bumped app version

Co-authored-by: Aidan Rowe <aidanrowe@gmail.com>

.github/workflows/release.yaml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '>=1.23.4'
+          go-version: '>=1.23.6'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

CHANGELOG.md

@@ -1,3 +1,256 @@
+## v0.27.2
+
+- Added workers pool when cascade deleting record files to minimize _"thread exhaustion"_ errors ([#6780](https://github.com/pocketbase/pocketbase/discussions/6780)).
+
+- Updated the `:excerpt` fields modifier to properly account for multibyte characters ([#6778](https://github.com/pocketbase/pocketbase/issues/6778)).
+
+- Use `rowid` as count column for non-view collections to minimize the need of having the id field in a covering index ([#6739](https://github.com/pocketbase/pocketbase/discussions/6739))
+
+
+## v0.27.1
+
+- Updated example `geoPoint` API preview body data.
+
+- Added JSVM `new GeoPointField({ ... })` constructor.
+
+- Added _partial_ WebP thumbs generation (_the thumbs will be stored as PNG_; [#6744](https://github.com/pocketbase/pocketbase/pull/6744)).
+
+- Updated npm dev dependencies.
+
+
+## v0.27.0
+
+- ⚠️ Moved the Create and Manage API rule checks out of the `OnRecordCreateRequest` hook finalizer, **aka. now all CRUD API rules are checked BEFORE triggering their corresponding `*Request` hook**.
+    This was done to minimize the confusion regarding the firing order of the request operations, making it more predictable and consistent with the other record List/View/Update/Delete request actions.
+    It could be a minor breaking change if you are relying on the old behavior and have a Go `tests.ApiScenario` that is testing a Create API rule failure and expect `OnRecordCreateRequest` to be fired. In that case for example you may have to update your test scenario like:
+    ```go
+    tests.ApiScenario{
+        Name:   "Example test that checks a Create API rule failure"
+        Method: http.MethodPost,
+        URL:    "/api/collections/example/records",
+        ...
+        // old:
+        ExpectedEvents:  map[string]int{
+            "*":                     0,
+            "OnRecordCreateRequest": 1,
+        },
+        // new:
+        ExpectedEvents:  map[string]int{"*": 0},
+    }
+    ```
+    If you are having difficulties adjusting your code, feel free to open a [Q&A discussion](https://github.com/pocketbase/pocketbase/discussions) with the failing/problematic code sample.
+
+- Added [new `geoPoint` field](https://pocketbase.io/docs/collections/#geopoint) for storing `{"lon":x,"lat":y}` geographic coordinates.
+    In addition, a new [`geoDistance(lonA, lotA, lonB, lotB)` function](htts://pocketbase.io/docs/api-rules-and-filters/#geodistancelona-lata-lonb-latb) was also implemented that could be used to apply an API rule or filter constraint based on the distance (in km) between 2 geo points.
+
+- Updated the `select` field UI to accommodate better larger lists and RTL languages ([#4674](https://github.com/pocketbase/pocketbase/issues/4674)).
+
+- Updated the mail attachments auto MIME type detection to use `gabriel-vasile/mimetype` for consistency and broader sniffing signatures support.
+
+- Forced `text/javascript` Content-Type when serving `.js`/`.mjs` collection uploaded files with the `/api/files/...` endpoint ([#6597](https://github.com/pocketbase/pocketbase/issues/6597)).
+
+- Added second optional JSVM `DateTime` constructor argument for specifying a default timezone as TZ identifier when parsing the date string as alternative to a fixed offset in order to better handle daylight saving time nuances ([#6688](https://github.com/pocketbase/pocketbase/discussions/6688)):
+    ```js
+    // the same as with CET offset: new DateTime("2025-10-26 03:00:00 +01:00")
+    new DateTime("2025-10-26 03:00:00", "Europe/Amsterdam") // 2025-10-26 02:00:00.000Z
+
+    // the same as with CEST offset: new DateTime("2025-10-26 01:00:00 +02:00")
+    new DateTime("2025-10-26 01:00:00", "Europe/Amsterdam") // 2025-10-25 23:00:00.000Z
+    ```
+
+- Soft-deprecated the `$http.send`'s `result.raw` field in favor of `result.body` that contains the response body as plain bytes slice to avoid the discrepancies between Go and the JSVM when casting binary data to string.
+
+- Updated `modernc.org/sqlite` to 1.37.0.
+
+- Other minor improvements (_removed the superuser fields from the auth record create/update body examples, allowed programmatically updating the auth record password from the create/update hooks, fixed collections import error response, etc._).
+
+
+## v0.26.6
+
+- Allow OIDC `email_verified` to be int or boolean string since some OIDC providers like AWS Cognito has non-standard userinfo response ([#6657](https://github.com/pocketbase/pocketbase/pull/6657)).
+
+- Updated `modernc.org/sqlite` to 1.36.3.
+
+
+## v0.26.5
+
+- Fixed canonical URI parts escaping when generating the S3 request signature ([#6654](https://github.com/pocketbase/pocketbase/issues/6654)).
+
+
+## v0.26.4
+
+- Fixed `RecordErrorEvent.Error` and `CollectionErrorEvent.Error` sync with `ModelErrorEvent.Error` ([#6639](https://github.com/pocketbase/pocketbase/issues/6639)).
+
+- Fixed logs details copy to clipboard action.
+
+- Updated `modernc.org/sqlite` to 1.36.2.
+
+
+## v0.26.3
+
+- Fixed and normalized logs error serialization across common types for more consistent logs error output ([#6631](https://github.com/pocketbase/pocketbase/issues/6631)).
+
+
+## v0.26.2
+
+- Updated `golang-jwt/jwt` dependency because it comes with a [minor security fix](https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp).
+
+
+## v0.26.1
+
+- Removed the wrapping of `io.EOF` error when reading files since currently `io.ReadAll` doesn't check for wrapped errors ([#6600](https://github.com/pocketbase/pocketbase/issues/6600)).
+
+
+## v0.26.0
+
+- ⚠️ Replaced `aws-sdk-go-v2` and `gocloud.dev/blob` with custom lighter implementation ([#6562](https://github.com/pocketbase/pocketbase/discussions/6562)).
+    As a side-effect of the dependency removal, the binary size has been reduced with ~10MB and builds ~30% faster.
+    _Although the change is expected to be backward-compatible, I'd recommend to test first locally the new version with your S3 provider (if you use S3 for files storage and backups)._
+
+- ⚠️ Prioritized the user submitted non-empty `createData.email` (_it will be unverified_) when creating the PocketBase user during the first OAuth2 auth.
+
+- Load the request info context during password/OAuth2/OTP authentication ([#6402](https://github.com/pocketbase/pocketbase/issues/6402)).
+    This could be useful in case you want to target the auth method as part of the MFA and Auth API rules.
+    For example, to disable MFA for the OAuth2 auth could be expressed as `@request.context != "oauth2"` MFA rule.
+
+- Added `store.Store.SetFunc(key, func(old T) new T)` to set/update a store value with the return result of the callback in a concurrent safe manner.
+
+- Added `subscription.Message.WriteSSE(w, id)` for writing an SSE formatted message into the provided writer interface (_used mostly to assist with the unit testing_).
+
+- Added `$os.stat(file)` JSVM helper ([#6407](https://github.com/pocketbase/pocketbase/discussions/6407)).
+
+- Added log warning for `async` marked JSVM handlers and resolve when possible the returned `Promise` as fallback ([#6476](https://github.com/pocketbase/pocketbase/issues/6476)).
+
+- Allowed calling `cronAdd`, `cronRemove` from inside other JSVM handlers ([#6481](https://github.com/pocketbase/pocketbase/discussions/6481)).
+
+- Bumped the default request read and write timeouts to 5mins (_old 3mins_) to accommodate slower internet connections and larger file uploads/downloads.
+    _If you want to change them you can modify the `OnServe` hook's `ServeEvent.ReadTimeout/WriteTimeout` fields as shown in [#6550](https://github.com/pocketbase/pocketbase/discussions/6550#discussioncomment-12364515)._
+
+- Normalized the `@request.auth.*` and `@request.body.*` back relations resolver to always return `null` when the relation field is pointing to a different collection ([#6590](https://github.com/pocketbase/pocketbase/discussions/6590#discussioncomment-12496581)).
+
+- Other minor improvements (_fixed query dev log nested parameters output, reintroduced `DynamicModel` object/array props reflect types caching, updated Go and npm deps, etc._)
+
+
+## v0.25.9
+
+- Fixed `DynamicModel` object/array props reflect type caching ([#6563](https://github.com/pocketbase/pocketbase/discussions/6563)).
+
+
+## v0.25.8
+
+- Added a default leeway of 5 minutes for the Apple/OIDC `id_token` timestamp claims check to account for clock-skew ([#6529](https://github.com/pocketbase/pocketbase/issues/6529)).
+    It can be further customized if needed with the `PB_ID_TOKEN_LEEWAY` env variable (_the value must be in seconds, e.g. "PB_ID_TOKEN_LEEWAY=60" for 1 minute_).
+
+
+## v0.25.7
+
+- Fixed `@request.body.jsonObjOrArr.*` values extraction ([#6493](https://github.com/pocketbase/pocketbase/discussions/6493)).
+
+
+## v0.25.6
+
+- Restore the missing `meta.isNew` field of the OAuth2 success response ([#6490](https://github.com/pocketbase/pocketbase/issues/6490)).
+
+- Updated npm dependencies.
+
+
+## v0.25.5
+
+- Set the current working directory as a default goja script path when executing inline JS strings to allow `require(m)` traversing parent `node_modules` directories.
+
+- Updated `modernc.org/sqlite` and `modernc.org/libc` dependencies.
+
+
+## v0.25.4
+
+- Downgraded `aws-sdk-go-v2` to the version before the default data integrity checks because there have been reports for non-AWS S3 providers in addition to Backblaze (IDrive, R2) that no longer or partially work with the latest AWS SDK changes.
+
+    While we try to enforce `when_required` by default, it is not enough to disable the new AWS SDK integrity checks entirely and some providers will require additional manual adjustments to make them compatible with the latest AWS SDK (e.g. removing the `x-aws-checksum-*` headers, unsetting the checksums calculation or reinstantiating the old MD5 checksums for some of the required operations, etc.) which as a result leads to a configuration mess that I'm not sure it would be a good idea to introduce.
+
+    This unfornuatelly is not a PocketBase or Go specific issue and the official AWS SDKs for other languages are in the same situation (even the latest aws-cli).
+
+    For those of you that extend PocketBase with Go: if your S3 vendor doesn't support the [AWS Data integrity checks](https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html) and you are updating with `go get -u`, then make sure that the `aws-sdk-go-v2` dependencies in your `go.mod` are the same as in the repo:
+    ```
+    // go.mod
+    github.com/aws/aws-sdk-go-v2 v1.36.1
+    github.com/aws/aws-sdk-go-v2/config v1.28.10
+    github.com/aws/aws-sdk-go-v2/credentials v1.17.51
+    github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.48
+    github.com/aws/aws-sdk-go-v2/service/s3 v1.72.2
+
+    // after that run
+    go clean -modcache && go mod tidy
+    ```
+    _The versions pinning is temporary until the non-AWS S3 vendors patch their implementation or until I manage to find time to remove/replace the `aws-sdk-go-v2` dependency (I'll consider prioritizing it for the v0.26 or v0.27 release)._
+
+
+## v0.25.3
+
+- Added a temporary exception for Backblaze S3 endpoints to exclude the new `aws-sdk-go-v2` checksum headers ([#6440](https://github.com/pocketbase/pocketbase/discussions/6440)).
+
+
+## v0.25.2
+
+- Fixed realtime delete event not being fired for `RecordProxy`-ies and added basic realtime record resolve automated tests ([#6433](https://github.com/pocketbase/pocketbase/issues/6433)).
+
+
+## v0.25.1
+
+- Fixed the batch API Preview success sample response.
+
+- Bumped GitHub action min Go version to 1.23.6 as it comes with a [minor security fix](https://github.com/golang/go/issues?q=milestone%3AGo1.23.6+label%3ACherryPickApproved) for the ppc64le build.
+
+
+## v0.25.0
+
+- ⚠️ Upgraded Google OAuth2 auth, token and userinfo endpoints to their latest versions.
+    _For users that don't do anything custom with the Google OAuth2 data or the OAuth2 auth URL, this should be a non-breaking change. The exceptions that I could find are:_
+    - `/v3/userinfo` auth response changes:
+        ```
+        meta.rawUser.id             => meta.rawUser.sub
+        meta.rawUser.verified_email => meta.rawUser.email_verified
+        ```
+    - `/v2/auth` query parameters changes:
+        If you are specifying custom `approval_prompt=force` query parameter for the OAuth2 auth URL, you'll have to replace it with **`prompt=consent`**.
+
+- Added Trakt OAuth2 provider ([#6338](https://github.com/pocketbase/pocketbase/pull/6338); thanks @aidan-)
+
+- Added support for case-insensitive password auth based on the related UNIQUE index field collation ([#6337](https://github.com/pocketbase/pocketbase/discussions/6337)).
+
+- Enforced `when_required` for the new AWS SDK request and response checksum validations to allow other non-AWS vendors to catch up with new AWS SDK changes (see [#6313](https://github.com/pocketbase/pocketbase/discussions/6313) and [aws/aws-sdk-go-v2#2960](https://github.com/aws/aws-sdk-go-v2/discussions/2960)).
+    _You can set the environment variables `AWS_REQUEST_CHECKSUM_CALCULATION` and `AWS_RESPONSE_CHECKSUM_VALIDATION` to `when_supported` if your S3 vendor supports the [new default integrity protections](https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html)._
+
+- Soft-deprecated `Record.GetUploadedFiles` in favor of `Record.GetUnsavedFiles` to minimize the ambiguities what the method do ([#6269](https://github.com/pocketbase/pocketbase/discussions/6269)).
+
+- Replaced archived `github.com/AlecAivazis/survey` dependency with a simpler  `osutils.YesNoPrompt(message, fallback)` helper.
+
+- Upgraded to `golang-jwt/jwt/v5`.
+
+- Added JSVM `new Timezone(name)` binding for constructing `time.Location` value ([#6219](https://github.com/pocketbase/pocketbase/discussions/6219)).
+
+- Added `inflector.Camelize(str)` and `inflector.Singularize(str)` helper methods.
+
+- Use the non-transactional app instance during the realtime records delete access checks to ensure that cascade deleted records with API rules relying on the parent will be resolved.
+
+- Other minor improvements (_replaced all `bool` exists db scans with `int` for broader drivers compatibility, updated API Preview sample error responses, updated UI dependencies, etc._)
+
+
+## v0.24.4
+
+- Fixed fields extraction for view query with nested comments ([#6309](https://github.com/pocketbase/pocketbase/discussions/6309)).
+
+- Bumped GitHub action min Go version to 1.23.5 as it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.23.5).
+
+
+## v0.24.3
+
+- Fixed incorrectly reported unique validator error for fields starting with name of another field ([#6281](https://github.com/pocketbase/pocketbase/pull/6281); thanks @svobol13).
+
+- Reload the created/edited records data in the RecordsPicker UI.
+
+- Updated Go dependencies.
+
+
 ## v0.24.2
 
 - Fixed display fields extraction when there are multiple "Presentable" `relation` fields in a single related collection ([#6229](https://github.com/pocketbase/pocketbase/issues/6229)).

CHANGELOG_16_22.md

@@ -2,6 +2,33 @@
 > For the most recent versions, please refer to [CHANGELOG.md](./CHANGELOG.md)
 ---
 
+## v0.22.34
+
+- (_Backported from v0.26.6_) Allow OIDC `email_verified` to be int or boolean string since some OIDC providers like AWS Cognito has non-standard userinfo response ([#6657](https://github.com/pocketbase/pocketbase/pull/6657)).
+
+
+## v0.22.33
+
+- (_Backported from v0.26.3_) Fixed and normalized logs error serialization across common types for more consistent logs error output ([#6631](https://github.com/pocketbase/pocketbase/issues/6631)).
+
+
+## v0.22.32
+
+- (_Backported from v0.26.2_) Updated `golang-jwt/jwt` dependency because it comes with a [minor security fix](https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp).
+
+
+## v0.22.31
+
+- (_Backported from v0.25.5_) Set the current working directory as a default goja script path when executing inline JS strings to allow `require(m)` traversing parent `node_modules` directories.
+
+
+## v0.22.30
+
+- (_Backported from v0.24.4_) Fixed fields extraction for view queries with nested comments ([#6309](https://github.com/pocketbase/pocketbase/discussions/6309)).
+
+- Bumped GitHub action min Go version to 1.23.5 as it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.23.5).
+
+
 ## v0.22.29
 
 - (_Backported from v0.23.11_) Upgraded `golang.org/x/net` to 0.33.0 to fix [CVE-2024-45338](https://www.cve.org/CVERecord?id=CVE-2024-45338).

README.md

@@ -25,10 +25,13 @@
 
 ## API SDK clients
 
-The easiest way to interact with the API is to use one of the official SDK clients:
+The easiest way to interact with the PocketBase Web APIs is to use one of the official SDK clients:
+
+- **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_Browser, Node.js, React Native_)
+- **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_Web, Mobile, Desktop, CLI_)
+
+You could also check the recommendations in https://pocketbase.io/docs/how-to-use/.
 
-- **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_browser and node_)
-- **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_web, mobile, desktop_)
 
 ## Overview
 

apis/backup_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
-	"gocloud.dev/blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
 )
 
 func TestBackupsList(t *testing.T) {
@@ -490,7 +490,7 @@ func TestBackupsDownload(t *testing.T) {
 					t.Fatal(err)
 				}
 			},
-			ExpectedStatus:  400,
+			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents:  map[string]int{"*": 0},
 		},

apis/collection_import.go

@@ -34,7 +34,7 @@ func collectionsImport(e *core.RequestEvent) error {
 
 		// validation failure
 		var validationErrors validation.Errors
-		if errors.As(err, &validationErrors) {
+		if errors.As(importErr, &validationErrors) {
 			return e.BadRequestError("Failed to import collections.", validationErrors)
 		}
 

apis/collection_import_test.go

@@ -1,6 +1,7 @@
 package apis_test
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 	"testing"
@@ -88,6 +89,7 @@ func TestCollectionsImport(t *testing.T) {
 				`import2`,
 				`fields`,
 			},
+			NotExpectedContent: []string{"Raw error:"},
 			ExpectedEvents: map[string]int{
 				"*":                            0,
 				"OnCollectionsImportRequest":   1,
@@ -109,6 +111,71 @@ func TestCollectionsImport(t *testing.T) {
 				}
 			},
 		},
+		{
+			Name:   "authorized as superuser + non-validator failure",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{
+						"name": "import1",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						],
+						"indexes": [
+							"create index idx_test on import2 (test)"
+						]
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"validation_collections_import_failure"`,
+				`Raw error:`,
+				`custom_error`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionsImportRequest":   1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionCreate().BindFunc(func(e *core.CollectionEvent) error {
+					return errors.New("custom_error")
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				expected := totalCollections
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+			},
+		},
 		{
 			Name:   "authorized as superuser + successful collections create",
 			Method: http.MethodPut,

apis/file.go

@@ -19,7 +19,7 @@ import (
 	"golang.org/x/sync/singleflight"
 )
 
-var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif"}
+var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif", "image/webp"}
 var defaultThumbSizes = []string{"100x100"}
 
 // bindFileApi registers the file api endpoints and the corresponding handlers.

apis/realtime.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"strings"
@@ -83,11 +84,10 @@ func realtimeConnect(e *core.RequestEvent) error {
 			Data: []byte(`{"clientId":"` + ce.Client.Id() + `"}`),
 		}
 		connectMsgErr := ce.App.OnRealtimeMessageSend().Trigger(connectMsgEvent, func(me *core.RealtimeMessageEvent) error {
-			me.Response.Write([]byte("id:" + me.Client.Id() + "\n"))
-			me.Response.Write([]byte("event:" + me.Message.Name + "\n"))
-			me.Response.Write([]byte("data:"))
-			me.Response.Write(me.Message.Data)
-			me.Response.Write([]byte("\n\n"))
+			err := me.Message.WriteSSE(me.Response, me.Client.Id())
+			if err != nil {
+				return err
+			}
 			return me.Flush()
 		})
 		if connectMsgErr != nil {
@@ -122,11 +122,10 @@ func realtimeConnect(e *core.RequestEvent) error {
 				msgEvent.Client = ce.Client
 				msgEvent.Message = &msg
 				msgErr := ce.App.OnRealtimeMessageSend().Trigger(msgEvent, func(me *core.RealtimeMessageEvent) error {
-					me.Response.Write([]byte("id:" + me.Client.Id() + "\n"))
-					me.Response.Write([]byte("event:" + me.Message.Name + "\n"))
-					me.Response.Write([]byte("data:"))
-					me.Response.Write(me.Message.Data)
-					me.Response.Write([]byte("\n\n"))
+					err := me.Message.WriteSSE(me.Response, me.Client.Id())
+					if err != nil {
+						return err
+					}
 					return me.Flush()
 				})
 				if msgErr != nil {
@@ -353,7 +352,10 @@ func bindRealtimeEvents(app core.App) {
 		Func: func(e *core.ModelEvent) error {
 			record := realtimeResolveRecord(e.App, e.Model, "")
 			if record != nil {
-				err := realtimeBroadcastRecord(e.App, "delete", record, true)
+				// note: use the outside scoped app instance for the access checks so that the API rules
+				// are performed out of the delete transaction ensuring that they would still work even if
+				// a cascade-deleted record's API rule relies on an already deleted parent record
+				err := realtimeBroadcastRecord(e.App, "delete", record, true, app)
 				if err != nil {
 					app.Logger().Debug(
 						"Failed to dry cache record delete",
@@ -372,14 +374,17 @@ func bindRealtimeEvents(app core.App) {
 	// delete: broadcast
 	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*core.ModelEvent]{
 		Func: func(e *core.ModelEvent) error {
-			record := realtimeResolveRecord(e.App, e.Model, "")
-			if record != nil {
-				err := realtimeBroadcastDryCachedRecord(e.App, "delete", record)
+			// note: only ensure that it is a collection record
+			// and don't use realtimeResolveRecord because in case of a
+			// custom model it'll fail to resolve since the record is already deleted
+			collection := realtimeResolveRecordCollection(e.App, e.Model)
+			if collection != nil {
+				err := realtimeBroadcastDryCacheKey(e.App, getDryCacheKey("delete", e.Model))
 				if err != nil {
 					app.Logger().Debug(
 						"Failed to broadcast record delete",
-						slog.String("id", record.Id),
-						slog.String("collectionName", record.Collection().Name),
+						slog.Any("id", e.Model.PK()),
+						slog.String("collectionName", collection.Name),
 						slog.String("error", err.Error()),
 					)
 				}
@@ -395,7 +400,7 @@ func bindRealtimeEvents(app core.App) {
 		Func: func(e *core.ModelErrorEvent) error {
 			record := realtimeResolveRecord(e.App, e.Model, "")
 			if record != nil {
-				err := realtimeUnsetDryCachedRecord(e.App, "delete", record)
+				err := realtimeUnsetDryCacheKey(e.App, getDryCacheKey("delete", record))
 				if err != nil {
 					app.Logger().Debug(
 						"Failed to cleanup after broadcast record delete failure",
@@ -415,7 +420,14 @@ func bindRealtimeEvents(app core.App) {
 // resolveRecord converts *if possible* the provided model interface to a Record.
 // This is usually helpful if the provided model is a custom Record model struct.
 func realtimeResolveRecord(app core.App, model core.Model, optCollectionType string) *core.Record {
-	record, _ := model.(*core.Record)
+	var record *core.Record
+	switch m := model.(type) {
+	case *core.Record:
+		record = m
+	case core.RecordProxy:
+		record = m.ProxyRecord()
+	}
+
 	if record != nil {
 		if optCollectionType == "" || record.Collection().Type == optCollectionType {
 			return record
@@ -444,14 +456,20 @@ func realtimeResolveRecord(app core.App, model core.Model, optCollectionType str
 // realtimeResolveRecordCollection extracts *if possible* the Collection model from the provided model interface.
 // This is usually helpful if the provided model is a custom Record model struct.
 func realtimeResolveRecordCollection(app core.App, model core.Model) (collection *core.Collection) {
-	if record, ok := model.(*core.Record); ok {
-		collection = record.Collection()
-	} else {
-		// check if it is custom Record model struct (ignore "private" tables)
-		collection, _ = app.FindCachedCollectionByNameOrId(model.TableName())
+	switch m := model.(type) {
+	case *core.Record:
+		return m.Collection()
+	case core.RecordProxy:
+		return m.ProxyRecord().Collection()
+	default:
+		// check if it is custom Record model struct
+		collection, err := app.FindCachedCollectionByNameOrId(model.TableName())
+		if err == nil {
+			return collection
+		}
 	}
 
-	return collection
+	return nil
 }
 
 // recordData represents the broadcasted record subscrition message data.
@@ -460,7 +478,11 @@ type recordData struct {
 	Action string `json:"action"`
 }
 
-func realtimeBroadcastRecord(app core.App, action string, record *core.Record, dryCache bool) error {
+// Note: the optAccessCheckApp is there in case you want the access check
+// to be performed against different db app context (e.g. out of a transaction).
+// If set, it is expected that optAccessCheckApp instance is used for read-only operations to avoid deadlocks.
+// If not set, it fallbacks to app.
+func realtimeBroadcastRecord(app core.App, action string, record *core.Record, dryCache bool, optAccessCheckApp ...core.App) error {
 	collection := record.Collection()
 	if collection == nil {
 		return errors.New("[broadcastRecord] Record collection not set")
@@ -482,10 +504,15 @@ func realtimeBroadcastRecord(app core.App, action string, record *core.Record, d
 		(collection.Id + "?"):   collection.ListRule,
 	}
 
-	dryCacheKey := action + "/" + record.Id
+	dryCacheKey := getDryCacheKey(action, record)
 
 	group := new(errgroup.Group)
 
+	accessCheckApp := app
+	if len(optAccessCheckApp) > 0 {
+		accessCheckApp = optAccessCheckApp[0]
+	}
+
 	for _, chunk := range chunks {
 		group.Go(func() error {
 			var clientAuth *core.Record
@@ -502,10 +529,6 @@ func realtimeBroadcastRecord(app core.App, action string, record *core.Record, d
 					clientAuth, _ = client.Get(RealtimeClientAuthKey).(*core.Record)
 
 					for sub, options := range subs {
-						// create a clean record copy without expand and unknown fields
-						// because we don't know yet which exact fields the client subscription has permissions to access
-						cleanRecord := record.Fresh()
-
 						// mock request data
 						requestInfo := &core.RequestInfo{
 							Context: core.RequestInfoContextRealtime,
@@ -515,10 +538,14 @@ func realtimeBroadcastRecord(app core.App, action string, record *core.Record, d
 							Auth:    clientAuth,
 						}
 
-						if !realtimeCanAccessRecord(app, cleanRecord, requestInfo, rule) {
+						if !realtimeCanAccessRecord(accessCheckApp, record, requestInfo, rule) {
 							continue
 						}
 
+						// create a clean record copy without expand and unknown fields because we don't know yet
+						// which exact fields the client subscription requested or has permissions to access
+						cleanRecord := record.Fresh()
+
 						// trigger the enrich hooks
 						enrichErr := triggerRecordEnrichHooks(app, requestInfo, []*core.Record{cleanRecord}, func() error {
 							// apply expand
@@ -541,7 +568,7 @@ func realtimeBroadcastRecord(app core.App, action string, record *core.Record, d
 							// for auth owner, superuser or manager
 							if collection.IsAuth() {
 								if isSameAuth(clientAuth, cleanRecord) ||
-									realtimeCanAccessRecord(app, cleanRecord, requestInfo, collection.ManageRule) {
+									realtimeCanAccessRecord(accessCheckApp, cleanRecord, requestInfo, collection.ManageRule) {
 									cleanRecord.IgnoreEmailVisibility(true)
 								}
 							}
@@ -622,15 +649,13 @@ func realtimeBroadcastRecord(app core.App, action string, record *core.Record, d
 	return group.Wait()
 }
 
-// realtimeBroadcastDryCachedRecord broadcasts all cached record related messages.
-func realtimeBroadcastDryCachedRecord(app core.App, action string, record *core.Record) error {
+// realtimeBroadcastDryCacheKey broadcasts the dry cached key related messages.
+func realtimeBroadcastDryCacheKey(app core.App, key string) error {
 	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
 	if len(chunks) == 0 {
 		return nil // no subscribers
 	}
 
-	key := action + "/" + record.Id
-
 	group := new(errgroup.Group)
 
 	for _, chunk := range chunks {
@@ -659,15 +684,13 @@ func realtimeBroadcastDryCachedRecord(app core.App, action string, record *core.
 	return group.Wait()
 }
 
-// realtimeUnsetDryCachedRecord removes the dry cached record related messages.
-func realtimeUnsetDryCachedRecord(app core.App, action string, record *core.Record) error {
+// realtimeUnsetDryCacheKey removes the dry cached key related messages.
+func realtimeUnsetDryCacheKey(app core.App, key string) error {
 	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
 	if len(chunks) == 0 {
 		return nil // no subscribers
 	}
 
-	key := action + "/" + record.Id
-
 	group := new(errgroup.Group)
 
 	for _, chunk := range chunks {
@@ -685,6 +708,15 @@ func realtimeUnsetDryCachedRecord(app core.App, action string, record *core.Reco
 	return group.Wait()
 }
 
+func getDryCacheKey(action string, model core.Model) string {
+	pkStr, ok := model.PK().(string)
+	if !ok {
+		pkStr = fmt.Sprintf("%v", model.PK())
+	}
+
+	return action + "/" + model.TableName() + "/" + pkStr
+}
+
 func isSameAuth(authA, authB *core.Record) bool {
 	if authA == nil {
 		return authB == nil
@@ -722,7 +754,7 @@ func realtimeCanAccessRecord(
 		return false
 	}
 
-	var exists bool
+	var exists int
 
 	q := app.DB().Select("(1)").
 		From(record.Collection().Name).
@@ -739,5 +771,5 @@ func realtimeCanAccessRecord(
 
 	err = q.Limit(1).Row(&exists)
 
-	return err == nil && exists
+	return err == nil && exists > 0
 }

apis/realtime_test.go

@@ -2,10 +2,13 @@ package apis_test
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -14,6 +17,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestRealtimeConnect(t *testing.T) {
@@ -632,3 +636,250 @@ func TestRealtimeCustomAuthModelUpdateEvent(t *testing.T) {
 		t.Fatalf("Expected authRecord with email %q, got %q", customUser.Email, clientAuthRecord.Email())
 	}
 }
+
+// -------------------------------------------------------------------
+
+var _ core.Model = (*CustomModelResolve)(nil)
+
+type CustomModelResolve struct {
+	core.BaseModel
+	tableName string
+
+	Created string `db:"created"`
+}
+
+func (m *CustomModelResolve) TableName() string {
+	return m.tableName
+}
+
+func TestRealtimeRecordResolve(t *testing.T) {
+	t.Parallel()
+
+	const testCollectionName = "realtime_test_collection"
+
+	testRecordId := core.GenerateDefaultRandomId()
+
+	client0 := subscriptions.NewDefaultClient()
+	client0.Subscribe(testCollectionName + "/*")
+	client0.Discard()
+	// ---
+	client1 := subscriptions.NewDefaultClient()
+	client1.Subscribe(testCollectionName + "/*")
+	// ---
+	client2 := subscriptions.NewDefaultClient()
+	client2.Subscribe(testCollectionName + "/" + testRecordId)
+	// ---
+	client3 := subscriptions.NewDefaultClient()
+	client3.Subscribe("demo1/*")
+
+	scenarios := []struct {
+		name     string
+		op       func(testApp core.App) error
+		expected map[string][]string // clientId -> [events]
+	}{
+		{
+			"core.Record",
+			func(testApp core.App) error {
+				c, err := testApp.FindCollectionByNameOrId(testCollectionName)
+				if err != nil {
+					return err
+				}
+
+				r := core.NewRecord(c)
+				r.Id = testRecordId
+
+				// create
+				err = testApp.Save(r)
+				if err != nil {
+					return err
+				}
+
+				// update
+				err = testApp.Save(r)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(r)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+		{
+			"core.RecordProxy",
+			func(testApp core.App) error {
+				c, err := testApp.FindCollectionByNameOrId(testCollectionName)
+				if err != nil {
+					return err
+				}
+
+				r := core.NewRecord(c)
+
+				proxy := &struct {
+					core.BaseRecordProxy
+				}{}
+				proxy.SetProxyRecord(r)
+				proxy.Id = testRecordId
+
+				// create
+				err = testApp.Save(proxy)
+				if err != nil {
+					return err
+				}
+
+				// update
+				err = testApp.Save(proxy)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(proxy)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+		{
+			"custom model struct",
+			func(testApp core.App) error {
+				m := &CustomModelResolve{tableName: testCollectionName}
+				m.Id = testRecordId
+
+				// create
+				err := testApp.Save(m)
+				if err != nil {
+					return err
+				}
+
+				// update
+				m.Created = "123"
+				err = testApp.Save(m)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(m)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			// init realtime handlers
+			apis.NewRouter(testApp)
+
+			// create new test collection with public read access
+			testCollection := core.NewBaseCollection(testCollectionName)
+			testCollection.Fields.Add(&core.AutodateField{Name: "created", OnCreate: true, OnUpdate: true})
+			testCollection.ListRule = types.Pointer("")
+			testCollection.ViewRule = types.Pointer("")
+			err := testApp.Save(testCollection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			testApp.SubscriptionsBroker().Register(client0)
+			testApp.SubscriptionsBroker().Register(client1)
+			testApp.SubscriptionsBroker().Register(client2)
+			testApp.SubscriptionsBroker().Register(client3)
+
+			var wg sync.WaitGroup
+
+			var notifications = map[string][]string{}
+
+			var mu sync.Mutex
+			notify := func(clientId string, eventData []byte) {
+				data := struct{ Action string }{}
+				_ = json.Unmarshal(eventData, &data)
+
+				mu.Lock()
+				defer mu.Unlock()
+
+				if notifications[clientId] == nil {
+					notifications[clientId] = []string{}
+				}
+				notifications[clientId] = append(notifications[clientId], data.Action)
+			}
+
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+
+				timeout := time.After(250 * time.Millisecond)
+
+				for {
+					select {
+					case e, ok := <-client0.Channel():
+						if ok {
+							notify(client0.Id(), e.Data)
+						}
+					case e, ok := <-client1.Channel():
+						if ok {
+							notify(client1.Id(), e.Data)
+						}
+					case e, ok := <-client2.Channel():
+						if ok {
+							notify(client2.Id(), e.Data)
+						}
+					case e, ok := <-client3.Channel():
+						if ok {
+							notify(client3.Id(), e.Data)
+						}
+					case <-timeout:
+						return
+					}
+				}
+			}()
+
+			err = s.op(testApp)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			wg.Wait()
+
+			if len(s.expected) != len(notifications) {
+				t.Fatalf("Expected %d notified clients, got %d:\n%v", len(s.expected), len(notifications), notifications)
+			}
+
+			for id, events := range s.expected {
+				if len(events) != len(notifications[id]) {
+					t.Fatalf("[%s] Expected %d events, got %d:\n%v\n%v", id, len(events), len(notifications[id]), s.expected, notifications)
+				}
+				for _, event := range events {
+					if !slices.Contains(notifications[id], event) {
+						t.Fatalf("[%s] Missing expected event %q in %v", id, event, notifications[id])
+					}
+				}
+			}
+		})
+	}
+}

apis/record_auth_with_oauth2.go

@@ -3,17 +3,18 @@ package apis
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"maps"
 	"net/http"
+	"strings"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"golang.org/x/oauth2"
@@ -34,6 +35,8 @@ func recordAuthWithOAuth2(e *core.RequestEvent) error {
 		fallbackAuthRecord = e.Auth
 	}
 
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOAuth2)
+
 	form := new(recordOAuth2LoginForm)
 	form.collection = collection
 	if err = e.BindBody(form); err != nil {
@@ -133,13 +136,17 @@ func recordAuthWithOAuth2(e *core.RequestEvent) error {
 			return firstApiError(err, e.BadRequestError("Failed to authenticate.", err))
 		}
 
-		meta := struct {
-			*auth.AuthUser
-			IsNew bool `json:"isNew"`
-		}{
-			AuthUser: e.OAuth2User,
-			IsNew:    e.IsNewRecord,
+		// @todo revert back to struct after removing the custom auth.AuthUser marshalization
+		meta := map[string]any{}
+		rawOAuth2User, err := json.Marshal(e.OAuth2User)
+		if err != nil {
+			return err
 		}
+		err = json.Unmarshal(rawOAuth2User, &meta)
+		if err != nil {
+			return err
+		}
+		meta["isNew"] = e.IsNewRecord
 
 		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOAuth2, meta)
 	})
@@ -194,10 +201,20 @@ func (form *recordOAuth2LoginForm) checkProviderName(value any) error {
 
 func oldCanAssignUsername(txApp core.App, collection *core.Collection, username string) bool {
 	// ensure that username is unique
-	checkUnique := dbutils.HasSingleColumnUniqueIndex(collection.OAuth2.MappedFields.Username, collection.Indexes)
-	if checkUnique {
-		if _, err := txApp.FindFirstRecordByData(collection, collection.OAuth2.MappedFields.Username, username); err == nil {
-			return false // already exist
+	index, hasUniqueue := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, collection.OAuth2.MappedFields.Username)
+	if hasUniqueue {
+		var expr dbx.Expression
+		if strings.EqualFold(index.Columns[0].Collate, "nocase") {
+			// case-insensitive search
+			expr = dbx.NewExp("username = {:username} COLLATE NOCASE", dbx.Params{"username": username})
+		} else {
+			expr = dbx.HashExp{"username": username}
+		}
+
+		var exists int
+		_ = txApp.RecordQuery(collection).Select("(1)").AndWhere(expr).Limit(1).Row(&exists)
+		if exists > 0 {
+			return false
 		}
 	}
 
@@ -221,7 +238,11 @@ func oauth2Submit(e *core.RecordAuthWithOAuth2RequestEvent, optExternalAuth *cor
 				payload = map[string]any{}
 			}
 
-			payload[core.FieldNameEmail] = e.OAuth2User.Email
+			// assign the OAuth2 user email only if the user hasn't submitted one
+			// (ignore empty/invalid values for consistency with the OAuth2->existing user update flow)
+			if v, _ := payload[core.FieldNameEmail].(string); v == "" {
+				payload[core.FieldNameEmail] = e.OAuth2User.Email
+			}
 
 			// map known fields (unless the field was explicitly submitted as part of CreateData)
 			if _, ok := payload[e.Collection.OAuth2.MappedFields.Id]; !ok && e.Collection.OAuth2.MappedFields.Id != "" {

apis/record_auth_with_oauth2_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"golang.org/x/oauth2"
 )
 
@@ -174,6 +175,20 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				if err := app.Save(ea); err != nil {
 					t.Fatal(err)
 				}
+
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextOAuth2 {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextOAuth2, info.Context)
+					}
+
+					return e.Next()
+				})
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -292,6 +307,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":false`,
 				`"email":"test2@example.com"`,
 				`"id":"oap640cot4yru2s"`,
 				`"id":"test_id"`,
@@ -383,6 +399,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":false`,
 				`"email":"test@example.com"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"id":"test_id"`,
@@ -488,6 +505,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":false`,
 				`"email":"test@example.com"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"id":"test_id"`,
@@ -601,6 +619,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":false`,
 				`"email":"test_oauth2@example.com"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"id":"test_id"`,
@@ -706,6 +725,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":false`,
 				`"email":"test@example.com"`,
 				`"id":"4q1xlclmfloku33"`,
 				`"id":"test_id"`,
@@ -795,6 +815,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"record":{`,
 				`"token":"`,
 				`"meta":{`,
+				`"isNew":true`,
 				`"email":""`,
 				`"id":"test_id"`,
 				`"verified":true`,
@@ -876,7 +897,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				`"verified":{"code":"validation_values_mismatch"`,
 			},
 			NotExpectedContent: []string{
-				`"email":`, // the value is always overwritten with the OAuth2 user email
+				`"email":`, // ignored because the record validator never ran
 				`"rel":`,   // ignored because the record validator never ran
 				`"file":`,  // ignored because the record validator never ran
 			},
@@ -929,12 +950,10 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{`,
+				`"email":{"code":"validation_is_email"`,
 				`"rel":{"code":"validation_missing_rel_records"`,
 				`"file":{"code":"validation_invalid_file"`,
 			},
-			NotExpectedContent: []string{
-				`"email":`, // the value is always overwritten with the OAuth2 user email
-			},
 			ExpectedEvents: map[string]int{
 				"*":                             0,
 				"OnRecordAuthWithOAuth2Request": 1,
@@ -948,7 +967,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 		},
 		{
-			Name:   "creating user (valid create data)",
+			Name:   "creating user (valid create data with empty submitted email)",
 			Method: http.MethodPost,
 			URL:    "/api/collections/users/auth-with-oauth2",
 			Body: strings.NewReader(`{
@@ -956,7 +975,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				"code":"123",
 				"redirectURL": "https://example.com",
 				"createData": {
-					"email": "invalid",
+					"email": "",
 					"emailVisibility": true,
 					"password": "1234567890",
 					"passwordConfirm": "1234567890",
@@ -993,6 +1012,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":""`,
 				`"emailVisibility":true`,
 				`"name":"test_name"`,
@@ -1040,6 +1060,95 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 				}
 			},
 		},
+		{
+			Name:   "creating user (valid create data with non-empty valid submitted email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"email": "test_create@example.com",
+					"emailVisibility": true,
+					"password": "1234567890",
+					"passwordConfirm": "1234567890",
+					"name": "test_name",
+					"username": "test_username",
+					"rel": "0yxhwia2amd8gec"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:    "test_id",
+							Email: "oauth2@example.com", // should be ignored because of the explicit submitted email
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test_create@example.com"`,
+				`"emailVisibility":true`,
+				`"name":"test_name"`,
+				`"username":"test_username"`,
+				`"verified":false`,
+				`"rel":"0yxhwia2amd8gec"`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelValidate":  3,
+				"OnRecordValidate": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindFirstRecordByData("users", "username", "test_username")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+			},
+		},
 		{
 			Name:   "creating user (with mapped OAuth2 fields and avatarURL->file field)",
 			Method: http.MethodPost,
@@ -1092,6 +1201,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":"oauth2@example.com"`,
 				`"emailVisibility":true`,
 				`"name":"test_name"`,
@@ -1174,6 +1284,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":"oauth2@example.com"`,
 				`"emailVisibility":false`,
 				`"verified":true`,
@@ -1210,7 +1321,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 		},
 		{
-			Name:   "creating user (with mapped OAuth2 fields and avatarURL->non-file field)",
+			Name:   "creating user (with mapped OAuth2 fields, case-sensitive username and avatarURL->non-file field)",
 			Method: http.MethodPost,
 			URL:    "/api/collections/users/auth-with-oauth2",
 			Body: strings.NewReader(`{
@@ -1230,7 +1341,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 						AuthUser: &auth.AuthUser{
 							Id:        "oauth2_id",
 							Email:     "oauth2@example.com",
-							Username:  "oauth2_username",
+							Username:  "tESt2_username", // wouldn't match with existing because the related field index is case-sensitive
 							Name:      "oauth2_name",
 							AvatarURL: server.URL + "/oauth2_avatar.png",
 						},
@@ -1256,9 +1367,10 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":"oauth2@example.com"`,
 				`"emailVisibility":false`,
-				`"username":"oauth2_username"`,
+				`"username":"tESt2_username"`,
 				`"name":"http://127.`,
 				`"verified":true`,
 				`"avatar":""`,
@@ -1294,7 +1406,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 		},
 		{
-			Name:   "creating user (with mapped OAuth2 fields and duplicated username)",
+			Name:   "creating user (with mapped OAuth2 fields and duplicated case-insensitive username)",
 			Method: http.MethodPost,
 			URL:    "/api/collections/users/auth-with-oauth2",
 			Body: strings.NewReader(`{
@@ -1314,13 +1426,21 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 						AuthUser: &auth.AuthUser{
 							Id:       "oauth2_id",
 							Email:    "oauth2@example.com",
-							Username: "test2_username",
+							Username: "tESt2_username",
 							Name:     "oauth2_name",
 						},
 						Token: &oauth2.Token{AccessToken: "abc"},
 					}
 				}
 
+				// make the username index case-insensitive to ensure that case-insensitive match is used
+				index, ok := dbutils.FindSingleColumnUniqueIndex(usersCol.Indexes, "username")
+				if ok {
+					index.Columns[0].Collate = "nocase"
+					usersCol.RemoveIndex(index.IndexName)
+					usersCol.Indexes = append(usersCol.Indexes, index.Build())
+				}
+
 				// add the test provider in the collection
 				usersCol.MFA.Enabled = false
 				usersCol.OAuth2.Enabled = true
@@ -1338,6 +1458,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":"oauth2@example.com"`,
 				`"emailVisibility":false`,
 				`"verified":true`,
@@ -1419,6 +1540,7 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
+				`"isNew":true`,
 				`"email":"oauth2@example.com"`,
 				`"emailVisibility":false`,
 				`"verified":true`,

apis/record_auth_with_otp.go

@@ -26,6 +26,8 @@ func recordAuthWithOTP(e *core.RequestEvent) error {
 		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
 	}
 
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOTP)
+
 	event := new(core.RecordAuthWithOTPRequestEvent)
 	event.RequestEvent = e
 	event.Collection = collection

apis/record_auth_with_otp_test.go

@@ -269,6 +269,20 @@ func TestRecordAuthWithOTP(t *testing.T) {
 				if err := app.Save(otp); err != nil {
 					t.Fatal(err)
 				}
+
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextOTP {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextOTP, info.Context)
+					}
+
+					return e.Next()
+				})
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{

apis/record_auth_with_password.go

@@ -3,10 +3,14 @@ package apis
 import (
 	"database/sql"
 	"errors"
+	"slices"
+	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
@@ -28,16 +32,18 @@ func recordAuthWithPassword(e *core.RequestEvent) error {
 		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
 	}
 
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextPasswordAuth)
+
 	var foundRecord *core.Record
 	var foundErr error
 
 	if form.IdentityField != "" {
-		foundRecord, foundErr = e.App.FindFirstRecordByData(collection.Id, form.IdentityField, form.Identity)
+		foundRecord, foundErr = findRecordByIdentityField(e.App, collection, form.IdentityField, form.Identity)
 	} else {
 		// prioritize email lookup
 		isEmail := is.EmailFormat.Validate(form.Identity) == nil
 		if isEmail && list.ExistInSlice(core.FieldNameEmail, collection.PasswordAuth.IdentityFields) {
-			foundRecord, foundErr = e.App.FindAuthRecordByEmail(collection.Id, form.Identity)
+			foundRecord, foundErr = findRecordByIdentityField(e.App, collection, core.FieldNameEmail, form.Identity)
 		}
 
 		// search by the other identity fields
@@ -47,7 +53,7 @@ func recordAuthWithPassword(e *core.RequestEvent) error {
 					continue // no need to search by the email field if it is not an email
 				}
 
-				foundRecord, foundErr = e.App.FindFirstRecordByData(collection.Id, name, form.Identity)
+				foundRecord, foundErr = findRecordByIdentityField(e.App, collection, name, form.Identity)
 				if foundErr == nil {
 					break
 				}
@@ -92,6 +98,38 @@ func (form *authWithPasswordForm) validate(collection *core.Collection) error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.Identity, validation.Required, validation.Length(1, 255)),
 		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
-		validation.Field(&form.IdentityField, validation.In(list.ToInterfaceSlice(collection.PasswordAuth.IdentityFields)...)),
+		validation.Field(
+			&form.IdentityField,
+			validation.Length(1, 255),
+			validation.In(list.ToInterfaceSlice(collection.PasswordAuth.IdentityFields)...),
+		),
 	)
 }
+
+func findRecordByIdentityField(app core.App, collection *core.Collection, field string, value any) (*core.Record, error) {
+	if !slices.Contains(collection.PasswordAuth.IdentityFields, field) {
+		return nil, errors.New("invalid identity field " + field)
+	}
+
+	index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, field)
+	if !ok {
+		return nil, errors.New("missing " + field + " unique index constraint")
+	}
+
+	var expr dbx.Expression
+	if strings.EqualFold(index.Columns[0].Collate, "nocase") {
+		// case-insensitive search
+		expr = dbx.NewExp("[["+field+"]] = {:identity} COLLATE NOCASE", dbx.Params{"identity": value})
+	} else {
+		expr = dbx.HashExp{field: value}
+	}
+
+	record := &core.Record{}
+
+	err := app.RecordQuery(collection).AndWhere(expr).Limit(1).One(record)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}

apis/record_auth_with_password_test.go

@@ -8,11 +8,38 @@ import (
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 )
 
 func TestRecordAuthWithPassword(t *testing.T) {
 	t.Parallel()
 
+	updateIdentityIndex := func(collectionIdOrName string, fieldCollateMap map[string]string) func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+		return func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			collection, err := app.FindCollectionByNameOrId("clients")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			for column, collate := range fieldCollateMap {
+				index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, column)
+				if !ok {
+					t.Fatalf("Missing unique identityField index for column %q", column)
+				}
+
+				index.Columns[0].Collate = collate
+
+				collection.RemoveIndex(index.IndexName)
+				collection.Indexes = append(collection.Indexes, index.Build())
+			}
+
+			err = app.Save(collection)
+			if err != nil {
+				t.Fatalf("Failed to update identityField index: %v", err)
+			}
+		}
+	}
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "disabled password auth",
@@ -99,6 +126,21 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"identity":"test@example.com",
 				"password":"1234567890"
 			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextPasswordAuth {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextPasswordAuth, info.Context)
+					}
+
+					return e.Next()
+				})
+			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"email":"test@example.com"`,
@@ -164,6 +206,22 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnMailerRecordAuthAlertSend": 1,
 			},
 		},
+		{
+			Name:   "unknown explicit identityField",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "created",
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"identityField":{"code":"validation_in_invalid"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
 		{
 			Name:   "valid identity field and valid password with mismatched explicit identityField",
 			Method: http.MethodPost,
@@ -440,6 +498,141 @@ func TestRecordAuthWithPassword(t *testing.T) {
 			},
 		},
 
+		// case sensitivity checks
+		// -----------------------------------------------------------
+		{
+			Name:   "with explicit identityField (case-sensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc:  updateIdentityIndex("clients", map[string]string{"username": ""}),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:   "with explicit identityField (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "without explicit identityField and non-email field (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "without explicit identityField and email field (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"tESt@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"email": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+
 		// rate limit checks
 		// -----------------------------------------------------------
 		{

apis/record_crud.go

@@ -79,6 +79,11 @@ func recordsList(e *core.RequestEvent) error {
 
 	searchProvider := search.NewProvider(fieldsResolver).Query(query)
 
+	// use rowid when available to minimize the need of a covering index with the "id" field
+	if !collection.IsView() {
+		searchProvider.CountCol("_rowid_")
+	}
+
 	records := []*core.Record{}
 	result, err := searchProvider.ParseAndExec(e.Request.URL.Query().Encode(), &records)
 	if err != nil {
@@ -251,6 +256,73 @@ func recordCreate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 			}
 		}
 
+		// check the request and record data against the create and manage rules
+		if !hasSuperuserAuth && collection.CreateRule != nil {
+			dummyRecord := record.Clone()
+
+			dummyRandomPart := "__pb_create__" + security.PseudorandomString(6)
+
+			// set an id if it doesn't have already
+			// (the value doesn't matter; it is used only to minimize the breaking changes with earlier versions)
+			if dummyRecord.Id == "" {
+				dummyRecord.Id = "__temp_id__" + dummyRandomPart
+			}
+
+			// unset the verified field to prevent manage API rule misuse in case the rule relies on it
+			dummyRecord.SetVerified(false)
+
+			// export the dummy record data into db params
+			dummyExport, err := dummyRecord.DBExport(e.App)
+			if err != nil {
+				return e.BadRequestError("Failed to create record", fmt.Errorf("dummy DBExport error: %w", err))
+			}
+
+			dummyParams := make(dbx.Params, len(dummyExport))
+			selects := make([]string, 0, len(dummyExport))
+			var param string
+			for k, v := range dummyExport {
+				k = inflector.Columnify(k) // columnify is just as extra measure in case of custom fields
+				param = "__pb_create__" + k
+				dummyParams[param] = v
+				selects = append(selects, "{:"+param+"} AS [["+k+"]]")
+			}
+
+			// shallow clone the current collection
+			dummyCollection := *collection
+			dummyCollection.Id += dummyRandomPart
+			dummyCollection.Name += inflector.Columnify(dummyRandomPart)
+
+			withFrom := fmt.Sprintf("WITH {{%s}} as (SELECT %s)", dummyCollection.Name, strings.Join(selects, ","))
+
+			// check non-empty create rule
+			if *dummyCollection.CreateRule != "" {
+				ruleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+
+				resolver := core.NewRecordFieldResolver(e.App, &dummyCollection, requestInfo, true)
+
+				expr, err := search.FilterData(*dummyCollection.CreateRule).BuildExpr(resolver)
+				if err != nil {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule build expression failure: %w", err))
+				}
+				ruleQuery.AndWhere(expr)
+
+				resolver.UpdateQuery(ruleQuery)
+
+				var exists int
+				err = ruleQuery.Limit(1).Row(&exists)
+				if err != nil || exists == 0 {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule failure: %w", err))
+				}
+			}
+
+			// check for manage rule access
+			manageRuleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+			if !form.HasManageAccess() &&
+				hasAuthManageAccess(e.App, requestInfo, &dummyCollection, manageRuleQuery) {
+				form.GrantManagerAccess()
+			}
+		}
+
 		var isOptFinalizerCalled bool
 
 		event := new(core.RecordRequestEvent)
@@ -262,73 +334,6 @@ func recordCreate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 			form.SetApp(e.App)
 			form.SetRecord(e.Record)
 
-			// temporary save the record and check it against the create and manage rules
-			if !hasSuperuserAuth && e.Collection.CreateRule != nil {
-				dummyRecord := e.Record.Clone()
-
-				dummyRandomPart := "__pb_create__" + security.PseudorandomString(6)
-
-				// set an id if it doesn't have already
-				// (the value doesn't matter; it is used only to minimize the breaking changes with earlier versions)
-				if dummyRecord.Id == "" {
-					dummyRecord.Id = "__temp_id__" + dummyRandomPart
-				}
-
-				// unset the verified field to prevent manage API rule misuse in case the rule relies on it
-				dummyRecord.SetVerified(false)
-
-				// export the dummy record data into db params
-				dummyExport, err := dummyRecord.DBExport(e.App)
-				if err != nil {
-					return e.BadRequestError("Failed to create record", fmt.Errorf("dummy DBExport error: %w", err))
-				}
-
-				dummyParams := make(dbx.Params, len(dummyExport))
-				selects := make([]string, 0, len(dummyExport))
-				var param string
-				for k, v := range dummyExport {
-					k = inflector.Columnify(k) // columnify is just as extra measure in case of custom fields
-					param = "__pb_create__" + k
-					dummyParams[param] = v
-					selects = append(selects, "{:"+param+"} AS [["+k+"]]")
-				}
-
-				// shallow clone the current collection
-				dummyCollection := *e.Collection
-				dummyCollection.Id += dummyRandomPart
-				dummyCollection.Name += inflector.Columnify(dummyRandomPart)
-
-				withFrom := fmt.Sprintf("WITH {{%s}} as (SELECT %s)", dummyCollection.Name, strings.Join(selects, ","))
-
-				// check non-empty create rule
-				if *dummyCollection.CreateRule != "" {
-					ruleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
-
-					resolver := core.NewRecordFieldResolver(e.App, &dummyCollection, requestInfo, true)
-
-					expr, err := search.FilterData(*dummyCollection.CreateRule).BuildExpr(resolver)
-					if err != nil {
-						return e.BadRequestError("Failed to create record", fmt.Errorf("create rule build expression failure: %w", err))
-					}
-					ruleQuery.AndWhere(expr)
-
-					resolver.UpdateQuery(ruleQuery)
-
-					var exists bool
-					err = ruleQuery.Limit(1).Row(&exists)
-					if err != nil || !exists {
-						return e.BadRequestError("Failed to create record", fmt.Errorf("create rule failure: %w", err))
-					}
-				}
-
-				// check for manage rule access
-				manageRuleQuery := e.App.DB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
-				if !form.HasManageAccess() &&
-					hasAuthManageAccess(e.App, requestInfo, &dummyCollection, manageRuleQuery) {
-					form.GrantManagerAccess()
-				}
-			}
-
 			err := form.Submit()
 			if err != nil {
 				return firstApiError(err, e.BadRequestError("Failed to create record", err))
@@ -441,6 +446,14 @@ func recordUpdate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 		}
 		form.Load(data)
 
+		manageRuleQuery := e.App.DB().Select("(1)").From(collection.Name).AndWhere(dbx.HashExp{
+			collection.Name + ".id": record.Id,
+		})
+		if !form.HasManageAccess() &&
+			hasAuthManageAccess(e.App, requestInfo, collection, manageRuleQuery) {
+			form.GrantManagerAccess()
+		}
+
 		var isOptFinalizerCalled bool
 
 		event := new(core.RecordRequestEvent)
@@ -452,14 +465,6 @@ func recordUpdate(optFinalizer func(data any) error) func(e *core.RequestEvent)
 			form.SetApp(e.App)
 			form.SetRecord(e.Record)
 
-			manageRuleQuery := e.App.DB().Select("(1)").From(e.Collection.Name).AndWhere(dbx.HashExp{
-				e.Collection.Name + ".id": e.Record.Id,
-			})
-			if !form.HasManageAccess() &&
-				hasAuthManageAccess(e.App, requestInfo, e.Collection, manageRuleQuery) {
-				form.GrantManagerAccess()
-			}
-
 			err := form.Submit()
 			if err != nil {
 				return firstApiError(err, e.BadRequestError("Failed to update record.", err))
@@ -719,9 +724,9 @@ func hasAuthManageAccess(app core.App, requestInfo *core.RequestInfo, collection
 
 	resolver.UpdateQuery(query)
 
-	var exists bool
+	var exists int
 
 	err = query.Limit(1).Row(&exists)
 
-	return err == nil && exists
+	return err == nil && exists > 0
 }

apis/record_crud_test.go

@@ -1563,10 +1563,7 @@ func TestRecordCrudCreate(t *testing.T) {
 			Body:            strings.NewReader(`{"title":"test123"}`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnRecordCreateRequest": 1,
-			},
+			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "auth record submit in restricted collection (rule failure check)",
@@ -1579,10 +1576,7 @@ func TestRecordCrudCreate(t *testing.T) {
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnRecordCreateRequest": 1,
-			},
+			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "auth record submit in restricted collection (rule pass check) + expand relations",
@@ -1731,10 +1725,7 @@ func TestRecordCrudCreate(t *testing.T) {
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnRecordCreateRequest": 1,
-			},
+			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "submit via multipart form data with @jsonPayload key and satisfied @request.body rule",
@@ -1974,14 +1965,9 @@ func TestRecordCrudCreate(t *testing.T) {
 				"total+":4,
 				"total-":2
 			}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{}`,
-			},
-			ExpectedEvents: map[string]int{
-				"*":                     0,
-				"OnRecordCreateRequest": 1,
-			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
 		},
 		{
 			Name:   "@request.body.field with compute modifers (rule pass check)",

apis/record_helpers.go

@@ -146,7 +146,7 @@ func wantsMFA(e *core.RequestEvent, record *core.Record) (bool, error) {
 		return true, err
 	}
 
-	var exists bool
+	var exists int
 
 	query := e.App.RecordQuery(record.Collection()).
 		Select("(1)").
@@ -165,7 +165,7 @@ func wantsMFA(e *core.RequestEvent, record *core.Record) (bool, error) {
 		return true, err
 	}
 
-	return exists, nil
+	return exists > 0, nil
 }
 
 // checkMFA handles any MFA auth checks that needs to be performed for the specified request event.

apis/serve.go

@@ -86,7 +86,7 @@ func Serve(app core.App, config ServeConfig) error {
 
 			// add a default CSP
 			if e.Response.Header().Get("Content-Security-Policy") == "" {
-				e.Response.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' http://127.0.0.1:* data: blob:; connect-src 'self' http://127.0.0.1:*; script-src 'self' 'sha256-GRUzBA7PzKYug7pqxv5rJaec5bwDCw1Vo6/IXwvD3Tc='")
+				e.Response.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' http://127.0.0.1:* https://tile.openstreetmap.org data: blob:; connect-src 'self' http://127.0.0.1:* https://nominatim.openstreetmap.org; script-src 'self' 'sha256-GRUzBA7PzKYug7pqxv5rJaec5bwDCw1Vo6/IXwvD3Tc='")
 			}
 
 			return e.Next()
@@ -143,9 +143,9 @@ func Serve(app core.App, config ServeConfig) error {
 			NextProtos:     []string{acme.ALPNProto},
 		},
 		// higher defaults to accommodate large file uploads/downloads
-		WriteTimeout:      3 * time.Minute,
-		ReadTimeout:       3 * time.Minute,
-		ReadHeaderTimeout: 30 * time.Second,
+		WriteTimeout:      5 * time.Minute,
+		ReadTimeout:       5 * time.Minute,
+		ReadHeaderTimeout: 1 * time.Minute,
 		Addr:              mainAddr,
 		BaseContext: func(l net.Listener) context.Context {
 			return baseCtx
@@ -259,6 +259,7 @@ func Serve(app core.App, config ServeConfig) error {
 	}
 
 	if listener == nil {
+		//nolint:staticcheck
 		return errors.New("The OnServe finalizer wasn't invoked. Did you forget to call the ServeEvent.Next() method?")
 	}
 

cmd/superuser.go

@@ -36,16 +36,16 @@ func superuserUpsertCommand(app core.App) *cobra.Command {
 		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) != 2 {
-				return errors.New("Missing email and password arguments.")
+				return errors.New("missing email and password arguments")
 			}
 
 			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("Missing or invalid email address.")
+				return errors.New("missing or invalid email address")
 			}
 
 			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
 			if err != nil {
-				return fmt.Errorf("Failed to fetch %q collection: %w.", core.CollectionNameSuperusers, err)
+				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
 			}
 
 			superuser, err := app.FindAuthRecordByEmail(superusersCol, args[0])
@@ -57,7 +57,7 @@ func superuserUpsertCommand(app core.App) *cobra.Command {
 			superuser.SetPassword(args[1])
 
 			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("Failed to upsert superuser account: %w.", err)
+				return fmt.Errorf("failed to upsert superuser account: %w", err)
 			}
 
 			color.Green("Successfully saved superuser %q!", superuser.Email())
@@ -76,16 +76,16 @@ func superuserCreateCommand(app core.App) *cobra.Command {
 		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) != 2 {
-				return errors.New("Missing email and password arguments.")
+				return errors.New("missing email and password arguments")
 			}
 
 			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("Missing or invalid email address.")
+				return errors.New("missing or invalid email address")
 			}
 
 			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
 			if err != nil {
-				return fmt.Errorf("Failed to fetch %q collection: %w.", core.CollectionNameSuperusers, err)
+				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
 			}
 
 			superuser := core.NewRecord(superusersCol)
@@ -93,7 +93,7 @@ func superuserCreateCommand(app core.App) *cobra.Command {
 			superuser.SetPassword(args[1])
 
 			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("Failed to create new superuser account: %w.", err)
+				return fmt.Errorf("failed to create new superuser account: %w", err)
 			}
 
 			color.Green("Successfully created new superuser %q!", superuser.Email())
@@ -112,22 +112,22 @@ func superuserUpdateCommand(app core.App) *cobra.Command {
 		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) != 2 {
-				return errors.New("Missing email and password arguments.")
+				return errors.New("missing email and password arguments")
 			}
 
 			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("Missing or invalid email address.")
+				return errors.New("missing or invalid email address")
 			}
 
 			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
 			if err != nil {
-				return fmt.Errorf("Superuser with email %q doesn't exist.", args[0])
+				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
 			}
 
 			superuser.SetPassword(args[1])
 
 			if err := app.Save(superuser); err != nil {
-				return fmt.Errorf("Failed to change superuser %q password: %w.", superuser.Email(), err)
+				return fmt.Errorf("failed to change superuser %q password: %w", superuser.Email(), err)
 			}
 
 			color.Green("Successfully changed superuser %q password!", superuser.Email())
@@ -146,17 +146,17 @@ func superuserDeleteCommand(app core.App) *cobra.Command {
 		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("Invalid or missing email address.")
+				return errors.New("invalid or missing email address")
 			}
 
 			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
 			if err != nil {
-				color.Yellow("Superuser %q is missing or already deleted.", args[0])
+				color.Yellow("superuser %q is missing or already deleted", args[0])
 				return nil
 			}
 
 			if err := app.Delete(superuser); err != nil {
-				return fmt.Errorf("Failed to delete superuser %q: %w.", superuser.Email(), err)
+				return fmt.Errorf("failed to delete superuser %q: %w", superuser.Email(), err)
 			}
 
 			color.Green("Successfully deleted superuser %q!", superuser.Email())
@@ -175,16 +175,16 @@ func superuserOTPCommand(app core.App) *cobra.Command {
 		SilenceUsage: true,
 		RunE: func(command *cobra.Command, args []string) error {
 			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
-				return errors.New("Invalid or missing email address.")
+				return errors.New("invalid or missing email address")
 			}
 
 			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
 			if err != nil {
-				return fmt.Errorf("Superuser with email %q doesn't exist.", args[0])
+				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
 			}
 
 			if !superuser.Collection().OTP.Enabled {
-				return errors.New("OTP is not enabled for the _superusers collection.")
+				return errors.New("OTP auth is not enabled for the _superusers collection")
 			}
 
 			pass := security.RandomStringWithAlphabet(superuser.Collection().OTP.Length, "1234567890")
@@ -196,7 +196,7 @@ func superuserOTPCommand(app core.App) *cobra.Command {
 
 			err = app.Save(otp)
 			if err != nil {
-				return fmt.Errorf("Failed to create OTP: %w", err)
+				return fmt.Errorf("failed to create OTP: %w", err)
 			}
 
 			color.New(color.BgGreen, color.FgBlack).Printf("Successfully created OTP for superuser %q:", superuser.Email())

core/app.go

@@ -91,7 +91,7 @@ type App interface {
 	// after you are done working with it.
 	NewFilesystem() (*filesystem.System, error)
 
-	// NewFilesystem creates a new local or S3 filesystem instance
+	// NewBackupsFilesystem creates a new local or S3 filesystem instance
 	// for managing app backups based on the current app settings.
 	//
 	// NB! Make sure to call Close() on the returned result
@@ -323,10 +323,10 @@ type App interface {
 	// FindLogById finds a single Log entry by its id.
 	FindLogById(id string) (*Log, error)
 
-	// LogsStatsItem defines the total number of logs for a specific time period.
+	// LogsStatsItem returns hourly grouped logs statistics.
 	LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error)
 
-	// DeleteOldLogs delete all requests that are created before createdBefore.
+	// DeleteOldLogs delete all logs that are created before createdBefore.
 	DeleteOldLogs(createdBefore time.Time) error
 
 	// ---------------------------------------------------------------

core/base.go

@@ -26,6 +26,8 @@ import (
 	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
 )
 
 const (
@@ -659,7 +661,7 @@ func (app *BaseApp) NewFilesystem() (*filesystem.System, error) {
 	return filesystem.NewLocal(filepath.Join(app.DataDir(), LocalStorageDirName))
 }
 
-// NewFilesystem creates a new local or S3 filesystem instance
+// NewBackupsFilesystem creates a new local or S3 filesystem instance
 // for managing app backups based on the current app settings.
 //
 // NB! Make sure to call Close() on the returned result
@@ -1139,26 +1141,25 @@ func (app *BaseApp) initDataDB() error {
 	return nil
 }
 
-var sqlLogReplacements = map[string]string{
-	"{{":    "`",
-	"}}":    "`",
-	"[[":    "`",
-	"]]":    "`",
-	"<nil>": "NULL",
+var sqlLogReplacements = []struct {
+	pattern     *regexp.Regexp
+	replacement string
+}{
+	{regexp.MustCompile(`\[\[([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\]\]`), "`$1`.`$2`"},
+	{regexp.MustCompile(`\{\{([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\}\}`), "`$1`.`$2`"},
+	{regexp.MustCompile(`([^'"])\{\{`), "$1`"},
+	{regexp.MustCompile(`\}\}([^'"])`), "`$1"},
+	{regexp.MustCompile(`([^'"])\[\[`), "$1`"},
+	{regexp.MustCompile(`\]\]([^'"])`), "`$1"},
+	{regexp.MustCompile(`<nil>`), "NULL"},
 }
-var sqlLogPrefixedTableIdentifierPattern = regexp.MustCompile(`\[\[([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\]\]`)
-var sqlLogPrefixedColumnIdentifierPattern = regexp.MustCompile(`\{\{([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\}\}`)
 
 // normalizeSQLLog replaces common query builder charactes with their plain SQL version for easier debugging.
 // The query is still not suitable for execution and should be used only for log and debug purposes
 // (the normalization is done here to avoid breaking changes in dbx).
 func normalizeSQLLog(sql string) string {
-	sql = sqlLogPrefixedTableIdentifierPattern.ReplaceAllString(sql, "`$1`.`$2`")
-
-	sql = sqlLogPrefixedColumnIdentifierPattern.ReplaceAllString(sql, "`$1`.`$2`")
-
-	for old, new := range sqlLogReplacements {
-		sql = strings.ReplaceAll(sql, old, new)
+	for _, item := range sqlLogReplacements {
+		sql = item.pattern.ReplaceAllString(sql, item.replacement)
 	}
 
 	return sql
@@ -1191,6 +1192,33 @@ func (app *BaseApp) initAuxDB() error {
 	return nil
 }
 
+// @todo remove after refactoring the FilesManager interface
+func supportFiles(m Model) bool {
+	var collection *Collection
+	switch v := m.(type) {
+	case *Collection:
+		collection = v
+	case *Record:
+		collection = v.Collection()
+	case RecordProxy:
+		if v.ProxyRecord() != nil {
+			collection = v.ProxyRecord().Collection()
+		}
+	}
+
+	if collection == nil {
+		return true
+	}
+
+	for _, f := range collection.Fields {
+		if f.Type() == FieldTypeFile {
+			return true
+		}
+	}
+
+	return false
+}
+
 func (app *BaseApp) registerBaseHooks() {
 	deletePrefix := func(prefix string) error {
 		fs, err := app.NewFilesystem()
@@ -1207,26 +1235,44 @@ func (app *BaseApp) registerBaseHooks() {
 		return nil
 	}
 
+	maxFilesDeleteWorkers := cast.ToInt64(os.Getenv("PB_FILES_DELETE_MAX_WORKERS"))
+	if maxFilesDeleteWorkers <= 0 {
+		maxFilesDeleteWorkers = 2000 // the value is arbitrary chosen and may change in the future
+	}
+
+	deleteSem := semaphore.NewWeighted(maxFilesDeleteWorkers)
+
 	// try to delete the storage files from deleted Collection, Records, etc. model
 	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*ModelEvent]{
 		Id: "__pbFilesManagerDelete__",
 		Func: func(e *ModelEvent) error {
-			if m, ok := e.Model.(FilesManager); ok && m.BaseFilesPath() != "" {
+			if m, ok := e.Model.(FilesManager); ok && m.BaseFilesPath() != "" && supportFiles(e.Model) {
 				// ensure that there is a trailing slash so that the list iterator could start walking from the prefix dir
 				// (https://github.com/pocketbase/pocketbase/discussions/5246#discussioncomment-10128955)
 				prefix := strings.TrimRight(m.BaseFilesPath(), "/") + "/"
 
-				// run in the background for "optimistic" delete to avoid
-				// blocking the delete transaction
-				routine.FireAndForget(func() {
-					if err := deletePrefix(prefix); err != nil {
-						app.Logger().Error(
-							"Failed to delete storage prefix (non critical error; usually could happen because of S3 api limits)",
-							slog.String("prefix", prefix),
-							slog.String("error", err.Error()),
-						)
-					}
-				})
+				// note: for now assume no context cancellation
+				err := deleteSem.Acquire(context.Background(), 1)
+				if err != nil {
+					app.Logger().Error(
+						"Failed to delete storage prefix (couldn't acquire a worker)",
+						slog.String("prefix", prefix),
+						slog.String("error", err.Error()),
+					)
+				} else {
+					// run in the background for "optimistic" delete to avoid blocking the delete transaction
+					routine.FireAndForget(func() {
+						defer deleteSem.Release(1)
+
+						if err := deletePrefix(prefix); err != nil {
+							app.Logger().Error(
+								"Failed to delete storage prefix (non critical error; usually could happen because of S3 api limits)",
+								slog.String("prefix", prefix),
+								slog.String("error", err.Error()),
+							)
+						}
+					})
+				}
 			}
 
 			return e.Next()

core/collection_import_test.go

@@ -170,7 +170,7 @@ func TestImportCollections(t *testing.T) {
 				expectedCollectionFields := map[string]int{
 					core.CollectionNameAuthOrigins: 6,
 					"nologin":                      10,
-					"demo1":                        18,
+					"demo1":                        19,
 					"demo2":                        5,
 					"demo3":                        5,
 					"demo4":                        16,

core/collection_model.go

@@ -762,9 +762,9 @@ func (c *Collection) updateGeneratedIdIfExists(app App) {
 
 	// add a number to the current id (if already exists)
 	for i := 2; i < 1000; i++ {
-		var exists bool
+		var exists int
 		_ = app.CollectionQuery().Select("(1)").AndWhere(dbx.HashExp{"id": newId}).Limit(1).Row(&exists)
-		if !exists {
+		if exists == 0 {
 			break
 		}
 		newId = c.idChecksum() + strconv.Itoa(i)
@@ -989,7 +989,7 @@ func (c *Collection) initTokenKeyField() {
 	}
 
 	// ensure that there is a unique index for the field
-	if !dbutils.HasSingleColumnUniqueIndex(FieldNameTokenKey, c.Indexes) {
+	if _, ok := dbutils.FindSingleColumnUniqueIndex(c.Indexes, FieldNameTokenKey); !ok {
 		c.Indexes = append(c.Indexes, fmt.Sprintf(
 			"CREATE UNIQUE INDEX `%s` ON `%s` (`%s`)",
 			c.fieldIndexName(FieldNameTokenKey),
@@ -1015,7 +1015,7 @@ func (c *Collection) initEmailField() {
 	}
 
 	// ensure that there is a unique index for the email field
-	if !dbutils.HasSingleColumnUniqueIndex(FieldNameEmail, c.Indexes) {
+	if _, ok := dbutils.FindSingleColumnUniqueIndex(c.Indexes, FieldNameEmail); !ok {
 		c.Indexes = append(c.Indexes, fmt.Sprintf(
 			"CREATE UNIQUE INDEX `%s` ON `%s` (`%s`) WHERE `%s` != ''",
 			c.fieldIndexName(FieldNameEmail),

core/collection_model_test.go

@@ -1,9 +1,12 @@
 package core_test
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -11,6 +14,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -976,6 +980,280 @@ func TestCollectionDelete(t *testing.T) {
 	}
 }
 
+func TestCollectionModelEventSync(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	testCollections := make([]*core.Collection, 4)
+	for i := 0; i < 4; i++ {
+		testCollections[i] = core.NewBaseCollection("sync_test_" + strconv.Itoa(i))
+		if err := app.Save(testCollections[i]); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	createModelEvent := func() *core.ModelEvent {
+		event := new(core.ModelEvent)
+		event.App = app
+		event.Context = context.Background()
+		event.Type = "test_a"
+		event.Model = testCollections[0]
+		return event
+	}
+
+	createModelErrorEvent := func() *core.ModelErrorEvent {
+		event := new(core.ModelErrorEvent)
+		event.ModelEvent = *createModelEvent()
+		event.Error = errors.New("error_a")
+		return event
+	}
+
+	changeCollectionEventBefore := func(e *core.CollectionEvent) {
+		e.Type = "test_b"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 123)
+		e.Collection = testCollections[1]
+	}
+
+	modelEventFinalizerChange := func(e *core.ModelEvent) {
+		e.Type = "test_c"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 456)
+		e.Model = testCollections[2]
+	}
+
+	changeCollectionEventAfter := func(e *core.CollectionEvent) {
+		e.Type = "test_d"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 789)
+		e.Collection = testCollections[3]
+	}
+
+	expectedBeforeModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Model.PK() != testCollections[0].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[0].Id, e.Model.PK(), 0)
+		}
+	}
+
+	expectedAfterModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_d" {
+			t.Fatalf("Expected type %q, got %q", "test_d", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 789 {
+			t.Fatalf("Expected context value %v, got %v", 789, v)
+		}
+
+		if e.Model.PK() != testCollections[3].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[3].Id, e.Model.PK(), 3)
+		}
+	}
+
+	expectedBeforeCollectionEventHandlerChecks := func(t *testing.T, e *core.CollectionEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Collection.Id != testCollections[0].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[0].Id, e.Collection.Id, 0)
+		}
+	}
+
+	expectedAfterCollectionEventHandlerChecks := func(t *testing.T, e *core.CollectionEvent) {
+		if e.Type != "test_c" {
+			t.Fatalf("Expected type %q, got %q", "test_c", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 456 {
+			t.Fatalf("Expected context value %v, got %v", 456, v)
+		}
+
+		if e.Collection.Id != testCollections[2].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[2].Id, e.Collection.Id, 2)
+		}
+	}
+
+	modelEventFinalizer := func(e *core.ModelEvent) error {
+		modelEventFinalizerChange(e)
+		return nil
+	}
+
+	modelErrorEventFinalizer := func(e *core.ModelErrorEvent) error {
+		modelEventFinalizerChange(&e.ModelEvent)
+		e.Error = errors.New("error_c")
+		return nil
+	}
+
+	modelEventHandler := &hook.Handler[*core.ModelEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelEvent) error {
+			t.Run("before model", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, e)
+			})
+
+			_ = e.Next()
+
+			t.Run("after model", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, e)
+			})
+
+			return nil
+		},
+	}
+
+	modelErrorEventHandler := &hook.Handler[*core.ModelErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelErrorEvent) error {
+			t.Run("before model error", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_a", v)
+				}
+			})
+
+			_ = e.Next()
+
+			t.Run("after model error", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_d" {
+					t.Fatalf("Expected error %q, got %q", "error_d", v)
+				}
+			})
+
+			return nil
+		},
+	}
+
+	recordEventHandler := &hook.Handler[*core.CollectionEvent]{
+		Priority: -999,
+		Func: func(e *core.CollectionEvent) error {
+			t.Run("before collection", func(t *testing.T) {
+				expectedBeforeCollectionEventHandlerChecks(t, e)
+			})
+
+			changeCollectionEventBefore(e)
+
+			_ = e.Next()
+
+			t.Run("after collection", func(t *testing.T) {
+				expectedAfterCollectionEventHandlerChecks(t, e)
+			})
+
+			changeCollectionEventAfter(e)
+
+			return nil
+		},
+	}
+
+	collectionErrorEventHandler := &hook.Handler[*core.CollectionErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.CollectionErrorEvent) error {
+			t.Run("before collection error", func(t *testing.T) {
+				expectedBeforeCollectionEventHandlerChecks(t, &e.CollectionEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeCollectionEventBefore(&e.CollectionEvent)
+			e.Error = errors.New("error_b")
+
+			_ = e.Next()
+
+			t.Run("after collection error", func(t *testing.T) {
+				expectedAfterCollectionEventHandlerChecks(t, &e.CollectionEvent)
+				if v := e.Error.Error(); v != "error_c" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeCollectionEventAfter(&e.CollectionEvent)
+			e.Error = errors.New("error_d")
+
+			return nil
+		},
+	}
+
+	// OnModelValidate
+	app.OnCollectionValidate().Bind(recordEventHandler)
+	app.OnModelValidate().Bind(modelEventHandler)
+	app.OnModelValidate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreate
+	app.OnCollectionCreate().Bind(recordEventHandler)
+	app.OnModelCreate().Bind(modelEventHandler)
+	app.OnModelCreate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreateExecute
+	app.OnCollectionCreateExecute().Bind(recordEventHandler)
+	app.OnModelCreateExecute().Bind(modelEventHandler)
+	app.OnModelCreateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateSuccess
+	app.OnCollectionAfterCreateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterCreateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterCreateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateError
+	app.OnCollectionAfterCreateError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterCreateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterCreateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelUpdate
+	app.OnCollectionUpdate().Bind(recordEventHandler)
+	app.OnModelUpdate().Bind(modelEventHandler)
+	app.OnModelUpdate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelUpdateExecute
+	app.OnCollectionUpdateExecute().Bind(recordEventHandler)
+	app.OnModelUpdateExecute().Bind(modelEventHandler)
+	app.OnModelUpdateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateSuccess
+	app.OnCollectionAfterUpdateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterUpdateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterUpdateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateError
+	app.OnCollectionAfterUpdateError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterUpdateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterUpdateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelDelete
+	app.OnCollectionDelete().Bind(recordEventHandler)
+	app.OnModelDelete().Bind(modelEventHandler)
+	app.OnModelDelete().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelDeleteExecute
+	app.OnCollectionDeleteExecute().Bind(recordEventHandler)
+	app.OnModelDeleteExecute().Bind(modelEventHandler)
+	app.OnModelDeleteExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteSuccess
+	app.OnCollectionAfterDeleteSuccess().Bind(recordEventHandler)
+	app.OnModelAfterDeleteSuccess().Bind(modelEventHandler)
+	app.OnModelAfterDeleteSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteError
+	app.OnCollectionAfterDeleteError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterDeleteError().Bind(modelErrorEventHandler)
+	app.OnModelAfterDeleteError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+}
+
 func TestCollectionSaveModel(t *testing.T) {
 	t.Parallel()
 

core/collection_query.go

@@ -206,9 +206,9 @@ func (app *BaseApp) IsCollectionNameUnique(name string, excludeIds ...string) bo
 		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
 	}
 
-	var exists bool
+	var total int
 
-	return query.Row(&exists) == nil && !exists
+	return query.Row(&total) == nil && total == 0
 }
 
 // TruncateCollection deletes all records associated with the provided collection.
@@ -220,7 +220,7 @@ func (app *BaseApp) IsCollectionNameUnique(name string, excludeIds ...string) bo
 // cascade and file delete actions.
 func (app *BaseApp) TruncateCollection(collection *Collection) error {
 	if collection.IsView() {
-		return errors.New("view collections cannot be truncated since they don't store their own records.")
+		return errors.New("view collections cannot be truncated since they don't store their own records")
 	}
 
 	return app.RunInTransaction(func(txApp App) error {

core/collection_validate.go

@@ -34,7 +34,11 @@ func onCollectionValidate(e *CollectionEvent) error {
 		original,
 	)
 
-	return validator.run()
+	if err := validator.run(); err != nil {
+		return err
+	}
+
+	return e.Next()
 }
 
 func newCollectionValidator(ctx context.Context, app App, new, original *Collection) *collectionValidator {
@@ -456,7 +460,7 @@ func (cv *collectionValidator) checkFieldsForUniqueIndex(value any) error {
 				SetParams(map[string]any{"fieldName": name})
 		}
 
-		if !dbutils.HasSingleColumnUniqueIndex(name, cv.new.Indexes) {
+		if _, ok := dbutils.FindSingleColumnUniqueIndex(cv.new.Indexes, name); !ok {
 			return validation.NewError("validation_missing_unique_constraint", "The field {{.fieldName}} doesn't have a UNIQUE constraint.").
 				SetParams(map[string]any{"fieldName": name})
 		}
@@ -666,7 +670,7 @@ func (cv *collectionValidator) checkIndexes(value any) error {
 	if cv.new.IsAuth() {
 		requiredNames := []string{FieldNameTokenKey, FieldNameEmail}
 		for _, name := range requiredNames {
-			if !dbutils.HasSingleColumnUniqueIndex(name, indexes) {
+			if _, ok := dbutils.FindSingleColumnUniqueIndex(indexes, name); !ok {
 				return validation.NewError(
 					"validation_missing_required_unique_index",
 					`Missing required unique index for field "{{.fieldName}}".`,

core/db.go

@@ -116,8 +116,7 @@ func (app *BaseApp) delete(ctx context.Context, model Model, isForAuxDB bool) er
 
 	deleteErr := app.OnModelDelete().Trigger(event, func(e *ModelEvent) error {
 		pk := cast.ToString(e.Model.LastSavedPK())
-
-		if cast.ToString(pk) == "" {
+		if pk == "" {
 			return errors.New("the model can be deleted only if it is existing and has a non-empty primary key")
 		}
 
@@ -483,7 +482,7 @@ func validateRecordId(app App, collectionNameOrId string) validation.RuleFunc {
 			return validation.NewError("validation_invalid_collection", "Missing or invalid collection.")
 		}
 
-		var exists bool
+		var exists int
 
 		rowErr := app.DB().Select("(1)").
 			From(collection.Name).
@@ -491,7 +490,7 @@ func validateRecordId(app App, collectionNameOrId string) validation.RuleFunc {
 			Limit(1).
 			Row(&exists)
 
-		if rowErr != nil || !exists {
+		if rowErr != nil || exists == 0 {
 			return validation.NewError("validation_invalid_record", "Missing or invalid record.")
 		}
 

core/db_table.go

@@ -108,7 +108,7 @@ func (app *BaseApp) AuxHasTable(tableName string) bool {
 }
 
 func (app *BaseApp) hasTable(db dbx.Builder, tableName string) bool {
-	var exists bool
+	var exists int
 
 	err := db.Select("(1)").
 		From("sqlite_schema").
@@ -117,7 +117,7 @@ func (app *BaseApp) hasTable(db dbx.Builder, tableName string) bool {
 		Limit(1).
 		Row(&exists)
 
-	return err == nil && exists
+	return err == nil && exists > 0
 }
 
 // Vacuum executes VACUUM on the current app.DB() instance

core/event_request.go

@@ -154,8 +154,10 @@ const (
 	RequestInfoContextExpand        = "expand"
 	RequestInfoContextRealtime      = "realtime"
 	RequestInfoContextProtectedFile = "protectedFile"
-	RequestInfoContextOAuth2        = "oauth2"
 	RequestInfoContextBatch         = "batch"
+	RequestInfoContextOAuth2        = "oauth2"
+	RequestInfoContextOTP           = "otp"
+	RequestInfoContextPasswordAuth  = "password"
 )
 
 // RequestInfo defines a HTTP request data struct, usually used

core/events.go

@@ -277,7 +277,7 @@ func syncModelErrorEventWithRecordErrorEvent(me *ModelErrorEvent, re *RecordErro
 
 func syncRecordErrorEventWithModelErrorEvent(re *RecordErrorEvent, me *ModelErrorEvent) {
 	syncRecordEventWithModelEvent(&re.RecordEvent, &me.ModelEvent)
-	me.Error = re.Error
+	re.Error = me.Error
 }
 
 // -------------------------------------------------------------------
@@ -354,7 +354,7 @@ func syncModelErrorEventWithCollectionErrorEvent(me *ModelErrorEvent, ce *Collec
 
 func syncCollectionErrorEventWithModelErrorEvent(ce *CollectionErrorEvent, me *ModelErrorEvent) {
 	syncCollectionEventWithModelEvent(&ce.CollectionEvent, &me.ModelEvent)
-	me.Error = ce.Error
+	ce.Error = me.Error
 }
 
 // -------------------------------------------------------------------

core/field_file.go

@@ -5,6 +5,7 @@ import (
 	"database/sql/driver"
 	"errors"
 	"fmt"
+	"log"
 	"regexp"
 	"strings"
 
@@ -637,7 +638,13 @@ func (f *FileField) FindGetter(key string) GetterFunc {
 		return func(record *Record) any {
 			return record.GetRaw(f.Name)
 		}
+	case f.Name + ":unsaved":
+		return func(record *Record) any {
+			return f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
+		}
 	case f.Name + ":uploaded":
+		// deprecated
+		log.Println("[file field getter] please replace :uploaded with :unsaved")
 		return func(record *Record) any {
 			return f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
 		}

core/field_file_test.go

@@ -672,8 +672,8 @@ func TestFileFieldFindGetter(t *testing.T) {
 			`["300_UhLKX91HVb.png",{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
 		},
 		{
-			"uploaded",
-			field.GetName() + ":uploaded",
+			"unsaved",
+			field.GetName() + ":unsaved",
 			true,
 			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
 		},

core/field_geo_point.go

@@ -0,0 +1,148 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeGeoPoint] = func() Field {
+		return &GeoPointField{}
+	}
+}
+
+const FieldTypeGeoPoint = "geoPoint"
+
+var (
+	_ Field = (*GeoPointField)(nil)
+)
+
+// GeoPointField defines "geoPoint" type field for storing latitude and longitude GPS coordinates.
+//
+// You can set the record field value as [types.GeoPoint], map or serialized json object with lat-lon props.
+// The stored value is always converted to [types.GeoPoint].
+// Nil, empty map, empty bytes slice, etc. results in zero [types.GeoPoint].
+//
+// Examples of updating a record's GeoPointField value programmatically:
+//
+//	record.Set("location", types.GeoPoint{Lat: 123, Lon: 456})
+//	record.Set("location", map[string]any{"lat":123, "lon":456})
+//	record.Set("location", []byte(`{"lat":123, "lon":456}`)
+type GeoPointField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Required will require the field coordinates to be non-zero (aka. not "Null Island").
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *GeoPointField) Type() string {
+	return FieldTypeGeoPoint
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *GeoPointField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *GeoPointField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *GeoPointField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *GeoPointField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *GeoPointField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *GeoPointField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *GeoPointField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *GeoPointField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *GeoPointField) ColumnType(app App) string {
+	return `JSON DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *GeoPointField) PrepareValue(record *Record, raw any) (any, error) {
+	point := types.GeoPoint{}
+	err := point.Scan(raw)
+	return point, err
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *GeoPointField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(types.GeoPoint)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	// zero value
+	if val.Lat == 0 && val.Lon == 0 {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil
+	}
+
+	if val.Lat < -90 || val.Lat > 90 {
+		return validation.NewError("validation_invalid_latitude", "Latitude must be between -90 and 90 degrees.")
+	}
+
+	if val.Lon < -180 || val.Lon > 180 {
+		return validation.NewError("validation_invalid_longitude", "Longitude must be between -180 and 180 degrees.")
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *GeoPointField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+	)
+}

core/field_geo_point_test.go

@@ -0,0 +1,202 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestGeoPointFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeGeoPoint)
+}
+
+func TestGeoPointFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.GeoPointField{}
+
+	expected := `JSON DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestGeoPointFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.GeoPointField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{nil, `{"lon":0,"lat":0}`},
+		{"", `{"lon":0,"lat":0}`},
+		{[]byte{}, `{"lon":0,"lat":0}`},
+		{map[string]any{}, `{"lon":0,"lat":0}`},
+		{types.GeoPoint{Lon: 10, Lat: 20}, `{"lon":10,"lat":20}`},
+		{&types.GeoPoint{Lon: 10, Lat: 20}, `{"lon":10,"lat":20}`},
+		{[]byte(`{"lon": 10, "lat": 20}`), `{"lon":10,"lat":20}`},
+		{map[string]any{"lon": 10, "lat": 20}, `{"lon":10,"lat":20}`},
+		{map[string]float64{"lon": 10, "lat": 20}, `{"lon":10,"lat":20}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestGeoPointFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.GeoPointField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (non-required)",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{})
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{})
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero Lat field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: 1})
+				return record
+			},
+			false,
+		},
+		{
+			"non-zero Lon field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: 1})
+				return record
+			},
+			false,
+		},
+		{
+			"non-zero Lat-Lon field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: -1, Lat: -2})
+				return record
+			},
+			false,
+		},
+		{
+			"lat < -90",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: -90.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lat > 90",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: 90.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lon < -180",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: -180.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lon > 180",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: 180.1})
+				return record
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestGeoPointFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeGeoPoint)
+	testDefaultFieldNameValidation(t, core.FieldTypeGeoPoint)
+}

core/field_text.go

@@ -193,14 +193,14 @@ func (f *TextField) ValidateValue(ctx context.Context, app App, record *Record)
 			//
 			// (@todo eventually may get replaced in the future with a system unique constraint to avoid races or wrapping the request in a transaction)
 			if f.Pattern != defaultLowercaseRecordIdPattern {
-				var exists bool
+				var exists int
 				err := app.DB().
 					Select("(1)").
 					From(record.TableName()).
-					Where(dbx.NewExp("id = {:id} COLLATE NOCASE", dbx.Params{"id": strings.ToLower(newVal)})).
+					Where(dbx.NewExp("id = {:id} COLLATE NOCASE", dbx.Params{"id": newVal})).
 					Limit(1).
 					Row(&exists)
-				if exists || (err != nil && !errors.Is(err, sql.ErrNoRows)) {
+				if exists > 0 || (err != nil && !errors.Is(err, sql.ErrNoRows)) {
 					return validation.NewError("validation_pk_invalid", "The record primary key is invalid or already exists.")
 				}
 			}

core/log_query.go

@@ -34,7 +34,7 @@ type LogsStatsItem struct {
 	Total int            `db:"total" json:"total"`
 }
 
-// LogsStats returns hourly grouped requests logs statistics.
+// LogsStats returns hourly grouped logs statistics.
 func (app *BaseApp) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
 	result := []*LogsStatsItem{}
 
@@ -51,7 +51,7 @@ func (app *BaseApp) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
 	return result, err
 }
 
-// DeleteOldLogs delete all requests that are created before createdBefore.
+// DeleteOldLogs delete all logs that are created before createdBefore.
 //
 // For better performance the logs delete is executed as plain SQL statement,
 // aka. no delete model hook events will be fired.

core/migrations_runner.go

@@ -5,9 +5,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/fatih/color"
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 	"github.com/spf13/cast"
 )
 
@@ -80,15 +80,11 @@ func (r *MigrationsRunner) Run(args ...string) error {
 			return err
 		}
 
-		confirm := false
-		prompt := &survey.Confirm{
-			Message: fmt.Sprintf(
-				"\n%v\nDo you really want to revert the last %d applied migration(s)?",
-				strings.Join(names, "\n"),
-				toRevertCount,
-			),
-		}
-		survey.AskOne(prompt, &confirm)
+		confirm := osutils.YesNoPrompt(fmt.Sprintf(
+			"\n%v\nDo you really want to revert the last %d applied migration(s)?",
+			strings.Join(names, "\n"),
+			toRevertCount,
+		), false)
 		if !confirm {
 			fmt.Println("The command has been cancelled")
 			return nil
@@ -116,7 +112,7 @@ func (r *MigrationsRunner) Run(args ...string) error {
 		color.Green("The %s table was synced with the available migrations.", r.tableName)
 		return nil
 	default:
-		return fmt.Errorf("Unsupported command: %q\n", cmd)
+		return fmt.Errorf("unsupported command: %q", cmd)
 	}
 }
 
@@ -155,12 +151,12 @@ func (r *MigrationsRunner) Up() ([]string, error) {
 				// ignore empty Up action
 				if m.Up != nil {
 					if err := m.Up(txApp); err != nil {
-						return fmt.Errorf("Failed to apply migration %s: %w", m.File, err)
+						return fmt.Errorf("failed to apply migration %s: %w", m.File, err)
 					}
 				}
 
 				if err := r.saveAppliedMigration(txApp, m.File); err != nil {
-					return fmt.Errorf("Failed to save applied migration info for %s: %w", m.File, err)
+					return fmt.Errorf("failed to save applied migration info for %s: %w", m.File, err)
 				}
 
 				applied = append(applied, m.File)
@@ -208,12 +204,12 @@ func (r *MigrationsRunner) Down(toRevertCount int) ([]string, error) {
 					// ignore empty Down action
 					if m.Down != nil {
 						if err := m.Down(txApp); err != nil {
-							return fmt.Errorf("Failed to revert migration %s: %w", m.File, err)
+							return fmt.Errorf("failed to revert migration %s: %w", m.File, err)
 						}
 					}
 
 					if err := r.saveRevertedMigration(txApp, m.File); err != nil {
-						return fmt.Errorf("Failed to save reverted migration info for %s: %w", m.File, err)
+						return fmt.Errorf("failed to save reverted migration info for %s: %w", m.File, err)
 					}
 
 					reverted = append(reverted, m.File)
@@ -267,15 +263,15 @@ func (r *MigrationsRunner) initMigrationsTable() error {
 }
 
 func (r *MigrationsRunner) isMigrationApplied(txApp App, file string) bool {
-	var exists bool
+	var exists int
 
-	err := txApp.DB().Select("count(*)").
+	err := txApp.DB().Select("(1)").
 		From(r.tableName).
 		Where(dbx.HashExp{"file": file}).
 		Limit(1).
 		Row(&exists)
 
-	return err == nil && exists
+	return err == nil && exists > 0
 }
 
 func (r *MigrationsRunner) saveAppliedMigration(txApp App, file string) error {

core/migrations_runner_test.go

@@ -200,38 +200,13 @@ func TestMigrationsRunnerRemoveMissingAppliedMigrations(t *testing.T) {
 }
 
 func isMigrationApplied(app core.App, file string) bool {
-	var exists bool
+	var exists int
 
-	err := app.DB().Select("count(*)").
+	err := app.DB().Select("(1)").
 		From(core.DefaultMigrationsTable).
 		Where(dbx.HashExp{"file": file}).
 		Limit(1).
 		Row(&exists)
 
-	return err == nil && exists
+	return err == nil && exists > 0
 }
-
-// // -------------------------------------------------------------------
-
-// type testDB struct {
-// 	*dbx.DB
-// 	CalledQueries []string
-// }
-
-// // NB! Don't forget to call `db.Close()` at the end of the test.
-// func createTestDB() (*testDB, error) {
-// 	sqlDB, err := sql.Open("sqlite", ":memory:")
-// 	if err != nil {
-// 		return nil, err
-// 	}
-
-// 	db := testDB{DB: dbx.NewFromDB(sqlDB, "sqlite")}
-// 	db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
-// 		db.CalledQueries = append(db.CalledQueries, sql)
-// 	}
-// 	db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
-// 		db.CalledQueries = append(db.CalledQueries, sql)
-// 	}
-
-// 	return &db, nil
-// }

core/record_field_resolver.go

@@ -11,6 +11,7 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )
 
@@ -300,6 +301,13 @@ func extractNestedVal(rawData any, keys ...string) (any, error) {
 		return mapVal(m, keys...)
 	case mapExtractor:
 		return mapVal(m.AsMap(), keys...)
+	case types.JSONRaw:
+		var raw any
+		err := json.Unmarshal(m, &raw)
+		if err != nil {
+			return nil, fmt.Errorf("failed to unmarshal raw JSON in order extract nested value from: %w", err)
+		}
+		return extractNestedVal(raw, keys...)
 
 	// slices
 	case []string:
@@ -338,6 +346,8 @@ func extractNestedVal(rawData any, keys ...string) (any, error) {
 		return arrVal(extracted, keys...)
 	case []any:
 		return arrVal(m, keys...)
+	case []types.JSONRaw:
+		return arrVal(m, keys...)
 	default:
 		return nil, fmt.Errorf("expected map or array, got %#v", rawData)
 	}

core/record_field_resolver_runner.go

@@ -419,8 +419,9 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 			return nil, fmt.Errorf("non-filterable field %q", prop)
 		}
 
-		// json field -> treat the rest of the props as json path
-		if field != nil && field.Type() == FieldTypeJSON {
+		// json or geoPoint field -> treat the rest of the props as json path
+		// @todo consider converting to "JSONExtractable" interface with optional extra validation for the remaining props?
+		if field != nil && (field.Type() == FieldTypeJSON || field.Type() == FieldTypeGeoPoint) {
 			var jsonPath strings.Builder
 			for j, p := range r.activeProps[i+1:] {
 				if _, err := strconv.Atoi(p); err == nil {
@@ -479,7 +480,11 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 				}
 				return nil, fmt.Errorf("missing back relation field %q", parts[2])
 			}
+
 			if backField.Type() != FieldTypeRelation {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
 				return nil, fmt.Errorf("invalid back relation field %q", parts[2])
 			}
 
@@ -492,7 +497,11 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 				return nil, fmt.Errorf("failed to initialize back relation field %q", backField.GetName())
 			}
 			if backRelField.CollectionId != collection.Id {
-				return nil, fmt.Errorf("invalid back relation field %q collection reference", backField.GetName())
+				// https://github.com/pocketbase/pocketbase/discussions/6590#discussioncomment-12496581
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("invalid collection reference of a back relation field %q", backField.GetName())
 			}
 
 			// join the back relation to the main query
@@ -505,7 +514,8 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 			isBackRelMultiple := backRelField.IsMultiple()
 			if !isBackRelMultiple {
 				// additionally check if the rel field has a single column unique index
-				isBackRelMultiple = !dbutils.HasSingleColumnUniqueIndex(backRelField.Name, backCollection.Indexes)
+				_, hasUniqueIndex := dbutils.FindSingleColumnUniqueIndex(backCollection.Indexes, backRelField.Name)
+				isBackRelMultiple = !hasUniqueIndex
 			}
 
 			if !isBackRelMultiple {

core/record_model.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 	"maps"
 	"slices"
 	"sort"
@@ -968,25 +969,32 @@ func (m *Record) GetDateTime(key string) types.DateTime {
 	return d
 }
 
+// GetGeoPoint returns the data value for "key" as a GeoPoint instance.
+func (m *Record) GetGeoPoint(key string) types.GeoPoint {
+	point := types.GeoPoint{}
+	_ = point.Scan(m.Get(key))
+	return point
+}
+
 // GetStringSlice returns the data value for "key" as a slice of non-zero unique strings.
 func (m *Record) GetStringSlice(key string) []string {
 	return list.ToUniqueStringSlice(m.Get(key))
 }
 
-// GetUploadedFiles returns the uploaded files for the provided "file" field key,
+// GetUnsavedFiles returns the uploaded files for the provided "file" field key,
 // (aka. the current [*filesytem.File] values) so that you can apply further
 // validations or modifications (including changing the file name or content before persisting).
 //
 // Example:
 //
-//	files := record.GetUploadedFiles("documents")
+//	files := record.GetUnsavedFiles("documents")
 //	for _, f := range files {
 //	    f.Name = "doc_" + f.Name // add a prefix to each file name
 //	}
 //	app.Save(record) // the files are pointers so the applied changes will transparently reflect on the record value
-func (m *Record) GetUploadedFiles(key string) []*filesystem.File {
-	if !strings.HasSuffix(key, ":uploaded") {
-		key += ":uploaded"
+func (m *Record) GetUnsavedFiles(key string) []*filesystem.File {
+	if !strings.HasSuffix(key, ":unsaved") {
+		key += ":unsaved"
 	}
 
 	values, _ := m.Get(key).([]*filesystem.File)
@@ -994,6 +1002,12 @@ func (m *Record) GetUploadedFiles(key string) []*filesystem.File {
 	return values
 }
 
+// Deprecated: replaced with GetUnsavedFiles.
+func (m *Record) GetUploadedFiles(key string) []*filesystem.File {
+	log.Println("Please replace GetUploadedFiles with GetUnsavedFiles")
+	return m.GetUnsavedFiles(key)
+}
+
 // Retrieves the "key" json field value and unmarshals it into "result".
 //
 // Example

core/record_model_test.go

@@ -5,9 +5,11 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"regexp"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -16,6 +18,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )
@@ -1013,7 +1016,44 @@ func TestRecordGetStringSlice(t *testing.T) {
 	}
 }
 
-func TestRecordGetUploadedFiles(t *testing.T) {
+func TestRecordGetGeoPoint(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected string
+	}{
+		{nil, `{"lon":0,"lat":0}`},
+		{"", `{"lon":0,"lat":0}`},
+		{0, `{"lon":0,"lat":0}`},
+		{false, `{"lon":0,"lat":0}`},
+		{"{}", `{"lon":0,"lat":0}`},
+		{"[]", `{"lon":0,"lat":0}`},
+		{[]int{1, 2}, `{"lon":0,"lat":0}`},
+		{map[string]any{"lon": 1, "lat": 2}, `{"lon":1,"lat":2}`},
+		{[]byte(`{"lon":1,"lat":2}`), `{"lon":1,"lat":2}`},
+		{`{"lon":1,"lat":2}`, `{"lon":1,"lat":2}`},
+		{types.GeoPoint{Lon: 1, Lat: 2}, `{"lon":1,"lat":2}`},
+		{&types.GeoPoint{Lon: 1, Lat: 2}, `{"lon":1,"lat":2}`},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			pointStr := record.GetGeoPoint("test").String()
+
+			if pointStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, pointStr)
+			}
+		})
+	}
+}
+
+func TestRecordGetUnsavedFiles(t *testing.T) {
 	t.Parallel()
 
 	app, _ := tests.NewTestApp()
@@ -1054,14 +1094,14 @@ func TestRecordGetUploadedFiles(t *testing.T) {
 			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
 		},
 		{
-			"files:uploaded",
+			"files:unsaved",
 			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
 		},
 	}
 
 	for i, s := range scenarios {
 		t.Run(fmt.Sprintf("%d_%#v", i, s.key), func(t *testing.T) {
-			v := record.GetUploadedFiles(s.key)
+			v := record.GetUnsavedFiles(s.key)
 
 			raw, err := json.Marshal(v)
 			if err != nil {
@@ -1618,6 +1658,288 @@ func TestRecordValidate(t *testing.T) {
 	})
 }
 
+func TestRecordModelEventSync(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	col, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testRecords := make([]*core.Record, 4)
+	for i := 0; i < 4; i++ {
+		testRecords[i] = core.NewRecord(col)
+		testRecords[i].Set("title", "sync_test_"+strconv.Itoa(i))
+		if err := app.Save(testRecords[i]); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	createModelEvent := func() *core.ModelEvent {
+		event := new(core.ModelEvent)
+		event.App = app
+		event.Context = context.Background()
+		event.Type = "test_a"
+		event.Model = testRecords[0]
+		return event
+	}
+
+	createModelErrorEvent := func() *core.ModelErrorEvent {
+		event := new(core.ModelErrorEvent)
+		event.ModelEvent = *createModelEvent()
+		event.Error = errors.New("error_a")
+		return event
+	}
+
+	changeRecordEventBefore := func(e *core.RecordEvent) {
+		e.Type = "test_b"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 123)
+		e.Record = testRecords[1]
+	}
+
+	modelEventFinalizerChange := func(e *core.ModelEvent) {
+		e.Type = "test_c"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 456)
+		e.Model = testRecords[2]
+	}
+
+	changeRecordEventAfter := func(e *core.RecordEvent) {
+		e.Type = "test_d"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 789)
+		e.Record = testRecords[3]
+	}
+
+	expectedBeforeModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Model.PK() != testRecords[0].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[0].Id, e.Model.PK(), 0)
+		}
+	}
+
+	expectedAfterModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_d" {
+			t.Fatalf("Expected type %q, got %q", "test_d", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 789 {
+			t.Fatalf("Expected context value %v, got %v", 789, v)
+		}
+
+		// note: currently the Model and Record values are not synced due to performance consideration
+		if e.Model.PK() != testRecords[2].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[2].Id, e.Model.PK(), 2)
+		}
+	}
+
+	expectedBeforeRecordEventHandlerChecks := func(t *testing.T, e *core.RecordEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Record.Id != testRecords[0].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[0].Id, e.Record.Id, 2)
+		}
+	}
+
+	expectedAfterRecordEventHandlerChecks := func(t *testing.T, e *core.RecordEvent) {
+		if e.Type != "test_c" {
+			t.Fatalf("Expected type %q, got %q", "test_c", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 456 {
+			t.Fatalf("Expected context value %v, got %v", 456, v)
+		}
+
+		// note: currently the Model and Record values are not synced due to performance consideration
+		if e.Record.Id != testRecords[1].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[1].Id, e.Record.Id, 1)
+		}
+	}
+
+	modelEventFinalizer := func(e *core.ModelEvent) error {
+		modelEventFinalizerChange(e)
+		return nil
+	}
+
+	modelErrorEventFinalizer := func(e *core.ModelErrorEvent) error {
+		modelEventFinalizerChange(&e.ModelEvent)
+		e.Error = errors.New("error_c")
+		return nil
+	}
+
+	modelEventHandler := &hook.Handler[*core.ModelEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelEvent) error {
+			t.Run("before model", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, e)
+			})
+
+			_ = e.Next()
+
+			t.Run("after model", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, e)
+			})
+
+			return nil
+		},
+	}
+
+	modelErrorEventHandler := &hook.Handler[*core.ModelErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelErrorEvent) error {
+			t.Run("before model error", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_a", v)
+				}
+			})
+
+			_ = e.Next()
+
+			t.Run("after model error", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_d" {
+					t.Fatalf("Expected error %q, got %q", "error_d", v)
+				}
+			})
+
+			return nil
+		},
+	}
+
+	recordEventHandler := &hook.Handler[*core.RecordEvent]{
+		Priority: -999,
+		Func: func(e *core.RecordEvent) error {
+			t.Run("before record", func(t *testing.T) {
+				expectedBeforeRecordEventHandlerChecks(t, e)
+			})
+
+			changeRecordEventBefore(e)
+
+			_ = e.Next()
+
+			t.Run("after record", func(t *testing.T) {
+				expectedAfterRecordEventHandlerChecks(t, e)
+			})
+
+			changeRecordEventAfter(e)
+
+			return nil
+		},
+	}
+
+	recordErrorEventHandler := &hook.Handler[*core.RecordErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.RecordErrorEvent) error {
+			t.Run("before record error", func(t *testing.T) {
+				expectedBeforeRecordEventHandlerChecks(t, &e.RecordEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeRecordEventBefore(&e.RecordEvent)
+			e.Error = errors.New("error_b")
+
+			_ = e.Next()
+
+			t.Run("after record error", func(t *testing.T) {
+				expectedAfterRecordEventHandlerChecks(t, &e.RecordEvent)
+				if v := e.Error.Error(); v != "error_c" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeRecordEventAfter(&e.RecordEvent)
+			e.Error = errors.New("error_d")
+
+			return nil
+		},
+	}
+
+	// OnModelValidate
+	app.OnRecordValidate().Bind(recordEventHandler)
+	app.OnModelValidate().Bind(modelEventHandler)
+	app.OnModelValidate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreate
+	app.OnRecordCreate().Bind(recordEventHandler)
+	app.OnModelCreate().Bind(modelEventHandler)
+	app.OnModelCreate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreateExecute
+	app.OnRecordCreateExecute().Bind(recordEventHandler)
+	app.OnModelCreateExecute().Bind(modelEventHandler)
+	app.OnModelCreateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateSuccess
+	app.OnRecordAfterCreateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterCreateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterCreateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateError
+	app.OnRecordAfterCreateError().Bind(recordErrorEventHandler)
+	app.OnModelAfterCreateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterCreateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelUpdate
+	app.OnRecordUpdate().Bind(recordEventHandler)
+	app.OnModelUpdate().Bind(modelEventHandler)
+	app.OnModelUpdate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelUpdateExecute
+	app.OnRecordUpdateExecute().Bind(recordEventHandler)
+	app.OnModelUpdateExecute().Bind(modelEventHandler)
+	app.OnModelUpdateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateSuccess
+	app.OnRecordAfterUpdateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterUpdateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterUpdateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateError
+	app.OnRecordAfterUpdateError().Bind(recordErrorEventHandler)
+	app.OnModelAfterUpdateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterUpdateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelDelete
+	app.OnRecordDelete().Bind(recordEventHandler)
+	app.OnModelDelete().Bind(modelEventHandler)
+	app.OnModelDelete().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelDeleteExecute
+	app.OnRecordDeleteExecute().Bind(recordEventHandler)
+	app.OnModelDeleteExecute().Bind(modelEventHandler)
+	app.OnModelDeleteExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteSuccess
+	app.OnRecordAfterDeleteSuccess().Bind(recordEventHandler)
+	app.OnModelAfterDeleteSuccess().Bind(modelEventHandler)
+	app.OnModelAfterDeleteSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteError
+	app.OnRecordAfterDeleteError().Bind(recordErrorEventHandler)
+	app.OnModelAfterDeleteError().Bind(modelErrorEventHandler)
+	app.OnModelAfterDeleteError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+}
+
 func TestRecordSave(t *testing.T) {
 	t.Parallel()
 

core/record_query.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/search"
@@ -527,20 +528,34 @@ func (app *BaseApp) FindAuthRecordByToken(token string, validTypes ...string) (*
 
 // FindAuthRecordByEmail finds the auth record associated with the provided email.
 //
+// The email check would be case-insensitive if the related collection
+// email unique index has COLLATE NOCASE specified for the email column.
+//
 // Returns an error if it is not an auth collection or the record is not found.
 func (app *BaseApp) FindAuthRecordByEmail(collectionModelOrIdentifier any, email string) (*Record, error) {
 	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch auth collection: %w", err)
 	}
+
 	if !collection.IsAuth() {
 		return nil, fmt.Errorf("%q is not an auth collection", collection.Name)
 	}
 
 	record := &Record{}
 
+	var expr dbx.Expression
+
+	index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, FieldNameEmail)
+	if ok && strings.EqualFold(index.Columns[0].Collate, "nocase") {
+		// case-insensitive search
+		expr = dbx.NewExp("[["+FieldNameEmail+"]] = {:email} COLLATE NOCASE", dbx.Params{"email": email})
+	} else {
+		expr = dbx.HashExp{FieldNameEmail: email}
+	}
+
 	err = app.RecordQuery(collection).
-		AndWhere(dbx.HashExp{FieldNameEmail: email}).
+		AndWhere(expr).
 		Limit(1).
 		One(record)
 	if err != nil {
@@ -584,7 +599,7 @@ func (app *BaseApp) CanAccessRecord(record *Record, requestInfo *RequestInfo, ac
 		return true, nil
 	}
 
-	var exists bool
+	var exists int
 
 	query := app.RecordQuery(record.Collection()).
 		Select("(1)").
@@ -603,5 +618,5 @@ func (app *BaseApp) CanAccessRecord(record *Record, requestInfo *RequestInfo, ac
 		return false, err
 	}
 
-	return exists, nil
+	return exists > 0, nil
 }

core/record_query_expand.go

@@ -143,7 +143,7 @@ func (app *BaseApp) expandRecords(records []*Record, expandPath string, fetchFun
 			MaxSelect:    2147483647,
 			CollectionId: indirectRel.Id,
 		}
-		if dbutils.HasSingleColumnUniqueIndex(indirectRelField.GetName(), indirectRel.Indexes) {
+		if _, ok := dbutils.FindSingleColumnUniqueIndex(indirectRel.Indexes, indirectRelField.GetName()); ok {
 			relField.MaxSelect = 1
 		}
 		relCollection = indirectRel

core/record_query_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -966,23 +967,46 @@ func TestFindAuthRecordByToken(t *testing.T) {
 func TestFindAuthRecordByEmail(t *testing.T) {
 	t.Parallel()
 
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
 	scenarios := []struct {
 		collectionIdOrName string
 		email              string
+		nocaseIndex        bool
 		expectError        bool
 	}{
-		{"missing", "test@example.com", true},
-		{"demo2", "test@example.com", true},
-		{"users", "missing@example.com", true},
-		{"users", "test@example.com", false},
-		{"clients", "test2@example.com", false},
+		{"missing", "test@example.com", false, true},
+		{"demo2", "test@example.com", false, true},
+		{"users", "missing@example.com", false, true},
+		{"users", "test@example.com", false, false},
+		{"clients", "test2@example.com", false, false},
+		// case-insensitive tests
+		{"clients", "TeSt2@example.com", false, true},
+		{"clients", "TeSt2@example.com", true, false},
 	}
 
 	for _, s := range scenarios {
 		t.Run(fmt.Sprintf("%s_%s", s.collectionIdOrName, s.email), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, _ := app.FindCollectionByNameOrId(s.collectionIdOrName)
+			if collection != nil {
+				emailIndex, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, core.FieldNameEmail)
+				if ok {
+					if s.nocaseIndex {
+						emailIndex.Columns[0].Collate = "nocase"
+					} else {
+						emailIndex.Columns[0].Collate = ""
+					}
+
+					collection.RemoveIndex(emailIndex.IndexName)
+					collection.Indexes = append(collection.Indexes, emailIndex.Build())
+					err := app.Save(collection)
+					if err != nil {
+						t.Fatalf("Failed to update email index: %v", err)
+					}
+				}
+			}
+
 			record, err := app.FindAuthRecordByEmail(s.collectionIdOrName, s.email)
 
 			hasErr := err != nil
@@ -994,7 +1018,7 @@ func TestFindAuthRecordByEmail(t *testing.T) {
 				return
 			}
 
-			if record.Email() != s.email {
+			if !strings.EqualFold(record.Email(), s.email) {
 				t.Fatalf("Expected record with email %s, got %s", s.email, record.Email())
 			}
 		})

core/record_tokens.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 

core/validators/db.go

@@ -50,7 +50,6 @@ func NormalizeUniqueIndexError(err error, tableOrAlias string, fieldNames []stri
 		return err
 	}
 
-	//
 	if _, ok := err.(validation.Errors); ok {
 		return err
 	}
@@ -59,12 +58,15 @@ func NormalizeUniqueIndexError(err error, tableOrAlias string, fieldNames []stri
 
 	// check for unique constraint failure
 	if strings.Contains(msg, "unique constraint failed") {
+		// note: extra space to unify multi-columns lookup
+		msg = strings.ReplaceAll(strings.TrimSpace(msg), ",", " ") + " "
+
 		normalizedErrs := validation.Errors{}
-		msg = strings.ReplaceAll(strings.TrimSpace(msg), ",", " ")
 
 		for _, name := range fieldNames {
-			// blank space to unify multi-columns lookup
-			if strings.Contains(msg+" ", strings.ToLower(tableOrAlias+"."+name)) {
+			// note: extra spaces to exclude table name with suffix matching the current one
+			// 		 OR other fields starting with the current field name
+			if strings.Contains(msg, strings.ToLower(" "+tableOrAlias+"."+name+" ")) {
 				normalizedErrs[name] = validation.NewError("validation_not_unique", "Value must be unique")
 			}
 		}

core/validators/db_test.go

@@ -78,6 +78,13 @@ func TestNormalizeUniqueIndexError(t *testing.T) {
 			[]string{"a", "b"},
 			nil,
 		},
+		{
+			"unique index error with table name suffix matching the specified one",
+			errors.New("UNIQUE constraint failed for fields test_suffix.a,test_suffix.b"),
+			"suffix",
+			[]string{"a", "b", "c"},
+			nil,
+		},
 		{
 			"unique index error but mismatched fields",
 			errors.New("UNIQUE constraint failed for fields test.a,test.b"),
@@ -92,6 +99,13 @@ func TestNormalizeUniqueIndexError(t *testing.T) {
 			[]string{"a", "b", "c"},
 			[]string{"a", "b"},
 		},
+		{
+			"unique index error with matching table name and field starting with the name of another non-unique field",
+			errors.New("UNIQUE constraint failed for fields test.a_2,test.c"),
+			"test",
+			[]string{"a", "a_2", "c"},
+			[]string{"a_2", "c"},
+		},
 	}
 
 	for _, s := range scenarios {

core/view.go

@@ -437,9 +437,11 @@ func getQueryTableInfo(app App, selectQuery string) ([]*TableInfoRow, error) {
 // Raw query identifiers parser
 // -------------------------------------------------------------------
 
-var joinReplaceRegex = regexp.MustCompile(`(?im)\s+(full\s+outer\s+join|left\s+outer\s+join|right\s+outer\s+join|full\s+join|cross\s+join|inner\s+join|outer\s+join|left\s+join|right\s+join|join)\s+?`)
-var discardReplaceRegex = regexp.MustCompile(`(?im)\s+(where|group\s+by|having|order|limit|with)\s+?`)
-var commentsReplaceRegex = regexp.MustCompile(`(?m)(\/\*[\s\S]+\*\/)|(--.+$)`)
+var (
+	joinReplaceRegex     = regexp.MustCompile(`(?im)\s+(full\s+outer\s+join|left\s+outer\s+join|right\s+outer\s+join|full\s+join|cross\s+join|inner\s+join|outer\s+join|left\s+join|right\s+join|join)\s+?`)
+	discardReplaceRegex  = regexp.MustCompile(`(?im)\s+(where|group\s+by|having|order|limit|with)\s+?`)
+	commentsReplaceRegex = regexp.MustCompile(`(?m)(\/\*[\s\S]*?\*\/)|(--.+$)`)
+)
 
 type identifier struct {
 	original string
@@ -453,9 +455,9 @@ type identifiersParser struct {
 
 func (p *identifiersParser) parse(selectQuery string) error {
 	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
-	str = joinReplaceRegex.ReplaceAllString(str, " _join_ ")
-	str = discardReplaceRegex.ReplaceAllString(str, " _discard_ ")
-	str = commentsReplaceRegex.ReplaceAllString(str, "")
+	str = commentsReplaceRegex.ReplaceAllString(str, " ")
+	str = joinReplaceRegex.ReplaceAllString(str, " __pb_join__ ")
+	str = discardReplaceRegex.ReplaceAllString(str, " __pb_discard__ ")
 
 	tk := tokenizer.NewFromString(str)
 	tk.Separators(',', ' ', '\n', '\t')
@@ -490,7 +492,7 @@ func (p *identifiersParser) parse(selectQuery string) error {
 			skip = false
 			partType = "from"
 			activeBuilder = &fromParts
-		case "_join_":
+		case "__pb_join__":
 			skip = false
 
 			// the previous part was also a join
@@ -500,7 +502,7 @@ func (p *identifiersParser) parse(selectQuery string) error {
 
 			partType = "join"
 			activeBuilder = &joinParts
-		case "_discard_":
+		case "__pb_discard__":
 			// skip following tokens
 			skip = true
 		default:

core/view_test.go

@@ -246,11 +246,21 @@ func TestCreateViewFields(t *testing.T) {
 			`
 				select
 				-- test single line
-				id,
-				text,
+				demo1.id,
+				demo1.text,
 				/* multi
-					line comment */
-				url, created, updated from demo1
+				 * line comment block */
+				demo1.url, demo1.created, demo1.updated from/* inline comment block with no spaces between the identifiers */demo1
+				-- comment before join
+				join demo2 ON (
+					-- comment inside join
+					demo2.id = demo1.id
+				)
+				-- comment before where
+				where (
+					-- comment inside where
+					demo2.id = demo1.id
+				)
 			`,
 			false,
 			map[string]string{

examples/base/main.go

@@ -36,7 +36,7 @@ func main() {
 		&hooksWatch,
 		"hooksWatch",
 		true,
-		"auto restart the app on pb_hooks file change",
+		"auto restart the app on pb_hooks file change; it has no effect on Windows",
 	)
 
 	var hooksPool int
@@ -76,7 +76,7 @@ func main() {
 		&indexFallback,
 		"indexFallback",
 		true,
-		"fallback the request to index.html on missing static path (eg. when pretty urls are used with SPA)",
+		"fallback the request to index.html on missing static path, e.g. when pretty urls are used with SPA",
 	)
 
 	app.RootCmd.ParseFlags(os.Args[1:])

forms/apple_client_secret_create.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/pocketbase/pocketbase/core"
 )
 

forms/apple_client_secret_create_test.go

@@ -9,7 +9,7 @@ import (
 	"encoding/pem"
 	"testing"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/tests"
 )

forms/record_upsert.go

@@ -27,9 +27,10 @@ type RecordUpsert struct {
 	accessLevel int
 
 	// extra password fields
-	password        string
-	passwordConfirm string
-	oldPassword     string
+	disablePasswordValidations bool
+	password                   string
+	passwordConfirm            string
+	oldPassword                string
 }
 
 // NewRecordUpsert creates a new [RecordUpsert] form from the provided [core.App] and [core.Record] instances
@@ -130,6 +131,8 @@ func (form *RecordUpsert) validateFormFields() error {
 		return nil
 	}
 
+	form.syncPasswordFields()
+
 	isNew := form.record.IsNew()
 
 	original := form.record.Original()
@@ -165,17 +168,17 @@ func (form *RecordUpsert) validateFormFields() error {
 			validation.Key(
 				"password",
 				validation.When(
-					(isNew || form.passwordConfirm != "" || form.oldPassword != ""),
+					!form.disablePasswordValidations && (isNew || form.passwordConfirm != "" || form.oldPassword != ""),
 					validation.Required,
 				),
 			),
 			validation.Key(
 				"passwordConfirm",
 				validation.When(
-					(isNew || form.password != "" || form.oldPassword != ""),
+					!form.disablePasswordValidations && (isNew || form.password != "" || form.oldPassword != ""),
 					validation.Required,
 				),
-				validation.By(validators.Equal(form.password)),
+				validation.When(!form.disablePasswordValidations, validation.By(validators.Equal(form.password))),
 			),
 			validation.Key(
 				"oldPassword",
@@ -183,7 +186,7 @@ func (form *RecordUpsert) validateFormFields() error {
 				// - form.HasManageAccess() is not satisfied
 				// - changing the existing password
 				validation.When(
-					!isNew && !form.HasManageAccess() && (form.password != "" || form.passwordConfirm != ""),
+					!form.disablePasswordValidations && !isNew && !form.HasManageAccess() && (form.password != "" || form.passwordConfirm != ""),
 					validation.Required,
 					validation.By(form.checkOldPassword),
 				),
@@ -287,3 +290,27 @@ func (form *RecordUpsert) Submit() error {
 	// run record validations and persist in db
 	return form.app.SaveWithContext(form.ctx, form.record)
 }
+
+// syncPasswordFields syncs the form's auth password fields with their
+// corresponding record field values.
+//
+// This could be useful in case the password fields were programmatically set
+// directly by modifying the related record model.
+func (form *RecordUpsert) syncPasswordFields() {
+	if !form.record.Collection().IsAuth() {
+		return // not an auth collection
+	}
+
+	form.disablePasswordValidations = false
+
+	rawPassword := form.record.GetRaw(core.FieldNamePassword)
+	if v, ok := rawPassword.(*core.PasswordFieldValue); ok && v != nil {
+		if
+		// programmatically set custom plain password value
+		(v.Plain != "" && v.Plain != form.password) ||
+			// random generated password for new record
+			(v.Plain == "" && v.Hash != "" && form.record.IsNew()) {
+			form.disablePasswordValidations = true
+		}
+	}
+}

forms/record_upsert_test.go

@@ -887,6 +887,119 @@ func TestRecordUpsertSubmitSuccess(t *testing.T) {
 	testFilesCount(t, testApp, record, 2) // the file + attrs
 }
 
+func TestRecordUpsertPasswordsSync(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	users, err := testApp.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("new user without password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		err := form.Submit()
+
+		tests.TestValidationErrors(t, err, []string{"password", "passwordConfirm"})
+	})
+
+	t.Run("new user with manual password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetPassword("1234567890")
+
+		err := form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+	})
+
+	t.Run("new user with random password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetRandomPassword()
+
+		err := form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+	})
+
+	t.Run("update user with no password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash != oldHash {
+			t.Fatal("Expected no password change")
+		}
+	})
+
+	t.Run("update user with manual password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetPassword("1234567890")
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash == oldHash {
+			t.Fatal("Expected password change")
+		}
+	})
+
+	t.Run("update user with random password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetRandomPassword()
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash == oldHash {
+			t.Fatal("Expected password change")
+		}
+	})
+}
+
 // -------------------------------------------------------------------
 
 func testFilesCount(t *testing.T, app core.App, record *core.Record, count int) {

go.mod

@@ -1,86 +1,50 @@
 module github.com/pocketbase/pocketbase
 
-go 1.23
+go 1.23.0
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/aws/aws-sdk-go-v2 v1.32.7
-	github.com/aws/aws-sdk-go-v2/config v1.28.7
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.48
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1
-	github.com/aws/smithy-go v1.22.1
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.6.2
-	github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3
-	github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc
+	github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c
+	github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0
 	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/gabriel-vasile/mimetype v1.4.7
-	github.com/ganigeorgiev/fexpr v0.4.1
+	github.com/gabriel-vasile/mimetype v1.4.8
+	github.com/ganigeorgiev/fexpr v0.5.0
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
-	github.com/golang-jwt/jwt/v4 v4.5.1
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/pocketbase/dbx v1.11.0
 	github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119
 	github.com/spf13/cast v1.7.1
-	github.com/spf13/cobra v1.8.1
-	gocloud.dev v0.40.0
-	golang.org/x/crypto v0.31.0
-	golang.org/x/net v0.33.0
-	golang.org/x/oauth2 v0.24.0
-	golang.org/x/sync v0.10.0
-	modernc.org/sqlite v1.34.4
+	github.com/spf13/cobra v1.9.1
+	golang.org/x/crypto v0.37.0
+	golang.org/x/image v0.26.0
+	golang.org/x/net v0.39.0
+	golang.org/x/oauth2 v0.29.0
+	golang.org/x/sync v0.13.0
+	modernc.org/sqlite v1.37.0
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 // indirect
-	github.com/dlclark/regexp2 v1.11.4 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
+	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
-	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/testify v1.8.2 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/image v0.23.0 // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/tools v0.28.0 // indirect
-	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.214.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def // indirect
-	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.1 // indirect
-	modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d // indirect
-	modernc.org/libc v1.55.3 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/tools v0.32.0 // indirect
+	modernc.org/libc v1.62.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.8.0 // indirect
-	modernc.org/strutil v1.2.1 // indirect
-	modernc.org/token v1.1.0 // indirect
+	modernc.org/memory v1.9.1 // indirect
 )

go.sum

@@ -1,182 +1,60 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
-cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.13.0 h1:8Fu8TZy167JkW8Tj3q7dIkr2v4cndv41ouecJx0PAHs=
-cloud.google.com/go/auth v0.13.0/go.mod h1:COOjD9gwfKNKz+IIduatIhYJQIc0mG3H102r/EMxX6Q=
-cloud.google.com/go/auth/oauth2adapt v0.2.6 h1:V6a6XDu2lTwPZWOawrAa9HUK+DB2zfJyTuciBG5hFkU=
-cloud.google.com/go/auth/oauth2adapt v0.2.6/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
-cloud.google.com/go/iam v1.1.13 h1:7zWBXG9ERbMLrzQBRhFliAV+kjcRToDTgQT3CTwYyv4=
-cloud.google.com/go/iam v1.1.13/go.mod h1:K8mY0uSXwEXS30KrnVb+j54LB/ntfZu1dr+4zFMNbus=
-cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyXFs=
-cloud.google.com/go/storage v1.43.0/go.mod h1:ajvxEa7WmZS1PxvKRq4bq0tFT3vMd502JwstCcYv0Q0=
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
-github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
 github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
-github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
-github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.32.7 h1:ky5o35oENWi0JYWUZkB7WYvVPP+bcRF5/Iq7JWSb5Rw=
-github.com/aws/aws-sdk-go-v2 v1.32.7/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
-github.com/aws/aws-sdk-go-v2/config v1.28.7 h1:GduUnoTXlhkgnxTD93g1nv4tVPILbdNQOzav+Wpg7AE=
-github.com/aws/aws-sdk-go-v2/config v1.28.7/go.mod h1:vZGX6GVkIE8uECSUHB6MWAUsd4ZcG2Yq/dMa4refR3M=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.48 h1:IYdLD1qTJ0zanRavulofmqut4afs45mOWEI+MzZtTfQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.48/go.mod h1:tOscxHN3CGmuX9idQ3+qbkzrjVIx32lqDSU1/0d/qXs=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 h1:kqOrpojG71DxJm/KDPO+Z/y1phm1JlC8/iT+5XRmAn8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22/go.mod h1:NtSFajXVVL8TA2QNngagVZmUtXciyrHOt7xgz4faS/M=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44 h1:2zxMLXLedpB4K1ilbJFxtMKsVKaexOqDttOhc0QGm3Q=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.44/go.mod h1:VuLHdqwjSvgftNC7yqPWyGVhEwPmJpeRi07gOgOfHF8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 h1:I/5wmGMffY4happ8NOCuIUEWGUvvFp5NSeQcXl9RHcI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26/go.mod h1:FR8f4turZtNy6baO0KJ5FJUmXH/cSkI9fOngs0yl6mA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 h1:zXFLuEuMMUOvEARXFUVJdfqZ4bvvSgdGRq/ATcrQxzM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26/go.mod h1:3o2Wpy0bogG1kyOPrgkXA8pgIfEEv0+m19O9D5+W8y8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26 h1:GeNJsIFHB+WW5ap2Tec4K6dzcVTsRbsT1Lra46Hv9ME=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.26/go.mod h1:zfgMpwHDXX2WGoG84xG2H+ZlPTkJUU4YUvx2svLQYWo=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7 h1:tB4tNw83KcajNAzaIMhkhVI2Nt8fAZd5A5ro113FEMY=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.7/go.mod h1:lvpyBGkZ3tZ9iSsUIcC2EWp+0ywa7aK3BLT+FwZi+mQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 h1:8eUsivBQzZHqe/3FE+cqwfH+0p5Jo8PFM/QYQSmeZ+M=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7/go.mod h1:kLPQvGUmxn/fqiCrDeohwG33bq2pQpGeY62yRO6Nrh0=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7 h1:Hi0KGbrnr57bEHWM0bJ1QcBzxLrL/k2DHvGYhb8+W1w=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.7/go.mod h1:wKNgWgExdjjrm4qvfbTorkvocEstaoDl4WCvGfeCy9c=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1 h1:aOVVZJgWbaH+EJYPvEgkNhCEbXXvH7+oML36oaPK3zE=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1/go.mod h1:r+xl5yzMk9083rMR+sJ5TYj9Tihvf/l1oxzZXDgGj2Q=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 h1:CvuUmnXI7ebaUAhbJcDy9YQx8wHR69eZ9I7q5hszt/g=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.8/go.mod h1:XDeGv1opzwm8ubxddF0cgqkZWsyOtw4lr6dxwmb6YQg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 h1:F2rBfNAL5UyswqoeWv9zs74N/NanhK16ydHW1pahX6E=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7/go.mod h1:JfyQ0g2JG8+Krq0EuZNnRwX0mU0HrwY/tG6JNfcqh4k=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 h1:Xgv/hyNgvLda/M9l9qxXc4UFSgppnRczLxlMs5Ae/QY=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.3/go.mod h1:5Gn+d+VaaRgsjewpMvGazt0WfcFO+Md4wLOuBfGR9Bc=
-github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
-github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
-github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
-github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
-github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 h1:16iT9CBDOniJwFGPI41MbUDfEk74hFaKTqudrX8kenY=
 github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217/go.mod h1:eIb+f24U+eWQCIsj9D/ah+MD9UP+wdxuqzsdLD+mhGM=
-github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3 h1:MXsAuToxwsTn5BEEYm2DheqIiC4jWGmkEJ1uy+KFhvQ=
-github.com/dop251/goja v0.0.0-20241009100908-5f46f2705ca3/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
-github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc h1:MKYt39yZJi0Z9xEeRmDX2L4ocE0ETKcHKw6MVL3R+co=
-github.com/dop251/goja_nodejs v0.0.0-20240728170619-29b559befffc/go.mod h1:VULptt4Q/fNzQUJlqY/GP3qHyU7ZH46mFkBZe0ZTokU=
+github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c h1:mxWGS0YyquJ/ikZOjSrRjjFIbUqIP9ojyYQ+QZTU3Rg=
+github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
+github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0 h1:jTwdYTGERaZ/3+glBUVQZV2NwGodd9HlkXJbTBUPLLo=
+github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0/go.mod h1:Tb7Xxye4LX7cT3i8YLvmPMGCV92IOi4CDZvm/V8ylc0=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
-github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
-github.com/ganigeorgiev/fexpr v0.4.1 h1:hpUgbUEEWIZhSDBtf4M9aUNfQQ0BZkGRaMePy7Gcx5k=
-github.com/ganigeorgiev/fexpr v0.4.1/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
+github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
 github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
-github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
-github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
-github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
-github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
-github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
-github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
-github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
-github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
-github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
-github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
-github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -185,7 +63,6 @@ github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU
 github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
 github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119 h1:TjQtEReJDTpvlNFTRjuHvPQpJHAeJdcQF130eCAAT/o=
 github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
@@ -193,177 +70,68 @@ github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/f
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 h1:r6I7RJCN86bpD/FQwedZ0vSixDpwuWREjW9oRMsmqDc=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
-go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
-go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
-go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
-go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
-go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
-go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
-go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
-go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
-go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
-go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
-gocloud.dev v0.40.0 h1:f8LgP+4WDqOG/RXoUcyLpeIAGOcAbZrZbDQCUee10ng=
-gocloud.dev v0.40.0/go.mod h1:drz+VyYNBvrMTW0KZiBAYEdl8lbNZx+OQ7oQvdrFmSQ=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
+golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.23.0 h1:HseQ7c2OpPKTPVzNjG5fwJsOTCiiwS4QdsYi5XU6H68=
-golang.org/x/image v0.23.0/go.mod h1:wJJBTdLfCCf3tiHa1fNxpZmUI4mmoZvwMCPP0ddoNKY=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/image v0.26.0 h1:4XjIFEZWQmCZi6Wv8BoxsDhRU3RVnLX04dToTDAEPlY=
+golang.org/x/image v0.26.0/go.mod h1:lcxbMFAovzpnJxzXS3nyL83K27tmqtKzIJpctK8YO5c=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
-golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-google.golang.org/api v0.214.0 h1:h2Gkq07OYi6kusGOaT/9rnNljuXmqPnaig7WGPmKbwA=
-google.golang.org/api v0.214.0/go.mod h1:bYPpLG8AyeMWwDU6NXoB00xC0DFkikVvd5MfwoxjLqE=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
+golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
+google.golang.org/appengine v1.6.5 h1:tycE03LOZYQNhDpS27tcQdAzLCVMaj7QT2SXxebnpCM=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988 h1:CT2Thj5AuPV9phrYMtzX11k+XkzMGfRAet42PmoTATM=
-google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988/go.mod h1:7uvplUBj4RjHAxIZ//98LzOvrQ04JBkaixRmCMI29hc=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def h1:4P81qv5JXI/sDNae2ClVx88cgDDA6DPilADkG9tYKz8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241230172942-26aa7a208def/go.mod h1:bdAgzvd4kFrpykc5/AC2eLUiegK9T/qxZHD4hXYf/ho=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
-google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-modernc.org/cc/v4 v4.21.4 h1:3Be/Rdo1fpr8GrQ7IVw9OHtplU4gWbb+wNgeoBMmGLQ=
-modernc.org/cc/v4 v4.21.4/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
-modernc.org/ccgo/v4 v4.19.2 h1:lwQZgvboKD0jBwdaeVCTouxhxAyN6iawF3STraAal8Y=
-modernc.org/ccgo/v4 v4.19.2/go.mod h1:ysS3mxiMV38XGRTTcgo0DQTeTmAO4oCmJl1nX9VFI3s=
+modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
+modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
+modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
 modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
 modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/gc/v2 v2.4.1 h1:9cNzOqPyMJBvrUipmynX0ZohMhcxPtMccYgGOJdOiBw=
-modernc.org/gc/v2 v2.4.1/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
-modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d h1:d0JExN5U5FjUVHCP6L9DIlLJBZveR6KUM4AvfDUL3+k=
-modernc.org/gc/v3 v3.0.0-20241223112719-96e2e1e4408d/go.mod h1:qBSLm/exCqouT2hrfyTKikWKG9IPq8EoX5fS00l3jqk=
-modernc.org/libc v1.55.3 h1:AzcW1mhlPNrRtjS5sS+eW2ISCgSOLLNyFzRh/V3Qj/U=
-modernc.org/libc v1.55.3/go.mod h1:qFXepLhz+JjFThQ4kzwzOjA/y/artDeg+pcYnY+Q83w=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
+modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
-modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
-modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
-modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
-modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.34.4 h1:sjdARozcL5KJBvYQvLlZEmctRgW9xqIZc2ncN7PU0P8=
-modernc.org/sqlite v1.34.4/go.mod h1:3QQFCG2SEMtc2nv+Wq4cQCH7Hjcg+p/RMlS1XK+zwbk=
+modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
+modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
+modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

golangci.yml

@@ -1,28 +1,27 @@
+version: "2"
 run:
   go: 1.23
   concurrency: 4
   timeout: 10m
-
 linters:
-  disable-all: true
+  default: none
   enable:
     - asasalint
     - asciicheck
-    - gofmt
-    - goimports
     - gomodguard
     - goprintffuncname
-    - gosimple
     - govet
     - ineffassign
     - misspell
     - nakedret
     - nolintlint
     - prealloc
-    - prealloc
     - reassign
     - staticcheck
-    - typecheck
     - unconvert
     - unused
     - whitespace
+formatters:
+  enable:
+    - gofmt
+    - goimports

modernc_versions_check.go

@@ -10,8 +10,8 @@ import (
 )
 
 const (
-	expectedDriverVersion = "v1.34.4"
-	expectedLibcVersion   = "v1.55.3"
+	expectedDriverVersion = "v1.37.0"
+	expectedLibcVersion   = "v1.62.1"
 
 	// ModerncDepsCheckHookId is the id of the hook that performs the modernc.org/* deps checks.
 	// It could be used for removing/unbinding the hook if you don't want the checks.

plugins/ghupdate/ghupdate.go

@@ -20,10 +20,10 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/fatih/color"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 	"github.com/spf13/cobra"
 )
 
@@ -121,11 +121,7 @@ func (p *plugin) updateCmd() *cobra.Command {
 			}
 
 			if needConfirm {
-				confirm := false
-				prompt := &survey.Confirm{
-					Message: "Do you want to proceed with the update?",
-				}
-				survey.AskOne(prompt, &confirm)
+				confirm := osutils.YesNoPrompt("Do you want to proceed with the update?", false)
 				if !confirm {
 					fmt.Println("The command has been cancelled.")
 					return nil
@@ -208,13 +204,13 @@ func (p *plugin) update(withBackup bool) error {
 		// try again with an .exe extension
 		newExec = newExec + ".exe"
 		if _, fallbackErr := os.Stat(newExec); fallbackErr != nil {
-			return fmt.Errorf("The executable in the extracted path is missing or it is inaccessible: %v, %v", err, fallbackErr)
+			return fmt.Errorf("the executable in the extracted path is missing or it is inaccessible: %v, %v", err, fallbackErr)
 		}
 	}
 
 	// rename the current executable
 	if err := os.Rename(oldExec, renamedOldExec); err != nil {
-		return fmt.Errorf("Failed to rename the current executable: %w", err)
+		return fmt.Errorf("failed to rename the current executable: %w", err)
 	}
 
 	tryToRevertExecChanges := func() {
@@ -231,7 +227,7 @@ func (p *plugin) update(withBackup bool) error {
 	// replace with the extracted binary
 	if err := os.Rename(newExec, oldExec); err != nil {
 		tryToRevertExecChanges()
-		return fmt.Errorf("Failed replacing the executable: %w", err)
+		return fmt.Errorf("failed replacing the executable: %w", err)
 	}
 
 	if withBackup {

plugins/jsvm/binds.go

@@ -13,12 +13,13 @@ import (
 	"path/filepath"
 	"reflect"
 	"slices"
+	"sort"
 	"strings"
 	"time"
 
 	"github.com/dop251/goja"
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
@@ -58,7 +59,7 @@ func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 		loader.Set(jsName, func(callback string, tags ...string) {
 			// overwrite the global $app with the hook scoped instance
 			callback = `function(e) { $app = e.app; return (` + callback + `).call(undefined, e) }`
-			pr := goja.MustCompile("", "{("+callback+").apply(undefined, __args)}", true)
+			pr := goja.MustCompile(defaultScriptPath, "{("+callback+").apply(undefined, __args)}", true)
 
 			tagsAsValues := make([]reflect.Value, len(tags))
 			for i, tag := range tags {
@@ -82,11 +83,9 @@ func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 					res, err := executor.RunProgram(pr)
 					executor.Set("__args", goja.Undefined())
 
-					// (legacy) check for returned Go error value
-					if res != nil {
-						if resErr, ok := res.Export().(error); ok {
-							return resErr
-						}
+					// check for returned Go error value
+					if resErr := checkGojaValueForError(app, res); resErr != nil {
+						return resErr
 					}
 
 					return normalizeException(err)
@@ -102,8 +101,8 @@ func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 }
 
 func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
-	loader.Set("cronAdd", func(jobId, cronExpr, handler string) {
-		pr := goja.MustCompile("", "{("+handler+").apply(undefined)}", true)
+	cronAdd := func(jobId, cronExpr, handler string) {
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler+").apply(undefined)}", true)
 
 		err := app.Cron().Add(jobId, cronExpr, func() {
 			err := executors.run(func(executor *goja.Runtime) error {
@@ -122,28 +121,27 @@ func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
 		if err != nil {
 			panic("[cronAdd] failed to register cron job " + jobId + ": " + err.Error())
 		}
-	})
+	}
+	loader.Set("cronAdd", cronAdd)
 
-	// note: it is not necessary needed but it is here for consistency
-	loader.Set("cronRemove", func(jobId string) {
+	cronRemove := func(jobId string) {
 		app.Cron().Remove(jobId)
-	})
+	}
+	loader.Set("cronRemove", cronRemove)
 
 	// register the removal helper also in the executors to allow removing cron jobs from everywhere
 	oldFactory := executors.factory
 	executors.factory = func() *goja.Runtime {
 		vm := oldFactory()
 
-		vm.Set("cronRemove", func(jobId string) {
-			app.Cron().Remove(jobId)
-		})
+		vm.Set("cronAdd", cronAdd)
+		vm.Set("cronRemove", cronRemove)
 
 		return vm
 	}
 	for _, item := range executors.items {
-		item.vm.Set("cronRemove", func(jobId string) {
-			app.Cron().Remove(jobId)
-		})
+		item.vm.Set("cronAdd", cronAdd)
+		item.vm.Set("cronRemove", cronRemove)
 	}
 }
 
@@ -189,7 +187,7 @@ func wrapHandlerFunc(executors *vmsPool, handler goja.Value) (func(*core.Request
 		// "native" handler func - no need to wrap
 		return h, nil
 	case func(goja.FunctionCall) goja.Value, string:
-		pr := goja.MustCompile("", "{("+handler.String()+").apply(undefined, __args)}", true)
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler.String()+").apply(undefined, __args)}", true)
 
 		wrappedHandler := func(e *core.RequestEvent) error {
 			return executors.run(func(executor *goja.Runtime) error {
@@ -198,11 +196,9 @@ func wrapHandlerFunc(executors *vmsPool, handler goja.Value) (func(*core.Request
 				res, err := executor.RunProgram(pr)
 				executor.Set("__args", goja.Undefined())
 
-				// (legacy) check for returned Go error value
-				if res != nil {
-					if v, ok := res.Export().(error); ok {
-						return v
-					}
+				// check for returned Go error value
+				if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+					return resErr
 				}
 
 				return normalizeException(err)
@@ -243,7 +239,7 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 				return nil, errors.New("missing or invalid Middleware function")
 			}
 
-			pr := goja.MustCompile("", "{("+v.serializedFunc+").apply(undefined, __args)}", true)
+			pr := goja.MustCompile(defaultScriptPath, "{("+v.serializedFunc+").apply(undefined, __args)}", true)
 
 			wrappedMiddlewares[i] = &hook.Handler[*core.RequestEvent]{
 				Id:       v.id,
@@ -255,11 +251,9 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 						res, err := executor.RunProgram(pr)
 						executor.Set("__args", goja.Undefined())
 
-						// (legacy) check for returned Go error value
-						if res != nil {
-							if v, ok := res.Export().(error); ok {
-								return v
-							}
+						// check for returned Go error value
+						if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+							return resErr
 						}
 
 						return normalizeException(err)
@@ -267,7 +261,7 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 				},
 			}
 		case func(goja.FunctionCall) goja.Value, string:
-			pr := goja.MustCompile("", "{("+m.String()+").apply(undefined, __args)}", true)
+			pr := goja.MustCompile(defaultScriptPath, "{("+m.String()+").apply(undefined, __args)}", true)
 
 			wrappedMiddlewares[i] = &hook.Handler[*core.RequestEvent]{
 				Func: func(e *core.RequestEvent) error {
@@ -277,11 +271,9 @@ func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.
 						res, err := executor.RunProgram(pr)
 						executor.Set("__args", goja.Undefined())
 
-						// (legacy) check for returned Go error value
-						if res != nil {
-							if v, ok := res.Export().(error); ok {
-								return v
-							}
+						// check for returned Go error value
+						if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+							return resErr
 						}
 
 						return normalizeException(err)
@@ -503,6 +495,10 @@ func baseBinds(vm *goja.Runtime) {
 		instance := &core.FileField{}
 		return structConstructorUnmarshal(vm, call, instance)
 	})
+	vm.Set("GeoPointField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.GeoPointField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
 	// ---
 
 	vm.Set("MailerMessage", func(call goja.ConstructorCall) *goja.Object {
@@ -538,12 +534,36 @@ func baseBinds(vm *goja.Runtime) {
 		return instanceValue
 	})
 
+	// note: named Timezone to avoid conflicts with the JS Location interface.
+	vm.Set("Timezone", func(call goja.ConstructorCall) *goja.Object {
+		name, _ := call.Argument(0).Export().(string)
+
+		instance, err := time.LoadLocation(name)
+		if err != nil {
+			instance = time.UTC
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
 	vm.Set("DateTime", func(call goja.ConstructorCall) *goja.Object {
 		instance := types.NowDateTime()
 
-		val, _ := call.Argument(0).Export().(string)
-		if val != "" {
-			instance, _ = types.ParseDateTime(val)
+		rawDate, _ := call.Argument(0).Export().(string)
+		locName, _ := call.Argument(1).Export().(string)
+		if rawDate != "" && locName != "" {
+			loc, err := time.LoadLocation(locName)
+			if err != nil {
+				loc = time.UTC
+			}
+
+			instance, _ = types.ParseDateTime(cast.ToTimeInDefaultLocation(rawDate, loc))
+		} else if rawDate != "" {
+			// forward directly to ParseDateTime to preserve the original behavior
+			instance, _ = types.ParseDateTime(rawDate)
 		}
 
 		instanceValue := vm.ToValue(instance).(*goja.Object)
@@ -700,6 +720,7 @@ func osBinds(vm *goja.Runtime) {
 	obj.Set("exit", os.Exit)
 	obj.Set("getenv", os.Getenv)
 	obj.Set("dirFS", os.DirFS)
+	obj.Set("stat", os.Stat)
 	obj.Set("readFile", os.ReadFile)
 	obj.Set("writeFile", os.WriteFile)
 	obj.Set("readDir", os.ReadDir)
@@ -766,11 +787,15 @@ func httpClientBinds(vm *goja.Runtime) {
 	})
 
 	type sendResult struct {
-		JSON       any                     `json:"json"`
-		Headers    map[string][]string     `json:"headers"`
-		Cookies    map[string]*http.Cookie `json:"cookies"`
-		Raw        string                  `json:"raw"`
-		StatusCode int                     `json:"statusCode"`
+		JSON    any                     `json:"json"`
+		Headers map[string][]string     `json:"headers"`
+		Cookies map[string]*http.Cookie `json:"cookies"`
+
+		// Deprecated: consider using Body instead
+		Raw string `json:"raw"`
+
+		Body       []byte `json:"body"`
+		StatusCode int    `json:"statusCode"`
 	}
 
 	type sendConfig struct {
@@ -875,6 +900,7 @@ func httpClientBinds(vm *goja.Runtime) {
 			Headers:    map[string][]string{},
 			Cookies:    map[string]*http.Cookie{},
 			Raw:        string(bodyRaw),
+			Body:       bodyRaw,
 		}
 
 		for k, v := range res.Header {
@@ -885,7 +911,7 @@ func httpClientBinds(vm *goja.Runtime) {
 			result.Cookies[v.Name] = v
 		}
 
-		if len(result.Raw) != 0 {
+		if len(result.Body) > 0 {
 			// try as map
 			result.JSON = map[string]any{}
 			if err := json.Unmarshal(bodyRaw, &result.JSON); err != nil {
@@ -903,6 +929,29 @@ func httpClientBinds(vm *goja.Runtime) {
 
 // -------------------------------------------------------------------
 
+// checkGojaValueForError resolves the provided goja.Value and tries
+// to extract its underlying error value (if any).
+func checkGojaValueForError(app core.App, value goja.Value) error {
+	if value == nil {
+		return nil
+	}
+
+	exported := value.Export()
+	switch v := exported.(type) {
+	case error:
+		return v
+	case *goja.Promise:
+		// Promise as return result is not officially supported but try to
+		// resolve any thrown exception to avoid silently ignoring it
+		app.Logger().Warn("the handler must a non-async function and not return a Promise")
+		if promiseErr, ok := v.Result().Export().(error); ok {
+			return normalizeException(promiseErr)
+		}
+	}
+
+	return nil
+}
+
 // normalizeException checks if the provided error is a goja.Exception
 // and attempts to return its underlying Go error.
 //
@@ -1004,11 +1053,19 @@ func structConstructorUnmarshal(vm *goja.Runtime, call goja.ConstructorCall, ins
 	return instanceValue
 }
 
-var cachedDynamicModels = store.New[string, *dynamicModelType](nil)
+var cachedDynamicModelStructs = store.New[string, reflect.Type](nil)
 
 // newDynamicModel creates a new dynamic struct with fields based
 // on the specified "shape".
 //
+// The "shape" values are used as defaults and could be of type:
+// - int (ex. 0)
+// - float (ex. -0)
+// - string (ex. "")
+// - bool (ex. false)
+// - slice (ex. [])
+// - map (ex. map[string]any{})
+//
 // Example:
 //
 //	m := newDynamicModel(map[string]any{
@@ -1016,46 +1073,21 @@ var cachedDynamicModels = store.New[string, *dynamicModelType](nil)
 //		"total": 0,
 //	})
 func newDynamicModel(shape map[string]any) any {
-	var modelType *dynamicModelType
+	info := make([]*shapeFieldInfo, 0, len(shape))
 
-	shapeRaw, err := json.Marshal(shape)
-	if err != nil {
-		modelType = getDynamicModelStruct(shape)
-	} else {
-		modelType = cachedDynamicModels.GetOrSet(string(shapeRaw), func() *dynamicModelType {
-			return getDynamicModelStruct(shape)
-		})
+	var hash strings.Builder
+
+	sortedKeys := make([]string, 0, len(shape))
+	for k := range shape {
+		sortedKeys = append(sortedKeys, k)
 	}
+	sort.Strings(sortedKeys)
 
-	rvShapeValues := make([]reflect.Value, len(modelType.shapeValues))
-	for i, v := range modelType.shapeValues {
-		rvShapeValues[i] = reflect.ValueOf(v)
-	}
-
-	elem := reflect.New(modelType.structType).Elem()
-
-	for i, v := range rvShapeValues {
-		elem.Field(i).Set(v)
-	}
-
-	return elem.Addr().Interface()
-}
-
-type dynamicModelType struct {
-	structType  reflect.Type
-	shapeValues []any
-}
-
-func getDynamicModelStruct(shape map[string]any) *dynamicModelType {
-	result := new(dynamicModelType)
-	result.shapeValues = make([]any, 0, len(shape))
-
-	structFields := make([]reflect.StructField, 0, len(shape))
-
-	for k, v := range shape {
+	for _, k := range sortedKeys {
+		v := shape[k]
 		vt := reflect.TypeOf(v)
 
-		switch kind := vt.Kind(); kind {
+		switch vt.Kind() {
 		case reflect.Map:
 			raw, _ := json.Marshal(v)
 			newV := types.JSONMap[any]{}
@@ -1070,16 +1102,40 @@ func getDynamicModelStruct(shape map[string]any) *dynamicModelType {
 			vt = reflect.TypeOf(newV)
 		}
 
-		result.shapeValues = append(result.shapeValues, v)
+		hash.WriteString(k)
+		hash.WriteString(":")
+		hash.WriteString(vt.String()) // it doesn't guarantee to be unique across all types but it should be fine with the primitive types DynamicModel is used
+		hash.WriteString("|")
 
-		structFields = append(structFields, reflect.StructField{
-			Name: inflector.UcFirst(k), // ensures that the field is exportable
-			Type: vt,
-			Tag:  reflect.StructTag(`db:"` + k + `" json:"` + k + `" form:"` + k + `"`),
-		})
+		info = append(info, &shapeFieldInfo{key: k, value: v, valueType: vt})
 	}
 
-	result.structType = reflect.StructOf(structFields)
+	st := cachedDynamicModelStructs.GetOrSet(hash.String(), func() reflect.Type {
+		structFields := make([]reflect.StructField, len(info))
 
-	return result
+		for i, item := range info {
+			structFields[i] = reflect.StructField{
+				Name: inflector.UcFirst(item.key), // ensures that the field is exportable
+				Type: item.valueType,
+				Tag:  reflect.StructTag(`db:"` + item.key + `" json:"` + item.key + `" form:"` + item.key + `"`),
+			}
+		}
+
+		return reflect.StructOf(structFields)
+	})
+
+	elem := reflect.New(st).Elem()
+
+	// load default values into the new model
+	for i, item := range info {
+		elem.Field(i).Set(reflect.ValueOf(item.value))
+	}
+
+	return elem.Addr().Interface()
+}
+
+type shapeFieldInfo struct {
+	value     any
+	valueType reflect.Type
+	key       string
 }

plugins/jsvm/binds_test.go

@@ -44,7 +44,7 @@ func TestBaseBindsCount(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 
-	testBindsCount(vm, "this", 32, t)
+	testBindsCount(vm, "this", 34, t)
 }
 
 func TestBaseBindsSleep(t *testing.T) {
@@ -83,7 +83,7 @@ func TestBaseBindsReaderToString(t *testing.T) {
 	}
 }
 
-func TestBaseBindsToString(t *testing.T) {
+func TestBaseBindsToStringAndToBytes(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 	vm.Set("scenarios", []struct {
@@ -399,6 +399,10 @@ func TestBaseBindsNamedFields(t *testing.T) {
 			"new FileField({name: 'test'})",
 			isType[*core.FileField],
 		},
+		{
+			"new GeoPointField({name: 'test'})",
+			isType[*core.GeoPointField],
+		},
 	}
 
 	for _, s := range scenarios {
@@ -538,20 +542,65 @@ func TestBaseBindsMiddleware(t *testing.T) {
 	}
 }
 
+func TestBaseBindsTimezone(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const v0 = (new Timezone()).string();
+		if (v0 != "UTC") {
+			throw new Error("(v0) Expected UTC got " + v0)
+		}
+
+		const v1 = (new Timezone("invalid")).string();
+		if (v1 != "UTC") {
+			throw new Error("(v1) Expected UTC got " + v1)
+		}
+
+		const v2 = (new Timezone("EET")).string();
+		if (v2 != "EET") {
+			throw new Error("(v2) Expected EET got " + v2)
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestBaseBindsDateTime(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 
 	_, err := vm.RunString(`
-		const v0 = new DateTime();
-		if (v0.isZero()) {
-			throw new Error('Expected to fallback to now, got zero value');
+		const now = new DateTime();
+		if (now.isZero()) {
+			throw new Error('(now) Expected to fallback to now, got zero value');
 		}
 
-		const v1 = new DateTime('2023-01-01 00:00:00.000Z');
-		const expected = "2023-01-01 00:00:00.000Z"
-		if (v1.string() != expected) {
-			throw new Error('Expected ' + expected + ', got ', v1.string());
+		const nowPart = now.string().substring(0, 19)
+
+		const scenarios = [
+			// empty datetime string and no custom location
+			{date: new DateTime(''), expected: nowPart},
+			// empty datetime string and custom default location (should be ignored)
+			{date: new DateTime('', 'Asia/Tokyo'), expected: nowPart},
+			// full datetime string and no custom default location
+			{date: new DateTime('2023-01-01 00:00:00.000Z'), expected: "2023-01-01 00:00:00.000Z"},
+			// invalid location (fallback to UTC)
+			{date: new DateTime('2025-10-26 03:00:00', 'invalid'), expected: "2025-10-26 03:00:00.000Z"},
+			// CET
+			{date: new DateTime('2025-10-26 03:00:00', 'Europe/Amsterdam'), expected: "2025-10-26 02:00:00.000Z"},
+			// CEST
+			{date: new DateTime('2025-10-26 01:00:00', 'Europe/Amsterdam'), expected: "2025-10-25 23:00:00.000Z"},
+			// with timezone/offset in the date string (aka. should ignore the custom default location)
+			{date: new DateTime('2025-10-26 01:00:00 +0200', 'Asia/Tokyo'), expected: "2025-10-25 23:00:00.000Z"},
+		];
+
+		for (let i = 0; i < scenarios.length; i++) {
+			const s = scenarios[i];
+			if (!s.date.string().includes(s.expected)) {
+				throw new Error('(' + i + ') ' + s.date.string() + ' does not contain expected ' + s.expected);
+			}
 		}
 	`)
 	if err != nil {
@@ -1112,6 +1161,65 @@ func TestLoadingDynamicModel(t *testing.T) {
 	}
 }
 
+func TestDynamicModelMapFieldCaching(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	dbxBinds(vm)
+	vm.Set("$app", app)
+
+	_, err := vm.RunString(`
+		let m1 = new DynamicModel({
+			int: 0,
+			float: -0,
+			text: "",
+			bool: false,
+			obj: {},
+			arr: [],
+		})
+
+		let m2 = new DynamicModel({
+			int: 0,
+			float: -0,
+			text: "",
+			bool: false,
+			obj: {},
+			arr: [],
+		})
+
+		m1.int = 1
+		m1.float = 1.5
+		m1.text = "a"
+		m1.bool = true
+		m1.obj.set("a", 1)
+		m1.arr.push(1)
+
+		m2.int = 2
+		m2.float = 2.5
+		m2.text = "b"
+		m2.bool = false
+		m2.obj.set("b", 1)
+		m2.arr.push(2)
+
+		let m1Expected = '{"arr":[1],"bool":true,"float":1.5,"int":1,"obj":{"a":1},"text":"a"}';
+		let m1Serialized = JSON.stringify(m1);
+		if (m1Serialized != m1Expected) {
+			throw new Error("Expected m1 \n" + m1Expected + "\ngot\n" + m1Serialized);
+		}
+
+		let m2Expected = '{"arr":[2],"bool":false,"float":2.5,"int":2,"obj":{"b":1},"text":"b"}';
+		let m2Serialized = JSON.stringify(m2);
+		if (m2Serialized != m2Expected) {
+			throw new Error("Expected m2 \n" + m2Expected + "\ngot\n" + m2Serialized);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestLoadingArrayOf(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -1279,6 +1387,13 @@ func TestHttpClientBindsSend(t *testing.T) {
 			headers: {"content-type": "text/plain"}, // should be ignored
 		})
 
+		// raw body response field check
+		const test4 = $http.send({
+			method: "post",
+			url:    testURL,
+			body:   'test',
+		})
+
 		const scenarios = [
 			[test0, {
 				"statusCode": "400",
@@ -1311,6 +1426,13 @@ func TestHttpClientBindsSend(t *testing.T) {
 					"multipart/form-data; boundary="
 				],
 			}],
+			[test4, {
+				"statusCode":              "200",
+				"headers.X-Custom.0":      "custom_header",
+				"cookies.sessionId.value": "123456",
+				// {"body":"test","headers":{"accept_encoding":"gzip","content_length":"4","user_agent":"Go-http-client/1.1"},"method":"POST"}
+				"body": [123,34,98,111,100,121,34,58,34,116,101,115,116,34,44,34,104,101,97,100,101,114,115,34,58,123,34,97,99,99,101,112,116,95,101,110,99,111,100,105,110,103,34,58,34,103,122,105,112,34,44,34,99,111,110,116,101,110,116,95,108,101,110,103,116,104,34,58,34,52,34,44,34,117,115,101,114,95,97,103,101,110,116,34,58,34,71,111,45,104,116,116,112,45,99,108,105,101,110,116,47,49,46,49,34,125,44,34,109,101,116,104,111,100,34,58,34,80,79,83,84,34,125],
+			}],
 		]
 
 		for (let scenario of scenarios) {
@@ -1324,13 +1446,13 @@ func TestHttpClientBindsSend(t *testing.T) {
 					// check for partial match(es)
 					for (let exp of expectation) {
 						if (!value.includes(exp)) {
-							throw new Error('Expected ' + key + ' to contain ' + exp + ', got: ' + result.raw);
+							throw new Error('Expected ' + key + ' to contain ' + exp + ', got: ' + toString(result.body));
 						}
 					}
 				} else {
 					// check for direct match
 					if (value != expectation) {
-						throw new Error('Expected ' + key + ' ' + expectation + ', got: ' + result.raw);
+						throw new Error('Expected ' + key + ' ' + expectation + ', got: ' + toString(result.body));
 					}
 				}
 			}
@@ -1354,7 +1476,7 @@ func TestCronBindsCount(t *testing.T) {
 	testBindsCount(vm, "this", 2, t)
 
 	pool.run(func(poolVM *goja.Runtime) error {
-		testBindsCount(poolVM, "this", 1, t)
+		testBindsCount(poolVM, "this", 2, t)
 		return nil
 	})
 }
@@ -1513,13 +1635,14 @@ func TestRouterBinds(t *testing.T) {
 	defer app.Cleanup()
 
 	result := &struct {
-		AddCount  int
-		WithCount int
+		RouteMiddlewareCalls  int
+		GlobalMiddlewareCalls int
 	}{}
 
 	vmFactory := func() *goja.Runtime {
 		vm := goja.New()
 		baseBinds(vm)
+		apisBinds(vm)
 		vm.Set("$app", app)
 		vm.Set("result", result)
 		return vm
@@ -1532,14 +1655,20 @@ func TestRouterBinds(t *testing.T) {
 
 	_, err := vm.RunString(`
 		routerAdd("GET", "/test", (e) => {
-			result.addCount++;
+			result.routeMiddlewareCalls++;
 		}, (e) => {
-			result.addCount++;
+			result.routeMiddlewareCalls++;
 			return e.next();
 		})
 
+		// Promise is not technically supported as return result
+		// but we try to resolve it at least for thrown errors
+		routerAdd("GET", "/error", async (e) => {
+			throw new ApiError(456, 'test', null)
+		})
+
 		routerUse((e) => {
-			result.withCount++;
+			result.globalMiddlewareCalls++;
 
 			return e.next();
 		})
@@ -1560,21 +1689,44 @@ func TestRouterBinds(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest("GET", "/test", nil)
-
 	mux, err := serveEvent.Router.BuildMux()
 	if err != nil {
 		t.Fatalf("Failed to build router mux: %v", err)
 	}
-	mux.ServeHTTP(rec, req)
 
-	if result.AddCount != 2 {
-		t.Fatalf("Expected AddCount %d, got %d", 2, result.AddCount)
+	scenarios := []struct {
+		method                        string
+		path                          string
+		expectedRouteMiddlewareCalls  int
+		expectedGlobalMiddlewareCalls int
+		expectedCode                  int
+	}{
+		{"GET", "/test", 2, 1, 200},
+		{"GET", "/error", 0, 1, 456},
 	}
 
-	if result.WithCount != 1 {
-		t.Fatalf("Expected WithCount %d, got %d", 1, result.WithCount)
+	for _, s := range scenarios {
+		t.Run(s.method+" "+s.path, func(t *testing.T) {
+			// reset
+			result.RouteMiddlewareCalls = 0
+			result.GlobalMiddlewareCalls = 0
+
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest(s.method, s.path, nil)
+			mux.ServeHTTP(rec, req)
+
+			if result.RouteMiddlewareCalls != s.expectedRouteMiddlewareCalls {
+				t.Fatalf("Expected RouteMiddlewareCalls %d, got %d", s.expectedRouteMiddlewareCalls, result.RouteMiddlewareCalls)
+			}
+
+			if result.GlobalMiddlewareCalls != s.expectedGlobalMiddlewareCalls {
+				t.Fatalf("Expected GlobalMiddlewareCalls %d, got %d", s.expectedGlobalMiddlewareCalls, result.GlobalMiddlewareCalls)
+			}
+
+			if rec.Code != s.expectedCode {
+				t.Fatalf("Expected status code %d, got %d", s.expectedCode, rec.Code)
+			}
+		})
 	}
 }
 
@@ -1589,5 +1741,5 @@ func TestOsBindsCount(t *testing.T) {
 	vm := goja.New()
 	osBinds(vm)
 
-	testBindsCount(vm, "$os", 17, t)
+	testBindsCount(vm, "$os", 18, t)
 }

plugins/jsvm/form_data.go

@@ -126,7 +126,8 @@ func (data FormData) toMultipart() (*bytes.Buffer, *multipart.Writer, error) {
 					}
 					defer file.Close()
 
-					if _, err := io.Copy(mpw, file); err != nil {
+					_, err = io.Copy(mpw, file)
+					if err != nil {
 						return err
 					}
 
@@ -136,7 +137,8 @@ func (data FormData) toMultipart() (*bytes.Buffer, *multipart.Writer, error) {
 					return nil, nil, err
 				}
 			default:
-				if err := mp.WriteField(k, cast.ToString(v)); err != nil {
+				err := mp.WriteField(k, cast.ToString(v))
+				if err != nil {
 					return nil, nil, err
 				}
 			}

plugins/jsvm/internal/types/types.go

@@ -482,6 +482,16 @@ declare class FileField implements core.FileField {
   constructor(data?: Partial<core.FileField>)
 }
 
+interface GeoPointField extends core.GeoPointField{} // merge
+/**
+ * {@inheritDoc core.GeoPointField}
+ *
+ * @group PocketBase
+ */
+declare class GeoPointField implements core.GeoPointField {
+  constructor(data?: Partial<core.GeoPointField>)
+}
+
 interface MailerMessage extends mailer.Message{} // merge
 /**
  * MailerMessage defines a single email message.
@@ -579,22 +589,56 @@ declare class Middleware {
   )
 }
 
+interface Timezone extends time.Location{} // merge
+/**
+ * Timezone returns the timezone location with the given name.
+ *
+ * The name is expected to be a location name corresponding to a file
+ * in the IANA Time Zone database, such as "America/New_York".
+ *
+ * If the name is "Local", LoadLocation returns Local.
+ *
+ * If the name is "", invalid or "UTC", returns UTC.
+ *
+ * The constructor is equivalent to calling the Go ` + "`" + `time.LoadLocation(name)` + "`" + ` method.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const zone = new Timezone("America/New_York")
+ * $app.cron().setTimezone(zone)
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Timezone implements time.Location {
+  constructor(name?: string)
+}
+
 interface DateTime extends types.DateTime{} // merge
 /**
  * DateTime defines a single DateTime type instance.
+ * The returned date is always represented in UTC.
  *
  * Example:
  *
  * ` + "```" + `js
  * const dt0 = new DateTime() // now
  *
+ * // full datetime string
  * const dt1 = new DateTime('2023-07-01 00:00:00.000Z')
+ *
+ * // datetime string with default "parse in" timezone location
+ * //
+ * // similar to new DateTime('2023-07-01 00:00:00 +01:00') or new DateTime('2023-07-01 00:00:00 +02:00')
+ * // but accounts for the daylight saving time (DST)
+ * const dt2 = new DateTime('2023-07-01 00:00:00', 'Europe/Amsterdam')
  * ` + "```" + `
  *
  * @group PocketBase
  */
 declare class DateTime implements types.DateTime {
-  constructor(date?: string)
+  constructor(date?: string, defaultParseInLocation?: string)
 }
 
 interface ValidationError extends ozzo_validation.Error{} // merge
@@ -856,6 +900,7 @@ declare namespace $os {
   export let dirFS:     os.dirFS
   export let readFile:  os.readFile
   export let writeFile: os.writeFile
+  export let stat:      os.stat
   export let readDir:   os.readDir
   export let tempDir:   os.tempDir
   export let truncate:  os.truncate
@@ -1050,7 +1095,7 @@ declare namespace $http {
    * console.log(res.statusCode) // the response HTTP status code
    * console.log(res.headers)    // the response headers (eg. res.headers['X-Custom'][0])
    * console.log(res.cookies)    // the response cookies (eg. res.cookies.sessionId.value)
-   * console.log(res.raw)        // the response body as plain text
+   * console.log(res.body)       // the response body as raw bytes slice
    * console.log(res.json)       // the response body as parsed json array or map
    * ` + "```" + `
    */
@@ -1067,8 +1112,11 @@ declare namespace $http {
     statusCode: number,
     headers:    { [key:string]: Array<string> },
     cookies:    { [key:string]: http.Cookie },
-    raw:        string,
     json:       any,
+    body:       Array<number>,
+
+    // @deprecated please use toString(result.body) instead
+    raw: string,
   };
 }
 
@@ -1131,7 +1179,6 @@ func main() {
 			"pflag.*":      "any",
 			"flag.*":       "any",
 			"log.*":        "any",
-			"aws.*":        "any",
 			"http.Client":  "any",
 			"mail.Address": "{ address: string; name?: string; }", // prevents the LSP to complain in case no name is provided
 		},

plugins/jsvm/jsvm.go

@@ -35,6 +35,24 @@ import (
 
 const typesFileName = "types.d.ts"
 
+var defaultScriptPath = "pb.js"
+
+func init() {
+	// For backward compatibility and consistency with the Go exposed
+	// methods that operate with relative paths (e.g. `$os.writeFile`),
+	// we define the "current JS module" as if it is a file in the current working directory
+	// (the filename itself doesn't really matter and in our case the hook handlers are executed as separate "programs").
+	//
+	// This is necessary for `require(module)` to properly traverse parents node_modules (goja_nodejs#95).
+	cwd, err := os.Getwd()
+	if err != nil {
+		// truly rare case, log just for debug purposes
+		color.Yellow("Failed to retrieve the current working directory: %v", err)
+	} else {
+		defaultScriptPath = filepath.Join(cwd, defaultScriptPath)
+	}
+}
+
 // Config defines the config options of the jsvm plugin.
 type Config struct {
 	// OnInit is an optional function that will be called
@@ -191,7 +209,7 @@ func (p *plugin) registerMigrations() error {
 			p.config.OnInit(vm)
 		}
 
-		_, err := vm.RunString(string(content))
+		_, err := vm.RunScript(defaultScriptPath, string(content))
 		if err != nil {
 			return fmt.Errorf("failed to run migration %s: %w", file, err)
 		}
@@ -296,7 +314,7 @@ func (p *plugin) registerHooks() error {
 		func() {
 			defer func() {
 				if err := recover(); err != nil {
-					fmtErr := fmt.Errorf("Failed to execute %s:\n - %v", file, err)
+					fmtErr := fmt.Errorf("failed to execute %s:\n - %v", file, err)
 
 					if p.config.HooksWatch {
 						color.Red("%v", fmtErr)
@@ -306,7 +324,7 @@ func (p *plugin) registerHooks() error {
 				}
 			}()
 
-			_, err := loader.RunString(string(content))
+			_, err := loader.RunScript(defaultScriptPath, string(content))
 			if err != nil {
 				panic(err)
 			}
@@ -389,7 +407,7 @@ func (p *plugin) watchHooks() error {
 				debounceTimer = time.AfterFunc(50*time.Millisecond, func() {
 					// app restart is currently not supported on Windows
 					if runtime.GOOS == "windows" {
-						color.Yellow("File %s changed, please restart the app", event.Name)
+						color.Yellow("File %s changed, please restart the app manually", event.Name)
 					} else {
 						color.Yellow("File %s changed, restarting...", event.Name)
 						if err := p.app.Restart(); err != nil {

plugins/migratecmd/migratecmd.go

@@ -23,9 +23,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 	"github.com/spf13/cobra"
 )
 
@@ -145,7 +145,7 @@ func (p *plugin) createCommand() *cobra.Command {
 
 func (p *plugin) migrateCreateHandler(template string, args []string, interactive bool) (string, error) {
 	if len(args) < 1 {
-		return "", errors.New("Missing migration file name")
+		return "", errors.New("missing migration file name")
 	}
 
 	name := args[0]
@@ -156,11 +156,7 @@ func (p *plugin) migrateCreateHandler(template string, args []string, interactiv
 	resultFilePath := path.Join(dir, filename)
 
 	if interactive {
-		confirm := false
-		prompt := &survey.Confirm{
-			Message: fmt.Sprintf("Do you really want to create migration %q?", resultFilePath),
-		}
-		survey.AskOne(prompt, &confirm)
+		confirm := osutils.YesNoPrompt(fmt.Sprintf("Do you really want to create migration %q?", resultFilePath), false)
 		if !confirm {
 			fmt.Println("The command has been cancelled")
 			return "", nil
@@ -176,7 +172,7 @@ func (p *plugin) migrateCreateHandler(template string, args []string, interactiv
 			template, templateErr = p.goBlankTemplate()
 		}
 		if templateErr != nil {
-			return "", fmt.Errorf("Failed to resolve create template: %v\n", templateErr)
+			return "", fmt.Errorf("failed to resolve create template: %v", templateErr)
 		}
 	}
 
@@ -187,7 +183,7 @@ func (p *plugin) migrateCreateHandler(template string, args []string, interactiv
 
 	// save the migration file
 	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
-		return "", fmt.Errorf("Failed to save migration file %q: %v\n", resultFilePath, err)
+		return "", fmt.Errorf("failed to save migration file %q: %v", resultFilePath, err)
 	}
 
 	if interactive {
@@ -203,7 +199,7 @@ func (p *plugin) migrateCollectionsHandler(args []string, interactive bool) (str
 
 	collections := []*core.Collection{}
 	if err := p.app.CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
-		return "", fmt.Errorf("Failed to fetch migrations list: %v\n", err)
+		return "", fmt.Errorf("failed to fetch migrations list: %v", err)
 	}
 
 	var template string
@@ -214,7 +210,7 @@ func (p *plugin) migrateCollectionsHandler(args []string, interactive bool) (str
 		template, templateErr = p.goSnapshotTemplate(collections)
 	}
 	if templateErr != nil {
-		return "", fmt.Errorf("Failed to resolve template: %v\n", templateErr)
+		return "", fmt.Errorf("failed to resolve template: %v", templateErr)
 	}
 
 	return p.migrateCreateHandler(template, createArgs, interactive)

tools/auth/apple.go

@@ -6,7 +6,7 @@ import (
 	"errors"
 	"strings"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 	"golang.org/x/oauth2"
@@ -138,19 +138,18 @@ func (p *Apple) parseAndVerifyIdToken(idToken string) (jwt.MapClaims, error) {
 
 	// validate common claims per https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user#3383769
 	// ---
-	err = claims.Valid() // exp, iat, etc.
+	jwtValidator := jwt.NewValidator(
+		jwt.WithExpirationRequired(),
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(idTokenLeeway),
+		jwt.WithIssuer("https://appleid.apple.com"),
+		jwt.WithAudience(p.clientId),
+	)
+	err = jwtValidator.Validate(claims)
 	if err != nil {
 		return nil, err
 	}
 
-	if !claims.VerifyIssuer("https://appleid.apple.com", true) {
-		return nil, errors.New("iss must be https://appleid.apple.com")
-	}
-
-	if !claims.VerifyAudience(p.clientId, true) {
-		return nil, errors.New("aud must be the developer's client_id")
-	}
-
 	// validate id_token signature
 	//
 	// note: this step could be technically considered optional because we trust

tools/auth/auth_test.go

@@ -7,7 +7,7 @@ import (
 )
 
 func TestProvidersCount(t *testing.T) {
-	expected := 29
+	expected := 30
 
 	if total := len(auth.Providers); total != expected {
 		t.Fatalf("Expected %d providers, got %d", expected, total)
@@ -287,4 +287,13 @@ func TestNewProviderByName(t *testing.T) {
 	if _, ok := p.(*auth.Linear); !ok {
 		t.Error("Expected to be instance of *auth.Linear")
 	}
+
+	// trakt
+	p, err = auth.NewProviderByName(auth.NameTrakt)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Trakt); !ok {
+		t.Error("Expected to be instance of *auth.Trakt")
+	}
 }

tools/auth/google.go

@@ -32,9 +32,9 @@ func NewGoogleProvider() *Google {
 			"https://www.googleapis.com/auth/userinfo.profile",
 			"https://www.googleapis.com/auth/userinfo.email",
 		},
-		authURL:     "https://accounts.google.com/o/oauth2/auth",
-		tokenURL:    "https://accounts.google.com/o/oauth2/token",
-		userInfoURL: "https://www.googleapis.com/oauth2/v1/userinfo",
+		authURL:     "https://accounts.google.com/o/oauth2/v2/auth",
+		tokenURL:    "https://oauth2.googleapis.com/token",
+		userInfoURL: "https://www.googleapis.com/oauth2/v3/userinfo",
 	}}
 }
 
@@ -51,11 +51,11 @@ func (p *Google) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	extracted := struct {
-		Id            string `json:"id"`
+		Id            string `json:"sub"`
 		Name          string `json:"name"`
-		Email         string `json:"email"`
 		Picture       string `json:"picture"`
-		VerifiedEmail bool   `json:"verified_email"`
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -72,7 +72,7 @@ func (p *Google) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
-	if extracted.VerifiedEmail {
+	if extracted.EmailVerified {
 		user.Email = extracted.Email
 	}
 

tools/auth/oidc.go

@@ -10,18 +10,35 @@ import (
 	"io"
 	"math/big"
 	"net/http"
+	"os"
+	"strconv"
 	"strings"
+	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 	"golang.org/x/oauth2"
 )
 
+// idTokenLeeway is the optional leeway for the id_token timestamp fields validation.
+//
+// It can be changed externally using the PB_ID_TOKEN_LEEWAY env variable
+// (the value must be in seconds, e.g. "PB_ID_TOKEN_LEEWAY=60" for 1 minute).
+var idTokenLeeway time.Duration = 5 * time.Minute
+
 func init() {
 	Providers[NameOIDC] = wrapFactory(NewOIDCProvider)
 	Providers[NameOIDC+"2"] = wrapFactory(NewOIDCProvider)
 	Providers[NameOIDC+"3"] = wrapFactory(NewOIDCProvider)
+
+	if leewayStr := os.Getenv("PB_ID_TOKEN_LEEWAY"); leewayStr != "" {
+		leeway, err := strconv.Atoi(leewayStr)
+		if err == nil {
+			idTokenLeeway = time.Duration(leeway) * time.Second
+		}
+	}
 }
 
 var _ Provider = (*OIDC)(nil)
@@ -75,7 +92,7 @@ func (p *OIDC) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Username      string `json:"preferred_username"`
 		Picture       string `json:"picture"`
 		Email         string `json:"email"`
-		EmailVerified bool   `json:"email_verified"`
+		EmailVerified any    `json:"email_verified"` // see #6657
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -93,7 +110,7 @@ func (p *OIDC) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 
 	user.Expiry, _ = types.ParseDateTime(token.Expiry)
 
-	if extracted.EmailVerified {
+	if cast.ToBool(extracted.EmailVerified) {
 		user.Email = extracted.Email
 	}
 
@@ -128,24 +145,25 @@ func (p *OIDC) parseIdToken(token *oauth2.Token) (jwt.MapClaims, error) {
 		return nil, err
 	}
 
-	// validate common claims like exp, iat, etc.
-	err = claims.Valid()
+	// validate common claims
+	jwtValidator := jwt.NewValidator(
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(idTokenLeeway),
+		jwt.WithAudience(p.clientId),
+	)
+	err = jwtValidator.Validate(claims)
 	if err != nil {
 		return nil, err
 	}
 
-	// validate aud
-	if !claims.VerifyAudience(p.clientId, true) {
-		return nil, errors.New("aud must be the developer's client_id")
-	}
-
 	// validate iss (if "issuers" extra config is set)
 	issuers := cast.ToStringSlice(p.Extra()["issuers"])
 	if len(issuers) > 0 {
 		var isIssValid bool
+		claimIssuer, _ := claims.GetIssuer()
 
 		for _, issuer := range issuers {
-			if claims.VerifyIssuer(issuer, true) {
+			if security.Equal(claimIssuer, issuer) {
 				isIssValid = true
 				break
 			}

tools/auth/patreon.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/endpoints"
 )
 
 func init() {
@@ -29,8 +30,8 @@ func NewPatreonProvider() *Patreon {
 		displayName: "Patreon",
 		pkce:        true,
 		scopes:      []string{"identity", "identity[email]"},
-		authURL:     "https://www.patreon.com/oauth2/authorize",
-		tokenURL:    "https://www.patreon.com/api/oauth2/token",
+		authURL:     endpoints.Patreon.AuthURL,
+		tokenURL:    endpoints.Patreon.TokenURL,
 		userInfoURL: "https://www.patreon.com/api/oauth2/v2/identity?fields%5Buser%5D=full_name,email,vanity,image_url,is_email_verified",
 	}}
 }

tools/auth/trakt.go

@@ -0,0 +1,102 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameTrakt] = wrapFactory(NewTraktProvider)
+}
+
+var _ Provider = (*Trakt)(nil)
+
+// NameTrakt is the unique name of the Trakt provider.
+const NameTrakt string = "trakt"
+
+// Trakt allows authentication via Trakt OAuth2.
+type Trakt struct {
+	BaseProvider
+}
+
+// NewTraktProvider creates new Trakt provider instance with some defaults.
+func NewTraktProvider() *Trakt {
+	return &Trakt{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Trakt",
+		pkce:        true,
+		authURL:     "https://trakt.tv/oauth/authorize",
+		tokenURL:    "https://api.trakt.tv/oauth/token",
+		userInfoURL: "https://api.trakt.tv/users/settings",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on Trakt's user settings API.
+// API reference: https://trakt.docs.apiary.io/#reference/users/settings/retrieve-settings
+func (p *Trakt) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		User struct {
+			Username string `json:"username"`
+			Name     string `json:"name"`
+			Ids      struct {
+				Slug string `json:"slug"`
+				UUID string `json:"uuid"`
+			} `json:"ids"`
+			Images struct {
+				Avatar struct {
+					Full string `json:"full"`
+				} `json:"avatar"`
+			} `json:"images"`
+		} `json:"user"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.User.Ids.UUID,
+		Username:     extracted.User.Username,
+		Name:         extracted.User.Name,
+		AvatarURL:    extracted.User.Images.Avatar.Full,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// This differ from BaseProvider because Trakt requires a number of
+// mandatory headers for all requests
+// (https://trakt.docs.apiary.io/#introduction/required-headers).
+func (p *Trakt) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	req, err := http.NewRequestWithContext(p.ctx, "GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-type", "application/json")
+	req.Header.Set("trakt-api-key", p.clientId)
+	req.Header.Set("trakt-api-version", "2")
+
+	return p.sendRawUserInfoRequest(req, token)
+}

tools/auth/twitch.go

@@ -66,7 +66,7 @@ func (p *Twitch) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}
 
 	if len(extracted.Data) == 0 {
-		return nil, errors.New("Failed to fetch AuthUser data")
+		return nil, errors.New("failed to fetch AuthUser data")
 	}
 
 	user := &AuthUser{

tools/dbutils/index.go

@@ -21,13 +21,13 @@ type IndexColumn struct {
 
 // Index represents a single parsed SQL CREATE INDEX expression.
 type Index struct {
-	Unique     bool          `json:"unique"`
-	Optional   bool          `json:"optional"`
 	SchemaName string        `json:"schemaName"`
 	IndexName  string        `json:"indexName"`
 	TableName  string        `json:"tableName"`
-	Columns    []IndexColumn `json:"columns"`
 	Where      string        `json:"where"`
+	Columns    []IndexColumn `json:"columns"`
+	Unique     bool          `json:"unique"`
+	Optional   bool          `json:"optional"`
 }
 
 // IsValid checks if the current Index contains the minimum required fields to be considered valid.
@@ -193,15 +193,25 @@ func ParseIndex(createIndexExpr string) Index {
 	return result
 }
 
-// HasColumnUniqueIndex loosely checks whether the specified column has
-// a single column unique index (WHERE statements are ignored).
-func HasSingleColumnUniqueIndex(column string, indexes []string) bool {
+// FindSingleColumnUniqueIndex returns the first matching single column unique index.
+func FindSingleColumnUniqueIndex(indexes []string, column string) (Index, bool) {
+	var index Index
+
 	for _, idx := range indexes {
-		parsed := ParseIndex(idx)
-		if parsed.Unique && len(parsed.Columns) == 1 && strings.EqualFold(parsed.Columns[0].Name, column) {
-			return true
+		index := ParseIndex(idx)
+		if index.Unique && len(index.Columns) == 1 && strings.EqualFold(index.Columns[0].Name, column) {
+			return index, true
 		}
 	}
 
-	return false
+	return index, false
+}
+
+// Deprecated: Use `_, ok := FindSingleColumnUniqueIndex(indexes, column)` instead.
+//
+// HasColumnUniqueIndex loosely checks whether the specified column has
+// a single column unique index (WHERE statements are ignored).
+func HasSingleColumnUniqueIndex(column string, indexes []string) bool {
+	_, ok := FindSingleColumnUniqueIndex(indexes, column)
+	return ok
 }

tools/dbutils/index_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/tools/dbutils"
@@ -312,3 +313,93 @@ func TestHasSingleColumnUniqueIndex(t *testing.T) {
 		})
 	}
 }
+
+func TestFindSingleColumnUniqueIndex(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		column   string
+		indexes  []string
+		expected bool
+	}{
+		{
+			"empty indexes",
+			"test",
+			nil,
+			false,
+		},
+		{
+			"empty column",
+			"",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"mismatched column",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test2`)",
+			},
+			false,
+		},
+		{
+			"non unique index",
+			"test",
+			[]string{
+				"CREATE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"matching columnd and unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"multiple columns",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+			},
+			false,
+		},
+		{
+			"multiple indexes",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+				"CREATE UNIQUE INDEX `index2` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"partial unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index` ON `example` (`test`) where test != ''",
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			index, exists := dbutils.FindSingleColumnUniqueIndex(s.indexes, s.column)
+			if exists != s.expected {
+				t.Fatalf("Expected exists %v got %v", s.expected, exists)
+			}
+
+			if !exists && len(index.Columns) > 0 {
+				t.Fatal("Expected index.Columns to be empty")
+			}
+
+			if exists && !strings.EqualFold(index.Columns[0].Name, s.column) {
+				t.Fatalf("Expected to find column %q in %v", s.column, index)
+			}
+		})
+	}
+}

tools/filesystem/blob/bucket.go

@@ -0,0 +1,734 @@
+// Package blob defines a lightweight abstration for interacting with
+// various storage services (local filesystem, S3, etc.).
+//
+// NB!
+// For compatibility with earlier PocketBase versions and to prevent
+// unnecessary breaking changes, this package is based and implemented
+// as a minimal, stripped down version of the previously used gocloud.dev/blob.
+// While there is no promise that it won't diverge in the future to accommodate
+// better some PocketBase specific use cases, currently it copies and
+// tries to follow as close as possible the same implementations,
+// conventions and rules for the key escaping/unescaping, blob read/write
+// interfaces and struct options as gocloud.dev/blob, therefore the
+// credits goes to the original Go Cloud Development Kit Authors.
+package blob
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+)
+
+var (
+	ErrNotFound = errors.New("resource not found")
+	ErrClosed   = errors.New("bucket or blob is closed")
+)
+
+// Bucket provides an easy and portable way to interact with blobs
+// within a "bucket", including read, write, and list operations.
+// To create a Bucket, use constructors found in driver subpackages.
+type Bucket struct {
+	drv Driver
+
+	// mu protects the closed variable.
+	// Read locks are kept to allow holding a read lock for long-running calls,
+	// and thereby prevent closing until a call finishes.
+	mu     sync.RWMutex
+	closed bool
+}
+
+// NewBucket creates a new *Bucket based on a specific driver implementation.
+func NewBucket(drv Driver) *Bucket {
+	return &Bucket{drv: drv}
+}
+
+// ListOptions sets options for listing blobs via Bucket.List.
+type ListOptions struct {
+	// Prefix indicates that only blobs with a key starting with this prefix
+	// should be returned.
+	Prefix string
+
+	// Delimiter sets the delimiter used to define a hierarchical namespace,
+	// like a filesystem with "directories". It is highly recommended that you
+	// use "" or "/" as the Delimiter. Other values should work through this API,
+	// but service UIs generally assume "/".
+	//
+	// An empty delimiter means that the bucket is treated as a single flat
+	// namespace.
+	//
+	// A non-empty delimiter means that any result with the delimiter in its key
+	// after Prefix is stripped will be returned with ListObject.IsDir = true,
+	// ListObject.Key truncated after the delimiter, and zero values for other
+	// ListObject fields. These results represent "directories". Multiple results
+	// in a "directory" are returned as a single result.
+	Delimiter string
+
+	// PageSize sets the maximum number of objects to be returned.
+	// 0 means no maximum; driver implementations should choose a reasonable
+	// max. It is guaranteed to be >= 0.
+	PageSize int
+
+	// PageToken may be filled in with the NextPageToken from a previous
+	// ListPaged call.
+	PageToken []byte
+}
+
+// ListPage represents a page of results return from ListPaged.
+type ListPage struct {
+	// Objects is the slice of objects found. If ListOptions.PageSize > 0,
+	// it should have at most ListOptions.PageSize entries.
+	//
+	// Objects should be returned in lexicographical order of UTF-8 encoded keys,
+	// including across pages. I.e., all objects returned from a ListPage request
+	// made using a PageToken from a previous ListPage request's NextPageToken
+	// should have Key >= the Key for all objects from the previous request.
+	Objects []*ListObject `json:"objects"`
+
+	// NextPageToken should be left empty unless there are more objects
+	// to return. The value may be returned as ListOptions.PageToken on a
+	// subsequent ListPaged call, to fetch the next page of results.
+	// It can be an arbitrary []byte; it need not be a valid key.
+	NextPageToken []byte `json:"nextPageToken"`
+}
+
+// ListIterator iterates over List results.
+type ListIterator struct {
+	b       *Bucket
+	opts    *ListOptions
+	page    *ListPage
+	nextIdx int
+}
+
+// Next returns a *ListObject for the next blob.
+// It returns (nil, io.EOF) if there are no more.
+func (i *ListIterator) Next(ctx context.Context) (*ListObject, error) {
+	if i.page != nil {
+		// We've already got a page of results.
+		if i.nextIdx < len(i.page.Objects) {
+			// Next object is in the page; return it.
+			dobj := i.page.Objects[i.nextIdx]
+			i.nextIdx++
+			return &ListObject{
+				Key:     dobj.Key,
+				ModTime: dobj.ModTime,
+				Size:    dobj.Size,
+				MD5:     dobj.MD5,
+				IsDir:   dobj.IsDir,
+			}, nil
+		}
+
+		if len(i.page.NextPageToken) == 0 {
+			// Done with current page, and there are no more; return io.EOF.
+			return nil, io.EOF
+		}
+
+		// We need to load the next page.
+		i.opts.PageToken = i.page.NextPageToken
+	}
+
+	i.b.mu.RLock()
+	defer i.b.mu.RUnlock()
+
+	if i.b.closed {
+		return nil, ErrClosed
+	}
+
+	// Loading a new page.
+	p, err := i.b.drv.ListPaged(ctx, i.opts)
+	if err != nil {
+		return nil, wrapError(i.b.drv, err, "")
+	}
+
+	i.page = p
+	i.nextIdx = 0
+
+	return i.Next(ctx)
+}
+
+// ListObject represents a single blob returned from List.
+type ListObject struct {
+	// Key is the key for this blob.
+	Key string `json:"key"`
+
+	// ModTime is the time the blob was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the blob's content in bytes.
+	Size int64 `json:"size"`
+
+	// MD5 is an MD5 hash of the blob contents or nil if not available.
+	MD5 []byte `json:"md5"`
+
+	// IsDir indicates that this result represents a "directory" in the
+	// hierarchical namespace, ending in ListOptions.Delimiter. Key can be
+	// passed as ListOptions.Prefix to list items in the "directory".
+	// Fields other than Key and IsDir will not be set if IsDir is true.
+	IsDir bool `json:"isDir"`
+}
+
+// List returns a ListIterator that can be used to iterate over blobs in a
+// bucket, in lexicographical order of UTF-8 encoded keys. The underlying
+// implementation fetches results in pages.
+//
+// A nil ListOptions is treated the same as the zero value.
+//
+// List is not guaranteed to include all recently-written blobs;
+// some services are only eventually consistent.
+func (b *Bucket) List(opts *ListOptions) *ListIterator {
+	if opts == nil {
+		opts = &ListOptions{}
+	}
+
+	dopts := &ListOptions{
+		Prefix:    opts.Prefix,
+		Delimiter: opts.Delimiter,
+	}
+
+	return &ListIterator{b: b, opts: dopts}
+}
+
+// FirstPageToken is the pageToken to pass to ListPage to retrieve the first page of results.
+var FirstPageToken = []byte("first page")
+
+// ListPage returns a page of ListObject results for blobs in a bucket, in lexicographical
+// order of UTF-8 encoded keys.
+//
+// To fetch the first page, pass FirstPageToken as the pageToken. For subsequent pages, pass
+// the pageToken returned from a previous call to ListPage.
+// It is not possible to "skip ahead" pages.
+//
+// Each call will return pageSize results, unless there are not enough blobs to fill the
+// page, in which case it will return fewer results (possibly 0).
+//
+// If there are no more blobs available, ListPage will return an empty pageToken. Note that
+// this may happen regardless of the number of returned results -- the last page might have
+// 0 results (i.e., if the last item was deleted), pageSize results, or anything in between.
+//
+// Calling ListPage with an empty pageToken will immediately return io.EOF. When looping
+// over pages, callers can either check for an empty pageToken, or they can make one more
+// call and check for io.EOF.
+//
+// The underlying implementation fetches results in pages, but one call to ListPage may
+// require multiple page fetches (and therefore, multiple calls to the BeforeList callback).
+//
+// A nil ListOptions is treated the same as the zero value.
+//
+// ListPage is not guaranteed to include all recently-written blobs;
+// some services are only eventually consistent.
+func (b *Bucket) ListPage(ctx context.Context, pageToken []byte, pageSize int, opts *ListOptions) (retval []*ListObject, nextPageToken []byte, err error) {
+	if opts == nil {
+		opts = &ListOptions{}
+	}
+	if pageSize <= 0 {
+		return nil, nil, fmt.Errorf("pageSize must be > 0 (%d)", pageSize)
+	}
+
+	// Nil pageToken means no more results.
+	if len(pageToken) == 0 {
+		return nil, nil, io.EOF
+	}
+
+	// FirstPageToken fetches the first page. Drivers use nil.
+	// The public API doesn't use nil for the first page because it would be too easy to
+	// keep fetching forever (since the last page return nil for the next pageToken).
+	if bytes.Equal(pageToken, FirstPageToken) {
+		pageToken = nil
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return nil, nil, ErrClosed
+	}
+
+	dopts := &ListOptions{
+		Prefix:    opts.Prefix,
+		Delimiter: opts.Delimiter,
+		PageToken: pageToken,
+		PageSize:  pageSize,
+	}
+
+	retval = make([]*ListObject, 0, pageSize)
+	for len(retval) < pageSize {
+		p, err := b.drv.ListPaged(ctx, dopts)
+		if err != nil {
+			return nil, nil, wrapError(b.drv, err, "")
+		}
+
+		for _, dobj := range p.Objects {
+			retval = append(retval, &ListObject{
+				Key:     dobj.Key,
+				ModTime: dobj.ModTime,
+				Size:    dobj.Size,
+				MD5:     dobj.MD5,
+				IsDir:   dobj.IsDir,
+			})
+		}
+
+		// ListPaged may return fewer results than pageSize. If there are more results
+		// available, signalled by non-empty p.NextPageToken, try to fetch the remainder
+		// of the page.
+		// It does not work to ask for more results than we need, because then we'd have
+		// a NextPageToken on a non-page boundary.
+		dopts.PageSize = pageSize - len(retval)
+		dopts.PageToken = p.NextPageToken
+		if len(dopts.PageToken) == 0 {
+			dopts.PageToken = nil
+			break
+		}
+	}
+
+	return retval, dopts.PageToken, nil
+}
+
+// Attributes contains attributes about a blob.
+type Attributes struct {
+	// CacheControl specifies caching attributes that services may use
+	// when serving the blob.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+	CacheControl string `json:"cacheControl"`
+
+	// ContentDisposition specifies whether the blob content is expected to be
+	// displayed inline or as an attachment.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+	ContentDisposition string `json:"contentDisposition"`
+
+	// ContentEncoding specifies the encoding used for the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+	ContentEncoding string `json:"contentEncoding"`
+
+	// ContentLanguage specifies the language used in the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+	ContentLanguage string `json:"contentLanguage"`
+
+	// ContentType is the MIME type of the blob. It will not be empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string `json:"contentType"`
+
+	// Metadata holds key/value pairs associated with the blob.
+	// Keys are guaranteed to be in lowercase, even if the backend service
+	// has case-sensitive keys (although note that Metadata written via
+	// this package will always be lowercased). If there are duplicate
+	// case-insensitive keys (e.g., "foo" and "FOO"), only one value
+	// will be kept, and it is undefined which one.
+	Metadata map[string]string `json:"metadata"`
+
+	// CreateTime is the time the blob was created, if available. If not available,
+	// CreateTime will be the zero time.
+	CreateTime time.Time `json:"createTime"`
+
+	// ModTime is the time the blob was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the blob's content in bytes.
+	Size int64 `json:"size"`
+
+	// MD5 is an MD5 hash of the blob contents or nil if not available.
+	MD5 []byte `json:"md5"`
+
+	// ETag for the blob; see https://en.wikipedia.org/wiki/HTTP_ETag.
+	ETag string `json:"etag"`
+}
+
+// Attributes returns attributes for the blob stored at key.
+//
+// If the blob does not exist, Attributes returns an error for which
+// gcerrors.Code will return gcerrors.NotFound.
+func (b *Bucket) Attributes(ctx context.Context, key string) (_ *Attributes, err error) {
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("Attributes key must be a valid UTF-8 string: %q", key)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	a, err := b.drv.Attributes(ctx, key)
+	if err != nil {
+		return nil, wrapError(b.drv, err, key)
+	}
+
+	var md map[string]string
+	if len(a.Metadata) > 0 {
+		// Services are inconsistent, but at least some treat keys
+		// as case-insensitive. To make the behavior consistent, we
+		// force-lowercase them when writing and reading.
+		md = make(map[string]string, len(a.Metadata))
+		for k, v := range a.Metadata {
+			md[strings.ToLower(k)] = v
+		}
+	}
+
+	return &Attributes{
+		CacheControl:       a.CacheControl,
+		ContentDisposition: a.ContentDisposition,
+		ContentEncoding:    a.ContentEncoding,
+		ContentLanguage:    a.ContentLanguage,
+		ContentType:        a.ContentType,
+		Metadata:           md,
+		CreateTime:         a.CreateTime,
+		ModTime:            a.ModTime,
+		Size:               a.Size,
+		MD5:                a.MD5,
+		ETag:               a.ETag,
+	}, nil
+}
+
+// Exists returns true if a blob exists at key, false if it does not exist, or
+// an error.
+//
+// It is a shortcut for calling Attributes and checking if it returns an error
+// with code ErrNotFound.
+func (b *Bucket) Exists(ctx context.Context, key string) (bool, error) {
+	_, err := b.Attributes(ctx, key)
+	if err == nil {
+		return true, nil
+	}
+
+	if errors.Is(err, ErrNotFound) {
+		return false, nil
+	}
+
+	return false, err
+}
+
+// NewReader is a shortcut for NewRangeReader with offset=0 and length=-1.
+func (b *Bucket) NewReader(ctx context.Context, key string) (*Reader, error) {
+	return b.newRangeReader(ctx, key, 0, -1)
+}
+
+// NewRangeReader returns a Reader to read content from the blob stored at key.
+// It reads at most length bytes starting at offset (>= 0).
+// If length is negative, it will read till the end of the blob.
+//
+// For the purposes of Seek, the returned Reader will start at offset and
+// end at the minimum of the actual end of the blob or (if length > 0) offset + length.
+//
+// Note that ctx is used for all reads performed during the lifetime of the reader.
+//
+// If the blob does not exist, NewRangeReader returns an error for which
+// gcerrors.Code will return gcerrors.NotFound. Exists is a lighter-weight way
+// to check for existence.
+//
+// A nil ReaderOptions is treated the same as the zero value.
+//
+// The caller must call Close on the returned Reader when done reading.
+func (b *Bucket) NewRangeReader(ctx context.Context, key string, offset, length int64) (_ *Reader, err error) {
+	return b.newRangeReader(ctx, key, offset, length)
+}
+
+func (b *Bucket) newRangeReader(ctx context.Context, key string, offset, length int64) (_ *Reader, err error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	if offset < 0 {
+		return nil, fmt.Errorf("NewRangeReader offset must be non-negative (%d)", offset)
+	}
+
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("NewRangeReader key must be a valid UTF-8 string: %q", key)
+	}
+
+	var dr DriverReader
+	dr, err = b.drv.NewRangeReader(ctx, key, offset, length)
+	if err != nil {
+		return nil, wrapError(b.drv, err, key)
+	}
+
+	r := &Reader{
+		drv:         b.drv,
+		r:           dr,
+		key:         key,
+		ctx:         ctx,
+		baseOffset:  offset,
+		baseLength:  length,
+		savedOffset: -1,
+	}
+
+	_, file, lineno, ok := runtime.Caller(2)
+	runtime.SetFinalizer(r, func(r *Reader) {
+		if !r.closed {
+			var caller string
+			if ok {
+				caller = fmt.Sprintf(" (%s:%d)", file, lineno)
+			}
+			log.Printf("A blob.Reader reading from %q was never closed%s", key, caller)
+		}
+	})
+
+	return r, nil
+}
+
+// WriterOptions sets options for NewWriter.
+type WriterOptions struct {
+	// BufferSize changes the default size in bytes of the chunks that
+	// Writer will upload in a single request; larger blobs will be split into
+	// multiple requests.
+	//
+	// This option may be ignored by some drivers.
+	//
+	// If 0, the driver will choose a reasonable default.
+	//
+	// If the Writer is used to do many small writes concurrently, using a
+	// smaller BufferSize may reduce memory usage.
+	BufferSize int
+
+	// MaxConcurrency changes the default concurrency for parts of an upload.
+	//
+	// This option may be ignored by some drivers.
+	//
+	// If 0, the driver will choose a reasonable default.
+	MaxConcurrency int
+
+	// CacheControl specifies caching attributes that services may use
+	// when serving the blob.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+	CacheControl string
+
+	// ContentDisposition specifies whether the blob content is expected to be
+	// displayed inline or as an attachment.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+	ContentDisposition string
+
+	// ContentEncoding specifies the encoding used for the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+	ContentEncoding string
+
+	// ContentLanguage specifies the language used in the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+	ContentLanguage string
+
+	// ContentType specifies the MIME type of the blob being written. If not set,
+	// it will be inferred from the content using the algorithm described at
+	// http://mimesniff.spec.whatwg.org/.
+	// Set DisableContentTypeDetection to true to disable the above and force
+	// the ContentType to stay empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string
+
+	// When true, if ContentType is the empty string, it will stay the empty
+	// string rather than being inferred from the content.
+	// Note that while the blob will be written with an empty string ContentType,
+	// most providers will fill one in during reads, so don't expect an empty
+	// ContentType if you read the blob back.
+	DisableContentTypeDetection bool
+
+	// ContentMD5 is used as a message integrity check.
+	// If len(ContentMD5) > 0, the MD5 hash of the bytes written must match
+	// ContentMD5, or Close will return an error without completing the write.
+	// https://tools.ietf.org/html/rfc1864
+	ContentMD5 []byte
+
+	// Metadata holds key/value strings to be associated with the blob, or nil.
+	// Keys may not be empty, and are lowercased before being written.
+	// Duplicate case-insensitive keys (e.g., "foo" and "FOO") will result in
+	// an error.
+	Metadata map[string]string
+}
+
+// NewWriter returns a Writer that writes to the blob stored at key.
+// A nil WriterOptions is treated the same as the zero value.
+//
+// If a blob with this key already exists, it will be replaced.
+// The blob being written is not guaranteed to be readable until Close
+// has been called; until then, any previous blob will still be readable.
+// Even after Close is called, newly written blobs are not guaranteed to be
+// returned from List; some services are only eventually consistent.
+//
+// The returned Writer will store ctx for later use in Write and/or Close.
+// To abort a write, cancel ctx; otherwise, it must remain open until
+// Close is called.
+//
+// The caller must call Close on the returned Writer, even if the write is
+// aborted.
+func (b *Bucket) NewWriter(ctx context.Context, key string, opts *WriterOptions) (_ *Writer, err error) {
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("NewWriter key must be a valid UTF-8 string: %q", key)
+	}
+	if opts == nil {
+		opts = &WriterOptions{}
+	}
+	dopts := &WriterOptions{
+		CacheControl:                opts.CacheControl,
+		ContentDisposition:          opts.ContentDisposition,
+		ContentEncoding:             opts.ContentEncoding,
+		ContentLanguage:             opts.ContentLanguage,
+		ContentMD5:                  opts.ContentMD5,
+		BufferSize:                  opts.BufferSize,
+		MaxConcurrency:              opts.MaxConcurrency,
+		DisableContentTypeDetection: opts.DisableContentTypeDetection,
+	}
+
+	if len(opts.Metadata) > 0 {
+		// Services are inconsistent, but at least some treat keys
+		// as case-insensitive. To make the behavior consistent, we
+		// force-lowercase them when writing and reading.
+		md := make(map[string]string, len(opts.Metadata))
+		for k, v := range opts.Metadata {
+			if k == "" {
+				return nil, errors.New("WriterOptions.Metadata keys may not be empty strings")
+			}
+			if !utf8.ValidString(k) {
+				return nil, fmt.Errorf("WriterOptions.Metadata keys must be valid UTF-8 strings: %q", k)
+			}
+			if !utf8.ValidString(v) {
+				return nil, fmt.Errorf("WriterOptions.Metadata values must be valid UTF-8 strings: %q", v)
+			}
+			lowerK := strings.ToLower(k)
+			if _, found := md[lowerK]; found {
+				return nil, fmt.Errorf("WriterOptions.Metadata has a duplicate case-insensitive metadata key: %q", lowerK)
+			}
+			md[lowerK] = v
+		}
+		dopts.Metadata = md
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+
+	w := &Writer{
+		drv:        b.drv,
+		cancel:     cancel,
+		key:        key,
+		contentMD5: opts.ContentMD5,
+		md5hash:    md5.New(),
+	}
+
+	if opts.ContentType != "" || opts.DisableContentTypeDetection {
+		var ct string
+		if opts.ContentType != "" {
+			t, p, err := mime.ParseMediaType(opts.ContentType)
+			if err != nil {
+				cancel()
+				return nil, err
+			}
+			ct = mime.FormatMediaType(t, p)
+		}
+		dw, err := b.drv.NewTypedWriter(ctx, key, ct, dopts)
+		if err != nil {
+			cancel()
+			return nil, wrapError(b.drv, err, key)
+		}
+		w.w = dw
+	} else {
+		// Save the fields needed to called NewTypedWriter later, once we've gotten
+		// sniffLen bytes; see the comment on Writer.
+		w.ctx = ctx
+		w.opts = dopts
+		w.buf = bytes.NewBuffer([]byte{})
+	}
+
+	_, file, lineno, ok := runtime.Caller(1)
+	runtime.SetFinalizer(w, func(w *Writer) {
+		if !w.closed {
+			var caller string
+			if ok {
+				caller = fmt.Sprintf(" (%s:%d)", file, lineno)
+			}
+			log.Printf("A blob.Writer writing to %q was never closed%s", key, caller)
+		}
+	})
+
+	return w, nil
+}
+
+// Copy the blob stored at srcKey to dstKey.
+// A nil CopyOptions is treated the same as the zero value.
+//
+// If the source blob does not exist, Copy returns an error for which
+// gcerrors.Code will return gcerrors.NotFound.
+//
+// If the destination blob already exists, it is overwritten.
+func (b *Bucket) Copy(ctx context.Context, dstKey, srcKey string) (err error) {
+	if !utf8.ValidString(srcKey) {
+		return fmt.Errorf("Copy srcKey must be a valid UTF-8 string: %q", srcKey)
+	}
+
+	if !utf8.ValidString(dstKey) {
+		return fmt.Errorf("Copy dstKey must be a valid UTF-8 string: %q", dstKey)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Copy(ctx, dstKey, srcKey), fmt.Sprintf("%s -> %s", srcKey, dstKey))
+}
+
+// Delete deletes the blob stored at key.
+//
+// If the blob does not exist, Delete returns an error for which
+// gcerrors.Code will return gcerrors.NotFound.
+func (b *Bucket) Delete(ctx context.Context, key string) (err error) {
+	if !utf8.ValidString(key) {
+		return fmt.Errorf("Delete key must be a valid UTF-8 string: %q", key)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Delete(ctx, key), key)
+}
+
+// Close releases any resources used for the bucket.
+func (b *Bucket) Close() error {
+	b.mu.Lock()
+	prev := b.closed
+	b.closed = true
+	b.mu.Unlock()
+
+	if prev {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Close(), "")
+}
+
+func wrapError(b Driver, err error, key string) error {
+	if err == nil {
+		return nil
+	}
+
+	// don't wrap or normalize EOF errors since there are many places
+	// in the standard library (e.g. io.ReadAll) that rely on checks
+	// such as "err == io.EOF" and they will fail
+	if errors.Is(err, io.EOF) {
+		return err
+	}
+
+	err = b.NormalizeError(err)
+
+	if key != "" {
+		err = fmt.Errorf("[key: %s] %w", key, err)
+	}
+
+	return err
+}

tools/filesystem/blob/driver.go

@@ -0,0 +1,110 @@
+package blob
+
+import (
+	"context"
+	"io"
+	"time"
+)
+
+// ReaderAttributes contains a subset of attributes about a blob that are
+// accessible from Reader.
+type ReaderAttributes struct {
+	// ContentType is the MIME type of the blob object. It must not be empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string `json:"contentType"`
+
+	// ModTime is the time the blob object was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the object in bytes.
+	Size int64 `json:"size"`
+}
+
+// DriverReader reads an object from the blob.
+type DriverReader interface {
+	io.ReadCloser
+
+	// Attributes returns a subset of attributes about the blob.
+	// The portable type will not modify the returned ReaderAttributes.
+	Attributes() *ReaderAttributes
+}
+
+// DriverWriter writes an object to the blob.
+type DriverWriter interface {
+	io.WriteCloser
+}
+
+// Driver provides read, write and delete operations on objects within it on the
+// blob service.
+type Driver interface {
+	NormalizeError(err error) error
+
+	// Attributes returns attributes for the blob. If the specified object does
+	// not exist, Attributes must return an error for which ErrorCode returns
+	// gcerrors.NotFound.
+	// The portable type will not modify the returned Attributes.
+	Attributes(ctx context.Context, key string) (*Attributes, error)
+
+	// ListPaged lists objects in the bucket, in lexicographical order by
+	// UTF-8-encoded key, returning pages of objects at a time.
+	// Services are only required to be eventually consistent with respect
+	// to recently written or deleted objects. That is to say, there is no
+	// guarantee that an object that's been written will immediately be returned
+	// from ListPaged.
+	// opts is guaranteed to be non-nil.
+	ListPaged(ctx context.Context, opts *ListOptions) (*ListPage, error)
+
+	// NewRangeReader returns a Reader that reads part of an object, reading at
+	// most length bytes starting at the given offset. If length is negative, it
+	// will read until the end of the object. If the specified object does not
+	// exist, NewRangeReader must return an error for which ErrorCode returns
+	// gcerrors.NotFound.
+	// opts is guaranteed to be non-nil.
+	//
+	// The returned Reader *may* also implement Downloader if the underlying
+	// implementation can take advantage of that. The Download call is guaranteed
+	// to be the only call to the Reader. For such readers, offset will always
+	// be 0 and length will always be -1.
+	NewRangeReader(ctx context.Context, key string, offset, length int64) (DriverReader, error)
+
+	// NewTypedWriter returns Writer that writes to an object associated with key.
+	//
+	// A new object will be created unless an object with this key already exists.
+	// Otherwise any previous object with the same key will be replaced.
+	// The object may not be available (and any previous object will remain)
+	// until Close has been called.
+	//
+	// contentType sets the MIME type of the object to be written.
+	// opts is guaranteed to be non-nil.
+	//
+	// The caller must call Close on the returned Writer when done writing.
+	//
+	// Implementations should abort an ongoing write if ctx is later canceled,
+	// and do any necessary cleanup in Close. Close should then return ctx.Err().
+	//
+	// The returned Writer *may* also implement Uploader if the underlying
+	// implementation can take advantage of that. The Upload call is guaranteed
+	// to be the only non-Close call to the Writer..
+	NewTypedWriter(ctx context.Context, key, contentType string, opts *WriterOptions) (DriverWriter, error)
+
+	// Copy copies the object associated with srcKey to dstKey.
+	//
+	// If the source object does not exist, Copy must return an error for which
+	// ErrorCode returns gcerrors.NotFound.
+	//
+	// If the destination object already exists, it should be overwritten.
+	//
+	// opts is guaranteed to be non-nil.
+	Copy(ctx context.Context, dstKey, srcKey string) error
+
+	// Delete deletes the object associated with key. If the specified object does
+	// not exist, Delete must return an error for which ErrorCode returns
+	// gcerrors.NotFound.
+	Delete(ctx context.Context, key string) error
+
+	// Close cleans up any resources used by the Bucket. Once Close is called,
+	// there will be no method calls to the Bucket other than As, ErrorAs, and
+	// ErrorCode. There may be open readers or writers that will receive calls.
+	// It is up to the driver as to how these will be handled.
+	Close() error
+}

tools/filesystem/blob/hex.go

@@ -0,0 +1,153 @@
+package blob
+
+import (
+	"fmt"
+	"strconv"
+)
+
+// Copied from gocloud.dev/blob to avoid nuances around the specific
+// HEX escaping/unescaping rules.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+// HexEscape returns s, with all runes for which shouldEscape returns true
+// escaped to "__0xXXX__", where XXX is the hex representation of the rune
+// value. For example, " " would escape to "__0x20__".
+//
+// Non-UTF-8 strings will have their non-UTF-8 characters escaped to
+// unicode.ReplacementChar; the original value is lost. Please file an
+// issue if you need non-UTF8 support.
+//
+// Note: shouldEscape takes the whole string as a slice of runes and an
+// index. Passing it a single byte or a single rune doesn't provide
+// enough context for some escape decisions; for example, the caller might
+// want to escape the second "/" in "//" but not the first one.
+// We pass a slice of runes instead of the string or a slice of bytes
+// because some decisions will be made on a rune basis (e.g., encode
+// all non-ASCII runes).
+func HexEscape(s string, shouldEscape func(s []rune, i int) bool) string {
+	// Do a first pass to see which runes (if any) need escaping.
+	runes := []rune(s)
+	var toEscape []int
+	for i := range runes {
+		if shouldEscape(runes, i) {
+			toEscape = append(toEscape, i)
+		}
+	}
+	if len(toEscape) == 0 {
+		return s
+	}
+
+	// Each escaped rune turns into at most 14 runes ("__0x7fffffff__"),
+	// so allocate an extra 13 for each. We'll reslice at the end
+	// if we didn't end up using them.
+	escaped := make([]rune, len(runes)+13*len(toEscape))
+	n := 0 // current index into toEscape
+	j := 0 // current index into escaped
+	for i, r := range runes {
+		if n < len(toEscape) && i == toEscape[n] {
+			// We were asked to escape this rune.
+			for _, x := range fmt.Sprintf("__%#x__", r) {
+				escaped[j] = x
+				j++
+			}
+			n++
+		} else {
+			escaped[j] = r
+			j++
+		}
+	}
+
+	return string(escaped[0:j])
+}
+
+// unescape tries to unescape starting at r[i].
+// It returns a boolean indicating whether the unescaping was successful,
+// and (if true) the unescaped rune and the last index of r that was used
+// during unescaping.
+func unescape(r []rune, i int) (bool, rune, int) {
+	// Look for "__0x".
+	if r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '0' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != 'x' {
+		return false, 0, 0
+	}
+	i++
+
+	// Capture the digits until the next "_" (if any).
+	var hexdigits []rune
+	for ; i < len(r) && r[i] != '_'; i++ {
+		hexdigits = append(hexdigits, r[i])
+	}
+
+	// Look for the trailing "__".
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+
+	// Parse the hex digits into an int32.
+	retval, err := strconv.ParseInt(string(hexdigits), 16, 32)
+	if err != nil {
+		return false, 0, 0
+	}
+
+	return true, rune(retval), i
+}
+
+// HexUnescape reverses HexEscape.
+func HexUnescape(s string) string {
+	var unescaped []rune
+
+	runes := []rune(s)
+	for i := 0; i < len(runes); i++ {
+		if ok, newR, newI := unescape(runes, i); ok {
+			// We unescaped some runes starting at i, resulting in the
+			// unescaped rune newR. The last rune used was newI.
+			if unescaped == nil {
+				// This is the first rune we've encountered that
+				// needed unescaping. Allocate a buffer and copy any
+				// previous runes.
+				unescaped = make([]rune, i)
+				copy(unescaped, runes)
+			}
+			unescaped = append(unescaped, newR)
+			i = newI
+		} else if unescaped != nil {
+			unescaped = append(unescaped, runes[i])
+		}
+	}
+
+	if unescaped == nil {
+		return s
+	}
+
+	return string(unescaped)
+}

tools/filesystem/blob/reader.go

@@ -0,0 +1,196 @@
+package blob
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"time"
+)
+
+// Largely copied from gocloud.dev/blob.Reader to minimize breaking changes.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+var _ io.ReadSeekCloser = (*Reader)(nil)
+
+// Reader reads bytes from a blob.
+// It implements io.ReadSeekCloser, and must be closed after reads are finished.
+type Reader struct {
+	ctx            context.Context // Used to recreate r after Seeks
+	r              DriverReader
+	drv            Driver
+	key            string
+	baseOffset     int64 // The base offset provided to NewRangeReader.
+	baseLength     int64 // The length provided to NewRangeReader (may be negative).
+	relativeOffset int64 // Current offset (relative to baseOffset).
+	savedOffset    int64 // Last relativeOffset for r, saved after relativeOffset is changed in Seek, or -1 if no Seek.
+	closed         bool
+}
+
+// Read implements io.Reader (https://golang.org/pkg/io/#Reader).
+func (r *Reader) Read(p []byte) (int, error) {
+	if r.savedOffset != -1 {
+		// We've done one or more Seeks since the last read. We may have
+		// to recreate the Reader.
+		//
+		// Note that remembering the savedOffset and lazily resetting the
+		// reader like this allows the caller to Seek, then Seek again back,
+		// to the original offset, without having to recreate the reader.
+		// We only have to recreate the reader if we actually read after a Seek.
+		// This is an important optimization because it's common to Seek
+		// to (SeekEnd, 0) and use the return value to determine the size
+		// of the data, then Seek back to (SeekStart, 0).
+		saved := r.savedOffset
+		if r.relativeOffset == saved {
+			// Nope! We're at the same place we left off.
+			r.savedOffset = -1
+		} else {
+			// Yep! We've changed the offset. Recreate the reader.
+			length := r.baseLength
+			if length >= 0 {
+				length -= r.relativeOffset
+				if length < 0 {
+					// Shouldn't happen based on checks in Seek.
+					return 0, fmt.Errorf("invalid Seek (base length %d, relative offset %d)", r.baseLength, r.relativeOffset)
+				}
+			}
+			newR, err := r.drv.NewRangeReader(r.ctx, r.key, r.baseOffset+r.relativeOffset, length)
+			if err != nil {
+				return 0, wrapError(r.drv, err, r.key)
+			}
+			_ = r.r.Close()
+			r.savedOffset = -1
+			r.r = newR
+		}
+	}
+	n, err := r.r.Read(p)
+	r.relativeOffset += int64(n)
+	return n, wrapError(r.drv, err, r.key)
+}
+
+// Seek implements io.Seeker (https://golang.org/pkg/io/#Seeker).
+func (r *Reader) Seek(offset int64, whence int) (int64, error) {
+	if r.savedOffset == -1 {
+		// Save the current offset for our reader. If the Seek changes the
+		// offset, and then we try to read, we'll need to recreate the reader.
+		// See comment above in Read for why we do it lazily.
+		r.savedOffset = r.relativeOffset
+	}
+	// The maximum relative offset is the minimum of:
+	// 1. The actual size of the blob, minus our initial baseOffset.
+	// 2. The length provided to NewRangeReader (if it was non-negative).
+	maxRelativeOffset := r.Size() - r.baseOffset
+	if r.baseLength >= 0 && r.baseLength < maxRelativeOffset {
+		maxRelativeOffset = r.baseLength
+	}
+	switch whence {
+	case io.SeekStart:
+		r.relativeOffset = offset
+	case io.SeekCurrent:
+		r.relativeOffset += offset
+	case io.SeekEnd:
+		r.relativeOffset = maxRelativeOffset + offset
+	}
+	if r.relativeOffset < 0 {
+		// "Seeking to an offset before the start of the file is an error."
+		invalidOffset := r.relativeOffset
+		r.relativeOffset = 0
+		return 0, fmt.Errorf("Seek resulted in invalid offset %d, using 0", invalidOffset)
+	}
+	if r.relativeOffset > maxRelativeOffset {
+		// "Seeking to any positive offset is legal, but the behavior of subsequent
+		// I/O operations on the underlying object is implementation-dependent."
+		// We'll choose to set the offset to the EOF.
+		log.Printf("blob.Reader.Seek set an offset after EOF (base offset/length from NewRangeReader %d, %d; actual blob size %d; relative offset %d -> absolute offset %d).", r.baseOffset, r.baseLength, r.Size(), r.relativeOffset, r.baseOffset+r.relativeOffset)
+		r.relativeOffset = maxRelativeOffset
+	}
+	return r.relativeOffset, nil
+}
+
+// Close implements io.Closer (https://golang.org/pkg/io/#Closer).
+func (r *Reader) Close() error {
+	r.closed = true
+	err := wrapError(r.drv, r.r.Close(), r.key)
+	return err
+}
+
+// ContentType returns the MIME type of the blob.
+func (r *Reader) ContentType() string {
+	return r.r.Attributes().ContentType
+}
+
+// ModTime returns the time the blob was last modified.
+func (r *Reader) ModTime() time.Time {
+	return r.r.Attributes().ModTime
+}
+
+// Size returns the size of the blob content in bytes.
+func (r *Reader) Size() int64 {
+	return r.r.Attributes().Size
+}
+
+// WriteTo reads from r and writes to w until there's no more data or
+// an error occurs.
+// The return value is the number of bytes written to w.
+//
+// It implements the io.WriterTo interface.
+func (r *Reader) WriteTo(w io.Writer) (int64, error) {
+	// If the writer has a ReaderFrom method, use it to do the copy.
+	// Don't do this for our own *Writer to avoid infinite recursion.
+	// Avoids an allocation and a copy.
+	switch w.(type) {
+	case *Writer:
+	default:
+		if rf, ok := w.(io.ReaderFrom); ok {
+			n, err := rf.ReadFrom(r)
+			return n, err
+		}
+	}
+
+	_, nw, err := readFromWriteTo(r, w)
+	return nw, err
+}
+
+// readFromWriteTo is a helper for ReadFrom and WriteTo.
+// It reads data from r and writes to w, until EOF or a read/write error.
+// It returns the number of bytes read from r and the number of bytes
+// written to w.
+func readFromWriteTo(r io.Reader, w io.Writer) (int64, int64, error) {
+	// Note: can't use io.Copy because it will try to use r.WriteTo
+	// or w.WriteTo, which is recursive in this context.
+	buf := make([]byte, 1024)
+	var totalRead, totalWritten int64
+	for {
+		numRead, rerr := r.Read(buf)
+		if numRead > 0 {
+			totalRead += int64(numRead)
+			numWritten, werr := w.Write(buf[0:numRead])
+			totalWritten += int64(numWritten)
+			if werr != nil {
+				return totalRead, totalWritten, werr
+			}
+		}
+		if rerr == io.EOF {
+			// Done!
+			return totalRead, totalWritten, nil
+		}
+		if rerr != nil {
+			return totalRead, totalWritten, rerr
+		}
+	}
+}

tools/filesystem/blob/writer.go

@@ -0,0 +1,184 @@
+package blob
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"hash"
+	"io"
+	"net/http"
+)
+
+// Largely copied from gocloud.dev/blob.Writer to minimize breaking changes.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+var _ io.WriteCloser = (*Writer)(nil)
+
+// Writer writes bytes to a blob.
+//
+// It implements io.WriteCloser (https://golang.org/pkg/io/#Closer), and must be
+// closed after all writes are done.
+type Writer struct {
+	drv          Driver
+	w            DriverWriter
+	key          string
+	cancel       func() // cancels the ctx provided to NewTypedWriter if contentMD5 verification fails
+	contentMD5   []byte
+	md5hash      hash.Hash
+	bytesWritten int
+	closed       bool
+
+	// These fields are non-zero values only when w is nil (not yet created).
+	//
+	// A ctx is stored in the Writer since we need to pass it into NewTypedWriter
+	// when we finish detecting the content type of the blob and create the
+	// underlying driver.Writer. This step happens inside Write or Close and
+	// neither of them take a context.Context as an argument.
+	//
+	// All 3 fields are only initialized when we create the Writer without
+	// setting the w field, and are reset to zero values after w is created.
+	ctx  context.Context
+	opts *WriterOptions
+	buf  *bytes.Buffer
+}
+
+// sniffLen is the byte size of Writer.buf used to detect content-type.
+const sniffLen = 512
+
+// Write implements the io.Writer interface (https://golang.org/pkg/io/#Writer).
+//
+// Writes may happen asynchronously, so the returned error can be nil
+// even if the actual write eventually fails. The write is only guaranteed to
+// have succeeded if Close returns no error.
+func (w *Writer) Write(p []byte) (int, error) {
+	if len(w.contentMD5) > 0 {
+		if _, err := w.md5hash.Write(p); err != nil {
+			return 0, err
+		}
+	}
+
+	if w.w != nil {
+		return w.write(p)
+	}
+
+	// If w is not yet created due to no content-type being passed in, try to sniff
+	// the MIME type based on at most 512 bytes of the blob content of p.
+
+	// Detect the content-type directly if the first chunk is at least 512 bytes.
+	if w.buf.Len() == 0 && len(p) >= sniffLen {
+		return w.open(p)
+	}
+
+	// Store p in w.buf and detect the content-type when the size of content in
+	// w.buf is at least 512 bytes.
+	n, err := w.buf.Write(p)
+	if err != nil {
+		return 0, err
+	}
+
+	if w.buf.Len() >= sniffLen {
+		// Note that w.open will return the full length of the buffer; we don't want
+		// to return that as the length of this write since some of them were written in
+		// previous writes. Instead, we return the n from this write, above.
+		_, err := w.open(w.buf.Bytes())
+		return n, err
+	}
+
+	return n, nil
+}
+
+// Close closes the blob writer. The write operation is not guaranteed
+// to have succeeded until Close returns with no error.
+//
+// Close may return an error if the context provided to create the
+// Writer is canceled or reaches its deadline.
+func (w *Writer) Close() (err error) {
+	w.closed = true
+
+	// Verify the MD5 hash of what was written matches the ContentMD5 provided by the user.
+	if len(w.contentMD5) > 0 {
+		md5sum := w.md5hash.Sum(nil)
+		if !bytes.Equal(md5sum, w.contentMD5) {
+			// No match! Return an error, but first cancel the context and call the
+			// driver's Close function to ensure the write is aborted.
+			w.cancel()
+			if w.w != nil {
+				_ = w.w.Close()
+			}
+			return fmt.Errorf("the WriterOptions.ContentMD5 you specified (%X) did not match what was written (%X)", w.contentMD5, md5sum)
+		}
+	}
+
+	defer w.cancel()
+
+	if w.w != nil {
+		return wrapError(w.drv, w.w.Close(), w.key)
+	}
+
+	if _, err := w.open(w.buf.Bytes()); err != nil {
+		return err
+	}
+
+	return wrapError(w.drv, w.w.Close(), w.key)
+}
+
+// open tries to detect the MIME type of p and write it to the blob.
+// The error it returns is wrapped.
+func (w *Writer) open(p []byte) (int, error) {
+	ct := http.DetectContentType(p)
+
+	var err error
+	w.w, err = w.drv.NewTypedWriter(w.ctx, w.key, ct, w.opts)
+	if err != nil {
+		return 0, wrapError(w.drv, err, w.key)
+	}
+
+	// Set the 3 fields needed for lazy NewTypedWriter back to zero values
+	// (see the comment on Writer).
+	w.buf = nil
+	w.ctx = nil
+	w.opts = nil
+
+	return w.write(p)
+}
+
+func (w *Writer) write(p []byte) (int, error) {
+	n, err := w.w.Write(p)
+	w.bytesWritten += n
+	return n, wrapError(w.drv, err, w.key)
+}
+
+// ReadFrom reads from r and writes to w until EOF or error.
+// The return value is the number of bytes read from r.
+//
+// It implements the io.ReaderFrom interface.
+func (w *Writer) ReadFrom(r io.Reader) (int64, error) {
+	// If the reader has a WriteTo method, use it to do the copy.
+	// Don't do this for our own *Reader to avoid infinite recursion.
+	// Avoids an allocation and a copy.
+	switch r.(type) {
+	case *Reader:
+	default:
+		if wt, ok := r.(io.WriterTo); ok {
+			return wt.WriteTo(w)
+		}
+	}
+
+	nr, _, err := readFromWriteTo(r, w)
+	return nr, err
+}

tools/filesystem/filesystem.go

@@ -14,22 +14,20 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/disintegration/imaging"
 	"github.com/gabriel-vasile/mimetype"
-	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3lite"
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/fileblob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"gocloud.dev/blob"
-	"gocloud.dev/blob/fileblob"
-	"gocloud.dev/gcerrors"
+
+	// explicit webp decoder because disintegration/imaging does not support webp
+	_ "golang.org/x/image/webp"
 )
 
-var gcpIgnoreHeaders = []string{"Accept-Encoding"}
-
-var ErrNotFound = errors.New("blob not found")
+// note: the same as blob.ErrNotFound for backward compatibility with earlier versions
+var ErrNotFound = blob.ErrNotFound
 
 type System struct {
 	ctx    context.Context
@@ -49,41 +47,21 @@ func NewS3(
 ) (*System, error) {
 	ctx := context.Background() // default context
 
-	cred := credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")
+	client := &s3.S3{
+		Bucket:       bucketName,
+		Region:       region,
+		Endpoint:     endpoint,
+		AccessKey:    accessKey,
+		SecretKey:    secretKey,
+		UsePathStyle: s3ForcePathStyle,
+	}
 
-	cfg, err := config.LoadDefaultConfig(
-		ctx,
-		config.WithCredentialsProvider(cred),
-		config.WithRegion(region),
-	)
+	drv, err := s3blob.New(client)
 	if err != nil {
 		return nil, err
 	}
 
-	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
-		// ensure that the endpoint has url scheme for
-		// backward compatibility with v1 of the aws sdk
-		if !strings.Contains(endpoint, "://") {
-			endpoint = "https://" + endpoint
-		}
-		o.BaseEndpoint = aws.String(endpoint)
-
-		o.UsePathStyle = s3ForcePathStyle
-
-		// Google Cloud Storage alters the Accept-Encoding header,
-		// which breaks the v2 request signature
-		// (https://github.com/aws/aws-sdk-go-v2/issues/1816)
-		if strings.Contains(endpoint, "storage.googleapis.com") {
-			ignoreSigningHeaders(o, gcpIgnoreHeaders)
-		}
-	})
-
-	bucket, err := s3lite.OpenBucketV2(ctx, client, bucketName, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return &System{ctx: ctx, bucket: bucket}, nil
+	return &System{ctx: ctx, bucket: blob.NewBucket(drv)}, nil
 }
 
 // NewLocal initializes a new local filesystem instance.
@@ -97,14 +75,14 @@ func NewLocal(dirPath string) (*System, error) {
 		return nil, err
 	}
 
-	bucket, err := fileblob.OpenBucket(dirPath, &fileblob.Options{
+	drv, err := fileblob.New(dirPath, &fileblob.Options{
 		NoTempDir: true,
 	})
 	if err != nil {
 		return nil, err
 	}
 
-	return &System{ctx: ctx, bucket: bucket}, nil
+	return &System{ctx: ctx, bucket: blob.NewBucket(drv)}, nil
 }
 
 // SetContext assigns the specified context to the current filesystem.
@@ -118,29 +96,15 @@ func (s *System) Close() error {
 }
 
 // Exists checks if file with fileKey path exists or not.
-//
-// If the file doesn't exist returns false and ErrNotFound.
 func (s *System) Exists(fileKey string) (bool, error) {
-	exists, err := s.bucket.Exists(s.ctx, fileKey)
-
-	if gcerrors.Code(err) == gcerrors.NotFound {
-		err = ErrNotFound
-	}
-
-	return exists, err
+	return s.bucket.Exists(s.ctx, fileKey)
 }
 
 // Attributes returns the attributes for the file with fileKey path.
 //
 // If the file doesn't exist it returns ErrNotFound.
 func (s *System) Attributes(fileKey string) (*blob.Attributes, error) {
-	attrs, err := s.bucket.Attributes(s.ctx, fileKey)
-
-	if gcerrors.Code(err) == gcerrors.NotFound {
-		err = ErrNotFound
-	}
-
-	return attrs, err
+	return s.bucket.Attributes(s.ctx, fileKey)
 }
 
 // GetFile returns a file content reader for the given fileKey.
@@ -149,13 +113,7 @@ func (s *System) Attributes(fileKey string) (*blob.Attributes, error) {
 //
 // If the file doesn't exist returns ErrNotFound.
 func (s *System) GetFile(fileKey string) (*blob.Reader, error) {
-	br, err := s.bucket.NewReader(s.ctx, fileKey, nil)
-
-	if gcerrors.Code(err) == gcerrors.NotFound {
-		err = ErrNotFound
-	}
-
-	return br, err
+	return s.bucket.NewReader(s.ctx, fileKey)
 }
 
 // Copy copies the file stored at srcKey to dstKey.
@@ -164,13 +122,7 @@ func (s *System) GetFile(fileKey string) (*blob.Reader, error) {
 //
 // If dstKey file already exists, it is overwritten.
 func (s *System) Copy(srcKey, dstKey string) error {
-	err := s.bucket.Copy(s.ctx, dstKey, srcKey, nil)
-
-	if gcerrors.Code(err) == gcerrors.NotFound {
-		err = ErrNotFound
-	}
-
-	return err
+	return s.bucket.Copy(s.ctx, dstKey, srcKey)
 }
 
 // List returns a flat list with info for all files under the specified prefix.
@@ -184,7 +136,7 @@ func (s *System) List(prefix string) ([]*blob.ListObject, error) {
 	for {
 		obj, err := iter.Next(s.ctx)
 		if err != nil {
-			if err != io.EOF {
+			if !errors.Is(err, io.EOF) {
 				return nil, err
 			}
 			break
@@ -301,13 +253,7 @@ func (s *System) UploadMultipart(fh *multipart.FileHeader, fileKey string) error
 //
 // If the file doesn't exist returns ErrNotFound.
 func (s *System) Delete(fileKey string) error {
-	err := s.bucket.Delete(s.ctx, fileKey)
-
-	if gcerrors.Code(err) == gcerrors.NotFound {
-		return ErrNotFound
-	}
-
-	return err
+	return s.bucket.Delete(s.ctx, fileKey)
 }
 
 // DeletePrefix deletes everything starting with the specified prefix.
@@ -339,7 +285,7 @@ func (s *System) DeletePrefix(prefix string) []error {
 	for {
 		obj, err := iter.Next(s.ctx)
 		if err != nil {
-			if err != io.EOF {
+			if !errors.Is(err, io.EOF) {
 				failed = append(failed, err)
 			}
 			break
@@ -398,7 +344,7 @@ func (s *System) IsEmptyDir(dir string) bool {
 
 	_, err := iter.Next(s.ctx)
 
-	return err == io.EOF
+	return err != nil && errors.Is(err, io.EOF)
 }
 
 var inlineServeContentTypes = []string{
@@ -415,8 +361,10 @@ var inlineServeContentTypes = []string{
 
 // manualExtensionContentTypes is a map of file extensions to content types.
 var manualExtensionContentTypes = map[string]string{
-	".svg": "image/svg+xml", // (see https://github.com/whatwg/mimesniff/issues/7)
-	".css": "text/css",      // (see https://github.com/gabriel-vasile/mimetype/pull/113)
+	".svg": "image/svg+xml",   // (see https://github.com/whatwg/mimesniff/issues/7)
+	".css": "text/css",        // (see https://github.com/gabriel-vasile/mimetype/pull/113)
+	".js":  "text/javascript", // (see https://github.com/pocketbase/pocketbase/issues/6597)
+	".mjs": "text/javascript",
 }
 
 // forceAttachmentParam is the name of the request query parameter to
@@ -451,7 +399,7 @@ func (s *System) Serve(res http.ResponseWriter, req *http.Request, fileKey strin
 	// make an exception for specific content types and force a custom
 	// content type to send in the response so that it can be loaded properly
 	extContentType := realContentType
-	if ct, found := manualExtensionContentTypes[filepath.Ext(name)]; found && extContentType != ct {
+	if ct, found := manualExtensionContentTypes[filepath.Ext(name)]; found {
 		extContentType = ct
 	}
 

tools/filesystem/filesystem_test.go

@@ -4,7 +4,9 @@ import (
 	"bytes"
 	"errors"
 	"image"
+	"image/jpeg"
 	"image/png"
+	"io"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
@@ -13,6 +15,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/gabriel-vasile/mimetype"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 )
 
@@ -364,7 +367,7 @@ func TestFileSystemServe(t *testing.T) {
 			map[string]string{
 				"Content-Disposition":     "attachment; filename=test_name.txt",
 				"Content-Type":            "application/octet-stream",
-				"Content-Length":          "0",
+				"Content-Length":          "4",
 				"Content-Security-Policy": csp,
 				"Cache-Control":           cacheControl,
 			},
@@ -429,6 +432,36 @@ func TestFileSystemServe(t *testing.T) {
 				"Cache-Control":           cacheControl,
 			},
 		},
+		{
+			// js exception
+			"main.js",
+			"test_name.js",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.js",
+				"Content-Type":            "text/javascript",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// mjs exception
+			"main.mjs",
+			"test_name.mjs",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.mjs",
+				"Content-Type":            "text/javascript",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
 		{
 			// custom header
 			"test/sub2.txt",
@@ -437,7 +470,7 @@ func TestFileSystemServe(t *testing.T) {
 			map[string]string{
 				"Content-Disposition":     "1",
 				"Content-Type":            "2",
-				"Content-Length":          "3",
+				"Content-Length":          "1",
 				"Content-Security-Policy": "4",
 				"Cache-Control":           "5",
 				"X-Custom":                "6",
@@ -446,7 +479,7 @@ func TestFileSystemServe(t *testing.T) {
 			map[string]string{
 				"Content-Disposition":     "1",
 				"Content-Type":            "2",
-				"Content-Length":          "0", // overwriten by http.ServeContent
+				"Content-Length":          "4", // overwriten by http.ServeContent
 				"Content-Security-Policy": "4",
 				"Cache-Control":           "5",
 				"X-Custom":                "6",
@@ -504,29 +537,42 @@ func TestFileSystemGetFile(t *testing.T) {
 	defer fsys.Close()
 
 	scenarios := []struct {
-		file        string
-		expectError bool
+		file            string
+		expectError     bool
+		expectedContent string
 	}{
-		{"missing.png", true},
-		{"image.png", false},
+		{"test/missing.txt", true, ""},
+		{"test/sub1.txt", false, "sub1"},
 	}
 
 	for _, s := range scenarios {
 		t.Run(s.file, func(t *testing.T) {
 			f, err := fsys.GetFile(s.file)
+			defer func() {
+				if f != nil {
+					f.Close()
+				}
+			}()
 
 			hasErr := err != nil
-
-			if !hasErr {
-				defer f.Close()
-			}
-
 			if hasErr != s.expectError {
 				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
 			}
 
-			if hasErr && !errors.Is(err, filesystem.ErrNotFound) {
-				t.Fatalf("Expected ErrNotFound error, got %v", err)
+			if hasErr {
+				if !errors.Is(err, filesystem.ErrNotFound) {
+					t.Fatalf("Expected ErrNotFound error, got %v", err)
+				}
+				return
+			}
+
+			raw, err := io.ReadAll(f)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(raw); str != s.expectedContent {
+				t.Fatalf("Expected content\n%s\ngot\n%s", s.expectedContent, str)
 			}
 		})
 	}
@@ -583,9 +629,13 @@ func TestFileSystemList(t *testing.T) {
 			"",
 			[]string{
 				"image.png",
+				"image.jpg",
 				"image.svg",
+				"image.webp",
 				"image_! noext",
 				"style.css",
+				"main.js",
+				"main.mjs",
 				"test/sub1.txt",
 				"test/sub2.txt",
 			},
@@ -604,25 +654,30 @@ func TestFileSystemList(t *testing.T) {
 	}
 
 	for _, s := range scenarios {
-		objs, err := fsys.List(s.prefix)
-		if err != nil {
-			t.Fatalf("[%s] %v", s.prefix, err)
-		}
-
-		if len(s.expected) != len(objs) {
-			t.Fatalf("[%s] Expected %d files, got \n%v", s.prefix, len(s.expected), objs)
-		}
-
-	ObjsLoop:
-		for _, obj := range objs {
-			for _, name := range s.expected {
-				if name == obj.Key {
-					continue ObjsLoop
-				}
+		t.Run("prefix_"+s.prefix, func(t *testing.T) {
+			objs, err := fsys.List(s.prefix)
+			if err != nil {
+				t.Fatal(err)
 			}
 
-			t.Fatalf("[%s] Unexpected file %q", s.prefix, obj.Key)
-		}
+			if len(s.expected) != len(objs) {
+				t.Fatalf("Expected %d files, got \n%v", len(s.expected), objs)
+			}
+
+			for _, obj := range objs {
+				var exists bool
+				for _, name := range s.expected {
+					if name == obj.Key {
+						exists = true
+						break
+					}
+				}
+
+				if !exists {
+					t.Fatalf("Unexpected file %q", obj.Key)
+				}
+			}
+		})
 	}
 }
 
@@ -700,39 +755,67 @@ func TestFileSystemCreateThumb(t *testing.T) {
 	defer fsys.Close()
 
 	scenarios := []struct {
-		file        string
-		thumb       string
-		cropCenter  bool
-		expectError bool
+		file             string
+		thumb            string
+		size             string
+		expectedMimeType string
 	}{
 		// missing
-		{"missing.txt", "thumb_test_missing", true, true},
+		{"missing.txt", "thumb_test_missing", "100x100", ""},
 		// non-image existing file
-		{"test/sub1.txt", "thumb_test_sub1", true, true},
-		// existing image file - crop center
-		{"image.png", "thumb_file_center", true, false},
-		// existing image file - crop top
-		{"image.png", "thumb_file_top", false, false},
+		{"test/sub1.txt", "thumb_test_sub1", "100x100", ""},
 		// existing image file with existing thumb path = should fail
-		{"image.png", "test", true, true},
+		{"image.png", "test", "100x100", ""},
+		// existing image file with invalid thumb size
+		{"image.png", "thumb0", "invalid", ""},
+		// existing image file with 0xH thumb size
+		{"image.png", "thumb_0xH", "0x100", "image/png"},
+		// existing image file with Wx0 thumb size
+		{"image.png", "thumb_Wx0", "100x0", "image/png"},
+		// existing image file with WxH thumb size
+		{"image.png", "thumb_WxH", "100x100", "image/png"},
+		// existing image file with WxHt thumb size
+		{"image.png", "thumb_WxHt", "100x100t", "image/png"},
+		// existing image file with WxHb thumb size
+		{"image.png", "thumb_WxHb", "100x100b", "image/png"},
+		// existing image file with WxHf thumb size
+		{"image.png", "thumb_WxHf", "100x100f", "image/png"},
+		// jpg
+		{"image.jpg", "thumb.jpg", "100x100", "image/jpeg"},
+		// webp (should produce png)
+		{"image.webp", "thumb.webp", "100x100", "image/png"},
 	}
 
-	for i, scenario := range scenarios {
-		err := fsys.CreateThumb(scenario.file, scenario.thumb, "100x100")
+	for _, s := range scenarios {
+		t.Run(s.file+"_"+s.thumb+"_"+s.size, func(t *testing.T) {
+			err := fsys.CreateThumb(s.file, s.thumb, s.size)
 
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
-			continue
-		}
+			expectErr := s.expectedMimeType == ""
 
-		if scenario.expectError {
-			continue
-		}
+			hasErr := err != nil
+			if hasErr != expectErr {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", expectErr, hasErr, err)
+			}
 
-		if exists, _ := fsys.Exists(scenario.thumb); !exists {
-			t.Errorf("(%d) Couldn't find %q thumb", i, scenario.thumb)
-		}
+			if hasErr {
+				return
+			}
+
+			f, err := fsys.GetFile(s.thumb)
+			if err != nil {
+				t.Fatalf("Missing expected thumb %s (%v)", s.thumb, err)
+			}
+			defer f.Close()
+
+			mt, err := mimetype.DetectReader(f)
+			if err != nil {
+				t.Fatalf("Failed to detect thumb %s mimetype (%v)", s.thumb, err)
+			}
+
+			if mtStr := mt.String(); mtStr != s.expectedMimeType {
+				t.Fatalf("Expected thumb %s MimeType %q, got %q", s.thumb, s.expectedMimeType, mtStr)
+			}
+		})
 	}
 }
 
@@ -744,56 +827,114 @@ func createTestDir(t *testing.T) string {
 		t.Fatal(err)
 	}
 
-	if err := os.MkdirAll(filepath.Join(dir, "empty"), os.ModePerm); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := os.MkdirAll(filepath.Join(dir, "test"), os.ModePerm); err != nil {
-		t.Fatal(err)
-	}
-
-	file1, err := os.OpenFile(filepath.Join(dir, "test/sub1.txt"), os.O_WRONLY|os.O_CREATE, 0644)
+	err = os.MkdirAll(filepath.Join(dir, "empty"), os.ModePerm)
 	if err != nil {
 		t.Fatal(err)
 	}
-	file1.Close()
 
-	file2, err := os.OpenFile(filepath.Join(dir, "test/sub2.txt"), os.O_WRONLY|os.O_CREATE, 0644)
+	err = os.MkdirAll(filepath.Join(dir, "test"), os.ModePerm)
 	if err != nil {
 		t.Fatal(err)
 	}
-	file2.Close()
 
-	file3, err := os.OpenFile(filepath.Join(dir, "image.png"), os.O_WRONLY|os.O_CREATE, 0644)
+	err = os.WriteFile(filepath.Join(dir, "test/sub1.txt"), []byte("sub1"), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
-	imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 png
-	png.Encode(file3, imgRect)
-	file3.Close()
-	err2 := os.WriteFile(filepath.Join(dir, "image.png.attrs"), []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null}`), 0644)
-	if err2 != nil {
-		t.Fatal(err2)
-	}
 
-	file4, err := os.OpenFile(filepath.Join(dir, "image.svg"), os.O_WRONLY|os.O_CREATE, 0644)
+	err = os.WriteFile(filepath.Join(dir, "test/sub2.txt"), []byte("sub2"), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
-	file4.Close()
 
-	file5, err := os.OpenFile(filepath.Join(dir, "style.css"), os.O_WRONLY|os.O_CREATE, 0644)
-	if err != nil {
-		t.Fatal(err)
-	}
-	file5.Close()
+	// png
+	{
 
-	file6, err := os.OpenFile(filepath.Join(dir, "image_! noext"), os.O_WRONLY|os.O_CREATE, 0644)
-	if err != nil {
-		t.Fatal(err)
+		file, err := os.OpenFile(filepath.Join(dir, "image.png"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 png
+		_ = png.Encode(file, imgRect)
+		file.Close()
+		err = os.WriteFile(filepath.Join(dir, "image.png.attrs"), []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// jpg
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image.jpg"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 jpg
+		_ = jpeg.Encode(file, imgRect, nil)
+		file.Close()
+		err = os.WriteFile(filepath.Join(dir, "image.jpg.attrs"), []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/jpeg","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// svg
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image.svg"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// webp
+	{
+		err := os.WriteFile(filepath.Join(dir, "image.webp"), []byte{
+			82, 73, 70, 70, 36, 0, 0, 0, 87, 69, 66, 80, 86, 80, 56, 32,
+			24, 0, 0, 0, 48, 1, 0, 157, 1, 42, 1, 0, 1, 0, 2, 0, 52, 37,
+			164, 0, 3, 112, 0, 254, 251, 253, 80, 0,
+		}, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// no extension and invalid characters
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image_! noext"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = png.Encode(file, image.Rect(0, 0, 1, 1)) // tiny 1x1 png
+		file.Close()
+	}
+
+	// css
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "style.css"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// js
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "main.js"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// mjs
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "main.mjs"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
 	}
-	png.Encode(file6, image.Rect(0, 0, 1, 1)) // tiny 1x1 png
-	file6.Close()
 
 	return dir
 }

tools/filesystem/ignore_signing_headers.go

@@ -1,72 +0,0 @@
-package filesystem
-
-import (
-	"context"
-	"fmt"
-
-	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/aws/smithy-go/middleware"
-	smithyhttp "github.com/aws/smithy-go/transport/http"
-)
-
-// ignoreSigningHeaders excludes the listed headers
-// from the request signing because some providers may alter them.
-//
-// See https://github.com/aws/aws-sdk-go-v2/issues/1816.
-func ignoreSigningHeaders(o *s3.Options, headers []string) {
-	o.APIOptions = append(o.APIOptions, func(stack *middleware.Stack) error {
-		if err := stack.Finalize.Insert(ignoreHeaders(headers), "Signing", middleware.Before); err != nil {
-			return err
-		}
-
-		if err := stack.Finalize.Insert(restoreIgnored(), "Signing", middleware.After); err != nil {
-			return err
-		}
-
-		return nil
-	})
-}
-
-type ignoredHeadersKey struct{}
-
-func ignoreHeaders(headers []string) middleware.FinalizeMiddleware {
-	return middleware.FinalizeMiddlewareFunc(
-		"IgnoreHeaders",
-		func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (out middleware.FinalizeOutput, metadata middleware.Metadata, err error) {
-			req, ok := in.Request.(*smithyhttp.Request)
-			if !ok {
-				return out, metadata, &v4.SigningError{Err: fmt.Errorf("(ignoreHeaders) unexpected request middleware type %T", in.Request)}
-			}
-
-			ignored := make(map[string]string, len(headers))
-			for _, h := range headers {
-				ignored[h] = req.Header.Get(h)
-				req.Header.Del(h)
-			}
-
-			ctx = middleware.WithStackValue(ctx, ignoredHeadersKey{}, ignored)
-
-			return next.HandleFinalize(ctx, in)
-		},
-	)
-}
-
-func restoreIgnored() middleware.FinalizeMiddleware {
-	return middleware.FinalizeMiddlewareFunc(
-		"RestoreIgnored",
-		func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (out middleware.FinalizeOutput, metadata middleware.Metadata, err error) {
-			req, ok := in.Request.(*smithyhttp.Request)
-			if !ok {
-				return out, metadata, &v4.SigningError{Err: fmt.Errorf("(restoreIgnored) unexpected request middleware type %T", in.Request)}
-			}
-
-			ignored, _ := middleware.GetStackValue(ctx, ignoredHeadersKey{}).(map[string]string)
-			for k, v := range ignored {
-				req.Header.Set(k, v)
-			}
-
-			return next.HandleFinalize(ctx, in)
-		},
-	)
-}

tools/filesystem/internal/fileblob/attrs.go

@@ -0,0 +1,84 @@
+package fileblob
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+// Largely copied from gocloud.dev/blob/fileblob to apply the same
+// retrieve and write side-car .attrs rules.
+//
+// -------------------------------------------------------------------
+// Copyright 2018 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+const attrsExt = ".attrs"
+
+var errAttrsExt = fmt.Errorf("file extension %q is reserved", attrsExt)
+
+// xattrs stores extended attributes for an object. The format is like
+// filesystem extended attributes, see
+// https://www.freedesktop.org/wiki/CommonExtendedAttributes.
+type xattrs struct {
+	CacheControl       string            `json:"user.cache_control"`
+	ContentDisposition string            `json:"user.content_disposition"`
+	ContentEncoding    string            `json:"user.content_encoding"`
+	ContentLanguage    string            `json:"user.content_language"`
+	ContentType        string            `json:"user.content_type"`
+	Metadata           map[string]string `json:"user.metadata"`
+	MD5                []byte            `json:"md5"`
+}
+
+// setAttrs creates a "path.attrs" file along with blob to store the attributes,
+// it uses JSON format.
+func setAttrs(path string, xa xattrs) error {
+	f, err := os.Create(path + attrsExt)
+	if err != nil {
+		return err
+	}
+
+	if err := json.NewEncoder(f).Encode(xa); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return err
+	}
+
+	return f.Close()
+}
+
+// getAttrs looks at the "path.attrs" file to retrieve the attributes and
+// decodes them into a xattrs struct. It doesn't return error when there is no
+// such .attrs file.
+func getAttrs(path string) (xattrs, error) {
+	f, err := os.Open(path + attrsExt)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Handle gracefully for non-existent .attr files.
+			return xattrs{
+				ContentType: "application/octet-stream",
+			}, nil
+		}
+		return xattrs{}, err
+	}
+
+	xa := new(xattrs)
+	if err := json.NewDecoder(f).Decode(xa); err != nil {
+		f.Close()
+		return xattrs{}, err
+	}
+
+	return *xa, f.Close()
+}

tools/filesystem/internal/fileblob/fileblob.go

@@ -0,0 +1,713 @@
+// Package fileblob provides a blob.Bucket driver implementation.
+//
+// NB! To minimize breaking changes with older PocketBase releases,
+// the driver is a stripped down and adapted version of the previously
+// used gocloud.dev/blob/fileblob, hence many of the below doc comments,
+// struct options and interface implementations are the same.
+//
+// To avoid partial writes, fileblob writes to a temporary file and then renames
+// the temporary file to the final path on Close. By default, it creates these
+// temporary files in `os.TempDir`. If `os.TempDir` is on a different mount than
+// your base bucket path, the `os.Rename` will fail with `invalid cross-device link`.
+// To avoid this, either configure the temp dir to use by setting the environment
+// variable `TMPDIR`, or set `Options.NoTempDir` to `true` (fileblob will create
+// the temporary files next to the actual files instead of in a temporary directory).
+//
+// By default fileblob stores blob metadata in "sidecar" files under the original
+// filename with an additional ".attrs" suffix.
+// This behaviour can be changed via `Options.Metadata`;
+// writing of those metadata files can be suppressed by setting it to
+// `MetadataDontWrite` or its equivalent "metadata=skip" in the URL for the opener.
+// In either case, absent any stored metadata many `blob.Attributes` fields
+// will be set to default values.
+//
+// The blob abstraction supports all UTF-8 strings; to make this work with services lacking
+// full UTF-8 support, strings must be escaped (during writes) and unescaped
+// (during reads). The following escapes are performed for fileblob:
+//   - Blob keys: ASCII characters 0-31 are escaped to "__0x<hex>__".
+//     If os.PathSeparator != "/", it is also escaped.
+//     Additionally, the "/" in "../", the trailing "/" in "//", and a trailing
+//     "/" is key names are escaped in the same way.
+//     On Windows, the characters "<>:"|?*" are also escaped.
+//
+// Example:
+//
+//	drv, _ := fileblob.New("/path/to/dir", nil)
+//	bucket := blob.NewBucket(drv)
+package fileblob
+
+import (
+	"context"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+)
+
+const defaultPageSize = 1000
+
+type metadataOption string // Not exported as subject to change.
+
+// Settings for Options.Metadata.
+const (
+	// Metadata gets written to a separate file.
+	MetadataInSidecar metadataOption = ""
+
+	// Writes won't carry metadata, as per the package docstring.
+	MetadataDontWrite metadataOption = "skip"
+)
+
+// Options sets options for constructing a *blob.Bucket backed by fileblob.
+type Options struct {
+	// Refers to the strategy for how to deal with metadata (such as blob.Attributes).
+	// For supported values please see the Metadata* constants.
+	// If left unchanged, 'MetadataInSidecar' will be used.
+	Metadata metadataOption
+
+	// The FileMode to use when creating directories for the top-level directory
+	// backing the bucket (when CreateDir is true), and for subdirectories for keys.
+	// Defaults to 0777.
+	DirFileMode os.FileMode
+
+	// If true, create the directory backing the Bucket if it does not exist
+	// (using os.MkdirAll).
+	CreateDir bool
+
+	// If true, don't use os.TempDir for temporary files, but instead place them
+	// next to the actual files. This may result in "stranded" temporary files
+	// (e.g., if the application is killed before the file cleanup runs).
+	//
+	// If your bucket directory is on a different mount than os.TempDir, you will
+	// need to set this to true, as os.Rename will fail across mount points.
+	NoTempDir bool
+}
+
+// New creates a new instance of the fileblob driver backed by the
+// filesystem and rooted at dir, which must exist.
+func New(dir string, opts *Options) (blob.Driver, error) {
+	if opts == nil {
+		opts = &Options{}
+	}
+	if opts.DirFileMode == 0 {
+		opts.DirFileMode = os.FileMode(0o777)
+	}
+
+	absdir, err := filepath.Abs(dir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert %s into an absolute path: %v", dir, err)
+	}
+
+	// Optionally, create the directory if it does not already exist.
+	info, err := os.Stat(absdir)
+	if err != nil && opts.CreateDir && os.IsNotExist(err) {
+		err = os.MkdirAll(absdir, opts.DirFileMode)
+		if err != nil {
+			return nil, fmt.Errorf("tried to create directory but failed: %v", err)
+		}
+		info, err = os.Stat(absdir)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if !info.IsDir() {
+		return nil, fmt.Errorf("%s is not a directory", absdir)
+	}
+
+	return &driver{dir: absdir, opts: opts}, nil
+}
+
+type driver struct {
+	opts *Options
+	dir  string
+}
+
+// Close implements [blob/Driver.Close].
+func (drv *driver) Close() error {
+	return nil
+}
+
+// NormalizeError implements [blob/Driver.NormalizeError].
+func (drv *driver) NormalizeError(err error) error {
+	if os.IsNotExist(err) {
+		return errors.Join(err, blob.ErrNotFound)
+	}
+
+	return err
+}
+
+// path returns the full path for a key.
+func (drv *driver) path(key string) (string, error) {
+	path := filepath.Join(drv.dir, escapeKey(key))
+
+	if strings.HasSuffix(path, attrsExt) {
+		return "", errAttrsExt
+	}
+
+	return path, nil
+}
+
+// forKey returns the full path, os.FileInfo, and attributes for key.
+func (drv *driver) forKey(key string) (string, os.FileInfo, *xattrs, error) {
+	path, err := drv.path(key)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	if info.IsDir() {
+		return "", nil, nil, os.ErrNotExist
+	}
+
+	xa, err := getAttrs(path)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	return path, info, &xa, nil
+}
+
+// ListPaged implements [blob/Driver.ListPaged].
+func (drv *driver) ListPaged(ctx context.Context, opts *blob.ListOptions) (*blob.ListPage, error) {
+	var pageToken string
+	if len(opts.PageToken) > 0 {
+		pageToken = string(opts.PageToken)
+	}
+
+	pageSize := opts.PageSize
+	if pageSize == 0 {
+		pageSize = defaultPageSize
+	}
+
+	// If opts.Delimiter != "", lastPrefix contains the last "directory" key we
+	// added. It is used to avoid adding it again; all files in this "directory"
+	// are collapsed to the single directory entry.
+	var lastPrefix string
+	var lastKeyAdded string
+
+	// If the Prefix contains a "/", we can set the root of the Walk
+	// to the path specified by the Prefix as any files below the path will not
+	// match the Prefix.
+	// Note that we use "/" explicitly and not os.PathSeparator, as the opts.Prefix
+	// is in the unescaped form.
+	root := drv.dir
+	if i := strings.LastIndex(opts.Prefix, "/"); i > -1 {
+		root = filepath.Join(root, opts.Prefix[:i])
+	}
+
+	var result blob.ListPage
+
+	// Do a full recursive scan of the root directory.
+	err := filepath.WalkDir(root, func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			// Couldn't read this file/directory for some reason; just skip it.
+			return nil
+		}
+
+		// Skip the self-generated attribute files.
+		if strings.HasSuffix(path, attrsExt) {
+			return nil
+		}
+
+		// os.Walk returns the root directory; skip it.
+		if path == drv.dir {
+			return nil
+		}
+
+		// Strip the <drv.dir> prefix from path.
+		prefixLen := len(drv.dir)
+		// Include the separator for non-root.
+		if drv.dir != "/" {
+			prefixLen++
+		}
+		path = path[prefixLen:]
+
+		// Unescape the path to get the key.
+		key := unescapeKey(path)
+
+		// Skip all directories. If opts.Delimiter is set, we'll create
+		// pseudo-directories later.
+		// Note that returning nil means that we'll still recurse into it;
+		// we're just not adding a result for the directory itself.
+		if info.IsDir() {
+			key += "/"
+			// Avoid recursing into subdirectories if the directory name already
+			// doesn't match the prefix; any files in it are guaranteed not to match.
+			if len(key) > len(opts.Prefix) && !strings.HasPrefix(key, opts.Prefix) {
+				return filepath.SkipDir
+			}
+			// Similarly, avoid recursing into subdirectories if we're making
+			// "directories" and all of the files in this subdirectory are guaranteed
+			// to collapse to a "directory" that we've already added.
+			if lastPrefix != "" && strings.HasPrefix(key, lastPrefix) {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+
+		// Skip files/directories that don't match the Prefix.
+		if !strings.HasPrefix(key, opts.Prefix) {
+			return nil
+		}
+
+		var md5 []byte
+		if xa, err := getAttrs(path); err == nil {
+			// Note: we only have the MD5 hash for blobs that we wrote.
+			// For other blobs, md5 will remain nil.
+			md5 = xa.MD5
+		}
+
+		fi, err := info.Info()
+		if err != nil {
+			return err
+		}
+
+		obj := &blob.ListObject{
+			Key:     key,
+			ModTime: fi.ModTime(),
+			Size:    fi.Size(),
+			MD5:     md5,
+		}
+
+		// If using Delimiter, collapse "directories".
+		if opts.Delimiter != "" {
+			// Strip the prefix, which may contain Delimiter.
+			keyWithoutPrefix := key[len(opts.Prefix):]
+			// See if the key still contains Delimiter.
+			// If no, it's a file and we just include it.
+			// If yes, it's a file in a "sub-directory" and we want to collapse
+			// all files in that "sub-directory" into a single "directory" result.
+			if idx := strings.Index(keyWithoutPrefix, opts.Delimiter); idx != -1 {
+				prefix := opts.Prefix + keyWithoutPrefix[0:idx+len(opts.Delimiter)]
+				// We've already included this "directory"; don't add it.
+				if prefix == lastPrefix {
+					return nil
+				}
+				// Update the object to be a "directory".
+				obj = &blob.ListObject{
+					Key:   prefix,
+					IsDir: true,
+				}
+				lastPrefix = prefix
+			}
+		}
+
+		// If there's a pageToken, skip anything before it.
+		if pageToken != "" && obj.Key <= pageToken {
+			return nil
+		}
+
+		// If we've already got a full page of results, set NextPageToken and stop.
+		// Unless the current object is a directory, in which case there may
+		// still be objects coming that are alphabetically before it (since
+		// we appended the delimiter). In that case, keep going; we'll trim the
+		// extra entries (if any) before returning.
+		if len(result.Objects) == pageSize && !obj.IsDir {
+			result.NextPageToken = []byte(result.Objects[pageSize-1].Key)
+			return io.EOF
+		}
+
+		result.Objects = append(result.Objects, obj)
+
+		// Normally, objects are added in the correct order (by Key).
+		// However, sometimes adding the file delimiter messes that up
+		// (e.g., if the file delimiter is later in the alphabet than the last character of a key).
+		// Detect if this happens and swap if needed.
+		if len(result.Objects) > 1 && obj.Key < lastKeyAdded {
+			i := len(result.Objects) - 1
+			result.Objects[i-1], result.Objects[i] = result.Objects[i], result.Objects[i-1]
+			lastKeyAdded = result.Objects[i].Key
+		} else {
+			lastKeyAdded = obj.Key
+		}
+
+		return nil
+	})
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+
+	if len(result.Objects) > pageSize {
+		result.Objects = result.Objects[0:pageSize]
+		result.NextPageToken = []byte(result.Objects[pageSize-1].Key)
+	}
+
+	return &result, nil
+}
+
+// Attributes implements [blob/Driver.Attributes].
+func (drv *driver) Attributes(ctx context.Context, key string) (*blob.Attributes, error) {
+	_, info, xa, err := drv.forKey(key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &blob.Attributes{
+		CacheControl:       xa.CacheControl,
+		ContentDisposition: xa.ContentDisposition,
+		ContentEncoding:    xa.ContentEncoding,
+		ContentLanguage:    xa.ContentLanguage,
+		ContentType:        xa.ContentType,
+		Metadata:           xa.Metadata,
+		// CreateTime left as the zero time.
+		ModTime: info.ModTime(),
+		Size:    info.Size(),
+		MD5:     xa.MD5,
+		ETag:    fmt.Sprintf("\"%x-%x\"", info.ModTime().UnixNano(), info.Size()),
+	}, nil
+}
+
+// NewRangeReader implements [blob/Driver.NewRangeReader].
+func (drv *driver) NewRangeReader(ctx context.Context, key string, offset, length int64) (blob.DriverReader, error) {
+	path, info, xa, err := drv.forKey(key)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if offset > 0 {
+		if _, err := f.Seek(offset, io.SeekStart); err != nil {
+			return nil, err
+		}
+	}
+
+	r := io.Reader(f)
+	if length >= 0 {
+		r = io.LimitReader(r, length)
+	}
+
+	return &reader{
+		r: r,
+		c: f,
+		attrs: &blob.ReaderAttributes{
+			ContentType: xa.ContentType,
+			ModTime:     info.ModTime(),
+			Size:        info.Size(),
+		},
+	}, nil
+}
+
+func createTemp(path string, noTempDir bool) (*os.File, error) {
+	// Use a custom createTemp function rather than os.CreateTemp() as
+	// os.CreateTemp() sets the permissions of the tempfile to 0600, rather than
+	// 0666, making it inconsistent with the directories and attribute files.
+	try := 0
+	for {
+		// Append the current time with nanosecond precision and .tmp to the
+		// base path. If the file already exists try again. Nanosecond changes enough
+		// between each iteration to make a conflict unlikely. Using the full
+		// time lowers the chance of a collision with a file using a similar
+		// pattern, but has undefined behavior after the year 2262.
+		var name string
+		if noTempDir {
+			name = path
+		} else {
+			name = filepath.Join(os.TempDir(), filepath.Base(path))
+		}
+		name += "." + strconv.FormatInt(time.Now().UnixNano(), 16) + ".tmp"
+
+		f, err := os.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o666)
+		if os.IsExist(err) {
+			if try++; try < 10000 {
+				continue
+			}
+			return nil, &os.PathError{Op: "createtemp", Path: path + ".*.tmp", Err: os.ErrExist}
+		}
+
+		return f, err
+	}
+}
+
+// NewTypedWriter implements [blob/Driver.NewTypedWriter].
+func (drv *driver) NewTypedWriter(ctx context.Context, key, contentType string, opts *blob.WriterOptions) (blob.DriverWriter, error) {
+	path, err := drv.path(key)
+	if err != nil {
+		return nil, err
+	}
+
+	err = os.MkdirAll(filepath.Dir(path), drv.opts.DirFileMode)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := createTemp(path, drv.opts.NoTempDir)
+	if err != nil {
+		return nil, err
+	}
+
+	if drv.opts.Metadata == MetadataDontWrite {
+		w := &writer{
+			ctx:  ctx,
+			File: f,
+			path: path,
+		}
+		return w, nil
+	}
+
+	var metadata map[string]string
+	if len(opts.Metadata) > 0 {
+		metadata = opts.Metadata
+	}
+
+	return &writerWithSidecar{
+		ctx:        ctx,
+		f:          f,
+		path:       path,
+		contentMD5: opts.ContentMD5,
+		md5hash:    md5.New(),
+		attrs: xattrs{
+			CacheControl:       opts.CacheControl,
+			ContentDisposition: opts.ContentDisposition,
+			ContentEncoding:    opts.ContentEncoding,
+			ContentLanguage:    opts.ContentLanguage,
+			ContentType:        contentType,
+			Metadata:           metadata,
+		},
+	}, nil
+}
+
+// Copy implements [blob/Driver.Copy].
+func (drv *driver) Copy(ctx context.Context, dstKey, srcKey string) error {
+	// Note: we could use NewRangeReader here, but since we need to copy all of
+	// the metadata (from xa), it's more efficient to do it directly.
+	srcPath, _, xa, err := drv.forKey(srcKey)
+	if err != nil {
+		return err
+	}
+
+	f, err := os.Open(srcPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// We'll write the copy using Writer, to avoid re-implementing making of a
+	// temp file, cleaning up after partial failures, etc.
+	wopts := blob.WriterOptions{
+		CacheControl:       xa.CacheControl,
+		ContentDisposition: xa.ContentDisposition,
+		ContentEncoding:    xa.ContentEncoding,
+		ContentLanguage:    xa.ContentLanguage,
+		Metadata:           xa.Metadata,
+	}
+
+	// Create a cancelable context so we can cancel the write if there are problems.
+	writeCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	w, err := drv.NewTypedWriter(writeCtx, dstKey, xa.ContentType, &wopts)
+	if err != nil {
+		return err
+	}
+
+	_, err = io.Copy(w, f)
+	if err != nil {
+		cancel() // cancel before Close cancels the write
+		w.Close()
+		return err
+	}
+
+	return w.Close()
+}
+
+// Delete implements [blob/Driver.Delete].
+func (b *driver) Delete(ctx context.Context, key string) error {
+	path, err := b.path(key)
+	if err != nil {
+		return err
+	}
+
+	err = os.Remove(path)
+	if err != nil {
+		return err
+	}
+
+	err = os.Remove(path + attrsExt)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type reader struct {
+	r     io.Reader
+	c     io.Closer
+	attrs *blob.ReaderAttributes
+}
+
+func (r *reader) Read(p []byte) (int, error) {
+	if r.r == nil {
+		return 0, io.EOF
+	}
+	return r.r.Read(p)
+}
+
+func (r *reader) Close() error {
+	if r.c == nil {
+		return nil
+	}
+	return r.c.Close()
+}
+
+// Attributes implements [blob/DriverReader.Attributes].
+func (r *reader) Attributes() *blob.ReaderAttributes {
+	return r.attrs
+}
+
+// -------------------------------------------------------------------
+
+// writerWithSidecar implements the strategy of storing metadata in a distinct file.
+type writerWithSidecar struct {
+	ctx        context.Context
+	md5hash    hash.Hash
+	f          *os.File
+	path       string
+	attrs      xattrs
+	contentMD5 []byte
+}
+
+func (w *writerWithSidecar) Write(p []byte) (n int, err error) {
+	n, err = w.f.Write(p)
+	if err != nil {
+		// Don't hash the unwritten tail twice when writing is resumed.
+		w.md5hash.Write(p[:n])
+		return n, err
+	}
+
+	if _, err := w.md5hash.Write(p); err != nil {
+		return n, err
+	}
+
+	return n, nil
+}
+
+func (w *writerWithSidecar) Close() error {
+	err := w.f.Close()
+	if err != nil {
+		return err
+	}
+
+	// Always delete the temp file. On success, it will have been
+	// renamed so the Remove will fail.
+	defer func() {
+		_ = os.Remove(w.f.Name())
+	}()
+
+	// Check if the write was cancelled.
+	if err := w.ctx.Err(); err != nil {
+		return err
+	}
+
+	md5sum := w.md5hash.Sum(nil)
+	w.attrs.MD5 = md5sum
+
+	// Write the attributes file.
+	if err := setAttrs(w.path, w.attrs); err != nil {
+		return err
+	}
+
+	// Rename the temp file to path.
+	if err := os.Rename(w.f.Name(), w.path); err != nil {
+		_ = os.Remove(w.path + attrsExt)
+		return err
+	}
+
+	return nil
+}
+
+// writer is a file with a temporary name until closed.
+//
+// Embedding os.File allows the likes of io.Copy to use optimizations,
+// which is why it is not folded into writerWithSidecar.
+type writer struct {
+	*os.File
+	ctx  context.Context
+	path string
+}
+
+func (w *writer) Close() error {
+	err := w.File.Close()
+	if err != nil {
+		return err
+	}
+
+	// Always delete the temp file. On success, it will have been renamed so
+	// the Remove will fail.
+	tempname := w.Name()
+	defer os.Remove(tempname)
+
+	// Check if the write was cancelled.
+	if err := w.ctx.Err(); err != nil {
+		return err
+	}
+
+	// Rename the temp file to path.
+	return os.Rename(tempname, w.path)
+}
+
+// -------------------------------------------------------------------
+
+// escapeKey does all required escaping for UTF-8 strings to work the filesystem.
+func escapeKey(s string) string {
+	s = blob.HexEscape(s, func(r []rune, i int) bool {
+		c := r[i]
+		switch {
+		case c < 32:
+			return true
+		// We're going to replace '/' with os.PathSeparator below. In order for this
+		// to be reversible, we need to escape raw os.PathSeparators.
+		case os.PathSeparator != '/' && c == os.PathSeparator:
+			return true
+		// For "../", escape the trailing slash.
+		case i > 1 && c == '/' && r[i-1] == '.' && r[i-2] == '.':
+			return true
+		// For "//", escape the trailing slash.
+		case i > 0 && c == '/' && r[i-1] == '/':
+			return true
+		// Escape the trailing slash in a key.
+		case c == '/' && i == len(r)-1:
+			return true
+		// https://docs.microsoft.com/en-us/windows/desktop/fileio/naming-a-file
+		case os.PathSeparator == '\\' && (c == '>' || c == '<' || c == ':' || c == '"' || c == '|' || c == '?' || c == '*'):
+			return true
+		}
+		return false
+	})
+
+	// Replace "/" with os.PathSeparator if needed, so that the local filesystem
+	// can use subdirectories.
+	if os.PathSeparator != '/' {
+		s = strings.ReplaceAll(s, "/", string(os.PathSeparator))
+	}
+
+	return s
+}
+
+// unescapeKey reverses escapeKey.
+func unescapeKey(s string) string {
+	if os.PathSeparator != '/' {
+		s = strings.ReplaceAll(s, string(os.PathSeparator), "/")
+	}
+
+	return blob.HexUnescape(s)
+}

tools/filesystem/internal/s3blob/s3/copy_object.go

@@ -0,0 +1,59 @@
+package s3
+
+import (
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html#API_CopyObject_ResponseSyntax
+type CopyObjectResponse struct {
+	CopyObjectResult  xml.Name  `json:"copyObjectResult" xml:"CopyObjectResult"`
+	ETag              string    `json:"etag" xml:"ETag"`
+	LastModified      time.Time `json:"lastModified" xml:"LastModified"`
+	ChecksumType      string    `json:"checksumType" xml:"ChecksumType"`
+	ChecksumCRC32     string    `json:"checksumCRC32" xml:"ChecksumCRC32"`
+	ChecksumCRC32C    string    `json:"checksumCRC32C" xml:"ChecksumCRC32C"`
+	ChecksumCRC64NVME string    `json:"checksumCRC64NVME" xml:"ChecksumCRC64NVME"`
+	ChecksumSHA1      string    `json:"checksumSHA1" xml:"ChecksumSHA1"`
+	ChecksumSHA256    string    `json:"checksumSHA256" xml:"ChecksumSHA256"`
+}
+
+// CopyObject copies a single object from srcKey to dstKey destination.
+// (both keys are expected to be operating within the same bucket).
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html
+func (s3 *S3) CopyObject(ctx context.Context, srcKey string, dstKey string, optReqFuncs ...func(*http.Request)) (*CopyObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, s3.URL(dstKey), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// per the doc the header value must be URL-encoded
+	req.Header.Set("x-amz-copy-source", url.PathEscape(s3.Bucket+"/"+strings.TrimLeft(srcKey, "/")))
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	result := &CopyObjectResponse{}
+
+	err = xml.NewDecoder(resp.Body).Decode(result)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}

tools/filesystem/internal/s3blob/s3/copy_object_test.go

@@ -0,0 +1,67 @@
+package s3_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3CopyObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/@dst_test",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":       "test",
+					"x-amz-copy-source": "test_bucket%2F@src_test",
+					"Authorization":     "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Body: io.NopCloser(strings.NewReader(`
+					<CopyObjectResult>
+						<LastModified>2025-01-01T01:02:03.456Z</LastModified>
+						<ETag>test_etag</ETag>
+					</CopyObjectResult>
+				`)),
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	copyResp, err := s3Client.CopyObject(context.Background(), "@src_test", "@dst_test", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if copyResp.ETag != "test_etag" {
+		t.Fatalf("Expected ETag %q, got %q", "test_etag", copyResp.ETag)
+	}
+
+	if date := copyResp.LastModified.Format("2006-01-02T15:04:05.000Z"); date != "2025-01-01T01:02:03.456Z" {
+		t.Fatalf("Expected LastModified %q, got %q", "2025-01-01T01:02:03.456Z", date)
+	}
+}

tools/filesystem/internal/s3blob/s3/delete_object.go

@@ -0,0 +1,31 @@
+package s3
+
+import (
+	"context"
+	"net/http"
+)
+
+// DeleteObject deletes a single object by its key.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html
+func (s3 *S3) DeleteObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, s3.URL(key), nil)
+	if err != nil {
+		return err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	return nil
+}

tools/filesystem/internal/s3blob/s3/delete_object_test.go

@@ -0,0 +1,48 @@
+package s3_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3DeleteObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodDelete,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	err := s3Client.DeleteObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}

tools/filesystem/internal/s3blob/s3/error.go

@@ -0,0 +1,49 @@
+package s3
+
+import (
+	"encoding/xml"
+	"strconv"
+	"strings"
+)
+
+var _ error = (*ResponseError)(nil)
+
+// ResponseError defines a general S3 response error.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
+type ResponseError struct {
+	XMLName   xml.Name `json:"-" xml:"Error"`
+	Code      string   `json:"code" xml:"Code"`
+	Message   string   `json:"message" xml:"Message"`
+	RequestId string   `json:"requestId" xml:"RequestId"`
+	Resource  string   `json:"resource" xml:"Resource"`
+	Raw       []byte   `json:"-" xml:"-"`
+	Status    int      `json:"status" xml:"Status"`
+}
+
+// Error implements the std error interface.
+func (err *ResponseError) Error() string {
+	var strBuilder strings.Builder
+
+	strBuilder.WriteString(strconv.Itoa(err.Status))
+	strBuilder.WriteString(" ")
+
+	if err.Code != "" {
+		strBuilder.WriteString(err.Code)
+	} else {
+		strBuilder.WriteString("S3ResponseError")
+	}
+
+	if err.Message != "" {
+		strBuilder.WriteString(": ")
+		strBuilder.WriteString(err.Message)
+	}
+
+	if len(err.Raw) > 0 {
+		strBuilder.WriteString("\n(RAW: ")
+		strBuilder.Write(err.Raw)
+		strBuilder.WriteString(")")
+	}
+
+	return strBuilder.String()
+}

tools/filesystem/internal/s3blob/s3/error_test.go

@@ -0,0 +1,86 @@
+package s3_test
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+)
+
+func TestResponseErrorSerialization(t *testing.T) {
+	raw := `
+		<?xml version="1.0" encoding="UTF-8"?>
+		<Error>
+		  <Code>test_code</Code>
+		  <Message>test_message</Message>
+		  <RequestId>test_request_id</RequestId>
+		  <Resource>test_resource</Resource>
+		</Error>
+	`
+
+	respErr := &s3.ResponseError{
+		Status: 123,
+		Raw:    []byte("test"),
+	}
+
+	err := xml.Unmarshal([]byte(raw), &respErr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jsonRaw, err := json.Marshal(respErr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonStr := string(jsonRaw)
+
+	expected := `{"code":"test_code","message":"test_message","requestId":"test_request_id","resource":"test_resource","status":123}`
+
+	if expected != jsonStr {
+		t.Fatalf("Expected JSON\n%s\ngot\n%s", expected, jsonStr)
+	}
+}
+
+func TestResponseErrorErrorInterface(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		err      *s3.ResponseError
+		expected string
+	}{
+		{
+			"empty",
+			&s3.ResponseError{},
+			"0 S3ResponseError",
+		},
+		{
+			"with code and message (nil raw)",
+			&s3.ResponseError{
+				Status:  123,
+				Code:    "test_code",
+				Message: "test_message",
+			},
+			"123 test_code: test_message",
+		},
+		{
+			"with code and message (non-nil raw)",
+			&s3.ResponseError{
+				Status:  123,
+				Code:    "test_code",
+				Message: "test_message",
+				Raw:     []byte("test_raw"),
+			},
+			"123 test_code: test_message\n(RAW: test_raw)",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.err.Error()
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}

tools/filesystem/internal/s3blob/s3/get_object.go

@@ -0,0 +1,43 @@
+package s3
+
+import (
+	"context"
+	"io"
+	"net/http"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html#API_GetObject_ResponseElements
+type GetObjectResponse struct {
+	Body io.ReadCloser `json:"-" xml:"-"`
+
+	HeadObjectResponse
+}
+
+// GetObject retrieves a single object by its key.
+//
+// NB! Make sure to call GetObjectResponse.Body.Close() after done working with the result.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
+func (s3 *S3) GetObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) (*GetObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, s3.URL(key), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+
+	result := &GetObjectResponse{Body: resp.Body}
+	result.load(resp.Header)
+
+	return result, nil
+}

tools/filesystem/internal/s3blob/s3/get_object_test.go

@@ -0,0 +1,92 @@
+package s3_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3GetObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodGet,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{
+					"Last-Modified":       []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+					"Cache-Control":       []string{"test_cache"},
+					"Content-Disposition": []string{"test_disposition"},
+					"Content-Encoding":    []string{"test_encoding"},
+					"Content-Language":    []string{"test_language"},
+					"Content-Type":        []string{"test_type"},
+					"Content-Range":       []string{"test_range"},
+					"Etag":                []string{"test_etag"},
+					"Content-Length":      []string{"100"},
+					"x-amz-meta-AbC":      []string{"test_meta_a"},
+					"x-amz-meta-Def":      []string{"test_meta_b"},
+				},
+				Body: io.NopCloser(strings.NewReader("test")),
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	resp, err := s3Client.GetObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// check body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bodyStr := string(body)
+
+	if bodyStr != "test" {
+		t.Fatalf("Expected body\n%q\ngot\n%q", "test", bodyStr)
+	}
+
+	// check serialized attributes
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"metadata":{"abc":"test_meta_a","def":"test_meta_b"},"lastModified":"2025-02-01T03:04:05Z","cacheControl":"test_cache","contentDisposition":"test_disposition","contentEncoding":"test_encoding","contentLanguage":"test_language","contentType":"test_type","contentRange":"test_range","etag":"test_etag","contentLength":100}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected attributes\n%s\ngot\n%s", expected, rawStr)
+	}
+}

tools/filesystem/internal/s3blob/s3/head_object.go

@@ -0,0 +1,89 @@
+package s3
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html#API_HeadObject_ResponseElements
+type HeadObjectResponse struct {
+	// Metadata is the extra data that is stored with the S3 object (aka. the "x-amz-meta-*" header values).
+	//
+	// The map keys are normalized to lower-case.
+	Metadata map[string]string `json:"metadata"`
+
+	// LastModified date and time when the object was last modified.
+	LastModified time.Time `json:"lastModified"`
+
+	// CacheControl specifies caching behavior along the request/reply chain.
+	CacheControl string `json:"cacheControl"`
+
+	// ContentDisposition specifies presentational information for the object.
+	ContentDisposition string `json:"contentDisposition"`
+
+	// ContentEncoding indicates what content encodings have been applied to the object
+	// and thus what decoding mechanisms must be applied to obtain the
+	// media-type referenced by the Content-Type header field.
+	ContentEncoding string `json:"contentEncoding"`
+
+	// ContentLanguage indicates the language the content is in.
+	ContentLanguage string `json:"contentLanguage"`
+
+	// ContentType is a standard MIME type describing the format of the object data.
+	ContentType string `json:"contentType"`
+
+	// ContentRange is the portion of the object usually returned in the response for a GET request.
+	ContentRange string `json:"contentRange"`
+
+	// ETag is an opaque identifier assigned by a web
+	// server to a specific version of a resource found at a URL.
+	ETag string `json:"etag"`
+
+	// ContentLength is size of the body in bytes.
+	ContentLength int64 `json:"contentLength"`
+}
+
+// load parses and load the header values into the current HeadObjectResponse fields.
+func (o *HeadObjectResponse) load(headers http.Header) {
+	o.LastModified, _ = time.Parse(time.RFC1123, headers.Get("Last-Modified"))
+	o.CacheControl = headers.Get("Cache-Control")
+	o.ContentDisposition = headers.Get("Content-Disposition")
+	o.ContentEncoding = headers.Get("Content-Encoding")
+	o.ContentLanguage = headers.Get("Content-Language")
+	o.ContentType = headers.Get("Content-Type")
+	o.ContentRange = headers.Get("Content-Range")
+	o.ETag = headers.Get("ETag")
+	o.ContentLength, _ = strconv.ParseInt(headers.Get("Content-Length"), 10, 0)
+	o.Metadata = extractMetadata(headers)
+}
+
+// HeadObject sends a HEAD request for a single object to check its
+// existence and to retrieve its metadata.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html
+func (s3 *S3) HeadObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) (*HeadObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, s3.URL(key), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	result := &HeadObjectResponse{}
+	result.load(resp.Header)
+
+	return result, nil
+}

tools/filesystem/internal/s3blob/s3/head_object_test.go

@@ -0,0 +1,77 @@
+package s3_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3HeadObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodHead,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{
+					"Last-Modified":       []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+					"Cache-Control":       []string{"test_cache"},
+					"Content-Disposition": []string{"test_disposition"},
+					"Content-Encoding":    []string{"test_encoding"},
+					"Content-Language":    []string{"test_language"},
+					"Content-Type":        []string{"test_type"},
+					"Content-Range":       []string{"test_range"},
+					"Etag":                []string{"test_etag"},
+					"Content-Length":      []string{"100"},
+					"x-amz-meta-AbC":      []string{"test_meta_a"},
+					"x-amz-meta-Def":      []string{"test_meta_b"},
+				},
+				Body: http.NoBody,
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	resp, err := s3Client.HeadObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"metadata":{"abc":"test_meta_a","def":"test_meta_b"},"lastModified":"2025-02-01T03:04:05Z","cacheControl":"test_cache","contentDisposition":"test_disposition","contentEncoding":"test_encoding","contentLanguage":"test_language","contentType":"test_type","contentRange":"test_range","etag":"test_etag","contentLength":100}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected response\n%s\ngot\n%s", expected, rawStr)
+	}
+}