(t *testing.T) {
 			},
 			[]string{},
 		},
+		{
+			"MaxSize > safe json int",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSize < 0",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: -1,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSelect > safe json int",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSelect: 1 << 53,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+		{
+			"MaxSelect < 0",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSelect: -1,
+				}
+			},
+			[]string{"maxSelect"},
+		},
 	}
 
 	for _, s := range scenarios {

core/field_json.go

@@ -51,7 +51,7 @@ type JSONField struct {
 
 	// ---
 
-	// MaxSize specifies the maximum size of the allowed field value (in bytes).
+	// MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
 	//
 	// If zero, a default limit of 5MB is applied.
 	MaxSize int64 `form:"maxSize" json:"maxSize"`
@@ -181,7 +181,7 @@ func (f *JSONField) ValidateSettings(ctx context.Context, app App, collection *C
 	return validation.ValidateStruct(f,
 		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
 		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
-		validation.Field(&f.MaxSize, validation.Min(0)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
 	)
 }
 

core/field_json_test.go

@@ -200,7 +200,7 @@ func TestJSONFieldValidateSettings(t *testing.T) {
 		expectErrors []string
 	}{
 		{
-			"< 0 MaxSize",
+			"MaxSize < 0",
 			func() *core.JSONField {
 				return &core.JSONField{
 					Id:      "test",
@@ -211,7 +211,7 @@ func TestJSONFieldValidateSettings(t *testing.T) {
 			[]string{"maxSize"},
 		},
 		{
-			"= 0 MaxSize",
+			"MaxSize = 0",
 			func() *core.JSONField {
 				return &core.JSONField{
 					Id:   "test",
@@ -221,7 +221,7 @@ func TestJSONFieldValidateSettings(t *testing.T) {
 			[]string{},
 		},
 		{
-			"> 0 MaxSize",
+			"MaxSize > 0",
 			func() *core.JSONField {
 				return &core.JSONField{
 					Id:      "test",
@@ -231,6 +231,17 @@ func TestJSONFieldValidateSettings(t *testing.T) {
 			},
 			[]string{},
 		},
+		{
+			"MaxSize > safe json int",
+			func() *core.JSONField {
+				return &core.JSONField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
 	}
 
 	for _, s := range scenarios {

core/field_text.go

@@ -259,8 +259,8 @@ func (f *TextField) ValidateSettings(ctx context.Context, app App, collection *C
 			validation.When(f.PrimaryKey, validation.In(idColumn).Error(`The primary key must be named "id".`)),
 		),
 		validation.Field(&f.PrimaryKey, validation.By(f.checkOtherFieldsForPK(collection))),
-		validation.Field(&f.Min, validation.Min(0)),
-		validation.Field(&f.Max, validation.Min(f.Min)),
+		validation.Field(&f.Min, validation.Min(0), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.Max, validation.Min(f.Min), validation.Max(maxSafeJSONInt)),
 		validation.Field(&f.Pattern, validation.When(f.PrimaryKey, validation.Required), validation.By(validators.IsRegex)),
 		validation.Field(&f.Hidden, validation.When(f.PrimaryKey, validation.Empty)),
 		validation.Field(&f.Required, validation.When(f.PrimaryKey, validation.Required)),

core/field_text_test.go

@@ -430,6 +430,50 @@ func TestTextFieldValidateSettings(t *testing.T) {
 			},
 			[]string{"autogeneratePattern"},
 		},
+		{
+			"Max > safe json int",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Max:  1 << 53,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"Max < 0",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Max:  -1,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"Min > safe json int",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Min:  1 << 53,
+				}
+			},
+			[]string{"min"},
+		},
+		{
+			"Min < 0",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Min:  -1,
+				}
+			},
+			[]string{"min"},
+		},
 	}
 
 	for _, s := range scenarios {

core/log_printer.go

@@ -11,7 +11,7 @@ import (
 	"github.com/spf13/cast"
 )
 
-var cachedColors = store.New[*color.Color](nil)
+var cachedColors = store.New[string, *color.Color](nil)
 
 // getColor returns [color.Color] object and cache it (if not already).
 func getColor(attrs ...color.Attribute) (c *color.Color) {

core/mfa_model.go

@@ -122,7 +122,7 @@ func (app *BaseApp) registerMFAHooks() {
 	recordRefHooks[*MFA](app, CollectionNameMFAs, CollectionTypeAuth)
 
 	// run on every hour to cleanup expired mfa sessions
-	app.Cron().Add("__mfasCleanup__", "0 * * * *", func() {
+	app.Cron().Add("__pbMFACleanup__", "0 * * * *", func() {
 		if err := app.DeleteExpiredMFAs(); err != nil {
 			app.Logger().Warn("Failed to delete expired MFA sessions", "error", err)
 		}

core/otp_model.go

@@ -119,7 +119,7 @@ func (app *BaseApp) registerOTPHooks() {
 	recordRefHooks[*OTP](app, CollectionNameOTPs, CollectionTypeAuth)
 
 	// run on every hour to cleanup expired otp sessions
-	app.Cron().Add("__otpsCleanup__", "0 * * * *", func() {
+	app.Cron().Add("__pbOTPCleanup__", "0 * * * *", func() {
 		if err := app.DeleteExpiredOTPs(); err != nil {
 			app.Logger().Warn("Failed to delete expired OTP sessions", "error", err)
 		}

core/record_field_resolver.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -18,6 +19,7 @@ const (
 	eachModifier   string = "each"
 	issetModifier  string = "isset"
 	lengthModifier string = "length"
+	lowerModifier  string = "lower"
 )
 
 // ensure that `search.FieldResolver` interface is implemented
@@ -47,6 +49,26 @@ type RecordFieldResolver struct {
 	allowHiddenFields bool
 }
 
+// AllowedFields returns a copy of the resolver's allowed fields.
+func (r *RecordFieldResolver) AllowedFields() []string {
+	return slices.Clone(r.allowedFields)
+}
+
+// SetAllowedFields replaces the resolver's allowed fields with the new ones.
+func (r *RecordFieldResolver) SetAllowedFields(newAllowedFields []string) {
+	r.allowedFields = slices.Clone(newAllowedFields)
+}
+
+// AllowHiddenFields returns whether the current resolver allows filtering hidden fields.
+func (r *RecordFieldResolver) AllowHiddenFields() bool {
+	return r.allowHiddenFields
+}
+
+// SetAllowHiddenFields enables or disables hidden fields filtering.
+func (r *RecordFieldResolver) SetAllowHiddenFields(allowHiddenFields bool) {
+	r.allowHiddenFields = allowHiddenFields
+}
+
 // NewRecordFieldResolver creates and initializes a new `RecordFieldResolver`.
 func NewRecordFieldResolver(
 	app App,
@@ -193,7 +215,14 @@ func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (*search
 		resultVal = val
 	}
 
-	placeholder := "f" + security.PseudorandomString(6)
+	placeholder := "f" + security.PseudorandomString(8)
+
+	if modifier == lowerModifier {
+		return &search.ResolverResult{
+			Identifier: "LOWER({:" + placeholder + "})",
+			Params:     dbx.Params{placeholder: resultVal},
+		}, nil
+	}
 
 	return &search.ResolverResult{
 		Identifier: "{:" + placeholder + "}",
@@ -355,7 +384,8 @@ func splitModifier(combined string) (string, string, error) {
 	switch parts[1] {
 	case issetModifier,
 		eachModifier,
-		lengthModifier:
+		lengthModifier,
+		lowerModifier:
 		return parts[0], parts[1], nil
 	}
 

core/record_field_resolver_runner.go

@@ -15,6 +15,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
 )
 
 // maxNestedRels defines the max allowed nested relations depth.
@@ -113,6 +114,11 @@ func (r *runner) run() (*search.ResolverResult, error) {
 			if modifier == lengthModifier && len(r.activeProps) == 3 {
 				return r.processRequestInfoLengthModifier(bodyField)
 			}
+
+			// check for body arrayble fields ":lower" modifier
+			if modifier == lowerModifier && len(r.activeProps) == 3 {
+				return r.processRequestInfoLowerModifier(bodyField)
+			}
 		}
 
 		// some other @request.* static field
@@ -191,6 +197,10 @@ func (r *runner) processCollectionField() (*search.ResolverResult, error) {
 }
 
 func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
+	if r.resolver.requestInfo == nil || r.resolver.requestInfo.Auth == nil || r.resolver.requestInfo.Auth.Collection() == nil {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
 	// plain auth field
 	// ---
 	if _, ok := plainRequestAuthFields[r.fieldName]; ok {
@@ -199,10 +209,6 @@ func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
 
 	// resolve the auth collection field
 	// ---
-	if r.resolver.requestInfo == nil || r.resolver.requestInfo.Auth == nil || r.resolver.requestInfo.Auth.Collection() == nil {
-		return &search.ResolverResult{Identifier: "NULL"}, nil
-	}
-
 	collection := r.resolver.requestInfo.Auth.Collection()
 
 	r.activeCollectionName = collection.Name
@@ -262,6 +268,19 @@ func toSlice(value any) []any {
 	return result
 }
 
+func (r *runner) processRequestInfoLowerModifier(bodyField Field) (*search.ResolverResult, error) {
+	rawValue := cast.ToString(r.resolver.requestInfo.Body[bodyField.GetName()])
+
+	placeholder := "infoLower" + bodyField.GetName() + security.PseudorandomString(6)
+
+	result := &search.ResolverResult{
+		Identifier: "LOWER({:" + placeholder + "})",
+		Params:     dbx.Params{placeholder: rawValue},
+	}
+
+	return result, nil
+}
+
 func (r *runner) processRequestInfoLengthModifier(bodyField Field) (*search.ResolverResult, error) {
 	if _, ok := bodyField.(MultiValuer); !ok {
 		return nil, fmt.Errorf("field %q doesn't support multivalue operations", bodyField.GetName())
@@ -396,6 +415,10 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 
 		field := collection.Fields.GetByName(prop)
 
+		if field != nil && field.GetHidden() && !r.allowHiddenFields {
+			return nil, fmt.Errorf("non-filterable field %q", prop)
+		}
+
 		// json field -> treat the rest of the props as json path
 		if field != nil && field.Type() == FieldTypeJSON {
 			var jsonPath strings.Builder
@@ -460,6 +483,10 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 				return nil, fmt.Errorf("invalid back relation field %q", parts[2])
 			}
 
+			if backField.GetHidden() && !r.allowHiddenFields {
+				return nil, fmt.Errorf("non-filterable back relation field %q", backField.GetName())
+			}
+
 			backRelField, ok := backField.(*RelationField)
 			if !ok {
 				return nil, fmt.Errorf("failed to initialize back relation field %q", backField.GetName())
@@ -713,11 +740,11 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 	// default
 	// -------------------------------------------------------
 	result := &search.ResolverResult{
-		Identifier: fmt.Sprintf("[[%s.%s]]", r.activeTableAlias, cleanFieldName),
+		Identifier: "[[" + r.activeTableAlias + "." + cleanFieldName + "]]",
 	}
 
 	if r.withMultiMatch {
-		r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.%s]]", r.multiMatchActiveTableAlias, cleanFieldName)
+		r.multiMatch.valueIdentifier = "[[" + r.multiMatchActiveTableAlias + "." + cleanFieldName + "]]"
 		result.MultiMatchSubQuery = r.multiMatch
 	}
 
@@ -743,5 +770,13 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 		}
 	}
 
+	// account for the ":lower" modifier
+	if modifier == lowerModifier {
+		result.Identifier = "LOWER(" + result.Identifier + ")"
+		if r.withMultiMatch {
+			r.multiMatch.valueIdentifier = "LOWER(" + r.multiMatch.valueIdentifier + ")"
+		}
+	}
+
 	return result, nil
 }

core/record_model.go

@@ -37,9 +37,9 @@ var (
 type Record struct {
 	collection       *Collection
 	originalData     map[string]any
-	customVisibility *store.Store[bool]
-	data             *store.Store[any]
-	expand           *store.Store[any]
+	customVisibility *store.Store[string, bool]
+	data             *store.Store[string, any]
+	expand           *store.Store[string, any]
 
 	BaseModel
 
@@ -55,10 +55,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordValidate().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordValidate().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -70,10 +73,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordCreate().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordCreate().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -85,10 +91,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordCreateExecute().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordCreateExecute().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -100,10 +109,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordAfterCreateSuccess().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordAfterCreateSuccess().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -115,10 +127,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelErrorEvent) error {
 			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnRecordAfterCreateError().Trigger(re, func(re *RecordErrorEvent) error {
+				err := me.App.OnRecordAfterCreateError().Trigger(re, func(re *RecordErrorEvent) error {
 					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -130,10 +145,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordUpdate().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordUpdate().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -145,10 +163,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordUpdateExecute().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordUpdateExecute().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -160,10 +181,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordAfterUpdateSuccess().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordAfterUpdateSuccess().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -175,10 +199,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelErrorEvent) error {
 			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnRecordAfterUpdateError().Trigger(re, func(re *RecordErrorEvent) error {
+				err := me.App.OnRecordAfterUpdateError().Trigger(re, func(re *RecordErrorEvent) error {
 					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -190,10 +217,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordDelete().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordDelete().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -205,10 +235,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordDeleteExecute().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordDeleteExecute().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -220,10 +253,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelEvent) error {
 			if re, ok := newRecordEventFromModelEvent(me); ok {
-				return me.App.OnRecordAfterDeleteSuccess().Trigger(re, func(re *RecordEvent) error {
+				err := me.App.OnRecordAfterDeleteSuccess().Trigger(re, func(re *RecordEvent) error {
 					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
 					return me.Next()
 				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -235,10 +271,13 @@ func (app *BaseApp) registerRecordHooks() {
 		Id: systemHookIdRecord,
 		Func: func(me *ModelErrorEvent) error {
 			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
-				return me.App.OnRecordAfterDeleteError().Trigger(re, func(re *RecordErrorEvent) error {
+				err := me.App.OnRecordAfterDeleteError().Trigger(re, func(re *RecordErrorEvent) error {
 					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
 					return me.Next()
 				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
 			}
 
 			return me.Next()
@@ -498,8 +537,8 @@ func newRecordsFromNullStringMaps(collection *Collection, rows []dbx.NullStringM
 func NewRecord(collection *Collection) *Record {
 	record := &Record{
 		collection:       collection,
-		data:             store.New[any](nil),
-		customVisibility: store.New[bool](nil),
+		data:             store.New[string, any](nil),
+		customVisibility: store.New[string, bool](nil),
 		originalData:     make(map[string]any, len(collection.Fields)),
 	}
 
@@ -642,7 +681,7 @@ func (m *Record) Expand() map[string]any {
 // SetExpand replaces the current Record's expand with the provided expand arg data (shallow copied).
 func (m *Record) SetExpand(expand map[string]any) {
 	if m.expand == nil {
-		m.expand = store.New[any](nil)
+		m.expand = store.New[string, any](nil)
 	}
 
 	m.expand.Reset(expand)
@@ -794,6 +833,10 @@ func (m *Record) IgnoreEmailVisibility(state bool) *Record {
 //
 // This could be used if you want to save only the record fields that you've changed
 // without overwrite other untouched fields in case of concurrent update.
+//
+// Note that the fields change comparison is based on the current fields against m.Original()
+// (aka. if you have performed save on the same Record instance multiple times you may have to refetch it,
+// so that m.Original() could reflect the last saved change).
 func (m *Record) IgnoreUnchangedFields(state bool) *Record {
 	m.ignoreUnchangedFields = state
 	return m
@@ -1370,12 +1413,18 @@ func onRecordValidate(e *RecordEvent) error {
 
 func onRecordSaveExecute(e *RecordEvent) error {
 	if e.Record.Collection().IsAuth() {
-		// ensure that the token key is different on password change
-		old := e.Record.Original()
-		if !e.Record.IsNew() &&
-			old.TokenKey() == e.Record.TokenKey() &&
-			old.Get(FieldNamePassword) != e.Record.Get(FieldNamePassword) {
-			e.Record.RefreshTokenKey()
+		// ensure that the token key is regenerated on password change or email change
+		if !e.Record.IsNew() {
+			lastSavedRecord, err := e.App.FindRecordById(e.Record.Collection(), e.Record.Id)
+			if err != nil {
+				return err
+			}
+
+			if lastSavedRecord.TokenKey() == e.Record.TokenKey() &&
+				(lastSavedRecord.Get(FieldNamePassword) != e.Record.Get(FieldNamePassword) ||
+					lastSavedRecord.Email() != e.Record.Email()) {
+				e.Record.RefreshTokenKey()
+			}
 		}
 
 		// cross-check that the auth record id is unique across all auth collections.
@@ -1413,7 +1462,7 @@ func onRecordDeleteExecute(e *RecordEvent) error {
 	//
 	// note: the select is outside of the transaction to minimize
 	// SQLITE_BUSY errors when mixing read&write in a single transaction
-	refs, err := e.App.FindCollectionReferences(e.Record.Collection())
+	refs, err := e.App.FindCachedCollectionReferences(e.Record.Collection())
 	if err != nil {
 		return err
 	}
@@ -1452,12 +1501,13 @@ func cascadeRecordDelete(app App, mainRecord *Record, refs map[*Collection][]Fie
 	for _, refCollection := range sortedRefKeys {
 		fields, ok := refs[refCollection]
 
-		if refCollection.IsView() || !ok {
+		if !ok || refCollection.IsView() {
 			continue // skip missing or view collections
 		}
 
+		recordTableName := inflector.Columnify(refCollection.Name)
+
 		for _, field := range fields {
-			recordTableName := inflector.Columnify(refCollection.Name)
 			prefixedFieldName := recordTableName + "." + inflector.Columnify(field.GetName())
 
 			query := app.RecordQuery(refCollection)

core/record_model_auth.go

@@ -1,5 +1,7 @@
 package core
 
+import "github.com/pocketbase/pocketbase/tools/security"
+
 // Email returns the "email" record field value (usually available with Auth collections).
 func (m *Record) Email() string {
 	return m.GetString(FieldNameEmail)
@@ -51,6 +53,25 @@ func (m *Record) SetPassword(password string) {
 	m.Set(FieldNamePassword, password)
 }
 
+// SetRandomPassword sets the "password" auth record field to a random autogenerated value.
+//
+// The autogenerated password is ~30 characters and it is set directly as hash,
+// aka. the field plain password value validators (length, pattern, etc.) are ignored
+// (this is usually used as part of the auto created OTP or OAuth2 user flows).
+func (m *Record) SetRandomPassword() string {
+	pass := security.RandomString(30)
+
+	m.Set(FieldNamePassword, pass)
+	m.RefreshTokenKey() // manually refresh the token key because the plain password is resetted
+
+	// unset the plain value to skip the field validators
+	if raw, ok := m.GetRaw(FieldNamePassword).(*PasswordFieldValue); ok {
+		raw.Plain = ""
+	}
+
+	return pass
+}
+
 // ValidatePassword validates a plain password against the "password" record field.
 //
 // Returns false if the password is incorrect.

core/record_model_auth_test.go

@@ -1,9 +1,11 @@
 package core_test
 
 import (
+	"context"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
@@ -117,3 +119,42 @@ func TestRecordPassword(t *testing.T) {
 		})
 	}
 }
+
+func TestRecordSetRandomPassword(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	oldTokenKey := "old_tokenKey"
+	record := core.NewRecord(core.NewAuthCollection("test"))
+	record.SetTokenKey(oldTokenKey)
+
+	pass := record.SetRandomPassword()
+
+	if pass == "" {
+		t.Fatal("Expected non-empty generated random password")
+	}
+
+	if !record.ValidatePassword(pass) {
+		t.Fatal("Expected the generated random password to be valid")
+	}
+
+	if record.TokenKey() == oldTokenKey {
+		t.Fatal("Expected token key to change")
+	}
+
+	f, ok := record.Collection().Fields.GetByName(core.FieldNamePassword).(*core.PasswordField)
+	if !ok {
+		t.Fatal("Expected *core.PasswordField")
+	}
+
+	// ensure that the field validators will be ignored
+	f.Min = 1
+	f.Max = 2
+	f.Pattern = `\d+`
+
+	if err := f.ValidateValue(context.Background(), app, record); err != nil {
+		t.Fatalf("Expected password field plain value validators to be ignored, got %v", err)
+	}
+}

core/record_model_test.go

@@ -1822,44 +1822,59 @@ func TestRecordSaveIdUpdateNoValidation(t *testing.T) {
 	}
 }
 
-func TestRecordSaveWithChangedPassword(t *testing.T) {
+func TestRecordSaveWithAutoTokenKeyRefresh(t *testing.T) {
 	t.Parallel()
 
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	record, err := app.FindAuthRecordByEmail("nologin", "test@example.com")
-	if err != nil {
-		t.Fatal(err)
+	scenarios := []struct {
+		name           string
+		payload        map[string]any
+		expectedChange bool
+	}{
+		{
+			"no email or password change",
+			map[string]any{"name": "example"},
+			false,
+		},
+		{
+			"password change",
+			map[string]any{"password": "1234567890"},
+			true,
+		},
+		{
+			"email change",
+			map[string]any{"email": "test_update@example.com"},
+			true,
+		},
 	}
 
-	originalTokenKey := record.TokenKey()
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record, err := app.FindFirstRecordByFilter("nologin", "1=1")
+			if err != nil {
+				t.Fatal(err)
+			}
 
-	t.Run("no password change shouldn't change the tokenKey", func(t *testing.T) {
-		record.Set("name", "example")
+			originalTokenKey := record.TokenKey()
 
-		if err := app.Save(record); err != nil {
-			t.Fatal(err)
-		}
+			record.Load(s.payload)
 
-		tokenKey := record.TokenKey()
-		if tokenKey == "" || originalTokenKey != tokenKey {
-			t.Fatalf("Expected tokenKey to not change, got %q VS %q", originalTokenKey, tokenKey)
-		}
-	})
+			err = app.Save(record)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-	t.Run("password change should change the tokenKey", func(t *testing.T) {
-		record.Set("password", "1234567890")
+			newTokenKey := record.TokenKey()
 
-		if err := app.Save(record); err != nil {
-			t.Fatal(err)
-		}
+			hasChange := originalTokenKey != newTokenKey
 
-		tokenKey := record.TokenKey()
-		if tokenKey == "" || originalTokenKey == tokenKey {
-			t.Fatalf("Expected tokenKey to change, got %q VS %q", originalTokenKey, tokenKey)
-		}
-	})
+			if hasChange != s.expectedChange {
+				t.Fatalf("Expected hasChange %v, got %v", s.expectedChange, hasChange)
+			}
+		})
+	}
 }
 
 func TestRecordDelete(t *testing.T) {

forms/record_upsert.go

@@ -27,9 +27,9 @@ type RecordUpsert struct {
 	accessLevel int
 
 	// extra password fields
-	Password        string `form:"password" json:"password"`
-	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
-	OldPassword     string `form:"oldPassword" json:"oldPassword"`
+	password        string
+	passwordConfirm string
+	oldPassword     string
 }
 
 // NewRecordUpsert creates a new [RecordUpsert] form from the provided [core.App] and [core.Record] instances
@@ -93,13 +93,13 @@ func (form *RecordUpsert) Load(data map[string]any) {
 	// load the special auth form fields
 	if isAuth {
 		if v, ok := data["password"]; ok {
-			form.Password = cast.ToString(v)
+			form.password = cast.ToString(v)
 		}
 		if v, ok := data["passwordConfirm"]; ok {
-			form.PasswordConfirm = cast.ToString(v)
+			form.passwordConfirm = cast.ToString(v)
 		}
 		if v, ok := data["oldPassword"]; ok {
-			form.OldPassword = cast.ToString(v)
+			form.oldPassword = cast.ToString(v)
 		}
 
 		excludeFields = append(excludeFields, "passwordConfirm", "oldPassword") // skip non-schema password fields
@@ -137,9 +137,9 @@ func (form *RecordUpsert) validateFormFields() error {
 	validateData := map[string]any{
 		"email":           form.record.Email(),
 		"verified":        form.record.Verified(),
-		"password":        form.Password,
-		"passwordConfirm": form.PasswordConfirm,
-		"oldPassword":     form.OldPassword,
+		"password":        form.password,
+		"passwordConfirm": form.passwordConfirm,
+		"oldPassword":     form.oldPassword,
 	}
 
 	return validation.Validate(validateData,
@@ -165,17 +165,17 @@ func (form *RecordUpsert) validateFormFields() error {
 			validation.Key(
 				"password",
 				validation.When(
-					(isNew || form.PasswordConfirm != "" || form.OldPassword != ""),
+					(isNew || form.passwordConfirm != "" || form.oldPassword != ""),
 					validation.Required,
 				),
 			),
 			validation.Key(
 				"passwordConfirm",
 				validation.When(
-					(isNew || form.Password != "" || form.OldPassword != ""),
+					(isNew || form.password != "" || form.oldPassword != ""),
 					validation.Required,
 				),
-				validation.By(validators.Equal(form.Password)),
+				validation.By(validators.Equal(form.password)),
 			),
 			validation.Key(
 				"oldPassword",
@@ -183,7 +183,7 @@ func (form *RecordUpsert) validateFormFields() error {
 				// - form.HasManageAccess() is not satisfied
 				// - changing the existing password
 				validation.When(
-					!isNew && !form.HasManageAccess() && (form.Password != "" || form.PasswordConfirm != ""),
+					!isNew && !form.HasManageAccess() && (form.password != "" || form.passwordConfirm != ""),
 					validation.Required,
 					validation.By(form.checkOldPassword),
 				),
@@ -205,7 +205,7 @@ func (form *RecordUpsert) checkOldPassword(value any) error {
 	return nil
 }
 
-// @todo consider removing and executing the Create API rule without dummy insert.
+// Deprecated: It was previously used as part of the record create action but it is not needed anymore and will be removed in the future.
 //
 // DrySubmit performs a temp form submit within a transaction and reverts it at the end.
 // For actual record persistence, check the [RecordUpsert.Submit()] method.

forms/record_upsert_test.go

@@ -64,15 +64,15 @@ func TestRecordUpsertLoad(t *testing.T) {
 				`"text":"test_text"`,
 				`"number":456`,
 				`"select_many":["optionB","optionC"]`,
-				`"password":""`,
-				`"oldPassword":""`,
-				`"passwordConfirm":""`,
 				`"created":""`,
 				`"updated":""`,
 				`"json":null`,
 			},
 			notExpected: []string{
 				`"custom"`,
+				`"password"`,
+				`"oldPassword"`,
+				`"passwordConfirm"`,
 				`"select_many-"`,
 				`"select_many+"`,
 			},
@@ -89,9 +89,11 @@ func TestRecordUpsertLoad(t *testing.T) {
 			record: core.NewRecord(usersCol),
 			expected: []string{
 				`"email":"test@example.com"`,
-				`"oldPassword":"123"`,
 				`"password":"456"`,
-				`"passwordConfirm":"789"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
 			},
 		},
 		{
@@ -110,8 +112,10 @@ func TestRecordUpsertLoad(t *testing.T) {
 				`"email":"test@example.com"`,
 				`"tokenKey":""`,
 				`"password":"456"`,
-				`"oldPassword":"123"`,
-				`"passwordConfirm":"789"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
 			},
 		},
 		{
@@ -130,8 +134,10 @@ func TestRecordUpsertLoad(t *testing.T) {
 				`"email":"test@example.com"`,
 				`"tokenKey":"abc"`,
 				`"password":"456"`,
-				`"oldPassword":"123"`,
-				`"passwordConfirm":"789"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
 			},
 		},
 		{
@@ -168,11 +174,7 @@ func TestRecordUpsertLoad(t *testing.T) {
 
 			form.Load(s.data)
 
-			loaded := map[string]any{
-				"oldPassword":     form.OldPassword,
-				"password":        form.Password,
-				"passwordConfirm": form.PasswordConfirm,
-			}
+			loaded := map[string]any{}
 			maps.Copy(loaded, s.record.FieldsData())
 			maps.Copy(loaded, s.record.CustomData())
 

go.mod

@@ -4,11 +4,11 @@ go 1.23
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/aws/aws-sdk-go-v2 v1.32.6
-	github.com/aws/aws-sdk-go-v2/config v1.28.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.47
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0
+	github.com/aws/aws-sdk-go-v2 v1.32.7
+	github.com/aws/aws-sdk-go-v2/config v1.28.7
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.48
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1
 	github.com/aws/smithy-go v1.22.1
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.6.2
@@ -21,32 +21,32 @@ require (
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
 	github.com/golang-jwt/jwt/v4 v4.5.1
 	github.com/pocketbase/dbx v1.11.0
-	github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75
-	github.com/spf13/cast v1.7.0
+	github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119
+	github.com/spf13/cast v1.7.1
 	github.com/spf13/cobra v1.8.1
 	gocloud.dev v0.40.0
-	golang.org/x/crypto v0.30.0
-	golang.org/x/net v0.32.0
+	golang.org/x/crypto v0.31.0
+	golang.org/x/net v0.33.0
 	golang.org/x/oauth2 v0.24.0
 	golang.org/x/sync v0.10.0
-	modernc.org/sqlite v1.34.2
+	modernc.org/sqlite v1.34.4
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 // indirect
 	github.com/dlclark/regexp2 v1.11.4 // indirect
 	github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -54,7 +54,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
@@ -66,7 +66,6 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stretchr/testify v1.8.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect
 	golang.org/x/image v0.23.0 // indirect
 	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
@@ -74,14 +73,14 @@ require (
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/tools v0.28.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.211.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/grpc v1.68.1 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
-	modernc.org/gc/v3 v3.0.0-20241004144649-1aea3fae8852 // indirect
-	modernc.org/libc v1.61.4 // indirect
-	modernc.org/mathutil v1.6.0 // indirect
+	google.golang.org/api v0.214.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def // indirect
+	google.golang.org/grpc v1.69.2 // indirect
+	google.golang.org/protobuf v1.36.1 // indirect
+	modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d // indirect
+	modernc.org/libc v1.55.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.8.0 // indirect
-	modernc.org/strutil v1.2.0 // indirect
+	modernc.org/strutil v1.2.1 // indirect
 	modernc.org/token v1.1.0 // indirect
 )

go.sum

@@ -1,12 +1,12 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.12.1 h1:n2Bj25BUMM0nvE9D2XLTiImanwZhO3DkfWSYS/SAJP4=
-cloud.google.com/go/auth v0.12.1/go.mod h1:BFMu+TNpF3DmvfBO9ClqTR/SiqVIm7LukKF9mbendF4=
+cloud.google.com/go/auth v0.13.0 h1:8Fu8TZy167JkW8Tj3q7dIkr2v4cndv41ouecJx0PAHs=
+cloud.google.com/go/auth v0.13.0/go.mod h1:COOjD9gwfKNKz+IIduatIhYJQIc0mG3H102r/EMxX6Q=
 cloud.google.com/go/auth/oauth2adapt v0.2.6 h1:V6a6XDu2lTwPZWOawrAa9HUK+DB2zfJyTuciBG5hFkU=
 cloud.google.com/go/auth/oauth2adapt v0.2.6/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
-cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixAHn3fyqngqo=
-cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
 cloud.google.com/go/iam v1.1.13 h1:7zWBXG9ERbMLrzQBRhFliAV+kjcRToDTgQT3CTwYyv4=
 cloud.google.com/go/iam v1.1.13/go.mod h1:K8mY0uSXwEXS30KrnVb+j54LB/ntfZu1dr+4zFMNbus=
 cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyXFs=
@@ -25,42 +25,42 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
 github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.32.6 h1:7BokKRgRPuGmKkFMhEg/jSul+tB9VvXhcViILtfG8b4=
-github.com/aws/aws-sdk-go-v2 v1.32.6/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
+github.com/aws/aws-sdk-go-v2 v1.32.7 h1:ky5o35oENWi0JYWUZkB7WYvVPP+bcRF5/Iq7JWSb5Rw=
+github.com/aws/aws-sdk-go-v2 v1.32.7/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
-github.com/aws/aws-sdk-go-v2/config v1.28.6 h1:D89IKtGrs/I3QXOLNTH93NJYtDhm8SYa9Q5CsPShmyo=
-github.com/aws/aws-sdk-go-v2/config v1.28.6/go.mod h1:GDzxJ5wyyFSCoLkS+UhGB0dArhb9mI+Co4dHtoTxbko=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.47 h1:48bA+3/fCdi2yAwVt+3COvmatZ6jUDNkDTIsqDiMUdw=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.47/go.mod h1:+KdckOejLW3Ks3b0E3b5rHsr2f9yuORBum0WPnE5o5w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 h1:AmoU1pziydclFT/xRV+xXE/Vb8fttJCLRPv8oAkprc0=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21/go.mod h1:AjUdLYe4Tgs6kpH4Bv7uMZo7pottoyHMn4eTcIcneaY=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43 h1:iLdpkYZ4cXIQMO7ud+cqMWR1xK5ESbt1rvN77tRi1BY=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.43/go.mod h1:OgbsKPAswXDd5kxnR4vZov69p3oYjbvUyIRBAAV0y9o=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25 h1:s/fF4+yDQDoElYhfIVvSNyeCydfbuTKzhxSXDXCPasU=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.25/go.mod h1:IgPfDv5jqFIzQSNbUEMoitNooSMXjRSDkhXv8jiROvU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25 h1:ZntTCl5EsYnhN/IygQEUugpdwbhdkom9uHcbCftiGgA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.25/go.mod h1:DBdPrgeocww+CSl1C8cEV8PN1mHMBhuCDLpXezyvWkE=
+github.com/aws/aws-sdk-go-v2/config v1.28.7 h1:GduUnoTXlhkgnxTD93g1nv4tVPILbdNQOzav+Wpg7AE=
+github.com/aws/aws-sdk-go-v2/config v1.28.7/go.mod h1:vZGX6GVkIE8uECSUHB6MWAUsd4ZcG2Yq/dMa4refR3M=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.48 h1:IYdLD1qTJ0zanRavulofmqut4afs45mOWEI+MzZtTfQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.48/go.mod h1:tOscxHN3CGmuX9idQ3+qbkzrjVIx32lqDSU1/0d/qXs=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 h1:kqOrpojG71DxJm/KDPO+Z/y1phm1JlC8/iT+5XRmAn8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22/go.mod h1:NtSFajXVVL8TA2QNngagVZmUtXciyrHOt7xgz4faS/M=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44 h1:2zxMLXLedpB4K1ilbJFxtMKsVKaexOqDttOhc0QGm3Q=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44/go.mod h1:VuLHdqwjSvgftNC7yqPWyGVhEwPmJpeRi07gOgOfHF8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 h1:I/5wmGMffY4happ8NOCuIUEWGUvvFp5NSeQcXl9RHcI=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26/go.mod h1:FR8f4turZtNy6baO0KJ5FJUmXH/cSkI9fOngs0yl6mA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 h1:zXFLuEuMMUOvEARXFUVJdfqZ4bvvSgdGRq/ATcrQxzM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26/go.mod h1:3o2Wpy0bogG1kyOPrgkXA8pgIfEEv0+m19O9D5+W8y8=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25 h1:r67ps7oHCYnflpgDy2LZU0MAQtQbYIOqNNnqGO6xQkE=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.25/go.mod h1:GrGY+Q4fIokYLtjCVB/aFfCVL6hhGUFl8inD18fDalE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26 h1:GeNJsIFHB+WW5ap2Tec4K6dzcVTsRbsT1Lra46Hv9ME=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26/go.mod h1:zfgMpwHDXX2WGoG84xG2H+ZlPTkJUU4YUvx2svLQYWo=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6 h1:HCpPsWqmYQieU7SS6E9HXfdAMSud0pteVXieJmcpIRI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.6/go.mod h1:ngUiVRCco++u+soRRVBIvBZxSMMvOVMXA4PJ36JLfSw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6 h1:50+XsN70RS7dwJ2CkVNXzj7U2L1HKP8nqTd3XWEXBN4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.6/go.mod h1:WqgLmwY7so32kG01zD8CPTJWVWM+TzJoOVHwTg4aPug=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6 h1:BbGDtTi0T1DYlmjBiCr/le3wzhA37O8QTC5/Ab8+EXk=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.6/go.mod h1:hLMJt7Q8ePgViKupeymbqI0la+t9/iYFBjxQCFwuAwI=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0 h1:nyuzXooUNJexRT0Oy0UQY6AhOzxPxhtt4DcBIHyCnmw=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.71.0/go.mod h1:sT/iQz8JK3u/5gZkT+Hmr7GzVZehUMkRZpOaAwYXeGY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.7 h1:rLnYAfXQ3YAccocshIH5mzNNwZBkBo+bP6EhIxak6Hw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.7/go.mod h1:ZHtuQJ6t9A/+YDuxOLnbryAmITtr8UysSny3qcyvJTc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 h1:JnhTZR3PiYDNKlXy50/pNeix9aGMo6lLpXwJ1mw8MD4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6/go.mod h1:URronUEGfXZN1VpdktPSD1EkAL9mfrV+2F4sjH38qOY=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 h1:s4074ZO1Hk8qv65GqNXqDjmkf4HSQqJukaLuuW0TpDA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.2/go.mod h1:mVggCnIWoM09jP71Wh+ea7+5gAp53q+49wDFs1SW5z8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7 h1:tB4tNw83KcajNAzaIMhkhVI2Nt8fAZd5A5ro113FEMY=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7/go.mod h1:lvpyBGkZ3tZ9iSsUIcC2EWp+0ywa7aK3BLT+FwZi+mQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 h1:8eUsivBQzZHqe/3FE+cqwfH+0p5Jo8PFM/QYQSmeZ+M=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7/go.mod h1:kLPQvGUmxn/fqiCrDeohwG33bq2pQpGeY62yRO6Nrh0=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7 h1:Hi0KGbrnr57bEHWM0bJ1QcBzxLrL/k2DHvGYhb8+W1w=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7/go.mod h1:wKNgWgExdjjrm4qvfbTorkvocEstaoDl4WCvGfeCy9c=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1 h1:aOVVZJgWbaH+EJYPvEgkNhCEbXXvH7+oML36oaPK3zE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1/go.mod h1:r+xl5yzMk9083rMR+sJ5TYj9Tihvf/l1oxzZXDgGj2Q=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 h1:CvuUmnXI7ebaUAhbJcDy9YQx8wHR69eZ9I7q5hszt/g=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.8/go.mod h1:XDeGv1opzwm8ubxddF0cgqkZWsyOtw4lr6dxwmb6YQg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 h1:F2rBfNAL5UyswqoeWv9zs74N/NanhK16ydHW1pahX6E=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7/go.mod h1:JfyQ0g2JG8+Krq0EuZNnRwX0mU0HrwY/tG6JNfcqh4k=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 h1:Xgv/hyNgvLda/M9l9qxXc4UFSgppnRczLxlMs5Ae/QY=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.3/go.mod h1:5Gn+d+VaaRgsjewpMvGazt0WfcFO+Md4wLOuBfGR9Bc=
 github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
 github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -151,8 +151,8 @@ github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
 github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
 github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
 github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
-github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
-github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
@@ -183,16 +183,16 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU=
 github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75 h1:XSbmekxgmbI2uPrre/nkCz7y8VsV652TPb3hAYzPb74=
-github.com/pocketbase/tygoja v0.0.0-20241015175937-d6ff411a0f75/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
+github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119 h1:TjQtEReJDTpvlNFTRjuHvPQpJHAeJdcQF130eCAAT/o=
+github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -214,22 +214,24 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.5
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
-go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
-go.opentelemetry.io/otel v1.29.0/go.mod h1:N/WtXPs1CNCUEx+Agz5uouwCba+i+bJGFicT8SR4NP8=
-go.opentelemetry.io/otel/metric v1.29.0 h1:vPf/HFWTNkPu1aYeIsc98l4ktOQaL6LeSoeV2g+8YLc=
-go.opentelemetry.io/otel/metric v1.29.0/go.mod h1:auu/QWieFVWx+DmQOUMgj0F8LHWdgalxXqvp7BII/W8=
-go.opentelemetry.io/otel/trace v1.29.0 h1:J/8ZNK4XgR7a21DZUAsbF8pZ5Jcw1VhACmnYt39JTi4=
-go.opentelemetry.io/otel/trace v1.29.0/go.mod h1:eHl3w0sp3paPkYstJOmAimxhiFXPg+MMTlEh3nsQgWQ=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
+go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
+go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
+go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
+go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
 gocloud.dev v0.40.0 h1:f8LgP+4WDqOG/RXoUcyLpeIAGOcAbZrZbDQCUee10ng=
 gocloud.dev v0.40.0/go.mod h1:drz+VyYNBvrMTW0KZiBAYEdl8lbNZx+OQ7oQvdrFmSQ=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
-golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20241210194714-1829a127f884 h1:Y/Mj/94zIQQGHVSv1tTtQBDaQaJe62U9bkDZKKyhPCU=
-golang.org/x/exp v0.0.0-20241210194714-1829a127f884/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.23.0 h1:HseQ7c2OpPKTPVzNjG5fwJsOTCiiwS4QdsYi5XU6H68=
 golang.org/x/image v0.23.0/go.mod h1:wJJBTdLfCCf3tiHa1fNxpZmUI4mmoZvwMCPP0ddoNKY=
@@ -249,8 +251,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI=
-golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -299,8 +301,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-google.golang.org/api v0.211.0 h1:IUpLjq09jxBSV1lACO33CGY3jsRcbctfGzhj+ZSE/Bg=
-google.golang.org/api v0.211.0/go.mod h1:XOloB4MXFH4UTlQSGuNUxw0UT74qdENK8d6JNsXKLi0=
+google.golang.org/api v0.214.0 h1:h2Gkq07OYi6kusGOaT/9rnNljuXmqPnaig7WGPmKbwA=
+google.golang.org/api v0.214.0/go.mod h1:bYPpLG8AyeMWwDU6NXoB00xC0DFkikVvd5MfwoxjLqE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
@@ -309,17 +311,17 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988 h1:CT2Thj5AuPV9phrYMtzX11k+XkzMGfRAet42PmoTATM=
 google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988/go.mod h1:7uvplUBj4RjHAxIZ//98LzOvrQ04JBkaixRmCMI29hc=
-google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 h1:pgr/4QbFyktUv9CtQ/Fq4gzEE6/Xs7iCXbktaGzLHbQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def h1:4P81qv5JXI/sDNae2ClVx88cgDDA6DPilADkG9tYKz8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def/go.mod h1:bdAgzvd4kFrpykc5/AC2eLUiegK9T/qxZHD4hXYf/ho=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.68.1 h1:oI5oTa11+ng8r8XMMN7jAOmWfPZWbYpCFaMUTACxkM0=
-google.golang.org/grpc v1.68.1/go.mod h1:+q1XYFJjShcqn0QZHvCyeR4CXPA+llXIeUIfIe00waw=
+google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
+google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -329,8 +331,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
-google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
+google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
@@ -340,29 +342,29 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-modernc.org/cc/v4 v4.23.1 h1:WqJoPL3x4cUufQVHkXpXX7ThFJ1C4ik80i2eXEXbhD8=
-modernc.org/cc/v4 v4.23.1/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
-modernc.org/ccgo/v4 v4.23.1 h1:N49a7JiWGWV7lkPE4yYcvjkBGZQi93/JabRYjdWmJXc=
-modernc.org/ccgo/v4 v4.23.1/go.mod h1:JoIUegEIfutvoWV/BBfDFpPpfR2nc3U0jKucGcbmwDU=
+modernc.org/cc/v4 v4.21.4 h1:3Be/Rdo1fpr8GrQ7IVw9OHtplU4gWbb+wNgeoBMmGLQ=
+modernc.org/cc/v4 v4.21.4/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
+modernc.org/ccgo/v4 v4.19.2 h1:lwQZgvboKD0jBwdaeVCTouxhxAyN6iawF3STraAal8Y=
+modernc.org/ccgo/v4 v4.19.2/go.mod h1:ysS3mxiMV38XGRTTcgo0DQTeTmAO4oCmJl1nX9VFI3s=
 modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
 modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/gc/v2 v2.5.0 h1:bJ9ChznK1L1mUtAQtxi0wi5AtAs5jQuw4PrPHO5pb6M=
-modernc.org/gc/v2 v2.5.0/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
-modernc.org/gc/v3 v3.0.0-20241004144649-1aea3fae8852 h1:IYXPPTTjjoSHvUClZIYexDiO7g+4x+XveKT4gCIAwiY=
-modernc.org/gc/v3 v3.0.0-20241004144649-1aea3fae8852/go.mod h1:Qz0X07sNOR1jWYCrJMEnbW/X55x206Q7Vt4mz6/wHp4=
-modernc.org/libc v1.61.4 h1:wVyqEx6tlltte9lPTjq0kDAdtdM9c4JH8rU6M1ZVawA=
-modernc.org/libc v1.61.4/go.mod h1:VfXVuM/Shh5XsMNrh3C6OkfL78G3loa4ZC/Ljv9k7xc=
-modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
-modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
+modernc.org/gc/v2 v2.4.1 h1:9cNzOqPyMJBvrUipmynX0ZohMhcxPtMccYgGOJdOiBw=
+modernc.org/gc/v2 v2.4.1/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
+modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d h1:d0JExN5U5FjUVHCP6L9DIlLJBZveR6KUM4AvfDUL3+k=
+modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d/go.mod h1:qBSLm/exCqouT2hrfyTKikWKG9IPq8EoX5fS00l3jqk=
+modernc.org/libc v1.55.3 h1:AzcW1mhlPNrRtjS5sS+eW2ISCgSOLLNyFzRh/V3Qj/U=
+modernc.org/libc v1.55.3/go.mod h1:qFXepLhz+JjFThQ4kzwzOjA/y/artDeg+pcYnY+Q83w=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
 modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
 modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.34.2 h1:J9n76TPsfYYkFkZ9Uy1QphILYifiVEwwOT7yP5b++2Y=
-modernc.org/sqlite v1.34.2/go.mod h1:dnR723UrTtjKpoHCAMN0Q/gZ9MT4r+iRvIBb9umWFkU=
-modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
-modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/sqlite v1.34.4 h1:sjdARozcL5KJBvYQvLlZEmctRgW9xqIZc2ncN7PU0P8=
+modernc.org/sqlite v1.34.4/go.mod h1:3QQFCG2SEMtc2nv+Wq4cQCH7Hjcg+p/RMlS1XK+zwbk=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

mails/base.go

@@ -1,4 +1,4 @@
-// Package mails implements various helper methods for sending user and admin
+// Package mails implements various helper methods for sending common
 // emails like forgotten password, verification, etc.
 package mails
 

mails/record.go

@@ -1,8 +1,10 @@
 package mails
 
 import (
+	"html"
 	"html/template"
 	"net/mail"
+	"slices"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails/templates"
@@ -232,6 +234,13 @@ func SendRecordChangeEmail(app core.App, authRecord *core.Record, newEmail strin
 	})
 }
 
+var nonescapeTypes = []string{
+	core.FieldTypeAutodate,
+	core.FieldTypeDate,
+	core.FieldTypeBool,
+	core.FieldTypeNumber,
+}
+
 func resolveEmailTemplate(
 	app core.App,
 	authRecord *core.Record,
@@ -258,7 +267,15 @@ func resolveEmailTemplate(
 
 		fieldPlacehodler := "{RECORD:" + field.GetName() + "}"
 		if _, ok := placeholders[fieldPlacehodler]; !ok {
-			placeholders[fieldPlacehodler] = authRecord.Get(field.GetName())
+			val := authRecord.GetString(field.GetName())
+
+			// note: the escaping is not strictly necessary but for just in case
+			// the user decide to store and render the email as plain html
+			if !slices.Contains(nonescapeTypes, field.Type()) {
+				val = html.EscapeString(val)
+			}
+
+			placeholders[fieldPlacehodler] = val
 		}
 	}
 

mails/record_test.go

@@ -1,6 +1,7 @@
 package mails_test
 
 import (
+	"html"
 	"strings"
 	"testing"
 
@@ -16,6 +17,9 @@ func TestSendRecordAuthAlert(t *testing.T) {
 
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
 
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
 	err := mails.SendRecordAuthAlert(testApp, user)
 	if err != nil {
 		t.Fatal(err)
@@ -26,7 +30,7 @@ func TestSendRecordAuthAlert(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		user.GetString("name") + "{RECORD:tokenKey}", // public and private record placeholder checks
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // public and private record placeholder checks
 		"login to your " + testApp.Settings().Meta.AppName + " account from a new location",
 		"If this was you",
 		"If this wasn't you",
@@ -46,6 +50,9 @@ func TestSendRecordPasswordReset(t *testing.T) {
 
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
 
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
 	err := mails.SendRecordPasswordReset(testApp, user)
 	if err != nil {
 		t.Fatal(err)
@@ -56,7 +63,7 @@ func TestSendRecordPasswordReset(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		user.GetString("name") + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
 		"http://localhost:8090/_/#/auth/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
@@ -74,6 +81,9 @@ func TestSendRecordVerification(t *testing.T) {
 
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
 
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
 	err := mails.SendRecordVerification(testApp, user)
 	if err != nil {
 		t.Fatal(err)
@@ -84,7 +94,7 @@ func TestSendRecordVerification(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		user.GetString("name") + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
 		"http://localhost:8090/_/#/auth/confirm-verification/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
@@ -102,6 +112,9 @@ func TestSendRecordChangeEmail(t *testing.T) {
 
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
 
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
 	err := mails.SendRecordChangeEmail(testApp, user, "new_test@example.com")
 	if err != nil {
 		t.Fatal(err)
@@ -112,7 +125,7 @@ func TestSendRecordChangeEmail(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		user.GetString("name") + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
 		"http://localhost:8090/_/#/auth/confirm-email-change/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
@@ -130,6 +143,9 @@ func TestSendRecordOTP(t *testing.T) {
 
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
 
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
 	err := mails.SendRecordOTP(testApp, user, "test_otp_id", "test_otp_code")
 	if err != nil {
 		t.Fatal(err)
@@ -140,7 +156,7 @@ func TestSendRecordOTP(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		user.GetString("name") + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
 		"one-time password",
 		"test_otp_code",
 	}

migrations/1717233558_v0.23_migrate3.go

@@ -11,11 +11,11 @@ import (
 // note: this migration will be deleted in future version
 
 func collectionIdChecksum(typ, name string) string {
-	return "pbc_" + strconv.Itoa(int(crc32.ChecksumIEEE([]byte(typ+name))))
+	return "pbc_" + strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(typ+name))), 10)
 }
 
 func fieldIdChecksum(typ, name string) string {
-	return typ + strconv.Itoa(int(crc32.ChecksumIEEE([]byte(name))))
+	return typ + strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(name))), 10)
 }
 
 // normalize system collection and field ids

modernc_versions_check.go

@@ -0,0 +1,83 @@
+package pocketbase
+
+import (
+	"fmt"
+	"log/slog"
+	"runtime/debug"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	expectedDriverVersion = "v1.34.4"
+	expectedLibcVersion   = "v1.55.3"
+
+	// ModerncDepsCheckHookId is the id of the hook that performs the modernc.org/* deps checks.
+	// It could be used for removing/unbinding the hook if you don't want the checks.
+	ModerncDepsCheckHookId = "pbModerncDepsCheck"
+)
+
+// checkModerncDeps checks whether the current binary was buit with the
+// expected and tested modernc driver dependencies.
+//
+// This is needed because modernc.org/libc doesn't follow semantic versioning
+// and using a version different from the one in the go.mod of modernc.org/sqlite
+// could have unintended side-effects and cause obscure build and runtime bugs
+// (https://github.com/pocketbase/pocketbase/issues/6136).
+func checkModerncDeps(app core.App) {
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return // no build info (probably compiled without module support)
+	}
+
+	var driverVersion, libcVersion string
+
+	for _, dep := range info.Deps {
+		switch dep.Path {
+		case "modernc.org/libc":
+			libcVersion = dep.Version
+		case "modernc.org/sqlite":
+			driverVersion = dep.Version
+		}
+
+		// no need to further search if both deps are located
+		if driverVersion != "" && libcVersion != "" {
+			break
+		}
+	}
+
+	// not using the default driver
+	if driverVersion == "" {
+		return
+	}
+
+	var msg string
+	if driverVersion != expectedDriverVersion {
+		msg = fmt.Sprintf(
+			"You are using modernc.org/sqlite %s which differs from the expected and tested %s.\n"+
+				"Make sure to either manually update in your go.mod the dependency version to the expected one OR if you want to keep yours "+
+				"ensure that its indirect modernc.org/libc dependency has the same version as in the https://gitlab.com/cznic/sqlite/-/blob/master/go.mod, "+
+				"otherwise it could result in unexpected build or runtime errors.",
+			driverVersion,
+			expectedDriverVersion,
+		)
+		app.Logger().Warn(msg, slog.String("current", driverVersion), slog.String("expected", expectedDriverVersion))
+	} else if libcVersion != expectedLibcVersion {
+		msg = fmt.Sprintf(
+			"You are using modernc.org/libc %s which differs from the expected and tested %s.\n"+
+				"Please update your go.mod and manually set modernc.org/libc to %s, otherwise it could result in unexpected build or runtime errors "+
+				"(you may have to also run 'go clean -modcache' to clear the cache if the warning persists).",
+			libcVersion,
+			expectedLibcVersion,
+			expectedLibcVersion,
+		)
+		app.Logger().Warn(msg, slog.String("current", libcVersion), slog.String("expected", expectedLibcVersion))
+	}
+
+	// ensure that the message is printed to the default stderr too
+	// (when in dev mode this is not needed because we print all logs)
+	if msg != "" && !app.IsDev() {
+		color.Yellow("\nWARN " + msg + "\n\n")
+	}
+}

plugins/jsvm/binds.go

@@ -30,6 +30,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/router"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
@@ -81,14 +82,14 @@ func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 					res, err := executor.RunProgram(pr)
 					executor.Set("__args", goja.Undefined())
 
-					// check for returned error value
+					// (legacy) check for returned Go error value
 					if res != nil {
 						if resErr, ok := res.Export().(error); ok {
 							return resErr
 						}
 					}
 
-					return err
+					return normalizeException(err)
 				})
 
 				return []reflect.Value{reflect.ValueOf(&err).Elem()}
@@ -197,14 +198,14 @@ func wrapHandlerFunc(executors *vmsPool, handler goja.Value) (func(*core.Request
 				res, err := executor.RunProgram(pr)
 				executor.Set("__args", goja.Undefined())
 
-				// check for returned error
+				// (legacy) check for returned Go error value
 				if res != nil {
 					if v, ok := res.Export().(error); ok {
 						return v
 					}
 				}
 
-				return err
+				return normalizeException(err)
 			})
 		}
 
@@ -215,9 +216,9 @@ func wrapHandlerFunc(executors *vmsPool, handler goja.Value) (func(*core.Request
 }
 
 type gojaHookHandler struct {
-	priority       int
 	id             string
 	serializedFunc string
+	priority       int
 }
 
 func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.Handler[*core.RequestEvent], error) {
@@ -254,14 +255,14 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 						res, err := executor.RunProgram(pr)
 						executor.Set("__args", goja.Undefined())
 
-						// check for returned error
+						// (legacy) check for returned Go error value
 						if res != nil {
 							if v, ok := res.Export().(error); ok {
 								return v
 							}
 						}
 
-						return err
+						return normalizeException(err)
 					})
 				},
 			}
@@ -276,14 +277,14 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 						res, err := executor.RunProgram(pr)
 						executor.Set("__args", goja.Undefined())
 
-						// check for returned error
+						// (legacy) check for returned Go error value
 						if res != nil {
 							if v, ok := res.Export().(error); ok {
 								return v
 							}
 						}
 
-						return err
+						return normalizeException(err)
 					})
 				},
 			}
@@ -295,6 +296,8 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 	return wrappedMiddlewares, nil
 }
 
+var cachedArrayOfTypes = store.New[reflect.Type, reflect.Type](nil)
+
 func baseBinds(vm *goja.Runtime) {
 	vm.SetFieldNameMapper(FieldMapper{})
 
@@ -348,10 +351,11 @@ func baseBinds(vm *goja.Runtime) {
 
 	vm.Set("arrayOf", func(model any) any {
 		mt := reflect.TypeOf(model)
-		st := reflect.SliceOf(mt)
-		elem := reflect.New(st).Elem()
+		st := cachedArrayOfTypes.GetOrSet(mt, func() reflect.Type {
+			return reflect.SliceOf(mt)
+		})
 
-		return elem.Addr().Interface()
+		return reflect.New(st).Elem().Addr().Interface()
 	})
 
 	vm.Set("unmarshal", func(data, dst any) error {
@@ -899,12 +903,42 @@ func httpClientBinds(vm *goja.Runtime) {
 
 // -------------------------------------------------------------------
 
+// normalizeException checks if the provided error is a goja.Exception
+// and attempts to return its underlying Go error.
+//
+// note: using just goja.Exception.Unwrap() is insufficient and may falsely result in nil.
+func normalizeException(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	jsException, ok := err.(*goja.Exception)
+	if !ok {
+		return err // no exception
+	}
+
+	switch v := jsException.Value().Export().(type) {
+	case error:
+		err = v
+	case map[string]any: // goja.GoError
+		if vErr, ok := v["value"].(error); ok {
+			err = vErr
+		}
+	}
+
+	return err
+}
+
+var cachedFactoryFuncTypes = store.New[string, reflect.Type](nil)
+
 // registerFactoryAsConstructor registers the factory function as native JS constructor.
 //
 // If there is missing or nil arguments, their type zero value is used.
 func registerFactoryAsConstructor(vm *goja.Runtime, constructorName string, factoryFunc any) {
 	rv := reflect.ValueOf(factoryFunc)
-	rt := reflect.TypeOf(factoryFunc)
+	rt := cachedFactoryFuncTypes.GetOrSet(constructorName, func() reflect.Type {
+		return reflect.TypeOf(factoryFunc)
+	})
 	totalArgs := rt.NumIn()
 
 	vm.Set(constructorName, func(call goja.ConstructorCall) *goja.Object {
@@ -970,6 +1004,8 @@ func structConstructorUnmarshal(vm *goja.Runtime, call goja.ConstructorCall, ins
 	return instanceValue
 }
 
+var cachedDynamicModels = store.New[string, *dynamicModelType](nil)
+
 // newDynamicModel creates a new dynamic struct with fields based
 // on the specified "shape".
 //
@@ -980,7 +1016,40 @@ func structConstructorUnmarshal(vm *goja.Runtime, call goja.ConstructorCall, ins
 //		"total": 0,
 //	})
 func newDynamicModel(shape map[string]any) any {
-	shapeValues := make([]reflect.Value, 0, len(shape))
+	var modelType *dynamicModelType
+
+	shapeRaw, err := json.Marshal(shape)
+	if err != nil {
+		modelType = getDynamicModelStruct(shape)
+	} else {
+		modelType = cachedDynamicModels.GetOrSet(string(shapeRaw), func() *dynamicModelType {
+			return getDynamicModelStruct(shape)
+		})
+	}
+
+	rvShapeValues := make([]reflect.Value, len(modelType.shapeValues))
+	for i, v := range modelType.shapeValues {
+		rvShapeValues[i] = reflect.ValueOf(v)
+	}
+
+	elem := reflect.New(modelType.structType).Elem()
+
+	for i, v := range rvShapeValues {
+		elem.Field(i).Set(v)
+	}
+
+	return elem.Addr().Interface()
+}
+
+type dynamicModelType struct {
+	structType  reflect.Type
+	shapeValues []any
+}
+
+func getDynamicModelStruct(shape map[string]any) *dynamicModelType {
+	result := new(dynamicModelType)
+	result.shapeValues = make([]any, 0, len(shape))
+
 	structFields := make([]reflect.StructField, 0, len(shape))
 
 	for k, v := range shape {
@@ -1001,7 +1070,7 @@ func newDynamicModel(shape map[string]any) any {
 			vt = reflect.TypeOf(newV)
 		}
 
-		shapeValues = append(shapeValues, reflect.ValueOf(v))
+		result.shapeValues = append(result.shapeValues, v)
 
 		structFields = append(structFields, reflect.StructField{
 			Name: inflector.UcFirst(k), // ensures that the field is exportable
@@ -1010,12 +1079,7 @@ func newDynamicModel(shape map[string]any) any {
 		})
 	}
 
-	st := reflect.StructOf(structFields)
-	elem := reflect.New(st).Elem()
+	result.structType = reflect.StructOf(structFields)
 
-	for i, v := range shapeValues {
-		elem.Field(i).Set(v)
-	}
-
-	return elem.Addr().Interface()
+	return result
 }

plugins/jsvm/binds_test.go

@@ -2,6 +2,7 @@ package jsvm
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"mime/multipart"
@@ -463,7 +464,7 @@ func TestBaseBindsMailerMessage(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expected := `{"from":{"Name":"test_from","Address":"test_from@example.com"},"to":[{"Name":"test_to1","Address":"test_to1@example.com"},{"Name":"test_to2","Address":"test_to2@example.com"}],"bcc":[{"Name":"test_bcc1","Address":"test_bcc1@example.com"},{"Name":"test_bcc2","Address":"test_bcc2@example.com"}],"cc":[{"Name":"test_cc1","Address":"test_cc1@example.com"},{"Name":"test_cc2","Address":"test_cc2@example.com"}],"subject":"test_subject","html":"test_html","text":"test_text","headers":{"header1":"a","header2":"b"},"attachments":null}`
+	expected := `{"from":{"Name":"test_from","Address":"test_from@example.com"},"to":[{"Name":"test_to1","Address":"test_to1@example.com"},{"Name":"test_to2","Address":"test_to2@example.com"}],"bcc":[{"Name":"test_bcc1","Address":"test_bcc1@example.com"},{"Name":"test_bcc2","Address":"test_bcc2@example.com"}],"cc":[{"Name":"test_cc1","Address":"test_cc1@example.com"},{"Name":"test_cc2","Address":"test_cc2@example.com"}],"subject":"test_subject","html":"test_html","text":"test_text","headers":{"header1":"a","header2":"b"},"attachments":null,"inlineAttachments":null}`
 
 	if string(raw) != expected {
 		t.Fatalf("Expected \n%s, \ngot \n%s", expected, raw)
@@ -1456,6 +1457,47 @@ func TestHooksBinds(t *testing.T) {
 	}
 }
 
+func TestHooksExceptionUnwrapping(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	goErr := errors.New("test")
+
+	vmFactory := func() *goja.Runtime {
+		vm := goja.New()
+		baseBinds(vm)
+		vm.Set("$app", app)
+		vm.Set("goErr", goErr)
+		return vm
+	}
+
+	pool := newPool(1, vmFactory)
+
+	vm := vmFactory()
+	hooksBinds(app, vm, pool)
+
+	_, err := vm.RunString(`
+		onModelUpdate((e) => {
+			throw goErr
+		}, "demo1")
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := app.FindFirstRecordByFilter("demo1", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record.Set("text", "update")
+
+	err = app.Save(record)
+	if !errors.Is(err, goErr) {
+		t.Fatalf("Expected goError, got %v", err)
+	}
+}
+
 func TestRouterBindsCount(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

plugins/jsvm/jsvm.go

@@ -326,21 +326,7 @@ func (p *plugin) normalizeServeExceptions(e *core.RequestEvent) error {
 		return err // no error or already committed
 	}
 
-	jsException, ok := err.(*goja.Exception)
-	if !ok {
-		return err // no exception
-	}
-
-	switch v := jsException.Value().Export().(type) {
-	case error:
-		err = v
-	case map[string]any: // goja.GoError
-		if vErr, ok := v["value"].(error); ok {
-			err = vErr
-		}
-	}
-
-	return err
+	return normalizeException(err)
 }
 
 // watchHooks initializes a hooks file watcher that will restart the

pocketbase.go

@@ -12,7 +12,9 @@ import (
 	"github.com/fatih/color"
 	"github.com/pocketbase/pocketbase/cmd"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/spf13/cobra"
 
 	_ "github.com/pocketbase/pocketbase/migrations"
@@ -137,6 +139,24 @@ func NewWithConfig(config Config) *PocketBase {
 	// hide the default help command (allow only `--help` flag)
 	pb.RootCmd.SetHelpCommand(&cobra.Command{Hidden: true})
 
+	// https://github.com/pocketbase/pocketbase/issues/6136
+	pb.OnBootstrap().Bind(&hook.Handler[*core.BootstrapEvent]{
+		Id: ModerncDepsCheckHookId,
+		Func: func(be *core.BootstrapEvent) error {
+			if err := be.Next(); err != nil {
+				return err
+			}
+
+			// run separately to avoid blocking
+			app := be.App
+			routine.FireAndForget(func() {
+				checkModerncDeps(app)
+			})
+
+			return nil
+		},
+	})
+
 	return pb
 }
 

tests/app.go

@@ -70,27 +70,43 @@ func (t *TestApp) registerEventCall(name string) {
 
 // NewTestApp creates and initializes a test application instance.
 //
-// It is the caller's responsibility to call `app.Cleanup()`
-// when the app is no longer needed.
+// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
 func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 	var testDataDir string
-	if len(optTestDataDir) == 0 || optTestDataDir[0] == "" {
-		// fallback to the default test data directory
-		_, currentFile, _, _ := runtime.Caller(0)
-		testDataDir = filepath.Join(path.Dir(currentFile), "data")
-	} else {
+	if len(optTestDataDir) > 0 {
 		testDataDir = optTestDataDir[0]
 	}
 
-	tempDir, err := TempDirClone(testDataDir)
+	return NewTestAppWithConfig(core.BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+	})
+}
+
+// NewTestAppWithConfig creates and initializes a test application instance
+// from the provided config.
+//
+// If config.DataDir is not set it fallbacks to the default internal test data directory.
+//
+// config.DataDir is cloned for each new test application instance.
+//
+// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
+func NewTestAppWithConfig(config core.BaseAppConfig) (*TestApp, error) {
+	if config.DataDir == "" {
+		// fallback to the default test data directory
+		_, currentFile, _, _ := runtime.Caller(0)
+		config.DataDir = filepath.Join(path.Dir(currentFile), "data")
+	}
+
+	tempDir, err := TempDirClone(config.DataDir)
 	if err != nil {
 		return nil, err
 	}
 
-	app := core.NewBaseApp(core.BaseAppConfig{
-		DataDir:       tempDir,
-		EncryptionEnv: "pb_test_env",
-	})
+	// replace with the clone
+	config.DataDir = tempDir
+
+	app := core.NewBaseApp(config)
 
 	// load data dir and db connections
 	if err := app.Bootstrap(); err != nil {

tools/auth/gitea.go

@@ -51,18 +51,18 @@ func (p *Gitea) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id        int    `json:"id"`
 		Name      string `json:"full_name"`
 		Username  string `json:"login"`
 		Email     string `json:"email"`
 		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Id),
+		Id:           strconv.FormatInt(extracted.Id, 10),
 		Name:         extracted.Name,
 		Username:     extracted.Username,
 		Email:        extracted.Email,

tools/auth/gitee.go

@@ -54,17 +54,17 @@ func (p *Gitee) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Login     string `json:"login"`
-		Id        int    `json:"id"`
 		Name      string `json:"name"`
 		Email     string `json:"email"`
 		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Id),
+		Id:           strconv.FormatInt(extracted.Id, 10),
 		Name:         extracted.Name,
 		Username:     extracted.Login,
 		AvatarURL:    extracted.AvatarURL,

tools/auth/github.go

@@ -54,17 +54,17 @@ func (p *Github) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Login     string `json:"login"`
-		Id        int    `json:"id"`
 		Name      string `json:"name"`
 		Email     string `json:"email"`
 		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Id),
+		Id:           strconv.FormatInt(extracted.Id, 10),
 		Name:         extracted.Name,
 		Username:     extracted.Login,
 		Email:        extracted.Email,

tools/auth/gitlab.go

@@ -51,18 +51,18 @@ func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id        int    `json:"id"`
 		Name      string `json:"name"`
 		Username  string `json:"username"`
 		Email     string `json:"email"`
 		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Id),
+		Id:           strconv.FormatInt(extracted.Id, 10),
 		Name:         extracted.Name,
 		Username:     extracted.Username,
 		Email:        extracted.Email,

tools/auth/kakao.go

@@ -52,7 +52,6 @@ func (p *Kakao) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id      int `json:"id"`
 		Profile struct {
 			Nickname string `json:"nickname"`
 			ImageURL string `json:"profile_image"`
@@ -62,13 +61,14 @@ func (p *Kakao) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 			IsEmailVerified bool   `json:"is_email_verified"`
 			IsEmailValid    bool   `json:"is_email_valid"`
 		} `json:"kakao_account"`
+		Id int64 `json:"id"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Id),
+		Id:           strconv.FormatInt(extracted.Id, 10),
 		Username:     extracted.Profile.Nickname,
 		AvatarURL:    extracted.Profile.ImageURL,
 		RawUser:      rawUser,

tools/auth/strava.go

@@ -53,7 +53,7 @@ func (p *Strava) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id              int    `json:"id"`
+		Id              int64  `json:"id"`
 		FirstName       string `json:"firstname"`
 		LastName        string `json:"lastname"`
 		Username        string `json:"username"`
@@ -78,7 +78,7 @@ func (p *Strava) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
 	if extracted.Id != 0 {
-		user.Id = strconv.Itoa(extracted.Id)
+		user.Id = strconv.FormatInt(extracted.Id, 10)
 	}
 
 	return user, nil

tools/auth/vk.go

@@ -58,7 +58,7 @@ func (p *VK) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	extracted := struct {
 		Response []struct {
-			Id        int    `json:"id"`
+			Id        int64  `json:"id"`
 			FirstName string `json:"first_name"`
 			LastName  string `json:"last_name"`
 			Username  string `json:"screen_name"`
@@ -75,7 +75,7 @@ func (p *VK) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	user := &AuthUser{
-		Id:           strconv.Itoa(extracted.Response[0].Id),
+		Id:           strconv.FormatInt(extracted.Response[0].Id, 10),
 		Name:         strings.TrimSpace(extracted.Response[0].FirstName + " " + extracted.Response[0].LastName),
 		Username:     extracted.Response[0].Username,
 		AvatarURL:    extracted.Response[0].AvatarURL,

tools/cron/cron.go

@@ -11,22 +11,18 @@ package cron
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"sync"
 	"time"
 )
 
-type job struct {
-	schedule *Schedule
-	run      func()
-}
-
 // Cron is a crontab-like struct for tasks/jobs scheduling.
 type Cron struct {
 	timezone   *time.Location
 	ticker     *time.Ticker
 	startTimer *time.Timer
-	jobs       map[string]*job
 	tickerDone chan bool
+	jobs       []*Job
 	interval   time.Duration
 	mux        sync.RWMutex
 }
@@ -40,7 +36,7 @@ func New() *Cron {
 	return &Cron{
 		interval:   1 * time.Minute,
 		timezone:   time.UTC,
-		jobs:       map[string]*job{},
+		jobs:       []*Job{},
 		tickerDone: make(chan bool),
 	}
 }
@@ -82,23 +78,30 @@ func (c *Cron) MustAdd(jobId string, cronExpr string, run func()) {
 //
 // cronExpr is a regular cron expression, eg. "0 */3 * * *" (aka. at minute 0 past every 3rd hour).
 // Check cron.NewSchedule() for the supported tokens.
-func (c *Cron) Add(jobId string, cronExpr string, run func()) error {
-	if run == nil {
-		return errors.New("failed to add new cron job: run must be non-nil function")
+func (c *Cron) Add(jobId string, cronExpr string, fn func()) error {
+	if fn == nil {
+		return errors.New("failed to add new cron job: fn must be non-nil function")
 	}
 
-	c.mux.Lock()
-	defer c.mux.Unlock()
-
 	schedule, err := NewSchedule(cronExpr)
 	if err != nil {
 		return fmt.Errorf("failed to add new cron job: %w", err)
 	}
 
-	c.jobs[jobId] = &job{
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	// remove previous (if any)
+	c.jobs = slices.DeleteFunc(c.jobs, func(j *Job) bool {
+		return j.Id() == jobId
+	})
+
+	// add new
+	c.jobs = append(c.jobs, &Job{
+		id:       jobId,
+		fn:       fn,
 		schedule: schedule,
-		run:      run,
-	}
+	})
 
 	return nil
 }
@@ -108,7 +111,13 @@ func (c *Cron) Remove(jobId string) {
 	c.mux.Lock()
 	defer c.mux.Unlock()
 
-	delete(c.jobs, jobId)
+	if c.jobs == nil {
+		return // nothing to remove
+	}
+
+	c.jobs = slices.DeleteFunc(c.jobs, func(j *Job) bool {
+		return j.Id() == jobId
+	})
 }
 
 // RemoveAll removes all registered cron jobs.
@@ -116,7 +125,7 @@ func (c *Cron) RemoveAll() {
 	c.mux.Lock()
 	defer c.mux.Unlock()
 
-	c.jobs = map[string]*job{}
+	c.jobs = []*Job{}
 }
 
 // Total returns the current total number of registered cron jobs.
@@ -127,6 +136,19 @@ func (c *Cron) Total() int {
 	return len(c.jobs)
 }
 
+// Jobs returns a shallow copy of the currently registered cron jobs.
+func (c *Cron) Jobs() []*Job {
+	c.mux.RLock()
+	defer c.mux.RUnlock()
+
+	copy := make([]*Job, len(c.jobs))
+	for i, j := range c.jobs {
+		copy[i] = j
+	}
+
+	return copy
+}
+
 // Stop stops the current cron ticker (if not already).
 //
 // You can resume the ticker by calling Start().
@@ -200,7 +222,7 @@ func (c *Cron) runDue(t time.Time) {
 
 	for _, j := range c.jobs {
 		if j.schedule.IsDue(moment) {
-			go j.run()
+			go j.Run()
 		}
 	}
 }

tools/cron/cron_test.go

@@ -2,6 +2,7 @@ package cron
 
 import (
 	"encoding/json"
+	"slices"
 	"testing"
 	"time"
 )
@@ -98,6 +99,11 @@ func TestCronAddAndRemove(t *testing.T) {
 	// try to remove non-existing (should be no-op)
 	c.Remove("missing")
 
+	indexedJobs := make(map[string]*Job, len(c.jobs))
+	for _, j := range c.jobs {
+		indexedJobs[j.Id()] = j
+	}
+
 	// check job keys
 	{
 		expectedKeys := []string{"test3", "test2", "test5"}
@@ -107,7 +113,7 @@ func TestCronAddAndRemove(t *testing.T) {
 		}
 
 		for _, k := range expectedKeys {
-			if c.jobs[k] == nil {
+			if indexedJobs[k] == nil {
 				t.Fatalf("Expected job with key %s, got nil", k)
 			}
 		}
@@ -121,7 +127,7 @@ func TestCronAddAndRemove(t *testing.T) {
 			"test5": `{"minutes":{"1":{}},"hours":{"2":{}},"days":{"3":{}},"months":{"4":{}},"daysOfWeek":{"5":{}}}`,
 		}
 		for k, v := range expectedSchedules {
-			raw, err := json.Marshal(c.jobs[k].schedule)
+			raw, err := json.Marshal(indexedJobs[k].schedule)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -148,7 +154,7 @@ func TestCronMustAdd(t *testing.T) {
 
 	c.MustAdd("test2", "* * * * *", func() {})
 
-	if _, ok := c.jobs["test2"]; !ok {
+	if !slices.ContainsFunc(c.jobs, func(j *Job) bool { return j.Id() == "test2" }) {
 		t.Fatal("Couldn't find job test2")
 	}
 }
@@ -208,6 +214,42 @@ func TestCronTotal(t *testing.T) {
 	}
 }
 
+func TestCronJobs(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	calls := ""
+
+	if err := c.Add("a", "1 * * * *", func() { calls += "a" }); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("b", "2 * * * *", func() { calls += "b" }); err != nil {
+		t.Fatal(err)
+	}
+
+	// overwrite
+	if err := c.Add("b", "3 * * * *", func() { calls += "b" }); err != nil {
+		t.Fatal(err)
+	}
+
+	jobs := c.Jobs()
+
+	if len(jobs) != 2 {
+		t.Fatalf("Expected 2 jobs, got %v", len(jobs))
+	}
+
+	for _, j := range jobs {
+		j.Run()
+	}
+
+	expectedCalls := "ab"
+	if calls != expectedCalls {
+		t.Fatalf("Expected %q calls, got %q", expectedCalls, calls)
+	}
+}
+
 func TestCronStartStop(t *testing.T) {
 	t.Parallel()
 

tools/cron/job.go

@@ -0,0 +1,41 @@
+package cron
+
+import "encoding/json"
+
+// Job defines a single registered cron job.
+type Job struct {
+	fn       func()
+	schedule *Schedule
+	id       string
+}
+
+// Id returns the cron job id.
+func (j *Job) Id() string {
+	return j.id
+}
+
+// Expression returns the plain cron job schedule expression.
+func (j *Job) Expression() string {
+	return j.schedule.rawExpr
+}
+
+// Run runs the cron job function.
+func (j *Job) Run() {
+	if j.fn != nil {
+		j.fn()
+	}
+}
+
+// MarshalJSON implements [json.Marshaler] and export the current
+// jobs data into valid JSON.
+func (j Job) MarshalJSON() ([]byte, error) {
+	plain := struct {
+		Id         string `json:"id"`
+		Expression string `json:"expression"`
+	}{
+		Id:         j.Id(),
+		Expression: j.Expression(),
+	}
+
+	return json.Marshal(plain)
+}

tools/cron/job_test.go

@@ -0,0 +1,71 @@
+package cron
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestJobId(t *testing.T) {
+	expected := "test"
+
+	j := Job{id: expected}
+
+	if j.Id() != expected {
+		t.Fatalf("Expected job with id %q, got %q", expected, j.Id())
+	}
+}
+
+func TestJobExpr(t *testing.T) {
+	expected := "1 2 3 4 5"
+
+	s, err := NewSchedule(expected)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	j := Job{schedule: s}
+
+	if j.Expression() != expected {
+		t.Fatalf("Expected job with cron expression %q, got %q", expected, j.Expression())
+	}
+}
+
+func TestJobRun(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("Shouldn't panic: %v", r)
+		}
+	}()
+
+	calls := ""
+
+	j1 := Job{}
+	j2 := Job{fn: func() { calls += "2" }}
+
+	j1.Run()
+	j2.Run()
+
+	expected := "2"
+	if calls != expected {
+		t.Fatalf("Expected calls %q, got %q", expected, calls)
+	}
+}
+
+func TestJobMarshalJSON(t *testing.T) {
+	s, err := NewSchedule("1 2 3 4 5")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	j := Job{id: "test_id", schedule: s}
+
+	raw, err := json.Marshal(j)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"id":"test_id","expression":"1 2 3 4 5"}`
+	if str := string(raw); str != expected {
+		t.Fatalf("Expected\n%s\ngot\n%s", expected, str)
+	}
+}

tools/cron/schedule.go

@@ -35,6 +35,8 @@ type Schedule struct {
 	Days       map[int]struct{} `json:"days"`
 	Months     map[int]struct{} `json:"months"`
 	DaysOfWeek map[int]struct{} `json:"daysOfWeek"`
+
+	rawExpr string
 }
 
 // IsDue checks whether the provided Moment satisfies the current Schedule.
@@ -130,6 +132,7 @@ func NewSchedule(cronExpr string) (*Schedule, error) {
 		Days:       days,
 		Months:     months,
 		DaysOfWeek: daysOfWeek,
+		rawExpr:    cronExpr,
 	}, nil
 }
 

tools/filesystem/internal/s3lite/s3lite.go

@@ -375,7 +375,6 @@ func (w *writer) open(r io.Reader, closePipeOnError bool) {
 		if err != nil {
 			if closePipeOnError {
 				w.pr.CloseWithError(err)
-				w.pr = nil
 			}
 			w.err = err
 		}

tools/list/list.go

@@ -9,7 +9,7 @@ import (
 	"github.com/spf13/cast"
 )
 
-var cachedPatterns = store.New[*regexp.Regexp](nil)
+var cachedPatterns = store.New[string, *regexp.Regexp](nil)
 
 // SubtractSlice returns a new slice with only the "base" elements
 // that don't exist in "subtract".

tools/mailer/mailer.go

@@ -9,15 +9,16 @@ import (
 
 // Message defines a generic email message struct.
 type Message struct {
-	From        mail.Address         `json:"from"`
-	To          []mail.Address       `json:"to"`
-	Bcc         []mail.Address       `json:"bcc"`
-	Cc          []mail.Address       `json:"cc"`
-	Subject     string               `json:"subject"`
-	HTML        string               `json:"html"`
-	Text        string               `json:"text"`
-	Headers     map[string]string    `json:"headers"`
-	Attachments map[string]io.Reader `json:"attachments"`
+	From              mail.Address         `json:"from"`
+	To                []mail.Address       `json:"to"`
+	Bcc               []mail.Address       `json:"bcc"`
+	Cc                []mail.Address       `json:"cc"`
+	Subject           string               `json:"subject"`
+	HTML              string               `json:"html"`
+	Text              string               `json:"text"`
+	Headers           map[string]string    `json:"headers"`
+	Attachments       map[string]io.Reader `json:"attachments"`
+	InlineAttachments map[string]io.Reader `json:"inlineAttachments"`
 }
 
 // Mailer defines a base mail client interface.

tools/mailer/smtp.go

@@ -114,11 +114,16 @@ func (c *SMTPClient) send(m *Message) error {
 		yak.Cc(addressesToStrings(m.Cc, true)...)
 	}
 
-	// add attachements (if any)
+	// add regular attachements (if any)
 	for name, data := range m.Attachments {
 		yak.Attach(name, data)
 	}
 
+	// add inline attachments (if any)
+	for name, data := range m.InlineAttachments {
+		yak.AttachInline(name, data)
+	}
+
 	// add custom headers (if any)
 	var hasMessageId bool
 	for k, v := range m.Headers {

tools/osutils/cmd.go

@@ -0,0 +1,31 @@
+package osutils
+
+import (
+	"os/exec"
+	"runtime"
+
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+)
+
+// LaunchURL attempts to open the provided url in the user's default browser.
+//
+// It is platform dependent and it uses:
+//   - "open" on macOS
+//   - "rundll32" on Windows
+//   - "xdg-open" on everything else (Linux, FreeBSD, etc.)
+func LaunchURL(url string) error {
+	if err := is.URL.Validate(url); err != nil {
+		return err
+	}
+
+	switch runtime.GOOS {
+	case "darwin":
+		return exec.Command("open", url).Start()
+	case "windows":
+		// not sure if this is the best command but seems to be the most reliable based on the comments in
+		// https://stackoverflow.com/questions/3739327/launching-a-website-via-the-windows-commandline#answer-49115945
+		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+	default:
+		return exec.Command("xdg-open", url).Start()
+	}
+}

tools/osutils/dir.go

@@ -8,7 +8,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
-// MoveDirContent moves the src dir content, that is not listed in the exclide list,
+// MoveDirContent moves the src dir content, that is not listed in the exclude list,
 // to dest dir (it will be created if missing).
 //
 // The rootExclude argument is used to specify a list of src root entries to exclude.

tools/router/event.go

@@ -34,7 +34,7 @@ type Event struct {
 
 	hook.Event
 
-	data store.Store[any]
+	data store.Store[string, any]
 }
 
 // RWUnwrapper specifies that an http.ResponseWriter could be "unwrapped"

tools/router/unmarshal_request_data.go

@@ -325,7 +325,8 @@ func inferValue(raw string) any {
 		// try to convert to number
 		//
 		// note: expects the provided raw string to match exactly with the minimal string representation of the parsed float
-		if raw[0] == '-' || (raw[0] >= '0' && raw[0] <= '9') && inferNumberCharsRegex.Match([]byte(raw)) {
+		if (raw[0] == '-' || (raw[0] >= '0' && raw[0] <= '9')) &&
+			inferNumberCharsRegex.Match([]byte(raw)) {
 			v, err := strconv.ParseFloat(raw, 64)
 			if err == nil && strconv.FormatFloat(v, 'f', -1, 64) == raw {
 				return v

tools/router/unmarshal_request_data_test.go

@@ -31,6 +31,7 @@ func TestUnmarshalRequestData(t *testing.T) {
 			"000001",
 			"-000001",
 			"1.6E-35",
+			"-1.6E-35",
 			"10e100",
 			"1_000_000",
 			"1.000.000",
@@ -328,7 +329,7 @@ func TestUnmarshalRequestData(t *testing.T) {
 			name:   "*map[string]any",
 			data:   mapData,
 			dst:    pointer(map[string]any{}),
-			result: `{"bool1":true,"bool2":[true,false],"json_a":null,"json_b":123,"json_c":[1,2,3],"mixed":[true,123,"test"],"number1":1,"number2":[2,3],"number3":[2.1,-3.4],"number4":[0,-0,0.0001],"string0":"","string1":"a","string2":["b","c"],"string3":["0.0","-0.0","000.1","000001","-000001","1.6E-35","10e100","1_000_000","1.000.000"," 123 ","0b1","0xFF","1234A","Infinity","-Infinity","undefined","null"]}`,
+			result: `{"bool1":true,"bool2":[true,false],"json_a":null,"json_b":123,"json_c":[1,2,3],"mixed":[true,123,"test"],"number1":1,"number2":[2,3],"number3":[2.1,-3.4],"number4":[0,-0,0.0001],"string0":"","string1":"a","string2":["b","c"],"string3":["0.0","-0.0","000.1","000001","-000001","1.6E-35","-1.6E-35","10e100","1_000_000","1.000.000"," 123 ","0b1","0xFF","1234A","Infinity","-Infinity","undefined","null"]}`,
 		},
 		{
 			name:   "valid pointer struct (all fields)",

tools/search/filter.go

@@ -628,7 +628,7 @@ func (e *manyVsManyExpr) Build(db *dbx.DB, params dbx.Params) string {
 			Identifier: "[[" + rAlias + ".multiMatchValue]]",
 			// note: the AfterBuild needs to be handled only once and it
 			// doesn't matter whether it is applied on the left or right subquery operand
-			AfterBuild: multiMatchAfterBuildFunc(e.op, lAlias, rAlias),
+			AfterBuild: dbx.Not, // inverse for the not-exist expression
 		},
 	)
 
@@ -650,7 +650,7 @@ func (e *manyVsManyExpr) Build(db *dbx.DB, params dbx.Params) string {
 
 var _ dbx.Expression = (*manyVsOneExpr)(nil)
 
-// manyVsManyExpr constructs a multi-match many<->one db where expression.
+// manyVsOneExpr constructs a multi-match many<->one db where expression.
 //
 // Expects subQuery to return a subquery with a single "multiMatchValue" column.
 //
@@ -676,7 +676,7 @@ func (e *manyVsOneExpr) Build(db *dbx.DB, params dbx.Params) string {
 	r1 := &ResolverResult{
 		NoCoalesce: e.noCoalesce,
 		Identifier: "[[" + alias + ".multiMatchValue]]",
-		AfterBuild: multiMatchAfterBuildFunc(e.op, alias),
+		AfterBuild: dbx.Not, // inverse for the not-exist expression
 	}
 
 	r2 := &ResolverResult{
@@ -704,31 +704,3 @@ func (e *manyVsOneExpr) Build(db *dbx.DB, params dbx.Params) string {
 		whereExpr.Build(db, params),
 	)
 }
-
-func multiMatchAfterBuildFunc(op fexpr.SignOp, multiMatchAliases ...string) func(dbx.Expression) dbx.Expression {
-	return func(expr dbx.Expression) dbx.Expression {
-		expr = dbx.Not(expr) // inverse for the not-exist expression
-
-		if op == fexpr.SignEq {
-			return expr
-		}
-
-		orExprs := make([]dbx.Expression, len(multiMatchAliases)+1)
-		orExprs[0] = expr
-
-		// Add an optional "IS NULL" condition(s) to handle the empty rows result.
-		//
-		// For example, let's assume that some "rel" field is [nonemptyRel1, nonemptyRel2, emptyRel3],
-		// The filter "rel.total > 0" ensures that the above will return true only if all relations
-		// are existing and match the condition.
-		//
-		// The "=" operator is excluded because it will never equal directly with NULL anyway
-		// and also because we want in case "rel.id = ''" is specified to allow
-		// matching the empty relations (they will match due to the applied COALESCE).
-		for i, mAlias := range multiMatchAliases {
-			orExprs[i+1] = dbx.NewExp("[[" + mAlias + ".multiMatchValue]] IS NULL")
-		}
-
-		return dbx.Enclose(dbx.Or(orExprs...))
-	}
-}

tools/search/identifier_macros.go

@@ -23,6 +23,26 @@ var identifierMacros = map[string]func() (any, error){
 
 		return d.String(), nil
 	},
+	"@yesterday": func() (any, error) {
+		yesterday := timeNow().UTC().AddDate(0, 0, -1)
+
+		d, err := types.ParseDateTime(yesterday)
+		if err != nil {
+			return "", fmt.Errorf("@yesterday: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@tomorrow": func() (any, error) {
+		tomorrow := timeNow().UTC().AddDate(0, 0, 1)
+
+		d, err := types.ParseDateTime(tomorrow)
+		if err != nil {
+			return "", fmt.Errorf("@tomorrow: %w", err)
+		}
+
+		return d.String(), nil
+	},
 	"@second": func() (any, error) {
 		return timeNow().UTC().Second(), nil
 	},

tools/search/identifier_macros_test.go

@@ -14,6 +14,8 @@ func TestIdentifierMacros(t *testing.T) {
 
 	testMacros := map[string]any{
 		"@now":        "2023-02-03 04:05:06.000Z",
+		"@yesterday":  "2023-02-02 04:05:06.000Z",
+		"@tomorrow":   "2023-02-04 04:05:06.000Z",
 		"@second":     6,
 		"@minute":     5,
 		"@hour":       4,

tools/search/provider.go

@@ -97,7 +97,7 @@ func NewProvider(fieldResolver FieldResolver) *Provider {
 	}
 }
 
-// MaxFilterExpressions changes the default max allowed filter expressions.
+// MaxFilterExprLimit changes the default max allowed filter expressions.
 //
 // Note that currently the limit is applied individually for each separate filter.
 func (s *Provider) MaxFilterExprLimit(max int) *Provider {
@@ -105,7 +105,7 @@ func (s *Provider) MaxFilterExprLimit(max int) *Provider {
 	return s
 }
 
-// MaxSortExpressions changes the default max allowed sort expressions.
+// MaxSortExprLimit changes the default max allowed sort expressions.
 func (s *Provider) MaxSortExprLimit(max int) *Provider {
 	s.maxSortExprLimit = max
 	return s

tools/store/store.go

@@ -9,15 +9,15 @@ import (
 const ShrinkThreshold = 200 // the number is arbitrary chosen
 
 // Store defines a concurrent safe in memory key-value data store.
-type Store[T any] struct {
-	data    map[string]T
+type Store[K comparable, T any] struct {
+	data    map[K]T
 	mu      sync.RWMutex
 	deleted int64
 }
 
 // New creates a new Store[T] instance with a shallow copy of the provided data (if any).
-func New[T any](data map[string]T) *Store[T] {
-	s := &Store[T]{}
+func New[K comparable, T any](data map[K]T) *Store[K, T] {
+	s := &Store[K, T]{}
 
 	s.Reset(data)
 
@@ -26,24 +26,24 @@ func New[T any](data map[string]T) *Store[T] {
 
 // Reset clears the store and replaces the store data with a
 // shallow copy of the provided newData.
-func (s *Store[T]) Reset(newData map[string]T) {
+func (s *Store[K, T]) Reset(newData map[K]T) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	if len(newData) > 0 {
-		s.data = make(map[string]T, len(newData))
+		s.data = make(map[K]T, len(newData))
 		for k, v := range newData {
 			s.data[k] = v
 		}
 	} else {
-		s.data = make(map[string]T)
+		s.data = make(map[K]T)
 	}
 
 	s.deleted = 0
 }
 
 // Length returns the current number of elements in the store.
-func (s *Store[T]) Length() int {
+func (s *Store[K, T]) Length() int {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -51,14 +51,14 @@ func (s *Store[T]) Length() int {
 }
 
 // RemoveAll removes all the existing store entries.
-func (s *Store[T]) RemoveAll() {
+func (s *Store[K, T]) RemoveAll() {
 	s.Reset(nil)
 }
 
 // Remove removes a single entry from the store.
 //
 // Remove does nothing if key doesn't exist in the store.
-func (s *Store[T]) Remove(key string) {
+func (s *Store[K, T]) Remove(key K) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -69,7 +69,7 @@ func (s *Store[T]) Remove(key string) {
 	//
 	// @todo remove after https://github.com/golang/go/issues/20135
 	if s.deleted >= ShrinkThreshold {
-		newData := make(map[string]T, len(s.data))
+		newData := make(map[K]T, len(s.data))
 		for k, v := range s.data {
 			newData[k] = v
 		}
@@ -79,7 +79,7 @@ func (s *Store[T]) Remove(key string) {
 }
 
 // Has checks if element with the specified key exist or not.
-func (s *Store[T]) Has(key string) bool {
+func (s *Store[K, T]) Has(key K) bool {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -91,7 +91,7 @@ func (s *Store[T]) Has(key string) bool {
 // Get returns a single element value from the store.
 //
 // If key is not set, the zero T value is returned.
-func (s *Store[T]) Get(key string) T {
+func (s *Store[K, T]) Get(key K) T {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -99,7 +99,7 @@ func (s *Store[T]) Get(key string) T {
 }
 
 // GetOk is similar to Get but returns also a boolean indicating whether the key exists or not.
-func (s *Store[T]) GetOk(key string) (T, bool) {
+func (s *Store[K, T]) GetOk(key K) (T, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -109,11 +109,11 @@ func (s *Store[T]) GetOk(key string) (T, bool) {
 }
 
 // GetAll returns a shallow copy of the current store data.
-func (s *Store[T]) GetAll() map[string]T {
+func (s *Store[K, T]) GetAll() map[K]T {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	var clone = make(map[string]T, len(s.data))
+	var clone = make(map[K]T, len(s.data))
 
 	for k, v := range s.data {
 		clone[k] = v
@@ -123,7 +123,7 @@ func (s *Store[T]) GetAll() map[string]T {
 }
 
 // Values returns a slice with all of the current store values.
-func (s *Store[T]) Values() []T {
+func (s *Store[K, T]) Values() []T {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -137,12 +137,12 @@ func (s *Store[T]) Values() []T {
 }
 
 // Set sets (or overwrite if already exist) a new value for key.
-func (s *Store[T]) Set(key string, value T) {
+func (s *Store[K, T]) Set(key K, value T) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	if s.data == nil {
-		s.data = make(map[string]T)
+		s.data = make(map[K]T)
 	}
 
 	s.data[key] = value
@@ -150,7 +150,7 @@ func (s *Store[T]) Set(key string, value T) {
 
 // GetOrSet retrieves a single existing value for the provided key
 // or stores a new one if it doesn't exist.
-func (s *Store[T]) GetOrSet(key string, setFunc func() T) T {
+func (s *Store[K, T]) GetOrSet(key K, setFunc func() T) T {
 	// lock only reads to minimize locks contention
 	s.mu.RLock()
 	v, ok := s.data[key]
@@ -160,7 +160,7 @@ func (s *Store[T]) GetOrSet(key string, setFunc func() T) T {
 		s.mu.Lock()
 		v = setFunc()
 		if s.data == nil {
-			s.data = make(map[string]T)
+			s.data = make(map[K]T)
 		}
 		s.data[key] = v
 		s.mu.Unlock()
@@ -174,12 +174,12 @@ func (s *Store[T]) GetOrSet(key string, setFunc func() T) T {
 // This method is similar to Set() but **it will skip adding new elements**
 // to the store if the store length has reached the specified limit.
 // false is returned if maxAllowedElements limit is reached.
-func (s *Store[T]) SetIfLessThanLimit(key string, value T, maxAllowedElements int) bool {
+func (s *Store[K, T]) SetIfLessThanLimit(key K, value T, maxAllowedElements int) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	if s.data == nil {
-		s.data = make(map[string]T)
+		s.data = make(map[K]T)
 	}
 
 	// check for existing item
@@ -200,8 +200,8 @@ func (s *Store[T]) SetIfLessThanLimit(key string, value T, maxAllowedElements in
 // provided JSON data into the store.
 //
 // The store entries that match with the ones from the data will be overwritten with the new value.
-func (s *Store[T]) UnmarshalJSON(data []byte) error {
-	raw := map[string]T{}
+func (s *Store[K, T]) UnmarshalJSON(data []byte) error {
+	raw := map[K]T{}
 	if err := json.Unmarshal(data, &raw); err != nil {
 		return err
 	}
@@ -210,7 +210,7 @@ func (s *Store[T]) UnmarshalJSON(data []byte) error {
 	defer s.mu.Unlock()
 
 	if s.data == nil {
-		s.data = make(map[string]T)
+		s.data = make(map[K]T)
 	}
 
 	for k, v := range raw {
@@ -222,6 +222,6 @@ func (s *Store[T]) UnmarshalJSON(data []byte) error {
 
 // MarshalJSON implements [json.Marshaler] and export the current
 // store data into valid JSON.
-func (s *Store[T]) MarshalJSON() ([]byte, error) {
+func (s *Store[K, T]) MarshalJSON() ([]byte, error) {
 	return json.Marshal(s.GetAll())
 }

tools/store/store_test.go

@@ -227,7 +227,7 @@ func TestValues(t *testing.T) {
 }
 
 func TestSet(t *testing.T) {
-	s := store.Store[int]{}
+	s := store.Store[string, int]{}
 
 	data := map[string]int{"test1": 0, "test2": 1, "test3": 3}
 
@@ -281,7 +281,7 @@ func TestGetOrSet(t *testing.T) {
 }
 
 func TestSetIfLessThanLimit(t *testing.T) {
-	s := store.Store[int]{}
+	s := store.Store[string, int]{}
 
 	limit := 2
 
@@ -316,7 +316,7 @@ func TestSetIfLessThanLimit(t *testing.T) {
 }
 
 func TestUnmarshalJSON(t *testing.T) {
-	s := store.Store[string]{}
+	s := store.Store[string, string]{}
 	s.Set("b", "old")   // should be overwritten
 	s.Set("c", "test3") // ensures that the old values are not removed
 
@@ -339,7 +339,7 @@ func TestUnmarshalJSON(t *testing.T) {
 }
 
 func TestMarshalJSON(t *testing.T) {
-	s := &store.Store[string]{}
+	s := &store.Store[string, string]{}
 	s.Set("a", "test1")
 	s.Set("b", "test2")
 
@@ -356,7 +356,7 @@ func TestMarshalJSON(t *testing.T) {
 }
 
 func TestShrink(t *testing.T) {
-	s := &store.Store[int]{}
+	s := &store.Store[string, int]{}
 
 	total := 1000
 

tools/subscriptions/broker.go

@@ -9,13 +9,13 @@ import (
 
 // Broker defines a struct for managing subscriptions clients.
 type Broker struct {
-	store *store.Store[Client]
+	store *store.Store[string, Client]
 }
 
 // NewBroker initializes and returns a new Broker instance.
 func NewBroker() *Broker {
 	return &Broker{
-		store: store.New[Client](nil),
+		store: store.New[string, Client](nil),
 	}
 }
 

tools/template/registry.go

@@ -37,7 +37,7 @@ import (
 // Use the Registry.Load* methods to load templates into the registry.
 func NewRegistry() *Registry {
 	return &Registry{
-		cache: store.New[*Renderer](nil),
+		cache: store.New[string, *Renderer](nil),
 		funcs: template.FuncMap{
 			"raw": func(str string) template.HTML {
 				return template.HTML(str)
@@ -50,7 +50,7 @@ func NewRegistry() *Registry {
 //
 // Use the Registry.Load* methods to load templates into the registry.
 type Registry struct {
-	cache *store.Store[*Renderer]
+	cache *store.Store[string, *Renderer]
 	funcs template.FuncMap
 }
 

ui/.env

@@ -1,12 +1,12 @@
 # all environments should start with 'PB_' prefix
 PB_BACKEND_URL         = "../"
-PB_MFA_DOCS            = "https://pocketbase.io/docs/authentication/#multi-factor-authentication"
-PB_OAUTH2_EXAMPLE      = "https://pocketbase.io/docs/authentication/#authenticate-with-oauth2"
-PB_RULES_SYNTAX_DOCS   = "https://pocketbase.io/docs/api-rules-and-filters/"
-PB_FILE_UPLOAD_DOCS    = "https://pocketbase.io/docs/files-handling/"
-PB_PROTECTED_FILE_DOCS = "https://pocketbase.io/docs/files-handling/#protected-files"
-PB_DOCS_URL            = "https://pocketbase.io/docs/"
+PB_MFA_DOCS            = "https://pocketbase.io/docs/authentication#multi-factor-authentication"
+PB_OAUTH2_EXAMPLE      = "https://pocketbase.io/docs/authentication#authenticate-with-oauth2"
+PB_RULES_SYNTAX_DOCS   = "https://pocketbase.io/docs/api-rules-and-filters"
+PB_FILE_UPLOAD_DOCS    = "https://pocketbase.io/docs/files-handling"
+PB_PROTECTED_FILE_DOCS = "https://pocketbase.io/docs/files-handling#protected-files"
+PB_DOCS_URL            = "https://pocketbase.io/docs"
 PB_JS_SDK_URL          = "https://github.com/pocketbase/js-sdk"
 PB_DART_SDK_URL        = "https://github.com/pocketbase/dart-sdk"
 PB_RELEASES            = "https://github.com/pocketbase/pocketbase/releases"
-PB_VERSION             = "v0.23.6"
+PB_VERSION             = "v0.24.1"

ui/dist/assets/AuthMethodsDocs-BuDTItBx.js

@@ -1,4 +1,4 @@
-import{S as Be,i as Ce,s as Te,V as Le,X as J,h as c,z as w,j as k,c as ae,k as h,n as d,o as a,m as ne,H as Q,Y as $e,Z as Se,E as je,_ as qe,G as Ee,t as z,a as I,v as u,d as ie,p as oe,J as He,l as N,q as Re,W as Ue}from"./index-BiaJFyLM.js";import{F as De}from"./FieldsQueryParam-BfNg6ueM.js";function we(n,s,l){const o=n.slice();return o[8]=s[l],o}function Me(n,s,l){const o=n.slice();return o[8]=s[l],o}function Ae(n,s){let l,o=s[8].code+"",p,b,i,f;function m(){return s[6](s[8])}return{key:n,first:null,c(){l=c("button"),p=w(o),b=k(),h(l,"class","tab-item"),N(l,"active",s[1]===s[8].code),this.first=l},m(v,y){d(v,l,y),a(l,p),a(l,b),i||(f=Re(l,"click",m),i=!0)},p(v,y){s=v,y&4&&o!==(o=s[8].code+"")&&Q(p,o),y&6&&N(l,"active",s[1]===s[8].code)},d(v){v&&u(l),i=!1,f()}}}function Pe(n,s){let l,o,p,b;return o=new Ue({props:{content:s[8].body}}),{key:n,first:null,c(){l=c("div"),ae(o.$$.fragment),p=k(),h(l,"class","tab-item"),N(l,"active",s[1]===s[8].code),this.first=l},m(i,f){d(i,l,f),ne(o,l,null),a(l,p),b=!0},p(i,f){s=i;const m={};f&4&&(m.content=s[8].body),o.$set(m),(!b||f&6)&&N(l,"active",s[1]===s[8].code)},i(i){b||(z(o.$$.fragment,i),b=!0)},o(i){I(o.$$.fragment,i),b=!1},d(i){i&&u(l),ie(o)}}}function Fe(n){var ke,ge;let s,l,o=n[0].name+"",p,b,i,f,m,v,y,g=n[0].name+"",O,ce,V,M,W,L,X,A,U,re,D,S,de,Y,F=n[0].name+"",Z,ue,K,j,x,P,ee,fe,te,T,le,q,se,B,E,$=[],me=new Map,pe,H,_=[],be=new Map,C;M=new Le({props:{js:`
+import{S as Be,i as Ce,s as Te,V as Le,X as J,h as c,z as w,j as k,c as ae,k as h,n as d,o as a,m as ne,H as Q,Y as $e,Z as Se,E as je,_ as qe,G as Ee,t as z,a as I,v as u,d as ie,p as oe,J as He,l as N,q as Re,W as Ue}from"./index-CGvwwHtM.js";import{F as De}from"./FieldsQueryParam-3ARDPOLO.js";function we(n,s,l){const o=n.slice();return o[8]=s[l],o}function Me(n,s,l){const o=n.slice();return o[8]=s[l],o}function Ae(n,s){let l,o=s[8].code+"",p,b,i,f;function m(){return s[6](s[8])}return{key:n,first:null,c(){l=c("button"),p=w(o),b=k(),h(l,"class","tab-item"),N(l,"active",s[1]===s[8].code),this.first=l},m(v,y){d(v,l,y),a(l,p),a(l,b),i||(f=Re(l,"click",m),i=!0)},p(v,y){s=v,y&4&&o!==(o=s[8].code+"")&&Q(p,o),y&6&&N(l,"active",s[1]===s[8].code)},d(v){v&&u(l),i=!1,f()}}}function Pe(n,s){let l,o,p,b;return o=new Ue({props:{content:s[8].body}}),{key:n,first:null,c(){l=c("div"),ae(o.$$.fragment),p=k(),h(l,"class","tab-item"),N(l,"active",s[1]===s[8].code),this.first=l},m(i,f){d(i,l,f),ne(o,l,null),a(l,p),b=!0},p(i,f){s=i;const m={};f&4&&(m.content=s[8].body),o.$set(m),(!b||f&6)&&N(l,"active",s[1]===s[8].code)},i(i){b||(z(o.$$.fragment,i),b=!0)},o(i){I(o.$$.fragment,i),b=!1},d(i){i&&u(l),ie(o)}}}function Fe(n){var ke,ge;let s,l,o=n[0].name+"",p,b,i,f,m,v,y,g=n[0].name+"",O,ce,V,M,W,L,X,A,U,re,D,S,de,Y,F=n[0].name+"",Z,ue,K,j,x,P,ee,fe,te,T,le,q,se,B,E,$=[],me=new Map,pe,H,_=[],be=new Map,C;M=new Le({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${n[3]}');

ui/dist/assets/AuthRefreshDocs-DPkjhBOO.js

@@ -1,4 +1,4 @@
-import{S as Ue,i as xe,s as Ke,V as Qe,W as Ne,X as K,h as s,z as k,j as p,c as Q,k as b,n as d,o,m as W,H as de,Y as Le,Z as We,E as Ge,_ as Ie,G as Xe,t as V,a as z,v as u,d as G,J as Oe,p as Ye,l as I,q as Ze}from"./index-BiaJFyLM.js";import{F as et}from"./FieldsQueryParam-BfNg6ueM.js";function Ve(r,a,l){const n=r.slice();return n[5]=a[l],n}function ze(r,a,l){const n=r.slice();return n[5]=a[l],n}function je(r,a){let l,n=a[5].code+"",m,_,i,h;function g(){return a[4](a[5])}return{key:r,first:null,c(){l=s("button"),m=k(n),_=p(),b(l,"class","tab-item"),I(l,"active",a[1]===a[5].code),this.first=l},m(v,w){d(v,l,w),o(l,m),o(l,_),i||(h=Ze(l,"click",g),i=!0)},p(v,w){a=v,w&4&&n!==(n=a[5].code+"")&&de(m,n),w&6&&I(l,"active",a[1]===a[5].code)},d(v){v&&u(l),i=!1,h()}}}function Je(r,a){let l,n,m,_;return n=new Ne({props:{content:a[5].body}}),{key:r,first:null,c(){l=s("div"),Q(n.$$.fragment),m=p(),b(l,"class","tab-item"),I(l,"active",a[1]===a[5].code),this.first=l},m(i,h){d(i,l,h),W(n,l,null),o(l,m),_=!0},p(i,h){a=i;const g={};h&4&&(g.content=a[5].body),n.$set(g),(!_||h&6)&&I(l,"active",a[1]===a[5].code)},i(i){_||(V(n.$$.fragment,i),_=!0)},o(i){z(n.$$.fragment,i),_=!1},d(i){i&&u(l),G(n)}}}function tt(r){var De,Fe;let a,l,n=r[0].name+"",m,_,i,h,g,v,w,B,X,S,j,ue,J,M,pe,Y,N=r[0].name+"",Z,he,fe,U,ee,D,te,T,oe,be,F,C,ae,me,le,_e,f,ke,P,ge,ve,$e,se,ye,ne,Se,we,Te,re,Ce,Re,q,ie,H,ce,R,E,y=[],Pe=new Map,qe,L,$=[],Ae=new Map,A;v=new Qe({props:{js:`
+import{S as Ue,i as xe,s as Ke,V as Qe,W as Ne,X as K,h as s,z as k,j as p,c as Q,k as b,n as d,o,m as W,H as de,Y as Le,Z as We,E as Ge,_ as Ie,G as Xe,t as V,a as z,v as u,d as G,J as Oe,p as Ye,l as I,q as Ze}from"./index-CGvwwHtM.js";import{F as et}from"./FieldsQueryParam-3ARDPOLO.js";function Ve(r,a,l){const n=r.slice();return n[5]=a[l],n}function ze(r,a,l){const n=r.slice();return n[5]=a[l],n}function je(r,a){let l,n=a[5].code+"",m,_,i,h;function g(){return a[4](a[5])}return{key:r,first:null,c(){l=s("button"),m=k(n),_=p(),b(l,"class","tab-item"),I(l,"active",a[1]===a[5].code),this.first=l},m(v,w){d(v,l,w),o(l,m),o(l,_),i||(h=Ze(l,"click",g),i=!0)},p(v,w){a=v,w&4&&n!==(n=a[5].code+"")&&de(m,n),w&6&&I(l,"active",a[1]===a[5].code)},d(v){v&&u(l),i=!1,h()}}}function Je(r,a){let l,n,m,_;return n=new Ne({props:{content:a[5].body}}),{key:r,first:null,c(){l=s("div"),Q(n.$$.fragment),m=p(),b(l,"class","tab-item"),I(l,"active",a[1]===a[5].code),this.first=l},m(i,h){d(i,l,h),W(n,l,null),o(l,m),_=!0},p(i,h){a=i;const g={};h&4&&(g.content=a[5].body),n.$set(g),(!_||h&6)&&I(l,"active",a[1]===a[5].code)},i(i){_||(V(n.$$.fragment,i),_=!0)},o(i){z(n.$$.fragment,i),_=!1},d(i){i&&u(l),G(n)}}}function tt(r){var De,Fe;let a,l,n=r[0].name+"",m,_,i,h,g,v,w,B,X,S,j,ue,J,M,pe,Y,N=r[0].name+"",Z,he,fe,U,ee,D,te,T,oe,be,F,C,ae,me,le,_e,f,ke,P,ge,ve,$e,se,ye,ne,Se,we,Te,re,Ce,Re,q,ie,H,ce,R,E,y=[],Pe=new Map,qe,L,$=[],Ae=new Map,A;v=new Qe({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${r[3]}');

ui/dist/assets/AuthWithOAuth2Docs-Bp79aJsR.js

@@ -1,4 +1,4 @@
-import{S as Ee,i as Je,s as xe,V as ze,W as Ve,X as Q,h as o,z as _,j as h,c as G,k as p,n as r,o as a,m as I,H as pe,Y as Ue,Z as Ne,E as Qe,_ as Ge,G as Ie,t as V,a as E,v as c,d as K,J as Be,p as Ke,l as X,q as Xe}from"./index-BiaJFyLM.js";import{F as Ye}from"./FieldsQueryParam-BfNg6ueM.js";function Fe(s,l,n){const i=s.slice();return i[5]=l[n],i}function He(s,l,n){const i=s.slice();return i[5]=l[n],i}function Le(s,l){let n,i=l[5].code+"",f,g,d,b;function k(){return l[4](l[5])}return{key:s,first:null,c(){n=o("button"),f=_(i),g=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(v,O){r(v,n,O),a(n,f),a(n,g),d||(b=Xe(n,"click",k),d=!0)},p(v,O){l=v,O&4&&i!==(i=l[5].code+"")&&pe(f,i),O&6&&X(n,"active",l[1]===l[5].code)},d(v){v&&c(n),d=!1,b()}}}function je(s,l){let n,i,f,g;return i=new Ve({props:{content:l[5].body}}),{key:s,first:null,c(){n=o("div"),G(i.$$.fragment),f=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(d,b){r(d,n,b),I(i,n,null),a(n,f),g=!0},p(d,b){l=d;const k={};b&4&&(k.content=l[5].body),i.$set(k),(!g||b&6)&&X(n,"active",l[1]===l[5].code)},i(d){g||(V(i.$$.fragment,d),g=!0)},o(d){E(i.$$.fragment,d),g=!1},d(d){d&&c(n),K(i)}}}function Ze(s){let l,n,i=s[0].name+"",f,g,d,b,k,v,O,D,Y,A,J,be,x,P,me,Z,z=s[0].name+"",ee,fe,te,M,ae,W,le,U,ne,y,oe,ge,B,S,se,_e,ie,ke,m,ve,C,we,$e,Oe,re,Ae,ce,ye,Se,Te,de,Ce,qe,q,ue,F,he,T,H,$=[],Re=new Map,De,L,w=[],Pe=new Map,R;v=new ze({props:{js:`
+import{S as Ee,i as Je,s as xe,V as ze,W as Ve,X as Q,h as o,z as _,j as h,c as G,k as p,n as r,o as a,m as I,H as pe,Y as Ue,Z as Ne,E as Qe,_ as Ge,G as Ie,t as V,a as E,v as c,d as K,J as Be,p as Ke,l as X,q as Xe}from"./index-CGvwwHtM.js";import{F as Ye}from"./FieldsQueryParam-3ARDPOLO.js";function Fe(s,l,n){const i=s.slice();return i[5]=l[n],i}function He(s,l,n){const i=s.slice();return i[5]=l[n],i}function Le(s,l){let n,i=l[5].code+"",f,g,d,b;function k(){return l[4](l[5])}return{key:s,first:null,c(){n=o("button"),f=_(i),g=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(v,O){r(v,n,O),a(n,f),a(n,g),d||(b=Xe(n,"click",k),d=!0)},p(v,O){l=v,O&4&&i!==(i=l[5].code+"")&&pe(f,i),O&6&&X(n,"active",l[1]===l[5].code)},d(v){v&&c(n),d=!1,b()}}}function je(s,l){let n,i,f,g;return i=new Ve({props:{content:l[5].body}}),{key:s,first:null,c(){n=o("div"),G(i.$$.fragment),f=h(),p(n,"class","tab-item"),X(n,"active",l[1]===l[5].code),this.first=n},m(d,b){r(d,n,b),I(i,n,null),a(n,f),g=!0},p(d,b){l=d;const k={};b&4&&(k.content=l[5].body),i.$set(k),(!g||b&6)&&X(n,"active",l[1]===l[5].code)},i(d){g||(V(i.$$.fragment,d),g=!0)},o(d){E(i.$$.fragment,d),g=!1},d(d){d&&c(n),K(i)}}}function Ze(s){let l,n,i=s[0].name+"",f,g,d,b,k,v,O,D,Y,A,J,be,x,P,me,Z,z=s[0].name+"",ee,fe,te,M,ae,W,le,U,ne,y,oe,ge,B,S,se,_e,ie,ke,m,ve,C,we,$e,Oe,re,Ae,ce,ye,Se,Te,de,Ce,qe,q,ue,F,he,T,H,$=[],Re=new Map,De,L,w=[],Pe=new Map,R;v=new ze({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${s[3]}');
@@ -46,7 +46,7 @@ import{S as Ee,i as Je,s as xe,V as ze,W as Ve,X as Q,h as o,z as _,j as h,c as
         // "logout"
         pb.authStore.clear();
     `}}),C=new Ve({props:{content:"?expand=relField1,relField2.subRelField"}}),q=new Ye({props:{prefix:"record."}});let N=Q(s[2]);const Me=e=>e[5].code;for(let e=0;e<N.length;e+=1){let t=He(s,N,e),u=Me(t);Re.set(u,$[e]=Le(u,t))}let j=Q(s[2]);const We=e=>e[5].code;for(let e=0;e<j.length;e+=1){let t=Fe(s,j,e),u=We(t);Pe.set(u,w[e]=je(u,t))}return{c(){l=o("h3"),n=_("Auth with OAuth2 ("),f=_(i),g=_(")"),d=h(),b=o("div"),b.innerHTML=`<p>Authenticate with an OAuth2 provider and returns a new auth token and record data.</p> <p>For more details please check the
-        <a href="https://pocketbase.io/docs/authentication/#authenticate-with-oauth2" target="_blank" rel="noopener noreferrer">OAuth2 integration documentation
+        <a href="https://pocketbase.io/docs/authentication#authenticate-with-oauth2" target="_blank" rel="noopener noreferrer">OAuth2 integration documentation
         </a>.</p>`,k=h(),G(v.$$.fragment),O=h(),D=o("h6"),D.textContent="API details",Y=h(),A=o("div"),J=o("strong"),J.textContent="POST",be=h(),x=o("div"),P=o("p"),me=_("/api/collections/"),Z=o("strong"),ee=_(z),fe=_("/auth-with-oauth2"),te=h(),M=o("div"),M.textContent="Body Parameters",ae=h(),W=o("table"),W.innerHTML=`<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>provider</span></div></td> <td><span class="label">String</span></td> <td>The name of the OAuth2 client provider (eg. &quot;google&quot;).</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>code</span></div></td> <td><span class="label">String</span></td> <td>The authorization code returned from the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>codeVerifier</span></div></td> <td><span class="label">String</span></td> <td>The code verifier sent with the initial request as part of the code_challenge.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>redirectURL</span></div></td> <td><span class="label">String</span></td> <td>The redirect url sent with the initial request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-warning">Optional</span> <span>createData</span></div></td> <td><span class="label">Object</span></td> <td><p>Optional data that will be used when creating the auth record on OAuth2 sign-up.</p> <p>The created auth record must comply with the same requirements and validations in the
                     regular <strong>create</strong> action.
                     <br/> <em>The data can only be in <code>json</code>, aka. <code>multipart/form-data</code> and files

ui/dist/assets/AuthWithOtpDocs-BfhrNjvD.js

@@ -0,0 +1,136 @@
+import{S as be,i as _e,s as ve,W as ge,X as V,h as d,j as T,z as R,c as x,k as g,n as b,o as s,m as ee,H as ce,Y as de,Z as je,E as ue,_ as Qe,G as he,t as E,a as j,v as _,d as te,J as ke,l as J,q as $e,V as ze,$ as Me,p as Ge,a0 as Be}from"./index-CGvwwHtM.js";import{F as Ke}from"./FieldsQueryParam-3ARDPOLO.js";function De(a,t,e){const l=a.slice();return l[4]=t[e],l}function Ie(a,t,e){const l=a.slice();return l[4]=t[e],l}function We(a,t){let e,l=t[4].code+"",h,i,c,n;function m(){return t[3](t[4])}return{key:a,first:null,c(){e=d("button"),h=R(l),i=T(),g(e,"class","tab-item"),J(e,"active",t[1]===t[4].code),this.first=e},m(v,C){b(v,e,C),s(e,h),s(e,i),c||(n=$e(e,"click",m),c=!0)},p(v,C){t=v,C&4&&l!==(l=t[4].code+"")&&ce(h,l),C&6&&J(e,"active",t[1]===t[4].code)},d(v){v&&_(e),c=!1,n()}}}function Fe(a,t){let e,l,h,i;return l=new ge({props:{content:t[4].body}}),{key:a,first:null,c(){e=d("div"),x(l.$$.fragment),h=T(),g(e,"class","tab-item"),J(e,"active",t[1]===t[4].code),this.first=e},m(c,n){b(c,e,n),ee(l,e,null),s(e,h),i=!0},p(c,n){t=c;const m={};n&4&&(m.content=t[4].body),l.$set(m),(!i||n&6)&&J(e,"active",t[1]===t[4].code)},i(c){i||(E(l.$$.fragment,c),i=!0)},o(c){j(l.$$.fragment,c),i=!1},d(c){c&&_(e),te(l)}}}function Xe(a){let t,e,l,h,i,c,n,m=a[0].name+"",v,C,F,D,I,M,Q,B,H,y,O,q,k,L,Y,A,G,N,o,$,P,X,u,p,S,w,K,we,Te,Pe,pe,Oe,ye,le,fe,oe,me,Z,ae,z=[],Se=new Map,qe,ne,U=[],Ce=new Map,se;P=new ge({props:{content:"?expand=relField1,relField2.subRelField"}}),le=new Ke({props:{prefix:"record."}});let re=V(a[2]);const Ae=r=>r[4].code;for(let r=0;r<re.length;r+=1){let f=Ie(a,re,r),W=Ae(f);Se.set(W,z[r]=We(W,f))}let ie=V(a[2]);const Re=r=>r[4].code;for(let r=0;r<ie.length;r+=1){let f=De(a,ie,r),W=Re(f);Ce.set(W,U[r]=Fe(W,f))}return{c(){t=d("div"),e=d("strong"),e.textContent="POST",l=T(),h=d("div"),i=d("p"),c=R("/api/collections/"),n=d("strong"),v=R(m),C=R("/auth-with-otp"),F=T(),D=d("div"),D.textContent="Body Parameters",I=T(),M=d("table"),M.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>otpId</span></div></td> <td><span class="label">String</span></td> <td>The id of the OTP request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The one-time password.</td></tr></tbody>',Q=T(),B=d("div"),B.textContent="Query parameters",H=T(),y=d("table"),O=d("thead"),O.innerHTML='<tr><th>Param</th> <th>Type</th> <th width="60%">Description</th></tr>',q=T(),k=d("tbody"),L=d("tr"),Y=d("td"),Y.textContent="expand",A=T(),G=d("td"),G.innerHTML='<span class="label">String</span>',N=T(),o=d("td"),$=R(`Auto expand record relations. Ex.:
+                `),x(P.$$.fragment),X=R(`
+                Supports up to 6-levels depth nested relations expansion. `),u=d("br"),p=R(`
+                The expanded relations will be appended to the record under the
+                `),S=d("code"),S.textContent="expand",w=R(" property (eg. "),K=d("code"),K.textContent='"expand": {"relField1": {...}, ...}',we=R(`).
+                `),Te=d("br"),Pe=R(`
+                Only the relations to which the request user has permissions to `),pe=d("strong"),pe.textContent="view",Oe=R(" will be expanded."),ye=T(),x(le.$$.fragment),fe=T(),oe=d("div"),oe.textContent="Responses",me=T(),Z=d("div"),ae=d("div");for(let r=0;r<z.length;r+=1)z[r].c();qe=T(),ne=d("div");for(let r=0;r<U.length;r+=1)U[r].c();g(e,"class","label label-primary"),g(h,"class","content"),g(t,"class","alert alert-success"),g(D,"class","section-title"),g(M,"class","table-compact table-border m-b-base"),g(B,"class","section-title"),g(y,"class","table-compact table-border m-b-base"),g(oe,"class","section-title"),g(ae,"class","tabs-header compact combined left"),g(ne,"class","tabs-content"),g(Z,"class","tabs")},m(r,f){b(r,t,f),s(t,e),s(t,l),s(t,h),s(h,i),s(i,c),s(i,n),s(n,v),s(i,C),b(r,F,f),b(r,D,f),b(r,I,f),b(r,M,f),b(r,Q,f),b(r,B,f),b(r,H,f),b(r,y,f),s(y,O),s(y,q),s(y,k),s(k,L),s(L,Y),s(L,A),s(L,G),s(L,N),s(L,o),s(o,$),ee(P,o,null),s(o,X),s(o,u),s(o,p),s(o,S),s(o,w),s(o,K),s(o,we),s(o,Te),s(o,Pe),s(o,pe),s(o,Oe),s(k,ye),ee(le,k,null),b(r,fe,f),b(r,oe,f),b(r,me,f),b(r,Z,f),s(Z,ae);for(let W=0;W<z.length;W+=1)z[W]&&z[W].m(ae,null);s(Z,qe),s(Z,ne);for(let W=0;W<U.length;W+=1)U[W]&&U[W].m(ne,null);se=!0},p(r,[f]){(!se||f&1)&&m!==(m=r[0].name+"")&&ce(v,m),f&6&&(re=V(r[2]),z=de(z,f,Ae,1,r,re,Se,ae,je,We,null,Ie)),f&6&&(ie=V(r[2]),ue(),U=de(U,f,Re,1,r,ie,Ce,ne,Qe,Fe,null,De),he())},i(r){if(!se){E(P.$$.fragment,r),E(le.$$.fragment,r);for(let f=0;f<ie.length;f+=1)E(U[f]);se=!0}},o(r){j(P.$$.fragment,r),j(le.$$.fragment,r);for(let f=0;f<U.length;f+=1)j(U[f]);se=!1},d(r){r&&(_(t),_(F),_(D),_(I),_(M),_(Q),_(B),_(H),_(y),_(fe),_(oe),_(me),_(Z)),te(P),te(le);for(let f=0;f<z.length;f+=1)z[f].d();for(let f=0;f<U.length;f+=1)U[f].d()}}}function Ze(a,t,e){let{collection:l}=t,h=200,i=[];const c=n=>e(1,h=n.code);return a.$$set=n=>{"collection"in n&&e(0,l=n.collection)},a.$$.update=()=>{a.$$.dirty&1&&e(2,i=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:ke.dummyCollectionRecord(l)},null,2)},{code:400,body:`
+                {
+                  "code": 400,
+                  "message": "Failed to authenticate.",
+                  "data": {
+                    "otpId": {
+                      "code": "validation_required",
+                      "message": "Missing required value."
+                    }
+                  }
+                }
+            `}])},[l,h,i,c]}class xe extends be{constructor(t){super(),_e(this,t,Ze,Xe,ve,{collection:0})}}function He(a,t,e){const l=a.slice();return l[4]=t[e],l}function Ue(a,t,e){const l=a.slice();return l[4]=t[e],l}function Le(a,t){let e,l=t[4].code+"",h,i,c,n;function m(){return t[3](t[4])}return{key:a,first:null,c(){e=d("button"),h=R(l),i=T(),g(e,"class","tab-item"),J(e,"active",t[1]===t[4].code),this.first=e},m(v,C){b(v,e,C),s(e,h),s(e,i),c||(n=$e(e,"click",m),c=!0)},p(v,C){t=v,C&4&&l!==(l=t[4].code+"")&&ce(h,l),C&6&&J(e,"active",t[1]===t[4].code)},d(v){v&&_(e),c=!1,n()}}}function Ye(a,t){let e,l,h,i;return l=new ge({props:{content:t[4].body}}),{key:a,first:null,c(){e=d("div"),x(l.$$.fragment),h=T(),g(e,"class","tab-item"),J(e,"active",t[1]===t[4].code),this.first=e},m(c,n){b(c,e,n),ee(l,e,null),s(e,h),i=!0},p(c,n){t=c;const m={};n&4&&(m.content=t[4].body),l.$set(m),(!i||n&6)&&J(e,"active",t[1]===t[4].code)},i(c){i||(E(l.$$.fragment,c),i=!0)},o(c){j(l.$$.fragment,c),i=!1},d(c){c&&_(e),te(l)}}}function et(a){let t,e,l,h,i,c,n,m=a[0].name+"",v,C,F,D,I,M,Q,B,H,y,O,q=[],k=new Map,L,Y,A=[],G=new Map,N,o=V(a[2]);const $=u=>u[4].code;for(let u=0;u<o.length;u+=1){let p=Ue(a,o,u),S=$(p);k.set(S,q[u]=Le(S,p))}let P=V(a[2]);const X=u=>u[4].code;for(let u=0;u<P.length;u+=1){let p=He(a,P,u),S=X(p);G.set(S,A[u]=Ye(S,p))}return{c(){t=d("div"),e=d("strong"),e.textContent="POST",l=T(),h=d("div"),i=d("p"),c=R("/api/collections/"),n=d("strong"),v=R(m),C=R("/request-otp"),F=T(),D=d("div"),D.textContent="Body Parameters",I=T(),M=d("table"),M.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>email</span></div></td> <td><span class="label">String</span></td> <td>The auth record email address to send the OTP request (if exists).</td></tr></tbody>',Q=T(),B=d("div"),B.textContent="Responses",H=T(),y=d("div"),O=d("div");for(let u=0;u<q.length;u+=1)q[u].c();L=T(),Y=d("div");for(let u=0;u<A.length;u+=1)A[u].c();g(e,"class","label label-primary"),g(h,"class","content"),g(t,"class","alert alert-success"),g(D,"class","section-title"),g(M,"class","table-compact table-border m-b-base"),g(B,"class","section-title"),g(O,"class","tabs-header compact combined left"),g(Y,"class","tabs-content"),g(y,"class","tabs")},m(u,p){b(u,t,p),s(t,e),s(t,l),s(t,h),s(h,i),s(i,c),s(i,n),s(n,v),s(i,C),b(u,F,p),b(u,D,p),b(u,I,p),b(u,M,p),b(u,Q,p),b(u,B,p),b(u,H,p),b(u,y,p),s(y,O);for(let S=0;S<q.length;S+=1)q[S]&&q[S].m(O,null);s(y,L),s(y,Y);for(let S=0;S<A.length;S+=1)A[S]&&A[S].m(Y,null);N=!0},p(u,[p]){(!N||p&1)&&m!==(m=u[0].name+"")&&ce(v,m),p&6&&(o=V(u[2]),q=de(q,p,$,1,u,o,k,O,je,Le,null,Ue)),p&6&&(P=V(u[2]),ue(),A=de(A,p,X,1,u,P,G,Y,Qe,Ye,null,He),he())},i(u){if(!N){for(let p=0;p<P.length;p+=1)E(A[p]);N=!0}},o(u){for(let p=0;p<A.length;p+=1)j(A[p]);N=!1},d(u){u&&(_(t),_(F),_(D),_(I),_(M),_(Q),_(B),_(H),_(y));for(let p=0;p<q.length;p+=1)q[p].d();for(let p=0;p<A.length;p+=1)A[p].d()}}}function tt(a,t,e){let{collection:l}=t,h=200,i=[];const c=n=>e(1,h=n.code);return a.$$set=n=>{"collection"in n&&e(0,l=n.collection)},e(2,i=[{code:200,body:JSON.stringify({otpId:ke.randomString(15)},null,2)},{code:400,body:`
+                {
+                  "code": 400,
+                  "message": "An error occurred while validating the submitted data.",
+                  "data": {
+                    "email": {
+                      "code": "validation_is_email",
+                      "message": "Must be a valid email address."
+                    }
+                  }
+                }
+            `},{code:429,body:`
+                {
+                  "code": 429,
+                  "message": "You've send too many OTP requests, please try again later.",
+                  "data": {}
+                }
+            `}]),[l,h,i,c]}class lt extends be{constructor(t){super(),_e(this,t,tt,et,ve,{collection:0})}}function Ve(a,t,e){const l=a.slice();return l[5]=t[e],l[7]=e,l}function Ee(a,t,e){const l=a.slice();return l[5]=t[e],l[7]=e,l}function Je(a){let t,e,l,h,i;function c(){return a[4](a[7])}return{c(){t=d("button"),e=d("div"),e.textContent=`${a[5].title}`,l=T(),g(e,"class","txt"),g(t,"class","tab-item"),J(t,"active",a[1]==a[7])},m(n,m){b(n,t,m),s(t,e),s(t,l),h||(i=$e(t,"click",c),h=!0)},p(n,m){a=n,m&2&&J(t,"active",a[1]==a[7])},d(n){n&&_(t),h=!1,i()}}}function Ne(a){let t,e,l,h;var i=a[5].component;function c(n,m){return{props:{collection:n[0]}}}return i&&(e=Be(i,c(a))),{c(){t=d("div"),e&&x(e.$$.fragment),l=T(),g(t,"class","tab-item"),J(t,"active",a[1]==a[7])},m(n,m){b(n,t,m),e&&ee(e,t,null),s(t,l),h=!0},p(n,m){if(i!==(i=n[5].component)){if(e){ue();const v=e;j(v.$$.fragment,1,0,()=>{te(v,1)}),he()}i?(e=Be(i,c(n)),x(e.$$.fragment),E(e.$$.fragment,1),ee(e,t,l)):e=null}else if(i){const v={};m&1&&(v.collection=n[0]),e.$set(v)}(!h||m&2)&&J(t,"active",n[1]==n[7])},i(n){h||(e&&E(e.$$.fragment,n),h=!0)},o(n){e&&j(e.$$.fragment,n),h=!1},d(n){n&&_(t),e&&te(e)}}}function ot(a){var Y,A,G,N;let t,e,l=a[0].name+"",h,i,c,n,m,v,C,F,D,I,M,Q,B,H;v=new ze({props:{js:`
+        import PocketBase from 'pocketbase';
+
+        const pb = new PocketBase('${a[2]}');
+
+        ...
+
+        // send OTP email to the provided auth record
+        const req = await pb.collection('${(Y=a[0])==null?void 0:Y.name}').requestOTP('test@example.com');
+
+        // ... show a screen/popup to enter the password from the email ...
+
+        // authenticate with the requested OTP id and the email password
+        const authData = await pb.collection('${(A=a[0])==null?void 0:A.name}').authWithOTP(
+            req.otpId,
+            "YOUR_OTP",
+        );
+
+        // after the above you can also access the auth data from the authStore
+        console.log(pb.authStore.isValid);
+        console.log(pb.authStore.token);
+        console.log(pb.authStore.record.id);
+
+        // "logout"
+        pb.authStore.clear();
+    `,dart:`
+        import 'package:pocketbase/pocketbase.dart';
+
+        final pb = PocketBase('${a[2]}');
+
+        ...
+
+        // send OTP email to the provided auth record
+        final req = await pb.collection('${(G=a[0])==null?void 0:G.name}').requestOTP('test@example.com');
+
+        // ... show a screen/popup to enter the password from the email ...
+
+        // authenticate with the requested OTP id and the email password
+        final authData = await pb.collection('${(N=a[0])==null?void 0:N.name}').authWithOTP(
+            req.otpId,
+            "YOUR_OTP",
+        );
+
+        // after the above you can also access the auth data from the authStore
+        print(pb.authStore.isValid);
+        print(pb.authStore.token);
+        print(pb.authStore.record.id);
+
+        // "logout"
+        pb.authStore.clear();
+    `}});let y=V(a[3]),O=[];for(let o=0;o<y.length;o+=1)O[o]=Je(Ee(a,y,o));let q=V(a[3]),k=[];for(let o=0;o<q.length;o+=1)k[o]=Ne(Ve(a,q,o));const L=o=>j(k[o],1,1,()=>{k[o]=null});return{c(){t=d("h3"),e=R("Auth with OTP ("),h=R(l),i=R(")"),c=T(),n=d("div"),n.innerHTML=`<p>Authenticate with an one-time password (OTP).</p> <p>Note that when requesting an OTP we return an <code>otpId</code> even if a user with the provided email
+        doesn&#39;t exist as a very basic enumeration protection.</p>`,m=T(),x(v.$$.fragment),C=T(),F=d("h6"),F.textContent="API details",D=T(),I=d("div"),M=d("div");for(let o=0;o<O.length;o+=1)O[o].c();Q=T(),B=d("div");for(let o=0;o<k.length;o+=1)k[o].c();g(t,"class","m-b-sm"),g(n,"class","content txt-lg m-b-sm"),g(F,"class","m-b-xs"),g(M,"class","tabs-header compact"),g(B,"class","tabs-content"),g(I,"class","tabs")},m(o,$){b(o,t,$),s(t,e),s(t,h),s(t,i),b(o,c,$),b(o,n,$),b(o,m,$),ee(v,o,$),b(o,C,$),b(o,F,$),b(o,D,$),b(o,I,$),s(I,M);for(let P=0;P<O.length;P+=1)O[P]&&O[P].m(M,null);s(I,Q),s(I,B);for(let P=0;P<k.length;P+=1)k[P]&&k[P].m(B,null);H=!0},p(o,[$]){var X,u,p,S;(!H||$&1)&&l!==(l=o[0].name+"")&&ce(h,l);const P={};if($&5&&(P.js=`
+        import PocketBase from 'pocketbase';
+
+        const pb = new PocketBase('${o[2]}');
+
+        ...
+
+        // send OTP email to the provided auth record
+        const req = await pb.collection('${(X=o[0])==null?void 0:X.name}').requestOTP('test@example.com');
+
+        // ... show a screen/popup to enter the password from the email ...
+
+        // authenticate with the requested OTP id and the email password
+        const authData = await pb.collection('${(u=o[0])==null?void 0:u.name}').authWithOTP(
+            req.otpId,
+            "YOUR_OTP",
+        );
+
+        // after the above you can also access the auth data from the authStore
+        console.log(pb.authStore.isValid);
+        console.log(pb.authStore.token);
+        console.log(pb.authStore.record.id);
+
+        // "logout"
+        pb.authStore.clear();
+    `),$&5&&(P.dart=`
+        import 'package:pocketbase/pocketbase.dart';
+
+        final pb = PocketBase('${o[2]}');
+
+        ...
+
+        // send OTP email to the provided auth record
+        final req = await pb.collection('${(p=o[0])==null?void 0:p.name}').requestOTP('test@example.com');
+
+        // ... show a screen/popup to enter the password from the email ...
+
+        // authenticate with the requested OTP id and the email password
+        final authData = await pb.collection('${(S=o[0])==null?void 0:S.name}').authWithOTP(
+            req.otpId,
+            "YOUR_OTP",
+        );
+
+        // after the above you can also access the auth data from the authStore
+        print(pb.authStore.isValid);
+        print(pb.authStore.token);
+        print(pb.authStore.record.id);
+
+        // "logout"
+        pb.authStore.clear();
+    `),v.$set(P),$&10){y=V(o[3]);let w;for(w=0;w<y.length;w+=1){const K=Ee(o,y,w);O[w]?O[w].p(K,$):(O[w]=Je(K),O[w].c(),O[w].m(M,null))}for(;w<O.length;w+=1)O[w].d(1);O.length=y.length}if($&11){q=V(o[3]);let w;for(w=0;w<q.length;w+=1){const K=Ve(o,q,w);k[w]?(k[w].p(K,$),E(k[w],1)):(k[w]=Ne(K),k[w].c(),E(k[w],1),k[w].m(B,null))}for(ue(),w=q.length;w<k.length;w+=1)L(w);he()}},i(o){if(!H){E(v.$$.fragment,o);for(let $=0;$<q.length;$+=1)E(k[$]);H=!0}},o(o){j(v.$$.fragment,o),k=k.filter(Boolean);for(let $=0;$<k.length;$+=1)j(k[$]);H=!1},d(o){o&&(_(t),_(c),_(n),_(m),_(C),_(F),_(D),_(I)),te(v,o),Me(O,o),Me(k,o)}}}function at(a,t,e){let l,{collection:h}=t;const i=[{title:"OTP Request",component:lt},{title:"OTP Auth",component:xe}];let c=0;const n=m=>e(1,c=m);return a.$$set=m=>{"collection"in m&&e(0,h=m.collection)},e(2,l=ke.getApiExampleUrl(Ge.baseURL)),[h,c,l,i,n]}class it extends be{constructor(t){super(),_e(this,t,at,ot,ve,{collection:0})}}export{it as default};

ui/dist/assets/AuthWithOtpDocs-Cemab_eW.js

@@ -1,130 +0,0 @@
-import{S as ee,i as te,s as le,X as U,h as p,j as S,z as H,k as g,n as b,o as h,H as X,Y as Z,Z as ge,E as Q,_ as ke,G as x,t as J,a as L,v as _,J as oe,l as Y,q as ae,W as we,c as F,m as G,d as K,V as $e,$ as se,p as Te,a0 as ne}from"./index-BiaJFyLM.js";function ie(s,t,e){const a=s.slice();return a[4]=t[e],a}function ce(s,t,e){const a=s.slice();return a[4]=t[e],a}function re(s,t){let e,a=t[4].code+"",d,c,r,n;function u(){return t[3](t[4])}return{key:s,first:null,c(){e=p("button"),d=H(a),c=S(),g(e,"class","tab-item"),Y(e,"active",t[1]===t[4].code),this.first=e},m(m,y){b(m,e,y),h(e,d),h(e,c),r||(n=ae(e,"click",u),r=!0)},p(m,y){t=m,y&4&&a!==(a=t[4].code+"")&&X(d,a),y&6&&Y(e,"active",t[1]===t[4].code)},d(m){m&&_(e),r=!1,n()}}}function de(s,t){let e,a,d,c;return a=new we({props:{content:t[4].body}}),{key:s,first:null,c(){e=p("div"),F(a.$$.fragment),d=S(),g(e,"class","tab-item"),Y(e,"active",t[1]===t[4].code),this.first=e},m(r,n){b(r,e,n),G(a,e,null),h(e,d),c=!0},p(r,n){t=r;const u={};n&4&&(u.content=t[4].body),a.$set(u),(!c||n&6)&&Y(e,"active",t[1]===t[4].code)},i(r){c||(J(a.$$.fragment,r),c=!0)},o(r){L(a.$$.fragment,r),c=!1},d(r){r&&_(e),K(a)}}}function Pe(s){let t,e,a,d,c,r,n,u=s[0].name+"",m,y,M,C,B,A,V,R,W,q,P,w=[],$=new Map,E,D,k=[],N=new Map,I,i=U(s[2]);const v=l=>l[4].code;for(let l=0;l<i.length;l+=1){let o=ce(s,i,l),f=v(o);$.set(f,w[l]=re(f,o))}let O=U(s[2]);const j=l=>l[4].code;for(let l=0;l<O.length;l+=1){let o=ie(s,O,l),f=j(o);N.set(f,k[l]=de(f,o))}return{c(){t=p("div"),e=p("strong"),e.textContent="POST",a=S(),d=p("div"),c=p("p"),r=H("/api/collections/"),n=p("strong"),m=H(u),y=H("/auth-with-otp"),M=S(),C=p("div"),C.textContent="Body Parameters",B=S(),A=p("table"),A.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>otpId</span></div></td> <td><span class="label">String</span></td> <td>The id of the OTP request.</td></tr> <tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>password</span></div></td> <td><span class="label">String</span></td> <td>The one-time password.</td></tr></tbody>',V=S(),R=p("div"),R.textContent="Responses",W=S(),q=p("div"),P=p("div");for(let l=0;l<w.length;l+=1)w[l].c();E=S(),D=p("div");for(let l=0;l<k.length;l+=1)k[l].c();g(e,"class","label label-primary"),g(d,"class","content"),g(t,"class","alert alert-success"),g(C,"class","section-title"),g(A,"class","table-compact table-border m-b-base"),g(R,"class","section-title"),g(P,"class","tabs-header compact combined left"),g(D,"class","tabs-content"),g(q,"class","tabs")},m(l,o){b(l,t,o),h(t,e),h(t,a),h(t,d),h(d,c),h(c,r),h(c,n),h(n,m),h(c,y),b(l,M,o),b(l,C,o),b(l,B,o),b(l,A,o),b(l,V,o),b(l,R,o),b(l,W,o),b(l,q,o),h(q,P);for(let f=0;f<w.length;f+=1)w[f]&&w[f].m(P,null);h(q,E),h(q,D);for(let f=0;f<k.length;f+=1)k[f]&&k[f].m(D,null);I=!0},p(l,[o]){(!I||o&1)&&u!==(u=l[0].name+"")&&X(m,u),o&6&&(i=U(l[2]),w=Z(w,o,v,1,l,i,$,P,ge,re,null,ce)),o&6&&(O=U(l[2]),Q(),k=Z(k,o,j,1,l,O,N,D,ke,de,null,ie),x())},i(l){if(!I){for(let o=0;o<O.length;o+=1)J(k[o]);I=!0}},o(l){for(let o=0;o<k.length;o+=1)L(k[o]);I=!1},d(l){l&&(_(t),_(M),_(C),_(B),_(A),_(V),_(R),_(W),_(q));for(let o=0;o<w.length;o+=1)w[o].d();for(let o=0;o<k.length;o+=1)k[o].d()}}}function Oe(s,t,e){let{collection:a}=t,d=200,c=[];const r=n=>e(1,d=n.code);return s.$$set=n=>{"collection"in n&&e(0,a=n.collection)},s.$$.update=()=>{s.$$.dirty&1&&e(2,c=[{code:200,body:JSON.stringify({token:"JWT_TOKEN",record:oe.dummyCollectionRecord(a)},null,2)},{code:400,body:`
-                {
-                  "code": 400,
-                  "message": "Failed to authenticate.",
-                  "data": {
-                    "otpId": {
-                      "code": "validation_required",
-                      "message": "Missing required value."
-                    }
-                  }
-                }
-            `}])},[a,d,c,r]}class Se extends ee{constructor(t){super(),te(this,t,Oe,Pe,le,{collection:0})}}function ue(s,t,e){const a=s.slice();return a[4]=t[e],a}function he(s,t,e){const a=s.slice();return a[4]=t[e],a}function pe(s,t){let e,a=t[4].code+"",d,c,r,n;function u(){return t[3](t[4])}return{key:s,first:null,c(){e=p("button"),d=H(a),c=S(),g(e,"class","tab-item"),Y(e,"active",t[1]===t[4].code),this.first=e},m(m,y){b(m,e,y),h(e,d),h(e,c),r||(n=ae(e,"click",u),r=!0)},p(m,y){t=m,y&4&&a!==(a=t[4].code+"")&&X(d,a),y&6&&Y(e,"active",t[1]===t[4].code)},d(m){m&&_(e),r=!1,n()}}}function fe(s,t){let e,a,d,c;return a=new we({props:{content:t[4].body}}),{key:s,first:null,c(){e=p("div"),F(a.$$.fragment),d=S(),g(e,"class","tab-item"),Y(e,"active",t[1]===t[4].code),this.first=e},m(r,n){b(r,e,n),G(a,e,null),h(e,d),c=!0},p(r,n){t=r;const u={};n&4&&(u.content=t[4].body),a.$set(u),(!c||n&6)&&Y(e,"active",t[1]===t[4].code)},i(r){c||(J(a.$$.fragment,r),c=!0)},o(r){L(a.$$.fragment,r),c=!1},d(r){r&&_(e),K(a)}}}function qe(s){let t,e,a,d,c,r,n,u=s[0].name+"",m,y,M,C,B,A,V,R,W,q,P,w=[],$=new Map,E,D,k=[],N=new Map,I,i=U(s[2]);const v=l=>l[4].code;for(let l=0;l<i.length;l+=1){let o=he(s,i,l),f=v(o);$.set(f,w[l]=pe(f,o))}let O=U(s[2]);const j=l=>l[4].code;for(let l=0;l<O.length;l+=1){let o=ue(s,O,l),f=j(o);N.set(f,k[l]=fe(f,o))}return{c(){t=p("div"),e=p("strong"),e.textContent="POST",a=S(),d=p("div"),c=p("p"),r=H("/api/collections/"),n=p("strong"),m=H(u),y=H("/request-otp"),M=S(),C=p("div"),C.textContent="Body Parameters",B=S(),A=p("table"),A.innerHTML='<thead><tr><th>Param</th> <th>Type</th> <th width="50%">Description</th></tr></thead> <tbody><tr><td><div class="inline-flex"><span class="label label-success">Required</span> <span>email</span></div></td> <td><span class="label">String</span></td> <td>The auth record email address to send the OTP request (if exists).</td></tr></tbody>',V=S(),R=p("div"),R.textContent="Responses",W=S(),q=p("div"),P=p("div");for(let l=0;l<w.length;l+=1)w[l].c();E=S(),D=p("div");for(let l=0;l<k.length;l+=1)k[l].c();g(e,"class","label label-primary"),g(d,"class","content"),g(t,"class","alert alert-success"),g(C,"class","section-title"),g(A,"class","table-compact table-border m-b-base"),g(R,"class","section-title"),g(P,"class","tabs-header compact combined left"),g(D,"class","tabs-content"),g(q,"class","tabs")},m(l,o){b(l,t,o),h(t,e),h(t,a),h(t,d),h(d,c),h(c,r),h(c,n),h(n,m),h(c,y),b(l,M,o),b(l,C,o),b(l,B,o),b(l,A,o),b(l,V,o),b(l,R,o),b(l,W,o),b(l,q,o),h(q,P);for(let f=0;f<w.length;f+=1)w[f]&&w[f].m(P,null);h(q,E),h(q,D);for(let f=0;f<k.length;f+=1)k[f]&&k[f].m(D,null);I=!0},p(l,[o]){(!I||o&1)&&u!==(u=l[0].name+"")&&X(m,u),o&6&&(i=U(l[2]),w=Z(w,o,v,1,l,i,$,P,ge,pe,null,he)),o&6&&(O=U(l[2]),Q(),k=Z(k,o,j,1,l,O,N,D,ke,fe,null,ue),x())},i(l){if(!I){for(let o=0;o<O.length;o+=1)J(k[o]);I=!0}},o(l){for(let o=0;o<k.length;o+=1)L(k[o]);I=!1},d(l){l&&(_(t),_(M),_(C),_(B),_(A),_(V),_(R),_(W),_(q));for(let o=0;o<w.length;o+=1)w[o].d();for(let o=0;o<k.length;o+=1)k[o].d()}}}function ye(s,t,e){let{collection:a}=t,d=200,c=[];const r=n=>e(1,d=n.code);return s.$$set=n=>{"collection"in n&&e(0,a=n.collection)},e(2,c=[{code:200,body:JSON.stringify({otpId:oe.randomString(15)},null,2)},{code:400,body:`
-                {
-                  "code": 400,
-                  "message": "An error occurred while validating the submitted data.",
-                  "data": {
-                    "email": {
-                      "code": "validation_is_email",
-                      "message": "Must be a valid email address."
-                    }
-                  }
-                }
-            `},{code:429,body:`
-                {
-                  "code": 429,
-                  "message": "You've send too many OTP requests, please try again later.",
-                  "data": {}
-                }
-            `}]),[a,d,c,r]}class Ae extends ee{constructor(t){super(),te(this,t,ye,qe,le,{collection:0})}}function me(s,t,e){const a=s.slice();return a[5]=t[e],a[7]=e,a}function be(s,t,e){const a=s.slice();return a[5]=t[e],a[7]=e,a}function _e(s){let t,e,a,d,c;function r(){return s[4](s[7])}return{c(){t=p("button"),e=p("div"),e.textContent=`${s[5].title}`,a=S(),g(e,"class","txt"),g(t,"class","tab-item"),Y(t,"active",s[1]==s[7])},m(n,u){b(n,t,u),h(t,e),h(t,a),d||(c=ae(t,"click",r),d=!0)},p(n,u){s=n,u&2&&Y(t,"active",s[1]==s[7])},d(n){n&&_(t),d=!1,c()}}}function ve(s){let t,e,a,d;var c=s[5].component;function r(n,u){return{props:{collection:n[0]}}}return c&&(e=ne(c,r(s))),{c(){t=p("div"),e&&F(e.$$.fragment),a=S(),g(t,"class","tab-item"),Y(t,"active",s[1]==s[7])},m(n,u){b(n,t,u),e&&G(e,t,null),h(t,a),d=!0},p(n,u){if(c!==(c=n[5].component)){if(e){Q();const m=e;L(m.$$.fragment,1,0,()=>{K(m,1)}),x()}c?(e=ne(c,r(n)),F(e.$$.fragment),J(e.$$.fragment,1),G(e,t,a)):e=null}else if(c){const m={};u&1&&(m.collection=n[0]),e.$set(m)}(!d||u&2)&&Y(t,"active",n[1]==n[7])},i(n){d||(e&&J(e.$$.fragment,n),d=!0)},o(n){e&&L(e.$$.fragment,n),d=!1},d(n){n&&_(t),e&&K(e)}}}function Re(s){var D,k,N,I;let t,e,a=s[0].name+"",d,c,r,n,u,m,y,M,C,B,A,V,R,W;m=new $e({props:{js:`
-        import PocketBase from 'pocketbase';
-
-        const pb = new PocketBase('${s[2]}');
-
-        ...
-
-        // send OTP email to the provided auth record
-        const req = await pb.collection('${(D=s[0])==null?void 0:D.name}').requestOTP('test@example.com');
-
-        // ... show a screen/popup to enter the password from the email ...
-
-        // authenticate with the requested OTP id and the email password
-        const authData = await pb.collection('${(k=s[0])==null?void 0:k.name}').authWithOTP(
-            req.otpId,
-            "YOUR_OTP",
-        );
-
-        // after the above you can also access the auth data from the authStore
-        console.log(pb.authStore.isValid);
-        console.log(pb.authStore.token);
-        console.log(pb.authStore.record.id);
-
-        // "logout"
-        pb.authStore.clear();
-    `,dart:`
-        import 'package:pocketbase/pocketbase.dart';
-
-        final pb = PocketBase('${s[2]}');
-
-        ...
-
-        // send OTP email to the provided auth record
-        final req = await pb.collection('${(N=s[0])==null?void 0:N.name}').requestOTP('test@example.com');
-
-        // ... show a screen/popup to enter the password from the email ...
-
-        // authenticate with the requested OTP id and the email password
-        final authData = await pb.collection('${(I=s[0])==null?void 0:I.name}').authWithOTP(
-            req.otpId,
-            "YOUR_OTP",
-        );
-
-        // after the above you can also access the auth data from the authStore
-        print(pb.authStore.isValid);
-        print(pb.authStore.token);
-        print(pb.authStore.record.id);
-
-        // "logout"
-        pb.authStore.clear();
-    `}});let q=U(s[3]),P=[];for(let i=0;i<q.length;i+=1)P[i]=_e(be(s,q,i));let w=U(s[3]),$=[];for(let i=0;i<w.length;i+=1)$[i]=ve(me(s,w,i));const E=i=>L($[i],1,1,()=>{$[i]=null});return{c(){t=p("h3"),e=H("Auth with OTP ("),d=H(a),c=H(")"),r=S(),n=p("div"),n.innerHTML=`<p>Authenticate with an one-time password (OTP).</p> <p>Note that when requesting an OTP we return an <code>otpId</code> even if a user with the provided email
-        doesn&#39;t exist as a very basic enumeration protection.</p>`,u=S(),F(m.$$.fragment),y=S(),M=p("h6"),M.textContent="API details",C=S(),B=p("div"),A=p("div");for(let i=0;i<P.length;i+=1)P[i].c();V=S(),R=p("div");for(let i=0;i<$.length;i+=1)$[i].c();g(t,"class","m-b-sm"),g(n,"class","content txt-lg m-b-sm"),g(M,"class","m-b-xs"),g(A,"class","tabs-header compact"),g(R,"class","tabs-content"),g(B,"class","tabs")},m(i,v){b(i,t,v),h(t,e),h(t,d),h(t,c),b(i,r,v),b(i,n,v),b(i,u,v),G(m,i,v),b(i,y,v),b(i,M,v),b(i,C,v),b(i,B,v),h(B,A);for(let O=0;O<P.length;O+=1)P[O]&&P[O].m(A,null);h(B,V),h(B,R);for(let O=0;O<$.length;O+=1)$[O]&&$[O].m(R,null);W=!0},p(i,[v]){var j,l,o,f;(!W||v&1)&&a!==(a=i[0].name+"")&&X(d,a);const O={};if(v&5&&(O.js=`
-        import PocketBase from 'pocketbase';
-
-        const pb = new PocketBase('${i[2]}');
-
-        ...
-
-        // send OTP email to the provided auth record
-        const req = await pb.collection('${(j=i[0])==null?void 0:j.name}').requestOTP('test@example.com');
-
-        // ... show a screen/popup to enter the password from the email ...
-
-        // authenticate with the requested OTP id and the email password
-        const authData = await pb.collection('${(l=i[0])==null?void 0:l.name}').authWithOTP(
-            req.otpId,
-            "YOUR_OTP",
-        );
-
-        // after the above you can also access the auth data from the authStore
-        console.log(pb.authStore.isValid);
-        console.log(pb.authStore.token);
-        console.log(pb.authStore.record.id);
-
-        // "logout"
-        pb.authStore.clear();
-    `),v&5&&(O.dart=`
-        import 'package:pocketbase/pocketbase.dart';
-
-        final pb = PocketBase('${i[2]}');
-
-        ...
-
-        // send OTP email to the provided auth record
-        final req = await pb.collection('${(o=i[0])==null?void 0:o.name}').requestOTP('test@example.com');
-
-        // ... show a screen/popup to enter the password from the email ...
-
-        // authenticate with the requested OTP id and the email password
-        final authData = await pb.collection('${(f=i[0])==null?void 0:f.name}').authWithOTP(
-            req.otpId,
-            "YOUR_OTP",
-        );
-
-        // after the above you can also access the auth data from the authStore
-        print(pb.authStore.isValid);
-        print(pb.authStore.token);
-        print(pb.authStore.record.id);
-
-        // "logout"
-        pb.authStore.clear();
-    `),m.$set(O),v&10){q=U(i[3]);let T;for(T=0;T<q.length;T+=1){const z=be(i,q,T);P[T]?P[T].p(z,v):(P[T]=_e(z),P[T].c(),P[T].m(A,null))}for(;T<P.length;T+=1)P[T].d(1);P.length=q.length}if(v&11){w=U(i[3]);let T;for(T=0;T<w.length;T+=1){const z=me(i,w,T);$[T]?($[T].p(z,v),J($[T],1)):($[T]=ve(z),$[T].c(),J($[T],1),$[T].m(R,null))}for(Q(),T=w.length;T<$.length;T+=1)E(T);x()}},i(i){if(!W){J(m.$$.fragment,i);for(let v=0;v<w.length;v+=1)J($[v]);W=!0}},o(i){L(m.$$.fragment,i),$=$.filter(Boolean);for(let v=0;v<$.length;v+=1)L($[v]);W=!1},d(i){i&&(_(t),_(r),_(n),_(u),_(y),_(M),_(C),_(B)),K(m,i),se(P,i),se($,i)}}}function Ce(s,t,e){let a,{collection:d}=t;const c=[{title:"OTP Request",component:Ae},{title:"OTP Auth",component:Se}];let r=0;const n=u=>e(1,r=u);return s.$$set=u=>{"collection"in u&&e(0,d=u.collection)},e(2,a=oe.getApiExampleUrl(Te.baseURL)),[d,r,a,c,n]}class De extends ee{constructor(t){super(),te(this,t,Ce,Re,le,{collection:0})}}export{De as default};

ui/dist/assets/AuthWithPasswordDocs-DkFa7ddV.js

@@ -1,4 +1,4 @@
-import{S as kt,i as gt,s as vt,V as St,X as B,W as _t,h as s,z as f,j as u,c as ae,k,n as c,o as t,m as oe,H as X,Y as ct,Z as wt,E as yt,_ as $t,G as Pt,t as G,a as K,v as d,d as se,$ as Rt,J as dt,p as Ct,l as ne,q as Ot}from"./index-BiaJFyLM.js";import{F as Tt}from"./FieldsQueryParam-BfNg6ueM.js";function pt(i,o,a){const n=i.slice();return n[7]=o[a],n}function ut(i,o,a){const n=i.slice();return n[7]=o[a],n}function ht(i,o,a){const n=i.slice();return n[12]=o[a],n[14]=a,n}function At(i){let o;return{c(){o=f("or")},m(a,n){c(a,o,n)},d(a){a&&d(o)}}}function bt(i){let o,a,n=i[12]+"",m,b=i[14]>0&&At();return{c(){b&&b.c(),o=u(),a=s("strong"),m=f(n)},m(r,h){b&&b.m(r,h),c(r,o,h),c(r,a,h),t(a,m)},p(r,h){h&2&&n!==(n=r[12]+"")&&X(m,n)},d(r){r&&(d(o),d(a)),b&&b.d(r)}}}function ft(i,o){let a,n=o[7].code+"",m,b,r,h;function g(){return o[6](o[7])}return{key:i,first:null,c(){a=s("button"),m=f(n),b=u(),k(a,"class","tab-item"),ne(a,"active",o[2]===o[7].code),this.first=a},m($,_){c($,a,_),t(a,m),t(a,b),r||(h=Ot(a,"click",g),r=!0)},p($,_){o=$,_&8&&n!==(n=o[7].code+"")&&X(m,n),_&12&&ne(a,"active",o[2]===o[7].code)},d($){$&&d(a),r=!1,h()}}}function mt(i,o){let a,n,m,b;return n=new _t({props:{content:o[7].body}}),{key:i,first:null,c(){a=s("div"),ae(n.$$.fragment),m=u(),k(a,"class","tab-item"),ne(a,"active",o[2]===o[7].code),this.first=a},m(r,h){c(r,a,h),oe(n,a,null),t(a,m),b=!0},p(r,h){o=r;const g={};h&8&&(g.content=o[7].body),n.$set(g),(!b||h&12)&&ne(a,"active",o[2]===o[7].code)},i(r){b||(G(n.$$.fragment,r),b=!0)},o(r){K(n.$$.fragment,r),b=!1},d(r){r&&d(a),se(n)}}}function Dt(i){var ot,st;let o,a,n=i[0].name+"",m,b,r,h,g,$,_,Z=i[1].join("/")+"",ie,De,re,We,ce,R,de,H,pe,C,x,Fe,ee,L,Me,ue,te=i[0].name+"",he,Ue,be,j,fe,O,me,qe,Y,T,_e,Be,ke,He,E,ge,Le,ve,Se,V,we,A,ye,je,N,D,$e,Ye,Pe,Ee,v,Ve,M,Ne,Je,Ie,Re,Qe,Ce,ze,Ge,Ke,Oe,Xe,Ze,U,Te,J,Ae,W,I,P=[],xe=new Map,et,Q,w=[],tt=new Map,F;R=new St({props:{js:`
+import{S as kt,i as gt,s as vt,V as St,X as B,W as _t,h as s,z as f,j as u,c as ae,k,n as c,o as t,m as oe,H as X,Y as ct,Z as wt,E as yt,_ as $t,G as Pt,t as G,a as K,v as d,d as se,$ as Rt,J as dt,p as Ct,l as ne,q as Ot}from"./index-CGvwwHtM.js";import{F as Tt}from"./FieldsQueryParam-3ARDPOLO.js";function pt(i,o,a){const n=i.slice();return n[7]=o[a],n}function ut(i,o,a){const n=i.slice();return n[7]=o[a],n}function ht(i,o,a){const n=i.slice();return n[12]=o[a],n[14]=a,n}function At(i){let o;return{c(){o=f("or")},m(a,n){c(a,o,n)},d(a){a&&d(o)}}}function bt(i){let o,a,n=i[12]+"",m,b=i[14]>0&&At();return{c(){b&&b.c(),o=u(),a=s("strong"),m=f(n)},m(r,h){b&&b.m(r,h),c(r,o,h),c(r,a,h),t(a,m)},p(r,h){h&2&&n!==(n=r[12]+"")&&X(m,n)},d(r){r&&(d(o),d(a)),b&&b.d(r)}}}function ft(i,o){let a,n=o[7].code+"",m,b,r,h;function g(){return o[6](o[7])}return{key:i,first:null,c(){a=s("button"),m=f(n),b=u(),k(a,"class","tab-item"),ne(a,"active",o[2]===o[7].code),this.first=a},m($,_){c($,a,_),t(a,m),t(a,b),r||(h=Ot(a,"click",g),r=!0)},p($,_){o=$,_&8&&n!==(n=o[7].code+"")&&X(m,n),_&12&&ne(a,"active",o[2]===o[7].code)},d($){$&&d(a),r=!1,h()}}}function mt(i,o){let a,n,m,b;return n=new _t({props:{content:o[7].body}}),{key:i,first:null,c(){a=s("div"),ae(n.$$.fragment),m=u(),k(a,"class","tab-item"),ne(a,"active",o[2]===o[7].code),this.first=a},m(r,h){c(r,a,h),oe(n,a,null),t(a,m),b=!0},p(r,h){o=r;const g={};h&8&&(g.content=o[7].body),n.$set(g),(!b||h&12)&&ne(a,"active",o[2]===o[7].code)},i(r){b||(G(n.$$.fragment,r),b=!0)},o(r){K(n.$$.fragment,r),b=!1},d(r){r&&d(a),se(n)}}}function Dt(i){var ot,st;let o,a,n=i[0].name+"",m,b,r,h,g,$,_,Z=i[1].join("/")+"",ie,De,re,We,ce,R,de,H,pe,C,x,Fe,ee,L,Me,ue,te=i[0].name+"",he,Ue,be,j,fe,O,me,qe,Y,T,_e,Be,ke,He,E,ge,Le,ve,Se,V,we,A,ye,je,N,D,$e,Ye,Pe,Ee,v,Ve,M,Ne,Je,Ie,Re,Qe,Ce,ze,Ge,Ke,Oe,Xe,Ze,U,Te,J,Ae,W,I,P=[],xe=new Map,et,Q,w=[],tt=new Map,F;R=new St({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${i[5]}');

ui/dist/assets/BatchApiDocs-BUixrff2.js

@@ -1,4 +1,4 @@
-import{S as St,i as Lt,s as jt,V as At,W as It,X as Z,h as o,z as _,j as i,c as Re,k as b,n as d,o as t,m as Te,C as Mt,D as Nt,H as Ut,Y as Pt,Z as zt,E as Jt,_ as Wt,G as Gt,t as Q,a as x,v as u,d as Pe,J as Ft,p as Kt,l as ee,q as Vt}from"./index-BiaJFyLM.js";function Bt(a,s,n){const c=a.slice();return c[6]=s[n],c}function Et(a,s,n){const c=a.slice();return c[6]=s[n],c}function Ot(a,s){let n,c,y;function f(){return s[5](s[6])}return{key:a,first:null,c(){n=o("button"),n.textContent=`${s[6].code} `,b(n,"class","tab-item"),ee(n,"active",s[1]===s[6].code),this.first=n},m(r,h){d(r,n,h),c||(y=Vt(n,"click",f),c=!0)},p(r,h){s=r,h&10&&ee(n,"active",s[1]===s[6].code)},d(r){r&&u(n),c=!1,y()}}}function Ht(a,s){let n,c,y,f;return c=new It({props:{content:s[6].body}}),{key:a,first:null,c(){n=o("div"),Re(c.$$.fragment),y=i(),b(n,"class","tab-item"),ee(n,"active",s[1]===s[6].code),this.first=n},m(r,h){d(r,n,h),Te(c,n,null),t(n,y),f=!0},p(r,h){s=r,(!f||h&10)&&ee(n,"active",s[1]===s[6].code)},i(r){f||(Q(c.$$.fragment,r),f=!0)},o(r){x(c.$$.fragment,r),f=!1},d(r){r&&u(n),Pe(c)}}}function Xt(a){var pt,mt,bt,ht,ft,_t,yt,kt;let s,n,c=a[0].name+"",y,f,r,h,F,g,U,Fe,P,B,Be,E,Ee,Oe,te,le,q,oe,O,ae,H,se,I,ne,z,ie,w,ce,He,re,S,J,Ie,k,W,Se,de,Le,C,G,je,ue,Ae,K,Me,pe,Ne,D,Ue,me,ze,Je,We,V,Ge,X,Ke,be,Ve,he,Xe,fe,Ye,p,_e,Ze,ye,Qe,ke,xe,$e,et,ge,tt,ve,lt,ot,at,Ce,st,R,De,L,qe,T,j,v=[],nt=new Map,it,A,$=[],ct=new Map,M,we,rt;q=new At({props:{js:`
+import{S as St,i as Lt,s as jt,V as At,W as It,X as Z,h as o,z as _,j as i,c as Re,k as b,n as d,o as t,m as Te,C as Mt,D as Nt,H as Ut,Y as Pt,Z as zt,E as Jt,_ as Wt,G as Gt,t as Q,a as x,v as u,d as Pe,J as Ft,p as Kt,l as ee,q as Vt}from"./index-CGvwwHtM.js";function Bt(a,s,n){const c=a.slice();return c[6]=s[n],c}function Et(a,s,n){const c=a.slice();return c[6]=s[n],c}function Ot(a,s){let n,c,y;function f(){return s[5](s[6])}return{key:a,first:null,c(){n=o("button"),n.textContent=`${s[6].code} `,b(n,"class","tab-item"),ee(n,"active",s[1]===s[6].code),this.first=n},m(r,h){d(r,n,h),c||(y=Vt(n,"click",f),c=!0)},p(r,h){s=r,h&10&&ee(n,"active",s[1]===s[6].code)},d(r){r&&u(n),c=!1,y()}}}function Ht(a,s){let n,c,y,f;return c=new It({props:{content:s[6].body}}),{key:a,first:null,c(){n=o("div"),Re(c.$$.fragment),y=i(),b(n,"class","tab-item"),ee(n,"active",s[1]===s[6].code),this.first=n},m(r,h){d(r,n,h),Te(c,n,null),t(n,y),f=!0},p(r,h){s=r,(!f||h&10)&&ee(n,"active",s[1]===s[6].code)},i(r){f||(Q(c.$$.fragment,r),f=!0)},o(r){x(c.$$.fragment,r),f=!1},d(r){r&&u(n),Pe(c)}}}function Xt(a){var pt,mt,bt,ht,ft,_t,yt,kt;let s,n,c=a[0].name+"",y,f,r,h,F,g,U,Fe,P,B,Be,E,Ee,Oe,te,le,q,oe,O,ae,H,se,I,ne,z,ie,w,ce,He,re,S,J,Ie,k,W,Se,de,Le,C,G,je,ue,Ae,K,Me,pe,Ne,D,Ue,me,ze,Je,We,V,Ge,X,Ke,be,Ve,he,Xe,fe,Ye,p,_e,Ze,ye,Qe,ke,xe,$e,et,ge,tt,ve,lt,ot,at,Ce,st,R,De,L,qe,T,j,v=[],nt=new Map,it,A,$=[],ct=new Map,M,we,rt;q=new At({props:{js:`
         import PocketBase from 'pocketbase';
 
         const pb = new PocketBase('${a[2]}');