updated CHANGELOG

bumped app version
updated golang.org/x/ deps
2026-09-20 13:30:50 +02:00 · 2026-02-21 13:31:48 +02:00 · 2026-02-18 20:00:31 +02:00 · 2026-02-18 19:44:13 +02:00 · 2026-02-18 19:24:38 +02:00 · 2026-02-17 18:20:07 +02:00
198 changed files with 8970 additions and 4396 deletions
@@ -2,4 +2,6 @@

 If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.

+**This is non-commercial personal open source project, so there are no bounties!**
+
 All reports will be promptly addressed and you'll be credited in the fix release notes.
@@ -26,9 +26,9 @@ jobs:
          node-version: 20.17.0

      - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version: '>=1.23.10'
+          go-version: '>=1.26.0'

      # This step usually is not needed because the /ui/dist is pregenerated locally
      # but its here to ensure that each release embeds the latest admin ui artifacts.
@@ -1,3 +1,291 @@
+## v0.36.5
+
+- Disabled collection and fields name normalization while in IME mode ([#7532](https://github.com/pocketbase/pocketbase/pull/7532); thanks @miaopan607).
+
+- Updated `modernc.org/sqlite` to v1.46.1 _(resets connection state on Tx.Commit failure)_.
+
+
+## v0.36.4
+
+- Made the optional `Bearer` token prefix case-insensitive ([#7525](https://github.com/pocketbase/pocketbase/pull/7525); thanks @benjamesfleming).
+
+- Enabled `$filesystem.s3(...)` and `$filesystem.local(...)` JSVM bindings ([#7526](https://github.com/pocketbase/pocketbase/issues/7526)).
+
+
+## v0.36.3
+
+- Added `Accept-Encoding: identity` to the S3 requests per the suggestion in [#7523](https://github.com/pocketbase/pocketbase/issues/7523).
+    _This should help fixing the 0-bytes file response when S3 API compression is enabled._
+
+- Bumped min Go GitHub action version to 1.26.0 _(it comes with minor [GC performance improvements](https://go.dev/doc/go1.26#runtime))_.
+
+- Other minor fixes _(updated `modernc.org/sqlite` to v1.45.0, updated `goja_nodejs` adding `Buffer.concat`, updated the arguments of `app.DeleteTable(...)`, `app.DeleteView(...)` and other similar methods to make it more clear that they are dangerous and shouldn't be used with untrusted input, etc.)_.
+
+
+## v0.36.2
+
+- Updated `modernc.org/sqlite` to v1.44.3 _(race check fix)_, `goja` _(circular references fix)_ and other go deps.
+
+- Other minor fixes _(updated tests to silence some of the race detector errors, updated `FindFirstRecordByData` with more clear error message when missing or invalid key is used, etc.)_.
+
+
+## v0.36.1
+
+- Reverted the `DISTINCT` with `GROUP BY` replacement optimization from v0.36.0 as it was reported to negatively impact the indexes utilization for some queries
+and the minor performance boost that you may get when used on large records is not enough to justify the more common use ([#7461](https://github.com/pocketbase/pocketbase/discussions/7461)).
+    _A better generic deduplication optimization for large records (aka. records with large `text`/`json` fields or many small ones) will be researched but there are no ETAs._
+
+- Updated `modernc.org/sqlite` to v1.44.2 _(SQLite 3.51.2)_.
+
+- Fixed code comment typos.
+
+
+## v0.36.0
+
+- List query and API rules optimizations:
+    - Removed unnecessary correlated subquery expression when using back-relations via single `relation` field.
+    - Replaced `DISTINCT` with `GROUP BY id` when rows deduplication is needed and when deemed safe.
+        _This should help with having a more stable and predictable performance even if the collection records are on the larger side._
+
+    For some queries and data sets the above 2 optimizations have shown significant improvements but if you notice a performance degradation after upgrading,
+    please open a Q&A discussion with export of your collections structure and the problematic request so that it can be analyzed.
+
+- Added [`strftime(format, timevalue, modifiers...)`](https://pocketbase.io/docs/api-rules-and-filters/#strftimeformat-time-value-modifiers-) date formatting filter and API rules function.
+    It works similarly to the [SQLite `strftime` builtin function](https://sqlite.org/lang_datefunc.html)
+    with the main difference that NULL results will be normalized for consistency with the non-nullable PocketBase `text` and `date` fields.
+    Multi-match expressions are also supported and works the same as if the collection field is referenced, for example:
+    ```js
+    // requires ANY/AT-LEAST-ONE-OF multiRel records to have "created" date matching the formatted string "2026-01"
+    strftime('%Y-%m', multiRel.created) ?= '2026-01'
+
+    // requires ALL multiRel records to have "created" date matching the formatted string "2026-01"
+    strftime('%Y-%m', multiRel.created) = '2026-01'
+    ```
+
+- ⚠️ Minor changes to the `search.ResolverResult` struct _(mostly used internally)_:
+    - Replaced `NoCoalesce` field with the more explicit `NullFallback` _(`NullFallbackDisabled` is the same as `NoCoalesce:true`)_.
+    - Replaced the expression interface of the `MultiMatchSubQuery` field with the concrete struct type `search.MultiMatchSubquery` to avoid excessive type assertions and allow direct mutations of the field.
+
+- Updated `modernc.org/sqlite` to v1.44.1 _(SQLite 3.51.1)_.
+
+- Bumped min Go GitHub action version to 1.25.6 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.6).
+
+
+## v0.35.1
+
+- Updated `modernc.org/sqlite` to v1.43.0 _(query cancellation race fix)_.
+
+- Other minor UI fixes (normalized relations picker selection and confirmation message when `maxSelect=0/1`, updated node deps).
+
+
+## v0.35.0
+
+- Added `nullString()`, `nullInt()`, `nullFloat()`, `nullBool`, `nullArray()`, `nullObject()` JSVM helpers for scanning nullable columns ([#7396](https://github.com/pocketbase/pocketbase/issues/7396)).
+
+- Store the correct `image/png` as attrs content type when generating a thumb fallback _(e.g. for `webp`)_.
+
+- Trimmed custom uploaded file name and extension from leftover `.` characters after `filesystem.File` normalization.
+    _This was done to prevent issues with external files sync programs that may have special handling for "invisible" files._
+
+- Updated `modernc.org/sqlite` _(v1.41.0 includes prepared statements optimization)_ and other minor Go deps.
+
+
+## v0.34.2
+
+- Bumped JS SDK to v0.26.5 to fix Safari AbortError detection introduced with the previous release ([#7369](https://github.com/pocketbase/pocketbase/issues/7369)).
+
+
+## v0.34.1
+
+- Added missing `:` char to the autocomplete regex ([#7353](https://github.com/pocketbase/pocketbase/pull/7353); thanks @ouvreboite).
+
+- Added "Copy raw JSON" collection dropdown option ([#7357](https://github.com/pocketbase/pocketbase/issues/7357)).
+
+- Updated Go deps and JS SDK.
+
+- Bumped min Go GitHub action version to 1.25.5 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.5).
+    _The runner action was also updated to `actions/setup-go@v6` since the previous v5 Go source seems [no longer accessible](https://github.com/actions/setup-go/pull/665#issuecomment-3416693714)._
+
+
+## v0.34.0
+
+- Added `@request.body.someField:changed` modifier.
+    It could be used when you want to ensure that a body field either wasn't submitted or was submitted with the same value.
+    Or in other words, if you want to disallow a field change the below 2 expressions would be equivalent:
+    ```js
+    // (old)
+    (@request.body.someField:isset = false || @request.body.someField = someField)
+
+    // (new)
+    @request.body.someField:changed = false
+    ```
+
+- Added `MailerRecordEvent.Meta["info"]` property for the `OnMailerRecordAuthAlertSend` hook.
+
+- Updated the backup restore popup with a short info about the performed restore steps.
+
+- Updated Go deps.
+
+
+## v0.33.0
+
+- Added extra `id` characters validation in addition to the user specified regex pattern ([#7312](https://github.com/pocketbase/pocketbase/issues/7312)).
+    _The following special characters are always forbidden: `./\|"'``<>:?*%$\n\r\t\0 `. Common reserved Windows file names such as `aux`, `prn`, `con`, `nul`, `com1-9`, `lpt1-9` are also not allowed._
+    _The list is not exhaustive but it should help minimizing eventual filesystem compatibility issues in case of wildcards or other loose regex patterns._
+
+- Added `{ALERT_INFO}` placeholder to the auth alert mail template ([#7314](https://github.com/pocketbase/pocketbase/issues/7314)).
+    _⚠️ `mails.SendRecordAuthAlert(app, authRecord, info)` also now accepts a 3rd `info` string argument._
+
+- Updated Go deps.
+
+
+## v0.32.0
+
+- ⚠️ Added extra List/Search API rules checks for the client-side `filter`/`sort` relations.
+
+    This is continuation of the effort to eliminate the risk of information disclosure _(and eventually the side-channel attacks that may originate from that)_.
+
+    So far this was accepted tradeoff between performance, usability and correctness since the solutions at the time weren't really practical _(especially with the back-relations as mentioned in ["Security and performance" section in #4417](https://github.com/pocketbase/pocketbase/discussions/4417))_, but with v0.23+ changes we can implement the extra checks without littering the code too much, with very little impact on the performance and at the same time ensuring better out of the box security _(especially for the cases where users operate with sensitive fields like "code", "token", "secret", etc.)_.
+
+    Similar to the previous release, probably for most users with already configured API rules this change won't be breaking, but if you have an _intermediate/junction collection_ that is "locked" (superusers-only) we no longer will allow the client-side relation filter to pass through it and you'll have to set its List/Search API rule to enable the current user to search in it.
+
+    For example, if you have a client-side filter that targets `rel1.rel2.token`, the client must have not only List/Search API rule access to the main collection BUT also to the collections referenced by "rel1" and "rel2" relation fields.
+
+    Note that this change is only for the **client-side** `filter`/`sort` and doesn't affect the execution of superuser requests, API rules and `expand` - they continue to work the same as it is.
+
+    An optional environment variable to toggle this behavior was considered but for now I think having 2 ways of resolving client-side filters would introduce maintenance burden and can even cause confusion (this change should actually make things more intuitive and clear because we can simply say something like _"you can search by a collection X field only if you have List/Search API rule access to it"_ no matter whether the targeted collection is the request's main collection, the first or last relation from the filter chain, etc.).
+
+    If you stumble on an error or extreme query performance degradation as a result of the extra checks, please open a Q&A discussion with the failing request and export of your collections configuration as JSON (_Settings > Export collections_) and I'll try to investigate it.
+
+- Increased the default SQLite `PRAGMA cache_size` to ~32MB.
+
+- Fixed deadlock when manually triggering the `OnTerminate` hook ([#7305](https://github.com/pocketbase/pocketbase/pull/7305); thanks @yerTools).
+
+- Fixed some code comment typos, regenerated the JSVM types and updated npm dependencies.
+
+- Updated `modernc.org/sqlite` to 1.40.0.
+
+
+## v0.31.0
+
+- Visualize presentable multiple `relation` fields ([#7260](https://github.com/pocketbase/pocketbase/issues/7260)).
+
+- Support Ed25519 in the optional OIDC `id_token` signature validation ([#7252](https://github.com/pocketbase/pocketbase/issues/7252); thanks @shynome).
+
+- Added `ApiScenario.DisableTestAppCleanup` optional field to skip the auto test app cleanup and leave it up to the developers to do the cleanup manually ([#7267](https://github.com/pocketbase/pocketbase/discussions/7267)).
+
+- Added `FileDownloadRequestEvent.ThumbError` field that is populated in case of a thumb generation failure (e.g. unsupported format, timing out, etc.), allowing developers to reject the thumb fallback and/or supply their own custom thumb generation ([#7268](https://github.com/pocketbase/pocketbase/discussions/7268)).
+
+- ⚠️ Disallow client-side filtering and sorting of relations where the collection of the last targeted relation field has superusers-only List/Search API rule to further minimize the risk of eventual side-channel attack.
+    _This should be a non-breaking change for most users, but if you want the old behavior, please open a new Q&A discussion with details about your use case to evaluate making it configurable._
+    _Note also that as mentioned in the "Security and performance" section of [#4417](https://github.com/pocketbase/pocketbase/discussions/4417) and [#5863](https://github.com/pocketbase/pocketbase/discussions/5863), the easiest and recommended solution to protect security sensitive fields (tokens, codes, passwords, etc.) is to mark them as "Hidden" (aka. make them non-API filterable)._
+
+- Regenerated JSVM types and updated npm and Go deps.
+
+
+## v0.30.4
+
+- Fixed `json` field CSS regression introduced with the overflow workaround in v0.30.3 ([#7259](https://github.com/pocketbase/pocketbase/issues/7259)).
+
+
+## v0.30.3
+
+- Fixed legacy identitity field priority check when a username is a valid email address ([#7256](https://github.com/pocketbase/pocketbase/issues/7256)).
+
+- Workaround autocomplete overflow issue with Firefox 144 ([#7223](https://github.com/pocketbase/pocketbase/issues/7223)).
+
+- Updated `modernc.org/sqlite` to 1.39.1 (SQLite 3.50.4).
+
+
+## v0.30.2
+
+- Bumped min Go GitHub action version to 1.24.8 since it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.24.8+label%3ACherryPickApproved).
+
+
+## v0.30.1
+
+- ⚠️ Excluded the `lost+found` directory from the backups ([#7208](https://github.com/pocketbase/pocketbase/pull/7208); thanks @lbndev).
+    _If for some reason you want to keep it, you can restore it by editing the `e.Exclude` list of the `OnBackupCreate` and `OnBackupRestore` hooks._
+
+- Minor tests improvements (disabled initial superuser creation for the test app to avoid cluttering the std output, added more tests for the `s3.Uploader.MaxConcurrency`, etc.).
+
+- Updated `modernc.org/sqlite` and other Go dependencies.
+
+
+## v0.30.0
+
+- Eagerly escape the S3 request path following the same rules as in the S3 signing header ([#7153](https://github.com/pocketbase/pocketbase/issues/7153)).
+
+- Added Lark OAuth2 provider ([#7130](https://github.com/pocketbase/pocketbase/pull/7130); thanks @mashizora).
+
+- Increased test tokens `exp` claim to minimize eventual issues with reproducible builds ([#7123](https://github.com/pocketbase/pocketbase/issues/7123)).
+
+- Added `os.Root` bindings to the JSVM ([`$os.openRoot`](https://pocketbase.io/jsvm/functions/_os.openRoot.html), [`$os.openInRoot`](https://pocketbase.io/jsvm/functions/_os.openInRoot.html)).
+
+- Added `osutils.IsProbablyGoRun()` helper to loosely check if the program was started using `go run`.
+
+- Various minor UI improvements (updated collections indexes UI, enabled seconds in the datepicker, updated helper texts, etc.).
+
+- ⚠️ Updated the minimum package Go version to 1.24.0 and bumped Go dependencies.
+
+
+## v0.29.3
+
+- Try to forward Apple OAuth2 POST redirect user's name so that it can be returned (and eventually assigned) with the success response of the all-in-one auth call ([#7090](https://github.com/pocketbase/pocketbase/issues/7090)).
+
+- Fixed `RateLimitRule.Audience` code comment ([#7098](https://github.com/pocketbase/pocketbase/pull/7098); thanks @iustin05).
+
+- Mocked `syscall.Exec` when building for WASM ([#7116](https://github.com/pocketbase/pocketbase/pull/7116); thanks @joas8211).
+    _Note that WASM is not officially supported PocketBase build target and many things may not work as expected._
+
+- Registered missing `$filesystem`, `$mails`, `$template` and `__hooks` bindings in the JSVM migrations ([#7125](https://github.com/pocketbase/pocketbase/issues/7125)).
+
+- Regenerated JSVM types to include methods from structs with single generic parameter.
+
+- Updated Go dependencies.
+
+
+## v0.29.2
+
+- Bumped min Go GitHub action version to 1.23.12 since it comes with some [minor fixes for the runtime and `database/sql` package](https://github.com/golang/go/issues?q=milestone%3AGo1.23.12+label%3ACherryPickApproved).
+
+
+## v0.29.1
+
+- Updated the X/Twitter provider to return the `confirmed_email` field and to use the `x.com` domain ([#7035](https://github.com/pocketbase/pocketbase/issues/7035)).
+
+- Added Box.com OAuth2 provider ([#7056](https://github.com/pocketbase/pocketbase/pull/7056); thanks @blakepatteson).
+
+- Updated `modernc.org/sqlite` to 1.38.2 (SQLite 3.50.3).
+
+- Fixed example List API response ([#7049](https://github.com/pocketbase/pocketbase/pull/7049); thanks @williamtguerra).
+
+
+## v0.29.0
+
+- Enabled calling the `/auth-refresh` endpoint with nonrenewable tokens.
+    _When used with nonrenewable tokens (e.g. impersonate) the endpoint will simply return the same token with the up-to-date user data associated with it._
+
+- Added the triggered rate rimit rule in the error log `details`.
+
+- Added optional `ServeEvent.Listener` field to initialize a custom network listener (e.g. `unix`) instead of the default `tcp` ([#3233](https://github.com/pocketbase/pocketbase/discussions/3233)).
+
+- Fixed request data unmarshalization for the `DynamicModel` array/object fields ([#7022](https://github.com/pocketbase/pocketbase/discussions/7022)).
+
+- Fixed Dashboard page title `-` escaping ([#6982](https://github.com/pocketbase/pocketbase/issues/6982)).
+
+- Other minor improvements (updated first superuser console text when running with `go run`, clarified trusted IP proxy header label, wrapped the backup restore in a transaction as an extra precaution, updated deps, etc.).
+
+
+## v0.28.4
+
+- Added global JSVM `toBytes()` helper to return the bytes slice representation of a value such as io.Reader or string, _other types are first serialized to Go string_ ([#6935](https://github.com/pocketbase/pocketbase/issues/6935)).
+
+- Fixed `security.RandomStringByRegex` random distribution ([#6947](https://github.com/pocketbase/pocketbase/pull/6947); thanks @yerTools).
+
+- Minor docs and typos fixes.
+
+
 ## v0.28.3

 - Skip sending empty `Range` header when fetching blobs from S3 ([#6914](https://github.com/pocketbase/pocketbase/pull/6914)).
@@ -83,7 +371,7 @@
    If you are having difficulties adjusting your code, feel free to open a [Q&A discussion](https://github.com/pocketbase/pocketbase/discussions) with the failing/problematic code sample.

 - Added [new `geoPoint` field](https://pocketbase.io/docs/collections/#geopoint) for storing `{"lon":x,"lat":y}` geographic coordinates.
-    In addition, a new [`geoDistance(lonA, lotA, lonB, lotB)` function](htts://pocketbase.io/docs/api-rules-and-filters/#geodistancelona-lata-lonb-latb) was also implemented that could be used to apply an API rule or filter constraint based on the distance (in km) between 2 geo points.
+    In addition, a new [`geoDistance(lonA, lotA, lonB, lotB)` function](https://pocketbase.io/docs/api-rules-and-filters/#geodistancelona-lata-lonb-latb) was also implemented that could be used to apply an API rule or filter constraint based on the distance (in km) between 2 geo points.

 - Updated the `select` field UI to accommodate better larger lists and RTL languages ([#4674](https://github.com/pocketbase/pocketbase/issues/4674)).

@@ -486,7 +774,7 @@ There are a lot of changes but to highlight some of the most notable ones:
 - Admins are now system `_superusers` auth records.
 - Builtin rate limiter (_supports tags, wildcards and exact routes matching_).
 - Batch/transactional Web API endpoint.
- Impersonate Web API endpoint (_it could be also used for generating fixed/non-refreshable superuser tokens, aka. "API keys"_).
+- Impersonate Web API endpoint (_it could be also used for generating fixed/nonrenewable superuser tokens, aka. "API keys"_).
 - Support for custom user request activity log attributes.
 - One-Time Password (OTP) auth method (_via email code_).
 - Multi-Factor Authentication (MFA) support (_currently requires any 2 different auth methods to be used_).
@@ -2,6 +2,29 @@
 > For the most recent versions, please refer to [CHANGELOG.md](./CHANGELOG.md)
 ---

+## v0.22.38
+
+- (_Backported from v0.36.0_) Bumped min Go GitHub action version to 1.25.6 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.6).
+
+
+## v0.22.37
+
+- (_Backported from v0.34.1_) - Added missing `:` char to the autocomplete regex ([#7353](https://github.com/pocketbase/pocketbase/pull/7353)).
+
+- (_Backported from v0.34.1_) Bumped min Go GitHub action version to 1.25.5 because it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.25.5).
+    _The runner action was also updated to `actions/setup-go@v6` since the previous v5 Go source seems [no longer accessible](https://github.com/actions/setup-go/pull/665#issuecomment-3416693714)._
+
+
+## v0.22.36
+
+- (_Backported from v0.30.2_) Bumped min Go GitHub action version to 1.24.8 since it comes with some [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.24.8+label%3ACherryPickApproved).
+
+
+## v0.22.35
+
+- (_Backported from v0.29.2_) Bumped min Go GitHub action version to 1.23.12 since it comes with some [minor fixes for the runtime and `database/sql` package](https://github.com/golang/go/issues?q=milestone%3AGo1.23.12+label%3ACherryPickApproved).
+
+
 ## v0.22.34

 - (_Backported from v0.26.6_) Allow OIDC `email_verified` to be int or boolean string since some OIDC providers like AWS Cognito has non-standard userinfo response ([#6657](https://github.com/pocketbase/pocketbase/pull/6657)).
@@ -10,7 +10,7 @@ This document describes how to prepare a PR for a change in the main repository.

 ## Prerequisites

- Go 1.23+ (for making changes in the Go code)
+- Go 1.24+ (for making changes in the Go code)
 - Node 18+ (for making changes in the Admin UI)

 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
@@ -92,7 +92,7 @@ _For more details please refer to [Extend with Go](https://pocketbase.io/docs/go

 To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:

-0. [Install Go 1.23+](https://go.dev/doc/install) (_if you haven't already_)
+0. [Install Go 1.24+](https://go.dev/doc/install) (_if you haven't already_)
 1. Clone/download the repo
 2. Navigate to `examples/base`
 3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
@@ -110,9 +110,11 @@ linux   386
 linux   amd64
 linux   arm
 linux   arm64
+linux   loong64
 linux   ppc64le
 linux   riscv64
 linux   s390x
+windows 386
 windows amd64
 windows arm64
 ```
@@ -9,6 +9,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/router"
 	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
 )

 // bindCollectionApi registers the collection api endpoints and the corresponding handlers.
@@ -192,14 +193,16 @@ func collectionTruncate(e *core.RequestEvent) error {
 }

 func collectionScaffolds(e *core.RequestEvent) error {
+	randomId := security.RandomStringWithAlphabet(10, core.DefaultIdAlphabet) // could be used as part of the default indexes name
+
 	collections := map[string]*core.Collection{
-		core.CollectionTypeBase: core.NewBaseCollection(""),
-		core.CollectionTypeAuth: core.NewAuthCollection(""),
-		core.CollectionTypeView: core.NewViewCollection(""),
+		core.CollectionTypeBase: core.NewBaseCollection("", randomId),
+		core.CollectionTypeAuth: core.NewAuthCollection("", randomId),
+		core.CollectionTypeView: core.NewViewCollection("", randomId),
 	}

 	for _, c := range collections {
-		c.Id = "" // clear autogenerated id
+		c.Id = "" // clear random id
 	}

 	return e.JSON(http.StatusOK, collections)
@@ -142,8 +142,14 @@ func (api *fileApi) download(e *core.RequestEvent) error {
 	defer fsys.Close()

 	originalPath := baseFilesPath + "/" + filename
-	servedPath := originalPath
-	servedName := filename
+
+	event := new(core.FileDownloadRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+	event.FileField = fileField
+	event.ServedPath = originalPath
+	event.ServedName = filename

 	// check for valid thumb size param
 	thumbSize := e.Request.URL.Query().Get("thumb")
@@ -157,34 +163,31 @@ func (api *fileApi) download(e *core.RequestEvent) error {
 		// check if it is an image
 		if list.ExistInSlice(oAttrs.ContentType, imageContentTypes) {
 			// add thumb size as file suffix
-			servedName = thumbSize + "_" + filename
-			servedPath = baseFilesPath + "/thumbs_" + filename + "/" + servedName
+			event.ServedName = thumbSize + "_" + filename
+			event.ServedPath = baseFilesPath + "/thumbs_" + filename + "/" + event.ServedName

 			// create a new thumb if it doesn't exist
-			if exists, _ := fsys.Exists(servedPath); !exists {
-				if err := api.createThumb(e, fsys, originalPath, servedPath, thumbSize); err != nil {
+			if exists, _ := fsys.Exists(event.ServedPath); !exists {
+				if err := api.createThumb(e, fsys, originalPath, event.ServedPath, thumbSize); err != nil {
 					e.App.Logger().Warn(
-						"Fallback to original - failed to create thumb "+servedName,
+						"Fallback to original - failed to create thumb "+event.ServedName,
 						slog.Any("error", err),
 						slog.String("original", originalPath),
-						slog.String("thumb", servedPath),
+						slog.String("thumb", event.ServedPath),
 					)

 					// fallback to the original
-					servedName = filename
-					servedPath = originalPath
+					event.ThumbError = err
+					event.ServedName = filename
+					event.ServedPath = originalPath
 				}
 			}
 		}
 	}

-	event := new(core.FileDownloadRequestEvent)
-	event.RequestEvent = e
-	event.Collection = collection
-	event.Record = record
-	event.FileField = fileField
-	event.ServedPath = servedPath
-	event.ServedName = servedName
+	if thumbSize != "" && event.ThumbError == nil && event.ServedPath == originalPath {
+		event.ThumbError = fmt.Errorf("the thumb size %q or the original file format are not supported", thumbSize)
+	}

 	// clickjacking shouldn't be a concern when serving uploaded files,
 	// so it safe to unset the global X-Frame-Options to allow files embedding
@@ -181,9 +181,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - missing thumb (should fallback to the original)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
+			Name:   "existing image - missing thumb (should fallback to the original)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError == nil {
+						t.Fatal("Expected thumb error, got nil")
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testImg)},
 			ExpectedEvents: map[string]int{
@@ -192,9 +200,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (crop center)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
+			Name:   "existing image - existing thumb (crop center)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropCenter)},
 			ExpectedEvents: map[string]int{
@@ -203,9 +219,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (crop top)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
+			Name:   "existing image - existing thumb (crop top)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropTop)},
 			ExpectedEvents: map[string]int{
@@ -214,9 +238,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (crop bottom)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
+			Name:   "existing image - existing thumb (crop bottom)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbCropBottom)},
 			ExpectedEvents: map[string]int{
@@ -225,9 +257,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (fit)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
+			Name:   "existing image - existing thumb (fit)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbFit)},
 			ExpectedEvents: map[string]int{
@@ -236,9 +276,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (zero width)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
+			Name:   "existing image - existing thumb (zero width)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbZeroWidth)},
 			ExpectedEvents: map[string]int{
@@ -247,9 +295,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb (zero height)",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
+			Name:   "existing image - existing thumb (zero height)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testThumbZeroHeight)},
 			ExpectedEvents: map[string]int{
@@ -258,9 +314,17 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing non image file - thumb parameter should be ignored",
-			Method:          http.MethodGet,
-			URL:             "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
+			Name:   "existing non image file - thumb parameter should be ignored",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError == nil {
+						t.Fatal("Expected thumb error, got nil")
+					}
+					return e.Next()
+				})
+			},
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testFile)},
 			ExpectedEvents: map[string]int{
@@ -32,7 +32,7 @@ func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL st
 	_ = osutils.LaunchURL(url)
 	color.Magenta("\n(!) Launch the URL below in the browser if it hasn't been open already to create your first superuser account:")
 	color.New(color.Bold).Add(color.FgCyan).Println(url)
-	color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", os.Args[0])
+	color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", executablePath())

 	return nil
 }
@@ -86,3 +86,11 @@ func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {

 	return record, nil
 }
+
+func executablePath() string {
+	if osutils.IsProbablyGoRun() {
+		return "go run ."
+	}
+
+	return os.Args[0]
+}
@@ -207,11 +207,13 @@ func loadAuthToken() *hook.Handler[*core.RequestEvent] {

 func getAuthTokenFromRequest(e *core.RequestEvent) string {
 	token := e.Request.Header.Get("Authorization")
-	if token != "" {
-		// the schema prefix is not required and it is only for
-		// compatibility with the defaults of some HTTP clients
-		token = strings.TrimPrefix(token, "Bearer ")
+
+	// the "Bearer" schema prefix is not required by PocketBase and it is
+	// supported only for compatibility with the defaults of some HTTP clients
+	if len(token) > 7 && strings.EqualFold(token[:7], "Bearer ") {
+		return token[7:]
 	}
+
 	return token
 }

@@ -1,6 +1,7 @@
 package apis

 import (
+	"errors"
 	"sync"
 	"time"

@@ -167,7 +168,7 @@ func checkRateLimit(e *core.RequestEvent, rtId string, rule core.RateLimitRule)
 	}

 	if !rt.isAllowed(key) {
-		return e.TooManyRequestsError("", nil)
+		return e.TooManyRequestsError("", errors.New("triggered rate limit rule: "+rule.String()))
 	}

 	return nil
@@ -233,12 +234,12 @@ func newRateLimiter(maxAllowed int, intervalInSec int64, minDeleteIntervalInSec
 		maxAllowed:        maxAllowed,
 		interval:          intervalInSec,
 		minDeleteInterval: minDeleteIntervalInSec,
-		clients:           map[string]*fixedWindow{},
+		clients:           map[string]*rateClient{},
 	}
 }

 type rateLimiter struct {
-	clients map[string]*fixedWindow
+	clients map[string]*rateClient

 	maxAllowed        int
 	interval          int64
@@ -249,7 +250,7 @@ type rateLimiter struct {
 }

 //nolint:unused
-func (rt *rateLimiter) getClient(key string) (*fixedWindow, bool) {
+func (rt *rateLimiter) getClient(key string) (*rateClient, bool) {
 	rt.RLock()
 	client, ok := rt.clients[key]
 	rt.RUnlock()
@@ -268,7 +269,7 @@ func (rt *rateLimiter) isAllowed(key string) bool {
 		// check again in case the client was added by another request
 		client, ok = rt.clients[key]
 		if !ok {
-			client = newFixedWindow(rt.maxAllowed, rt.interval)
+			client = newRateClient(rt.maxAllowed, rt.interval)
 			rt.clients[key] = client
 		}
 		rt.Unlock()
@@ -294,7 +295,7 @@ func (rt *rateLimiter) clean() {
 	//
 	// @todo remove after https://github.com/golang/go/issues/20135
 	if rt.totalDeleted >= 300 {
-		shrunk := make(map[string]*fixedWindow, len(rt.clients))
+		shrunk := make(map[string]*rateClient, len(rt.clients))
 		for k, v := range rt.clients {
 			shrunk[k] = v
 		}
@@ -303,14 +304,20 @@ func (rt *rateLimiter) clean() {
 	}
 }

-func newFixedWindow(maxAllowed int, intervalInSec int64) *fixedWindow {
-	return &fixedWindow{
+func newRateClient(maxAllowed int, intervalInSec int64) *rateClient {
+	return &rateClient{
 		maxAllowed: maxAllowed,
 		interval:   intervalInSec,
 	}
 }

-type fixedWindow struct {
+// @todo evaluate swiching to a more traditional fixed window or sliding window counter
+// implementations since some users complained that it is not intuitive (see #7329).
+//
+// rateClient is a mixture of token bucket and fixed window rate limit strategies
+// that refills the allowance only after at least "interval" seconds
+// has elapsed since the last request.
+type rateClient struct {
 	// use plain Mutex instead of RWMutex since the operations are expected
 	// to be mostly writes (e.g. consume()) and it should perform better
 	sync.Mutex
@@ -323,18 +330,18 @@ type fixedWindow struct {

 // hasExpired checks whether it has been at least minElapsed seconds since the lastConsume time.
 // (usually used to perform periodic cleanup of staled instances).
-func (l *fixedWindow) hasExpired(relativeNow int64, minElapsed int64) bool {
+func (l *rateClient) hasExpired(relativeNow int64, minElapsed int64) bool {
 	l.Lock()
 	defer l.Unlock()

 	return relativeNow-l.lastConsume > minElapsed
 }

-// consume decrease the current window allowance with 1 (if not exhausted already).
+// consume decreases the current allowance with 1 (if not exhausted already).
 //
 // It returns false if the allowance has been already exhausted and the user
 // has to wait until it resets back to its maxAllowed value.
-func (l *fixedWindow) consume() bool {
+func (l *rateClient) consume() bool {
 	l.Lock()
 	defer l.Unlock()

@@ -118,7 +118,7 @@ func TestDefaultRateLimitMiddleware(t *testing.T) {
 		{"/rate/guest", 0, false, 429},

 		// "guest" rule with regular user (should fallback to the /rate/ rule)
-		{"/rate/guest", 1, true, 200},
+		{"/rate/guest", 1.1, true, 200},
 		{"/rate/guest", 0, true, 200},
 		{"/rate/guest", 0, true, 429},
 		{"/rate/guest", 0, true, 429},
@@ -224,6 +224,22 @@ func TestRequireAuth(t *testing.T) {
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"test123"},
 		},
+		{
+			Name:   "valid record auth token with Bearer case-insensitive prefix",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				// regular user
+				"Authorization": "BeArEr eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
 	}

 	for _, scenario := range scenarios {
@@ -769,7 +769,11 @@ func realtimeCanAccessRecord(
 	}

 	q.AndWhere(expr)
-	resolver.UpdateQuery(q)
+
+	err = resolver.UpdateQuery(q)
+	if err != nil {
+		return false
+	}

 	err = q.Limit(1).Row(&exists)

@@ -12,18 +12,24 @@ func recordAuthRefresh(e *core.RequestEvent) error {
 		return e.NotFoundError("Missing auth record context.", nil)
 	}

-	currentToken := getAuthTokenFromRequest(e)
-	claims, _ := security.ParseUnverifiedJWT(currentToken)
-	if v, ok := claims[core.TokenClaimRefreshable]; !ok || !cast.ToBool(v) {
-		return e.ForbiddenError("The current auth token is not refreshable.", nil)
-	}
-
 	event := new(core.RecordAuthRefreshRequestEvent)
 	event.RequestEvent = e
 	event.Collection = record.Collection()
 	event.Record = record

 	return e.App.OnRecordAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshRequestEvent) error {
-		return RecordAuthResponse(e.RequestEvent, e.Record, "", nil)
+		token := getAuthTokenFromRequest(e.RequestEvent)
+
+		// skip token renewal if the token's payload doesn't explicitly allow it (e.g. impersonate tokens)
+		claims, _ := security.ParseUnverifiedJWT(token) //
+		if v, ok := claims[core.TokenClaimRefreshable]; ok && cast.ToBool(v) {
+			var tokenErr error
+			token, tokenErr = e.Record.NewAuthToken()
+			if tokenErr != nil {
+				return e.InternalServerError("Failed to refresh auth token.", tokenErr)
+			}
+		}
+
+		return recordAuthResponse(e.RequestEvent, e.Record, token, "", nil)
 	})
 }
@@ -73,6 +73,8 @@ func TestRecordAuthRefresh(t *testing.T) {
 			},
 			NotExpectedContent: []string{
 				`"missing":`,
+				// should return a different token
+				"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
 			},
 			ExpectedEvents: map[string]int{
 				"*":                          0,
@@ -88,9 +90,21 @@ func TestRecordAuthRefresh(t *testing.T) {
 			Headers: map[string]string{
 				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak",
 			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-			ExpectedEvents:  map[string]int{"*": 0},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				// should return the same token
+				`"token":"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak"`,
+				`"record":`,
+				`"id":"4q1xlclmfloku33"`,
+				`"emailVisibility":false`,
+				`"email":"test@example.com"`, // the owner can always view their email address
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             1,
+			},
 		},
 		{
 			Name:   "unverified auth record in onlyVerified collection",
@@ -15,6 +15,7 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"golang.org/x/oauth2"
@@ -90,6 +91,19 @@ func recordAuthWithOAuth2(e *core.RequestEvent) error {
 		return firstApiError(err, e.BadRequestError("Failed to fetch OAuth2 user.", err))
 	}

+	// Apple currently returns the user's name only as part of the first redirect data response
+	// so we try to assign the [apis.oauth2SubscriptionRedirect] forwarded name.
+	if form.Provider == auth.NameApple && authUser.Name == "" {
+		nameKey := oauth2RedirectAppleNameStoreKeyPrefix + form.Code
+		name, ok := e.App.Store().Get(nameKey).(string)
+		if ok {
+			e.App.Store().Remove(nameKey)
+			authUser.Name = name
+		} else {
+			e.App.Logger().Debug("Missing or already removed Apple user's name")
+		}
+	}
+
 	var authRecord *core.Record

 	// check for existing relation with the auth collection
@@ -2,22 +2,29 @@ package apis

 import (
 	"encoding/json"
+	"errors"
 	"net/http"
+	"strings"
+	"time"

 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )

 const (
-	oauth2SubscriptionTopic   string = "@oauth2"
-	oauth2RedirectFailurePath string = "../_/#/auth/oauth2-redirect-failure"
-	oauth2RedirectSuccessPath string = "../_/#/auth/oauth2-redirect-success"
+	oauth2SubscriptionTopic               string = "@oauth2"
+	oauth2RedirectFailurePath             string = "../_/#/auth/oauth2-redirect-failure"
+	oauth2RedirectSuccessPath             string = "../_/#/auth/oauth2-redirect-success"
+	oauth2RedirectAppleNameStoreKeyPrefix string = "@redirect_name_"
 )

 type oauth2RedirectData struct {
 	State string `form:"state" json:"state"`
 	Code  string `form:"code" json:"code"`
 	Error string `form:"error" json:"error,omitempty"`
+
+	// returned by Apple only
+	AppleUser string `form:"user" json:"-"`
 }

 func oauth2SubscriptionRedirect(e *core.RequestEvent) error {
@@ -52,6 +59,20 @@ func oauth2SubscriptionRedirect(e *core.RequestEvent) error {
 	}
 	defer client.Unsubscribe(oauth2SubscriptionTopic)

+	// temporary store the Apple user's name so that it can be later retrieved with the authWithOAuth2 call
+	// (see https://github.com/pocketbase/pocketbase/issues/7090)
+	if data.AppleUser != "" && data.Error == "" && data.Code != "" {
+		nameErr := parseAndStoreAppleRedirectName(
+			e.App,
+			oauth2RedirectAppleNameStoreKeyPrefix+data.Code,
+			data.AppleUser,
+		)
+		if nameErr != nil {
+			// non-critical error
+			e.App.Logger().Debug("Failed to parse and load Apple Redirect name data", "error", nameErr)
+		}
+	}
+
 	encodedData, err := json.Marshal(data)
 	if err != nil {
 		e.App.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
@@ -72,3 +93,56 @@ func oauth2SubscriptionRedirect(e *core.RequestEvent) error {

 	return e.Redirect(redirectStatusCode, oauth2RedirectSuccessPath)
 }
+
+// parseAndStoreAppleRedirectName extracts the first and last name
+// from serializedNameData and temporary store them in the app.Store.
+//
+// This is hacky workaround to forward safely and seamlessly the Apple
+// redirect user's name back to the OAuth2 auth handler.
+//
+// Note that currently Apple is the only provider that behaves like this and
+// for now it is unnecessary to check whether the redirect is coming from Apple or not.
+//
+// Ideally this shouldn't be needed and will be removed in the future
+// once Apple adds a dedicated userinfo endpoint.
+func parseAndStoreAppleRedirectName(app core.App, nameKey string, serializedNameData string) error {
+	if serializedNameData == "" {
+		return nil
+	}
+
+	// just in case to prevent storing large strings in memory
+	if len(nameKey) > 1000 {
+		return errors.New("nameKey is too large")
+	}
+
+	// https://developer.apple.com/documentation/signinwithapple/incorporating-sign-in-with-apple-into-other-platforms#Handle-the-response
+	extracted := struct {
+		Name struct {
+			FirstName string `json:"firstName"`
+			LastName  string `json:"lastName"`
+		} `json:"name"`
+	}{}
+	if err := json.Unmarshal([]byte(serializedNameData), &extracted); err != nil {
+		return err
+	}
+
+	fullName := extracted.Name.FirstName + " " + extracted.Name.LastName
+
+	// truncate just in case to prevent storing large strings in memory
+	if len(fullName) > 150 {
+		fullName = fullName[:150]
+	}
+
+	fullName = strings.TrimSpace(fullName)
+	if fullName == "" {
+		return nil
+	}
+
+	// store (and remove)
+	app.Store().Set(nameKey, fullName)
+	time.AfterFunc(1*time.Minute, func() {
+		app.Store().Remove(nameKey)
+	})
+
+	return nil
+}
@@ -3,6 +3,7 @@ package apis_test
 import (
 	"context"
 	"net/http"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -266,6 +267,74 @@ func TestRecordAuthWithOAuth2Redirect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Name:   "(POST) Apple user's name json (nameKey error)",
+			Method: http.MethodPost,
+			URL:    "/api/oauth2-redirect",
+			Body: strings.NewReader(url.Values{
+				"code":  []string{strings.Repeat("a", 986)},
+				"state": []string{clientStubs[8]["c3"].Id()},
+				"user": []string{
+					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
+				},
+			}.Encode()),
+			Headers: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[8], map[string][]string{
+				"c3": {`"state":"` + clientStubs[8]["c3"].Id(), `"code":"` + strings.Repeat("a", 986) + `"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[8]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+
+				if storedName := app.Store().Get("@redirect_name_" + strings.Repeat("a", 986)); storedName != nil {
+					t.Fatalf("Didn't expect stored name, got %q", storedName)
+				}
+			},
+		},
+		{
+			Name:   "(POST) Apple user's name json",
+			Method: http.MethodPost,
+			URL:    "/api/oauth2-redirect",
+			Body: strings.NewReader(url.Values{
+				"code":  []string{strings.Repeat("a", 985)},
+				"state": []string{clientStubs[9]["c3"].Id()},
+				"user": []string{
+					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
+				},
+			}.Encode()),
+			Headers: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[9], map[string][]string{
+				"c3": {`"state":"` + clientStubs[9]["c3"].Id(), `"code":"` + strings.Repeat("a", 985) + `"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[9]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+
+				storedName, _ := app.Store().Get("@redirect_name_" + strings.Repeat("a", 985)).(string)
+				expectedName := "aaa " + strings.Repeat("b", 146)
+				if storedName != expectedName {
+					t.Fatalf("Expected stored name\n%q\ngot\n%q", expectedName, storedName)
+				}
+			},
+		},
 	}

 	for _, scenario := range scenarios {
@@ -1641,6 +1641,104 @@ func TestRecordAuthWithOAuth2(t *testing.T) {
 			ExpectedContent: []string{"TX_ERROR"},
 		},

+		// Apple AuthUser.Name assign checks
+		// -----------------------------------------------------------
+		{
+			Name:   "store name with Apple provider",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "apple",
+				"code":"test_code",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				users, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers[auth.NameApple] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				app.Store().Set("@redirect_name_test_code", "test_store_name")
+
+				// add the test provider in the collection
+				users.MFA.Enabled = false
+				users.OAuth2.Enabled = true
+				users.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         auth.NameApple,
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(users); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"meta":{`,
+				`"name":"test_store_name"`,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.Store().Has("@redirect_name_test_code") {
+					t.Fatal("Expected @redirect_name_test_code store key to be removed")
+				}
+			},
+		},
+		{
+			Name:   "store name with non-Apple provider",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"test_code",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				users, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				app.Store().Set("@redirect_name_test_code", "test_store_name")
+
+				// add the test provider in the collection
+				users.MFA.Enabled = false
+				users.OAuth2.Enabled = true
+				users.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(users); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			NotExpectedContent: []string{
+				`"name":"test_store_name"`,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if !app.Store().Has("@redirect_name_test_code") {
+					t.Fatal("Expected @redirect_name_test_code store key to NOT be deleted")
+				}
+			},
+		},
+
 		// rate limit checks
 		// -----------------------------------------------------------
 		{
@@ -40,23 +40,32 @@ func recordAuthWithPassword(e *core.RequestEvent) error {
 	if form.IdentityField != "" {
 		foundRecord, foundErr = findRecordByIdentityField(e.App, collection, form.IdentityField, form.Identity)
 	} else {
-		// prioritize email lookup
-		isEmail := is.EmailFormat.Validate(form.Identity) == nil
-		if isEmail && list.ExistInSlice(core.FieldNameEmail, collection.PasswordAuth.IdentityFields) {
-			foundRecord, foundErr = findRecordByIdentityField(e.App, collection, core.FieldNameEmail, form.Identity)
+		identityFields := collection.PasswordAuth.IdentityFields
+
+		// @todo consider removing with the stable release or moving it in the collection save
+		//
+		// prioritize email lookup to minimize breaking changes with earlier versions
+		if len(identityFields) > 1 && identityFields[0] != core.FieldNameEmail {
+			identityFields = slices.Clone(identityFields)
+			slices.SortStableFunc(identityFields, func(a, b string) int {
+				if a == "email" {
+					return -1
+				}
+				if b == "email" {
+					return 1
+				}
+				return 0
+			})
 		}

-		// search by the other identity fields
-		if !isEmail || foundErr != nil {
-			for _, name := range collection.PasswordAuth.IdentityFields {
-				if !isEmail && name == core.FieldNameEmail {
-					continue // no need to search by the email field if it is not an email
-				}
+		for _, name := range identityFields {
+			if name == core.FieldNameEmail && is.EmailFormat.Validate(form.Identity) != nil {
+				continue // no need to query the database if we know that the submitted value is not an email
+			}

-				foundRecord, foundErr = findRecordByIdentityField(e.App, collection, name, form.Identity)
-				if foundErr == nil {
-					break
-				}
+			foundRecord, foundErr = findRecordByIdentityField(e.App, collection, name, form.Identity)
+			if foundErr == nil {
+				break
 			}
 		}
 	}
@@ -212,6 +212,57 @@ func TestRecordAuthWithPassword(t *testing.T) {
 				"OnMailerRecordAuthAlertSend": 1,
 			},
 		},
+		{
+			// https://github.com/pocketbase/pocketbase/issues/7256
+			Name:   "valid non-email identity field with a value that is a properly formatted email",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"username_as_email@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				record, err := app.FindAuthRecordByEmail("clients", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				record.Set("username", "username_as_email@example.com")
+
+				err = app.SaveNoValidate(record)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"username_as_email@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
 		{
 			Name:   "unknown explicit identityField",
 			Method: http.MethodPost,
@@ -118,7 +118,7 @@ func recordsList(e *core.RequestEvent) error {
 			len(e.Records) == 0 &&
 			checkRateLimit(e.RequestEvent, "@pb_list_timing_check_"+collection.Id, listTimingRateLimitRule) != nil {
 			e.App.Logger().Debug("Randomized throttle because of too many failed searches", "collectionId", collection.Id)
-			randomizedThrottle(150)
+			randomizedThrottle(500)
 		}

 		return execAfterSuccessTx(true, e.App, func() error {
@@ -169,12 +169,18 @@ func recordView(e *core.RequestEvent) error {
 	ruleFunc := func(q *dbx.SelectQuery) error {
 		if !requestInfo.HasSuperuserAuth() && collection.ViewRule != nil && *collection.ViewRule != "" {
 			resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
 			expr, err := search.FilterData(*collection.ViewRule).BuildExpr(resolver)
 			if err != nil {
 				return err
 			}
-			resolver.UpdateQuery(q)
+
 			q.AndWhere(expr)
+
+			err = resolver.UpdateQuery(q)
+			if err != nil {
+				return err
+			}
 		}
 		return nil
 	}
@@ -310,7 +316,10 @@ func recordCreate(responseWriteAfterTx bool, optFinalizer func(data any) error)
 				}
 				ruleQuery.AndWhere(expr)

-				resolver.UpdateQuery(ruleQuery)
+				err = resolver.UpdateQuery(ruleQuery)
+				if err != nil {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule update query failure: %w", err))
+				}

 				var exists int
 				err = ruleQuery.Limit(1).Row(&exists)
@@ -430,12 +439,18 @@ func recordUpdate(responseWriteAfterTx bool, optFinalizer func(data any) error)
 		ruleFunc := func(q *dbx.SelectQuery) error {
 			if !hasSuperuserAuth && collection.UpdateRule != nil && *collection.UpdateRule != "" {
 				resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
 				expr, err := search.FilterData(*collection.UpdateRule).BuildExpr(resolver)
 				if err != nil {
 					return err
 				}
-				resolver.UpdateQuery(q)
+
 				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
 			}
 			return nil
 		}
@@ -546,12 +561,18 @@ func recordDelete(responseWriteAfterTx bool, optFinalizer func(data any) error)
 		ruleFunc := func(q *dbx.SelectQuery) error {
 			if !requestInfo.HasSuperuserAuth() && collection.DeleteRule != nil && *collection.DeleteRule != "" {
 				resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
 				expr, err := search.FilterData(*collection.DeleteRule).BuildExpr(resolver)
 				if err != nil {
 					return err
 				}
-				resolver.UpdateQuery(q)
+
 				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
 			}
 			return nil
 		}
@@ -732,7 +753,10 @@ func hasAuthManageAccess(app core.App, requestInfo *core.RequestInfo, collection
 	}
 	query.AndWhere(expr)

-	resolver.UpdateQuery(query)
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return false
+	}

 	var exists int

@@ -382,10 +382,32 @@ func TestRecordCrudList(t *testing.T) {
 			},
 		},
 		{
-			Name:           "multi-match - at least one of",
+			Name:           "multi-match - at least one of (guest - non-satisfied relation filter API rule)",
 			Method:         http.MethodGet,
 			URL:            "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length?=2"),
 			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":0`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       0,
+			},
+		},
+		{
+			Name:   "multi-match - at least one of (clients)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length?=2"),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
@@ -401,9 +423,13 @@ func TestRecordCrudList(t *testing.T) {
 			},
 		},
 		{
-			Name:           "multi-match - all",
-			Method:         http.MethodGet,
-			URL:            "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length=2"),
+			Name:   "multi-match - all (clients)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length=2"),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"page":1`,
@@ -15,6 +15,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
 )

 const (
@@ -160,7 +161,11 @@ func wantsMFA(e *core.RequestEvent, record *core.Record) (bool, error) {
 	if err != nil {
 		return true, err
 	}
-	resolver.UpdateQuery(query)
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return true, err
+	}

 	err = query.AndWhere(expr).Limit(1).Row(&exists)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
@@ -379,12 +384,18 @@ func expandFetch(app core.App, originalRequestInfo *core.RequestInfo) core.Expan

 			if *relCollection.ViewRule != "" {
 				resolver := core.NewRecordFieldResolver(app, relCollection, requestInfoPtr, true)
+
 				expr, err := search.FilterData(*(relCollection.ViewRule)).BuildExpr(resolver)
 				if err != nil {
 					return err
 				}
-				resolver.UpdateQuery(q)
+
 				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
 			}

 			return nil
@@ -465,10 +476,16 @@ func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *
 	if err != nil {
 		return err
 	}
-	resolver.UpdateQuery(query)
+
 	query.AndWhere(expr)

-	if err := query.Column(&managedIds); err != nil {
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return err
+	}
+
+	err = query.Column(&managedIds)
+	if err != nil {
 		return err
 	}
 	// ---
@@ -563,13 +580,17 @@ func execAfterSuccessTx(checkTx bool, app core.App, fn func() error) error {
 const maxAuthOrigins = 5

 func authAlert(e *core.RequestEvent, authRecord *core.Record) error {
-	// generating fingerprint
+	// generate fingerprint
 	// ---
+	ip := e.RealIP()
+
 	userAgent := e.Request.UserAgent()
-	if len(userAgent) > 300 {
-		userAgent = userAgent[:300]
+	if len(userAgent) > 200 {
+		userAgent = userAgent[:200] + "..."
 	}
-	fingerprint := security.MD5(e.RealIP() + userAgent)
+
+	fingerprint := security.MD5(ip + userAgent)
+	alertInfo := fmt.Sprintf("%s - %s %s", types.NowDateTime().String(), ip, userAgent)
 	// ---

 	origins, err := e.App.FindAllAuthOriginsByRecord(authRecord)
@@ -609,7 +630,7 @@ func authAlert(e *core.RequestEvent, authRecord *core.Record) error {
 		})

 		routine.FireAndForget(func() {
-			err := mails.SendRecordAuthAlert(e.App, authRecord)
+			err := mails.SendRecordAuthAlert(e.App, authRecord, alertInfo)
 			timer.Stop()
 			mailSent <- err
 		})
@@ -153,13 +153,6 @@ func Serve(app core.App, config ServeConfig) error {
 		ErrorLog: log.New(&serverErrorLogWriter{app: app}, "", 0),
 	}

-	serveEvent := new(core.ServeEvent)
-	serveEvent.App = app
-	serveEvent.Router = pbRouter
-	serveEvent.Server = server
-	serveEvent.CertManager = certManager
-	serveEvent.InstallerFunc = DefaultInstallerFunc
-
 	var listener net.Listener

 	// graceful shutdown
@@ -207,6 +200,13 @@ func Serve(app core.App, config ServeConfig) error {

 	var baseURL string

+	serveEvent := new(core.ServeEvent)
+	serveEvent.App = app
+	serveEvent.Router = pbRouter
+	serveEvent.Server = server
+	serveEvent.CertManager = certManager
+	serveEvent.InstallerFunc = DefaultInstallerFunc
+
 	// trigger the OnServe hook and start the tcp listener
 	serveHookErr := app.OnServe().Trigger(serveEvent, func(e *core.ServeEvent) error {
 		handler, err := e.Router.BuildMux()
@@ -237,9 +237,13 @@ func Serve(app core.App, config ServeConfig) error {
 			}
 		}

-		listener, err = net.Listen("tcp", addr)
-		if err != nil {
-			return err
+		if e.Listener == nil {
+			listener, err = net.Listen("tcp", addr)
+			if err != nil {
+				return err
+			}
+		} else {
+			listener = e.Listener
 		}

 		if e.InstallerFunc != nil {
@@ -260,7 +264,7 @@ func Serve(app core.App, config ServeConfig) error {

 	if listener == nil {
 		//nolint:staticcheck
-		return errors.New("The OnServe finalizer wasn't invoked. Did you forget to call the ServeEvent.Next() method?")
+		return errors.New("The OnServe listener was not initialized. Did you forget to call the ServeEvent.Next() method?")
 	}

 	if config.ShowStartBanner {
@@ -240,29 +240,32 @@ type App interface {
 	// This method is a no-op if a table with the provided name doesn't exist.
 	//
 	// NB! Be aware that this method is vulnerable to SQL injection and the
-	// "tableName" argument must come only from trusted input!
-	DeleteTable(tableName string) error
+	// "dangerousTableName" argument must come only from trusted input!
+	DeleteTable(dangerousTableName string) error

 	// DeleteView drops the specified view name.
 	//
 	// This method is a no-op if a view with the provided name doesn't exist.
 	//
 	// NB! Be aware that this method is vulnerable to SQL injection and the
-	// "name" argument must come only from trusted input!
-	DeleteView(name string) error
+	// "dangerousViewName" argument must come only from trusted input!
+	DeleteView(dangerousViewName string) error

 	// SaveView creates (or updates already existing) persistent SQL view.
 	//
-	// NB! Be aware that this method is vulnerable to SQL injection and the
-	// "selectQuery" argument must come only from trusted input!
-	SaveView(name string, selectQuery string) error
+	// NB! Be aware that this method is vulnerable to SQL injection and
+	// its arguments must come only from trusted input!
+	SaveView(dangerousViewName string, dangerousSelectQuery string) error

 	// CreateViewFields creates a new FieldsList from the provided select query.
 	//
 	// There are some caveats:
 	// - The select query must have an "id" column.
 	// - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
-	CreateViewFields(selectQuery string) (FieldsList, error)
+	//
+	// NB! Be aware that this method is vulnerable to SQL injection and the
+	// "dangerousSelectQuery" argument must come only from trusted input!
+	CreateViewFields(dangerousSelectQuery string) (FieldsList, error)

 	// FindRecordByViewFile returns the original Record of the provided view collection file.
 	FindRecordByViewFile(viewCollectionModelOrIdentifier any, fileFieldName string, filename string) (*Record, error)
@@ -1195,7 +1198,7 @@ type App interface {
 	// ---------------------------------------------------------------

 	// OnMailerSend hook is triggered every time when a new email is
-	// being send using the [App.NewMailClient()] instance.
+	// being sent using the [App.NewMailClient()] instance.
 	//
 	// It allows intercepting the email message or to use a custom mailer client.
 	OnMailerSend() *hook.Hook[*MailerEvent]
@@ -12,7 +12,6 @@ import (
 	"regexp"
 	"runtime"
 	"strings"
-	"syscall"
 	"time"

 	"github.com/fatih/color"
@@ -41,6 +40,9 @@ const (
 	LocalBackupsDirName       string = "backups"
 	LocalTempDirName          string = ".pb_temp_to_delete" // temp pb_data sub directory that will be deleted on each app.Bootstrap()
 	LocalAutocertCacheDirName string = ".autocert_cache"
+
+	// @todo consider removing after backups refactoring
+	lostFoundDirName string = "lost+found"
 )

 // FilesManager defines an interface with common methods that files manager models should implement.
@@ -773,7 +775,7 @@ func (app *BaseApp) Restart() error {
 			}
 		}()

-		return syscall.Exec(execPath, os.Args, os.Environ())
+		return execve(execPath, os.Args, os.Environ())
 	})
 }

@@ -1365,7 +1367,7 @@ func (app *BaseApp) registerBaseHooks() {
 			app.Logger().Warn("Failed to run periodic PRAGMA wal_checkpoint for the auxiliary DB", slog.String("error", execErr.Error()))
 		}

-		_, execErr = app.ConcurrentDB().NewQuery("PRAGMA optimize").Execute()
+		_, execErr = app.NonconcurrentDB().NewQuery("PRAGMA optimize").Execute()
 		if execErr != nil {
 			app.Logger().Warn("Failed to run periodic PRAGMA optimize", slog.String("error", execErr.Error()))
 		}
@@ -1406,7 +1408,7 @@ func getLoggerMinLevel(app App) slog.Level {
 func (app *BaseApp) initLogger() error {
 	duration := 3 * time.Second
 	ticker := time.NewTicker(duration)
-	done := make(chan bool)
+	done := make(chan bool, 1)

 	handler := logger.NewBatchHandler(logger.BatchOptions{
 		Level:     getLoggerMinLevel(app),
@@ -1477,7 +1479,11 @@ func (app *BaseApp) initLogger() error {

 			ticker.Stop()

-			done <- true
+			// don't block in case OnTerminate is triggered more than once
+			select {
+			case done <- true:
+			default:
+			}

 			return e.Next()
 		},
@@ -54,7 +54,7 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
 	event.Context = ctx
 	event.Name = name
 	// default root dir entries to exclude from the backup generation
-	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName}
+	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName, lostFoundDirName}

 	return app.OnBackupCreate().Trigger(event, func(e *BackupEvent) error {
 		// generate a default name if missing
@@ -71,7 +71,7 @@ func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {

 		// archive pb_data in a temp directory, exluding the "backups" and the temp dirs
 		//
-		// Run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection).
+		// run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection)
 		// ---
 		tempPath := filepath.Join(localTempDir, "pb_backup_"+security.PseudorandomString(6))
 		createErr := e.App.RunInTransaction(func(txApp App) error {
@@ -159,7 +159,7 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 	event.Context = ctx
 	event.Name = name
 	// default root dir entries to exclude from the backup restore
-	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName}
+	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName, lostFoundDirName}

 	return app.OnBackupRestore().Trigger(event, func(e *BackupEvent) error {
 		if runtime.GOOS == "windows" {
@@ -228,7 +228,7 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 		} else {
 			// manually construct the local path to avoid creating a copy of the zip file
 			// since the blob reader currently doesn't implement ReaderAt
-			zipPath := filepath.Join(app.DataDir(), LocalBackupsDirName, filepath.Base(name))
+			zipPath := filepath.Join(e.App.DataDir(), LocalBackupsDirName, filepath.Base(name))

 			err = archive.Extract(zipPath, extractedDataDir)
 			if err != nil {
@@ -242,29 +242,43 @@ func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
 			return fmt.Errorf("data.db file is missing or invalid: %w", err)
 		}

-		// move the current pb_data content to a special temp location
-		// that will hold the old data between dirs replace
-		// (the temp dir will be automatically removed on the next app start)
 		oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(8))
-		if err := osutils.MoveDirContent(e.App.DataDir(), oldTempDataDir, e.Exclude...); err != nil {
-			return fmt.Errorf("failed to move the current pb_data content to a temp location: %w", err)
-		}

-		// move the extracted archive content to the app's pb_data
-		if err := osutils.MoveDirContent(extractedDataDir, e.App.DataDir(), e.Exclude...); err != nil {
-			return fmt.Errorf("failed to move the extracted archive content to pb_data: %w", err)
+		replaceErr := e.App.RunInTransaction(func(txApp App) error {
+			return txApp.AuxRunInTransaction(func(txApp App) error {
+				// move the current pb_data content to a special temp location
+				// that will hold the old data between dirs replace
+				// (the temp dir will be automatically removed on the next app start)
+				if err := osutils.MoveDirContent(txApp.DataDir(), oldTempDataDir, e.Exclude...); err != nil {
+					return fmt.Errorf("failed to move the current pb_data content to a temp location: %w", err)
+				}
+
+				// move the extracted archive content to the app's pb_data
+				if err := osutils.MoveDirContent(extractedDataDir, txApp.DataDir(), e.Exclude...); err != nil {
+					return fmt.Errorf("failed to move the extracted archive content to pb_data: %w", err)
+				}
+
+				return nil
+			})
+		})
+		if replaceErr != nil {
+			return replaceErr
 		}

 		revertDataDirChanges := func() error {
-			if err := osutils.MoveDirContent(e.App.DataDir(), extractedDataDir, e.Exclude...); err != nil {
-				return fmt.Errorf("failed to revert the extracted dir change: %w", err)
-			}
+			return e.App.RunInTransaction(func(txApp App) error {
+				return txApp.AuxRunInTransaction(func(txApp App) error {
+					if err := osutils.MoveDirContent(txApp.DataDir(), extractedDataDir, e.Exclude...); err != nil {
+						return fmt.Errorf("failed to revert the extracted dir change: %w", err)
+					}

-			if err := osutils.MoveDirContent(oldTempDataDir, e.App.DataDir(), e.Exclude...); err != nil {
-				return fmt.Errorf("failed to revert old pb_data dir change: %w", err)
-			}
+					if err := osutils.MoveDirContent(oldTempDataDir, txApp.DataDir(), e.Exclude...); err != nil {
+						return fmt.Errorf("failed to revert old pb_data dir change: %w", err)
+					}

-			return nil
+					return nil
+				})
+			})
 		}

 		// restart the app
@@ -552,3 +552,19 @@ func TestBaseAppAuxDBDualBuilder(t *testing.T) {
 		}
 	}
 }
+
+func TestBaseAppTriggerOnTerminate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	event := new(core.TerminateEvent)
+	event.App = app
+
+	// trigger OnTerminate multiple times to ensure that it doesn't deadlock
+	// https://github.com/pocketbase/pocketbase/pull/7305
+	app.OnTerminate().Trigger(event)
+	app.OnTerminate().Trigger(event)
+	app.OnTerminate().Trigger(event)
+}
@@ -1062,7 +1062,7 @@ func (c *Collection) fieldIndexName(field string) string {
 	} else if c.Name != "" {
 		name += c.Name
 	} else {
-		name += security.PseudorandomString(10)
+		name += security.PseudorandomStringWithAlphabet(10, DefaultIdAlphabet)
 	}

 	if len(name) > 64 {
@@ -2,11 +2,12 @@ package core

 // Common settings placeholder tokens
 const (
-	EmailPlaceholderAppName string = "{APP_NAME}"
-	EmailPlaceholderAppURL  string = "{APP_URL}"
-	EmailPlaceholderToken   string = "{TOKEN}"
-	EmailPlaceholderOTP     string = "{OTP}"
-	EmailPlaceholderOTPId   string = "{OTP_ID}"
+	EmailPlaceholderAppName   string = "{APP_NAME}"
+	EmailPlaceholderAppURL    string = "{APP_URL}"
+	EmailPlaceholderToken     string = "{TOKEN}"
+	EmailPlaceholderOTP       string = "{OTP}"
+	EmailPlaceholderOTPId     string = "{OTP_ID}"
+	EmailPlaceholderAlertInfo string = "{ALERT_INFO}"
 )

 var defaultVerificationTemplate = EmailTemplate{
@@ -65,9 +66,10 @@ var defaultOTPTemplate = EmailTemplate{
 var defaultAuthAlertTemplate = EmailTemplate{
 	Subject: "Login from a new location",
 	Body: `<p>Hello,</p>
-<p>We noticed a login to your ` + EmailPlaceholderAppName + ` account from a new location.</p>
-<p>If this was you, you may disregard this email.</p>
+<p>We noticed a login to your ` + EmailPlaceholderAppName + ` account from a new location:</p>
+<p><em>` + EmailPlaceholderAlertInfo + `</em></p>
 <p><strong>If this wasn't you, you should immediately change your ` + EmailPlaceholderAppName + ` account password to revoke access from all other locations.</strong></p>
+<p>If this was you, you may disregard this email.</p>
 <p>
  Thanks,<br/>
  ` + EmailPlaceholderAppName + ` team
@@ -144,7 +144,7 @@ func (app *BaseApp) SyncRecordTableSchema(newCollection *Collection, oldCollecti

 	// run optimize per the SQLite recommendations
 	// (https://www.sqlite.org/pragma.html#pragma_optimize)
-	_, optimizeErr := app.ConcurrentDB().NewQuery("PRAGMA optimize").Execute()
+	_, optimizeErr := app.NonconcurrentDB().NewQuery("PRAGMA optimize").Execute()
 	if optimizeErr != nil {
 		app.Logger().Warn("Failed to run PRAGMA optimize after record table sync", slog.String("error", optimizeErr.Error()))
 	}
@@ -489,7 +489,7 @@ func (validator *collectionValidator) checkRule(value any) error {
 		return nil // nothing to check
 	}

-	r := NewRecordFieldResolver(validator.app, validator.new, nil, true)
+	r := NewRecordFieldResolver(validator.app, validator.new, &RequestInfo{}, true)
 	_, err := search.FilterData(vStr).BuildExpr(r)
 	if err != nil {
 		return validation.NewError("validation_invalid_rule", "Invalid rule. Raw error: "+err.Error())
@@ -319,8 +319,8 @@ func TestCollectionValidate(t *testing.T) {
 				c.ListRule = types.Pointer("!invalid")
 				c.ViewRule = types.Pointer("missing = 123")
 				c.CreateRule = types.Pointer("id = 123 && missing = 456")
-				c.UpdateRule = types.Pointer("(id = 123")
-				c.DeleteRule = types.Pointer("missing = 123")
+				c.UpdateRule = types.Pointer("@request.body.missing:changed = false")
+				c.DeleteRule = types.Pointer("(id=123")
 				return c, nil
 			},
 			expectedErrors: []string{"listRule", "viewRule", "createRule", "updateRule", "deleteRule"},
@@ -333,7 +333,7 @@ func TestCollectionValidate(t *testing.T) {
 				c.ListRule = types.Pointer("")
 				c.ViewRule = types.Pointer("f1 = 123")
 				c.CreateRule = types.Pointer("id = 123 && f1 = 456")
-				c.UpdateRule = types.Pointer("(id = 123)")
+				c.UpdateRule = types.Pointer("(id = 123 && @request.body.f1:changed = false)")
 				c.DeleteRule = types.Pointer("f1 = 123")
 				return c, nil
 			},
@@ -11,7 +11,7 @@ func DefaultDBConnect(dbPath string) (*dbx.DB, error) {
 	// Note: the busy_timeout pragma must be first because
 	// the connection needs to be set to block on busy before WAL mode
 	// is set in case it hasn't been already set by another connection.
-	pragmas := "?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=journal_size_limit(200000000)&_pragma=synchronous(NORMAL)&_pragma=foreign_keys(ON)&_pragma=temp_store(MEMORY)&_pragma=cache_size(-16000)"
+	pragmas := "?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=journal_size_limit(200000000)&_pragma=synchronous(NORMAL)&_pragma=foreign_keys(ON)&_pragma=temp_store(MEMORY)&_pragma=cache_size(-32000)"

 	db, err := dbx.Open("sqlite", dbPath+pragmas)
 	if err != nil {
@@ -85,11 +85,11 @@ func (app *BaseApp) TableIndexes(tableName string) (map[string]string, error) {
 // This method is a no-op if a table with the provided name doesn't exist.
 //
 // NB! Be aware that this method is vulnerable to SQL injection and the
-// "tableName" argument must come only from trusted input!
-func (app *BaseApp) DeleteTable(tableName string) error {
+// "dangerousTableName" argument must come only from trusted input!
+func (app *BaseApp) DeleteTable(dangerousTableName string) error {
 	_, err := app.NonconcurrentDB().NewQuery(fmt.Sprintf(
 		"DROP TABLE IF EXISTS {{%s}}",
-		tableName,
+		dangerousTableName,
 	)).Execute()

 	return err
@@ -2,6 +2,7 @@ package core

 import (
 	"context"
+	"net"
 	"net/http"
 	"time"

@@ -104,6 +105,11 @@ type ServeEvent struct {
 	Server      *http.Server
 	CertManager *autocert.Manager

+	// Listener allow specifying a custom network listener.
+	//
+	// Leave it nil to use the default net.Listen("tcp", e.Server.Addr).
+	Listener net.Listener
+
 	// InstallerFunc is the "installer" function that is called after
 	// successful server tcp bind but only if there is no explicit
 	// superuser record created yet.
@@ -378,6 +384,13 @@ type FileDownloadRequestEvent struct {
 	FileField  *FileField
 	ServedPath string
 	ServedName string
+
+	// ThumbError indicates the a thumb wasn't able to be generated
+	// (e.g. because it didn't satisfy the support image formats or it timed out).
+	//
+	// Note that PocketBase fallbacks to the original file in case of a thumb error,
+	// but developers can check the field and provide their own custom thumb generation if necessary.
+	ThumbError error
 }

 // -------------------------------------------------------------------
@@ -31,6 +31,22 @@ var (
 	_ RecordInterceptor = (*TextField)(nil)
 )

+var forbiddenPKCharacters = []string{
+	".", "/", `\`, "|", `"`, "'", "`",
+	"<", ">", ":", "?", "*", "%", "$",
+	"\000", "\t", "\n", "\r", " ",
+}
+
+// (see largestReservedPKLength)
+var caseInsensitiveReservedPKs = []string{
+	// reserved Windows files names
+	"CON", "PRN", "AUX", "NUL",
+	"COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+	"LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+}
+
+const largestReservedPKLength = 4
+
 // TextField defines "text" type field for storing any string value.
 //
 // The respective zero record field value is empty string.
@@ -155,8 +171,6 @@ func (f *TextField) PrepareValue(record *Record, raw any) (any, error) {
 	return cast.ToString(raw), nil
 }

-var forbiddenPKChars = []string{"/", "\\"}
-
 // ValidateValue implements [Field.ValidateValue] interface method.
 func (f *TextField) ValidateValue(ctx context.Context, app App, record *Record) error {
 	newVal, ok := record.GetRaw(f.Name).(string)
@@ -178,15 +192,6 @@ func (f *TextField) ValidateValue(ctx context.Context, app App, record *Record)
 				return nil
 			}
 		} else {
-			// disallow PK special characters no matter of the Pattern validator to minimize
-			// side-effects when the primary key is used for example in a directory path
-			for _, c := range forbiddenPKChars {
-				if strings.Contains(newVal, c) {
-					return validation.NewError("validation_pk_forbidden", "The record primary key contains forbidden characters.").
-						SetParams(map[string]any{"forbidden": c})
-				}
-			}
-
 			// this technically shouldn't be necessarily but again to
 			// minimize misuse of the Pattern validator that could cause
 			// side-effects on some platforms check for duplicates in a case-insensitive manner
@@ -226,7 +231,7 @@ func (f *TextField) ValidatePlainValue(value string) error {
 	length := len([]rune(value))

 	if f.Min > 0 && length < f.Min {
-		return validation.NewError("validation_min_text_constraint", "Must be at least {{.min}} character(s)").
+		return validation.NewError("validation_min_text_constraint", "Must be at least {{.min}} character(s).").
 			SetParams(map[string]any{"min": f.Min})
 	}

@@ -236,14 +241,34 @@ func (f *TextField) ValidatePlainValue(value string) error {
 	}

 	if max > 0 && length > max {
-		return validation.NewError("validation_max_text_constraint", "Must be no more than {{.max}} character(s)").
+		return validation.NewError("validation_max_text_constraint", "Must be no more than {{.max}} character(s).").
 			SetParams(map[string]any{"max": max})
 	}

 	if f.Pattern != "" {
 		match, _ := regexp.MatchString(f.Pattern, value)
 		if !match {
-			return validation.NewError("validation_invalid_format", "Invalid value format")
+			return validation.NewError("validation_invalid_format", "Invalid value format.")
+		}
+	}
+
+	// additional primary key checks to minimize eventual filesystem compatibility issues
+	// because the primary key is often used as a file/directory name
+	if f.PrimaryKey && f.Pattern != defaultLowercaseRecordIdPattern {
+		for _, ch := range forbiddenPKCharacters {
+			if strings.Contains(value, ch) {
+				return validation.NewError("validation_forbidden_pk_character", "'{{.ch}}' is not a valid primary key character.").
+					SetParams(map[string]any{"ch": ch})
+			}
+		}
+
+		if largestReservedPKLength >= length {
+			for _, reserved := range caseInsensitiveReservedPKs {
+				if strings.EqualFold(value, reserved) {
+					return validation.NewError("validation_reserved_pk", "The primary key '{{.reserved}}' is reserved and cannot be used.").
+						SetParams(map[string]any{"reserved": reserved})
+				}
+			}
 		}
 	}

@@ -129,7 +129,7 @@ func TestTextFieldValidateValue(t *testing.T) {
 			&core.TextField{Name: "test", PrimaryKey: false},
 			func() *core.Record {
 				record := core.NewRecord(collection)
-				record.SetRaw("test", "/")
+				record.SetRaw("test", "abc/")
 				return record
 			},
 			false,
@@ -139,7 +139,37 @@ func TestTextFieldValidateValue(t *testing.T) {
 			&core.TextField{Name: "test", PrimaryKey: false},
 			func() *core.Record {
 				record := core.NewRecord(collection)
-				record.SetRaw("test", "\\")
+				record.SetRaw("test", "abc\\")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character . (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc.")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character ' ' (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "ab c")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character * (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc*")
 				return record
 			},
 			false,
@@ -149,7 +179,7 @@ func TestTextFieldValidateValue(t *testing.T) {
 			&core.TextField{Name: "test", PrimaryKey: true},
 			func() *core.Record {
 				record := core.NewRecord(collection)
-				record.SetRaw("test", "/")
+				record.SetRaw("test", "abc/")
 				return record
 			},
 			true,
@@ -159,11 +189,71 @@ func TestTextFieldValidateValue(t *testing.T) {
 			&core.TextField{Name: "test", PrimaryKey: true},
 			func() *core.Record {
 				record := core.NewRecord(collection)
-				record.SetRaw("test", "\\")
+				record.SetRaw("test", "abc\\")
 				return record
 			},
 			true,
 		},
+		{
+			"special forbidden character . (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc.")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character ' ' (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "ab c")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character * (primaryKey; used in the realtime events too)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc*")
+				return record
+			},
+			true,
+		},
+		{
+			"reserved pk literal (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx")
+				return record
+			},
+			false,
+		},
+		{
+			"reserved pk literal (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx")
+				return record
+			},
+			true,
+		},
+		{
+			"reserved pk literal (non-exact match, primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx-")
+				return record
+			},
+			false,
+		},
 		{
 			"zero field value (primaryKey)",
 			&core.TextField{Name: "test", PrimaryKey: true},
@@ -9,6 +9,7 @@ import (
 	"strings"

 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/types"
@@ -17,10 +18,11 @@ import (

 // filter modifiers
 const (
-	eachModifier   string = "each"
-	issetModifier  string = "isset"
-	lengthModifier string = "length"
-	lowerModifier  string = "lower"
+	eachModifier    string = "each"
+	issetModifier   string = "isset"
+	lengthModifier  string = "length"
+	lowerModifier   string = "lower"
+	changedModifier string = "changed"
 )

 // ensure that `search.FieldResolver` interface is implemented
@@ -46,8 +48,12 @@ type RecordFieldResolver struct {
 	requestInfo       *RequestInfo
 	staticRequestInfo map[string]any
 	allowedFields     []string
-	joins             []*join
+	joins             []*search.Join
 	allowHiddenFields bool
+	// ---
+	listRuleJoins       map[string]*Collection // tableAlias->collection
+	joinAliasSuffix     string                 // used for uniqueness in the flatten collection list rule join
+	baseCollectionAlias string
 }

 // AllowedFields returns a copy of the resolver's allowed fields.
@@ -82,7 +88,7 @@ func NewRecordFieldResolver(
 		baseCollection:    baseCollection,
 		requestInfo:       requestInfo,
 		allowHiddenFields: allowHiddenFields, // note: it is not based only on the requestInfo.auth since it could be used by a non-request internal method
-		joins:             []*join{},
+		joins:             []*search.Join{},
 		allowedFields: []string{
 			`^\w+[\w\.\:]*$`,
 			`^\@request\.context$`,
@@ -115,18 +121,63 @@ func NewRecordFieldResolver(
 	return r
 }

+// @todo think of a better a way how to call it automatically after BuildExpr
+//
 // UpdateQuery implements `search.FieldResolver` interface.
 //
 // Conditionally updates the provided search query based on the
 // resolved fields (eg. dynamically joining relations).
 func (r *RecordFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
 	if len(r.joins) > 0 {
-		query.Distinct(true)
+		r.updateQueryWithDeduplicateConstraint(query)

 		for _, join := range r.joins {
 			query.LeftJoin(
-				(join.tableName + " " + join.tableAlias),
-				join.on,
+				(join.TableName + " " + join.TableAlias),
+				join.On,
+			)
+		}
+	}
+
+	// note: for now the joins are not applied for multi-match conditions to avoid excessive checks
+	if len(r.listRuleJoins) > 0 {
+		for alias, c := range r.listRuleJoins {
+			err := r.updateQueryWithCollectionListRule(c, alias, query)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (r *RecordFieldResolver) updateQueryWithCollectionListRule(c *Collection, tableAlias string, query *dbx.SelectQuery) error {
+	if r.allowHiddenFields || c == nil || c.ListRule == nil || *c.ListRule == "" {
+		return nil
+	}
+
+	cloneR := *r
+	cloneR.joins = []*search.Join{}
+	cloneR.baseCollection = c
+	cloneR.baseCollectionAlias = tableAlias
+	cloneR.allowHiddenFields = true
+	cloneR.joinAliasSuffix = security.PseudorandomString(8)
+
+	expr, err := search.FilterData(*c.ListRule).BuildExpr(&cloneR)
+	if err != nil {
+		return fmt.Errorf("to buld %q list rule join subquery filter expression: %w", c.Name, err)
+	}
+
+	query.AndWhere(expr)
+
+	if len(cloneR.joins) > 0 {
+		r.updateQueryWithDeduplicateConstraint(query)
+
+		for _, j := range cloneR.joins {
+			query.LeftJoin(
+				(j.TableName + " " + j.TableAlias),
+				j.On,
 			)
 		}
 	}
@@ -134,6 +185,79 @@ func (r *RecordFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
 	return nil
 }

+func (r *RecordFieldResolver) updateQueryWithDeduplicateConstraint(query *dbx.SelectQuery) {
+	query.Distinct(true)
+
+	// @todo Research better options for generic rows deduplication.
+	//
+	// Disable the GROUP BY conditional checks for now since it prevents
+	// proper utilization of ORDER BY indexes (and maybe others)
+	// (https://github.com/pocketbase/pocketbase/discussions/7461)
+
+	// info := query.Info()
+	// if info.Distinct {
+	// 	return
+	// }
+
+	// // already has the group by registered
+	// var groupByCol = r.baseCollection.Name
+	// if r.baseCollectionAlias != "" {
+	// 	groupByCol = r.baseCollectionAlias
+	// }
+	// groupByCol += ".id"
+	// if len(info.GroupBy) > 0 && info.GroupBy[0] == groupByCol {
+	// 	return
+	// }
+
+	// // when deemed safe (GROUP BY could have different execution order compared to DISTINCT),
+	// // prefer GROUP BY to deduplicate only on the id field instead of all columns
+	// // so that the size of a single row wouldn't matter that much
+	// if preferGroupBy(info, groupByCol) {
+	// 	query.GroupBy(groupByCol)
+	// } else {
+	// 	query.Distinct(true)
+	// }
+}
+
+func preferGroupBy(info *dbx.QueryInfo, fullUnquotedGroupByCol string) bool {
+	if len(info.GroupBy) != 0 {
+		return false
+	}
+
+	if info.Having != nil {
+		return false
+	}
+
+	// dbx fallbacks to * if not set
+	if len(info.Selects) == 0 {
+		return true
+	}
+
+	if len(info.Selects) != 1 {
+		return false
+	}
+
+	identifier := info.Selects[0]
+
+	if identifier == "*" || identifier == fullUnquotedGroupByCol {
+		return true
+	}
+
+	// try again as direct col match in an unquoted column format
+	identifier = inflector.Columnify(identifier)
+	if identifier == fullUnquotedGroupByCol {
+		return true
+	}
+
+	// remains table.* to check
+	// (aliased columns for now are ignored as they could be represented by expressions)
+	if !strings.HasSuffix(identifier, ".*") {
+		return false
+	}
+
+	return strings.HasPrefix(fullUnquotedGroupByCol, strings.TrimSuffix(identifier, "*"))
+}
+
 // Resolve implements `search.FieldResolver` interface.
 //
 // Example of some resolvable fieldName formats:
@@ -186,7 +310,7 @@ func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (*search

 	switch v := resultVal.(type) {
 	case nil:
-		return &search.ResolverResult{Identifier: "NULL"}, nil
+		// no further processing is needed...
 	case string:
 		// check if it is a number field and explicitly try to cast to
 		// float in case of a numeric string value was used
@@ -216,8 +340,20 @@ func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (*search
 		resultVal = val
 	}

-	placeholder := "f" + security.PseudorandomString(8)
+	// unsupported modifier
+	// @todo consider deprecating with the introduction of filter functions
+	if modifier != "" && modifier != lowerModifier {
+		return nil, fmt.Errorf("invalid modifier sequence %s:%s", lastProp, modifier)
+	}

+	// no need to wrap as placeholder if we already know that it is null
+	if resultVal == nil {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	placeholder := "f" + security.PseudorandomString(10)
+
+	// @todo consider deprecating with the introduction of filter functions
 	if modifier == lowerModifier {
 		return &search.ResolverResult{
 			Identifier: "LOWER({:" + placeholder + "})",
@@ -239,23 +375,42 @@ func (r *RecordFieldResolver) loadCollection(collectionNameOrId string) (*Collec
 	return getCollectionByModelOrIdentifier(r.app, collectionNameOrId)
 }

-func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string, on dbx.Expression) {
-	join := &join{
-		tableName:  tableName,
-		tableAlias: tableAlias,
-		on:         on,
+func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string, on dbx.Expression) error {
+	newJoin := &search.Join{
+		TableName:  tableName,
+		TableAlias: tableAlias,
+		On:         on,
+	}
+
+	// (see updateQueryWithCollectionListRule)
+	if !r.allowHiddenFields {
+		c, _ := r.loadCollection(tableName)
+
+		// ignore non-collections since the table name could be an expression (e.g. json) or some other subquery
+		if c != nil {
+			// treat all fields as if they are hidden
+			if c.ListRule == nil {
+				return fmt.Errorf("%q fields can be accessed only when allowHiddenFields is enabled or by superusers", c.Name)
+			}
+
+			if r.listRuleJoins == nil {
+				r.listRuleJoins = map[string]*Collection{}
+			}
+			r.listRuleJoins[newJoin.TableAlias] = c
+		}
 	}

 	// replace existing join
 	for i, j := range r.joins {
-		if j.tableAlias == join.tableAlias {
-			r.joins[i] = join
-			return
+		if j.TableAlias == newJoin.TableAlias {
+			r.joins[i] = newJoin
+			return nil
 		}
 	}

 	// register new join
-	r.joins = append(r.joins, join)
+	r.joins = append(r.joins, newJoin)
+	return nil
 }

 type mapExtractor interface {
@@ -395,7 +550,8 @@ func splitModifier(combined string) (string, string, error) {
 	case issetModifier,
 		eachModifier,
 		lengthModifier,
-		lowerModifier:
+		lowerModifier,
+		changedModifier:
 		return parts[0], parts[1], nil
 	}

@@ -1,70 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/pocketbase/dbx"
-)
-
-var _ dbx.Expression = (*multiMatchSubquery)(nil)
-
-// join defines the specification for a single SQL JOIN clause.
-type join struct {
-	tableName  string
-	tableAlias string
-	on         dbx.Expression
-}
-
-// multiMatchSubquery defines a record multi-match subquery expression.
-type multiMatchSubquery struct {
-	baseTableAlias  string
-	fromTableName   string
-	fromTableAlias  string
-	valueIdentifier string
-	joins           []*join
-	params          dbx.Params
-}
-
-// Build converts the expression into a SQL fragment.
-//
-// Implements [dbx.Expression] interface.
-func (m *multiMatchSubquery) Build(db *dbx.DB, params dbx.Params) string {
-	if m.baseTableAlias == "" || m.fromTableName == "" || m.fromTableAlias == "" {
-		return "0=1"
-	}
-
-	if params == nil {
-		params = m.params
-	} else {
-		// merge by updating the parent params
-		for k, v := range m.params {
-			params[k] = v
-		}
-	}
-
-	var mergedJoins strings.Builder
-	for i, j := range m.joins {
-		if i > 0 {
-			mergedJoins.WriteString(" ")
-		}
-		mergedJoins.WriteString("LEFT JOIN ")
-		mergedJoins.WriteString(db.QuoteTableName(j.tableName))
-		mergedJoins.WriteString(" ")
-		mergedJoins.WriteString(db.QuoteTableName(j.tableAlias))
-		if j.on != nil {
-			mergedJoins.WriteString(" ON ")
-			mergedJoins.WriteString(j.on.Build(db, params))
-		}
-	}
-
-	return fmt.Sprintf(
-		`SELECT %s as [[multiMatchValue]] FROM %s %s %s WHERE %s = %s`,
-		db.QuoteColumnName(m.valueIdentifier),
-		db.QuoteTableName(m.fromTableName),
-		db.QuoteTableName(m.fromTableAlias),
-		mergedJoins.String(),
-		db.QuoteColumnName(m.fromTableAlias+".id"),
-		db.QuoteColumnName(m.baseTableAlias+".id"),
-	)
-}
@@ -0,0 +1,31 @@
+package core
+
+import (
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+var _ dbx.Expression = (*replaceWithExpression)(nil)
+
+// replaceWithExpression defines a custom expression that will replace
+// a placeholder identifier found in "old" with the result of "new".
+type replaceWithExpression struct {
+	placeholder string
+	old         dbx.Expression
+	new         dbx.Expression
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *replaceWithExpression) Build(db *dbx.DB, params dbx.Params) string {
+	if e.placeholder == "" || e.old == nil || e.new == nil {
+		return "0=1"
+	}
+
+	oldResult := e.old.Build(db, params)
+	newResult := e.new.Build(db, params)
+
+	return strings.ReplaceAll(oldResult, e.placeholder, newResult)
+}
@@ -49,14 +49,13 @@ type runner struct {

 	// shared processing state
 	// ---------------------------------------------------------------
-	activeProps                []string            // holds the active props that remains to be processed
-	activeCollectionName       string              // the last used collection name
-	activeTableAlias           string              // the last used table alias
-	allowHiddenFields          bool                // indicates whether hidden fields (eg. email) should be allowed without extra conditions
-	nullifyMisingField         bool                // indicating whether to return null on missing field or return an error
-	withMultiMatch             bool                // indicates whether to attach a multiMatchSubquery condition to the ResolverResult
-	multiMatchActiveTableAlias string              // the last used multi-match table alias
-	multiMatch                 *multiMatchSubquery // the multi-match subquery expression generated from the fieldName
+	activeProps                []string                   // holds the active props that remains to be processed
+	activeCollectionName       string                     // the last used collection name
+	activeTableAlias           string                     // the last used table alias
+	nullifyMisingField         bool                       // indicating whether to return null on missing field or return an error
+	withMultiMatch             bool                       // indicates whether to attach a MultiMatchSubquery condition to the ResolverResult
+	multiMatchActiveTableAlias string                     // the last used multi-match table alias
+	multiMatch                 *search.MultiMatchSubquery // the multi-match subquery expression generated from the fieldName
 }

 func (r *runner) run() (*search.ResolverResult, error) {
@@ -81,6 +80,7 @@ func (r *runner) run() (*search.ResolverResult, error) {
 	}

 	if r.activeProps[0] == "@request" {
+		// @todo consider returning an error instead?
 		if r.resolver.requestInfo == nil {
 			return &search.ResolverResult{Identifier: "NULL"}, nil
 		}
@@ -89,7 +89,9 @@ func (r *runner) run() (*search.ResolverResult, error) {
 			return r.processRequestAuthField()
 		}

-		if strings.HasPrefix(r.fieldName, "@request.body.") && len(r.activeProps) > 2 {
+		totalProps := len(r.activeProps)
+
+		if strings.HasPrefix(r.fieldName, "@request.body.") && totalProps > 2 {
 			name, modifier, err := splitModifier(r.activeProps[2])
 			if err != nil {
 				return nil, err
@@ -101,23 +103,21 @@ func (r *runner) run() (*search.ResolverResult, error) {
 			}

 			// check for body relation field
-			if bodyField.Type() == FieldTypeRelation && len(r.activeProps) > 3 {
-				return r.processRequestInfoRelationField(bodyField)
+			if bodyField.Type() == FieldTypeRelation && totalProps > 3 {
+				return r.processRequestBodyRelationField(bodyField)
 			}

-			// check for body arrayble fields ":each" modifier
-			if modifier == eachModifier && len(r.activeProps) == 3 {
-				return r.processRequestInfoEachModifier(bodyField)
-			}
-
-			// check for body arrayble fields ":length" modifier
-			if modifier == lengthModifier && len(r.activeProps) == 3 {
-				return r.processRequestInfoLengthModifier(bodyField)
-			}
-
-			// check for body arrayble fields ":lower" modifier
-			if modifier == lowerModifier && len(r.activeProps) == 3 {
-				return r.processRequestInfoLowerModifier(bodyField)
+			if totalProps == 3 { // aka. last prop
+				switch modifier {
+				case eachModifier:
+					return r.processRequestBodyEachModifier(bodyField)
+				case lengthModifier:
+					return r.processRequestBodyLengthModifier(bodyField)
+				case lowerModifier:
+					return r.processRequestBodyLowerModifier(bodyField)
+				case changedModifier:
+					return r.processRequestBodyChangedModifier(bodyField)
+				}
 			}
 		}

@@ -133,12 +133,10 @@ func (r *runner) prepare() {
 	r.activeProps = strings.Split(r.fieldName, ".")

 	r.activeCollectionName = r.resolver.baseCollection.Name
-	r.activeTableAlias = inflector.Columnify(r.activeCollectionName)
-
-	r.allowHiddenFields = r.resolver.allowHiddenFields
-	// always allow hidden fields since the @.* filter is a system one
-	if r.activeProps[0] == "@collection" || r.activeProps[0] == "@request" {
-		r.allowHiddenFields = true
+	if r.resolver.baseCollectionAlias == "" {
+		r.activeTableAlias = inflector.Columnify(r.activeCollectionName)
+	} else {
+		r.activeTableAlias = r.resolver.baseCollectionAlias
 	}

 	// enable the ignore flag for missing @request.* fields for backward
@@ -146,13 +144,13 @@ func (r *runner) prepare() {
 	r.nullifyMisingField = r.activeProps[0] == "@request"

 	// prepare a multi-match subquery
-	r.multiMatch = &multiMatchSubquery{
-		baseTableAlias: r.activeTableAlias,
-		params:         dbx.Params{},
+	r.multiMatch = &search.MultiMatchSubquery{
+		TargetTableAlias: r.activeTableAlias,
+		Params:           dbx.Params{},
 	}
-	r.multiMatch.fromTableName = inflector.Columnify(r.activeCollectionName)
-	r.multiMatch.fromTableAlias = "__mm_" + r.activeTableAlias
-	r.multiMatchActiveTableAlias = r.multiMatch.fromTableAlias
+	r.multiMatch.FromTableName = inflector.Columnify(r.activeCollectionName)
+	r.multiMatch.FromTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatchActiveTableAlias = r.multiMatch.FromTableAlias
 	r.withMultiMatch = false
 }

@@ -172,21 +170,24 @@ func (r *runner) processCollectionField() (*search.ResolverResult, error) {
 	r.activeCollectionName = collection.Name

 	if len(collectionParts) == 2 && collectionParts[1] != "" {
-		r.activeTableAlias = inflector.Columnify("__collection_alias_" + collectionParts[1])
+		r.activeTableAlias = inflector.Columnify("__collection_alias_"+collectionParts[1]) + r.resolver.joinAliasSuffix
 	} else {
-		r.activeTableAlias = inflector.Columnify("__collection_" + r.activeCollectionName)
+		r.activeTableAlias = inflector.Columnify("__collection_"+r.activeCollectionName) + r.resolver.joinAliasSuffix
 	}

 	r.withMultiMatch = true

 	// join the collection to the main query
-	r.resolver.registerJoin(inflector.Columnify(collection.Name), r.activeTableAlias, nil)
+	err = r.resolver.registerJoin(inflector.Columnify(collection.Name), r.activeTableAlias, nil)
+	if err != nil {
+		return nil, err
+	}

 	// join the collection to the multi-match subquery
-	r.multiMatchActiveTableAlias = "__mm" + r.activeTableAlias
-	r.multiMatch.joins = append(r.multiMatch.joins, &join{
-		tableName:  inflector.Columnify(collection.Name),
-		tableAlias: r.multiMatchActiveTableAlias,
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.Joins = append(r.multiMatch.Joins, &search.Join{
+		TableName:  inflector.Columnify(collection.Name),
+		TableAlias: r.multiMatchActiveTableAlias,
 	})

 	// leave only the collection fields
@@ -212,10 +213,10 @@ func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
 	collection := r.resolver.requestInfo.Auth.Collection()

 	r.activeCollectionName = collection.Name
-	r.activeTableAlias = "__auth_" + inflector.Columnify(r.activeCollectionName)
+	r.activeTableAlias = "__auth_" + inflector.Columnify(r.activeCollectionName) + r.resolver.joinAliasSuffix

 	// join the auth collection to the main query
-	r.resolver.registerJoin(
+	err := r.resolver.registerJoin(
 		inflector.Columnify(r.activeCollectionName),
 		r.activeTableAlias,
 		dbx.HashExp{
@@ -223,15 +224,18 @@ func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
 			(r.activeTableAlias + ".id"): r.resolver.requestInfo.Auth.Id,
 		},
 	)
+	if err != nil {
+		return nil, err
+	}

 	// join the auth collection to the multi-match subquery
 	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
-	r.multiMatch.joins = append(
-		r.multiMatch.joins,
-		&join{
-			tableName:  inflector.Columnify(r.activeCollectionName),
-			tableAlias: r.multiMatchActiveTableAlias,
-			on: dbx.HashExp{
+	r.multiMatch.Joins = append(
+		r.multiMatch.Joins,
+		&search.Join{
+			TableName:  inflector.Columnify(r.activeCollectionName),
+			TableAlias: r.multiMatchActiveTableAlias,
+			On: dbx.HashExp{
 				(r.multiMatchActiveTableAlias + ".id"): r.resolver.requestInfo.Auth.Id,
 			},
 		},
@@ -268,10 +272,37 @@ func toSlice(value any) []any {
 	return result
 }

-func (r *runner) processRequestInfoLowerModifier(bodyField Field) (*search.ResolverResult, error) {
+func (r *runner) processRequestBodyChangedModifier(bodyField Field) (*search.ResolverResult, error) {
+	name := bodyField.GetName()
+
+	alias := search.FilterData(fmt.Sprintf("@request.body.%s:isset = true && @request.body.%s != %s", name, name, name))
+
+	aliasExpr, err := alias.BuildExpr(r.resolver)
+	if err != nil {
+		return nil, err
+	}
+
+	placeholder := "@changed@" + name + security.PseudorandomString(8)
+
+	result := &search.ResolverResult{
+		Identifier:   placeholder,
+		NullFallback: search.NullFallbackDisabled,
+		AfterBuild: func(expr dbx.Expression) dbx.Expression {
+			return &replaceWithExpression{
+				placeholder: placeholder,
+				old:         expr,
+				new:         aliasExpr,
+			}
+		},
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestBodyLowerModifier(bodyField Field) (*search.ResolverResult, error) {
 	rawValue := cast.ToString(r.resolver.requestInfo.Body[bodyField.GetName()])

-	placeholder := "infoLower" + bodyField.GetName() + security.PseudorandomString(6)
+	placeholder := "infoLower" + bodyField.GetName() + security.PseudorandomString(8)

 	result := &search.ResolverResult{
 		Identifier: "LOWER({:" + placeholder + "})",
@@ -281,7 +312,7 @@ func (r *runner) processRequestInfoLowerModifier(bodyField Field) (*search.Resol
 	return result, nil
 }

-func (r *runner) processRequestInfoLengthModifier(bodyField Field) (*search.ResolverResult, error) {
+func (r *runner) processRequestBodyLengthModifier(bodyField Field) (*search.ResolverResult, error) {
 	if _, ok := bodyField.(MultiValuer); !ok {
 		return nil, fmt.Errorf("field %q doesn't support multivalue operations", bodyField.GetName())
 	}
@@ -295,7 +326,7 @@ func (r *runner) processRequestInfoLengthModifier(bodyField Field) (*search.Reso
 	return result, nil
 }

-func (r *runner) processRequestInfoEachModifier(bodyField Field) (*search.ResolverResult, error) {
+func (r *runner) processRequestBodyEachModifier(bodyField Field) (*search.ResolverResult, error) {
 	multiValuer, ok := bodyField.(MultiValuer)
 	if !ok {
 		return nil, fmt.Errorf("field %q doesn't support multivalue operations", bodyField.GetName())
@@ -307,11 +338,15 @@ func (r *runner) processRequestInfoEachModifier(bodyField Field) (*search.Resolv
 		return nil, fmt.Errorf("cannot serialize the data for field %q", r.activeProps[2])
 	}

-	placeholder := "dataEach" + security.PseudorandomString(6)
+	placeholder := "dataEach" + security.PseudorandomString(8)
 	cleanFieldName := inflector.Columnify(bodyField.GetName())
 	jeTable := fmt.Sprintf("json_each({:%s})", placeholder)
-	jeAlias := "__dataEach_" + cleanFieldName + "_je"
-	r.resolver.registerJoin(jeTable, jeAlias, nil)
+	jeAlias := "__dataEach_je_" + cleanFieldName + r.resolver.joinAliasSuffix
+
+	err = r.resolver.registerJoin(jeTable, jeAlias, nil)
+	if err != nil {
+		return nil, err
+	}

 	result := &search.ResolverResult{
 		Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
@@ -325,14 +360,14 @@ func (r *runner) processRequestInfoEachModifier(bodyField Field) (*search.Resolv
 	if r.withMultiMatch {
 		placeholder2 := "mm" + placeholder
 		jeTable2 := fmt.Sprintf("json_each({:%s})", placeholder2)
-		jeAlias2 := "__mm" + jeAlias
+		jeAlias2 := "__mm_" + jeAlias

-		r.multiMatch.joins = append(r.multiMatch.joins, &join{
-			tableName:  jeTable2,
-			tableAlias: jeAlias2,
+		r.multiMatch.Joins = append(r.multiMatch.Joins, &search.Join{
+			TableName:  jeTable2,
+			TableAlias: jeAlias2,
 		})
-		r.multiMatch.params[placeholder2] = bodyItemsRaw
-		r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+		r.multiMatch.Params[placeholder2] = bodyItemsRaw
+		r.multiMatch.ValueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)

 		result.MultiMatchSubQuery = r.multiMatch
 	}
@@ -340,7 +375,7 @@ func (r *runner) processRequestInfoEachModifier(bodyField Field) (*search.Resolv
 	return result, nil
 }

-func (r *runner) processRequestInfoRelationField(bodyField Field) (*search.ResolverResult, error) {
+func (r *runner) processRequestBodyRelationField(bodyField Field) (*search.ResolverResult, error) {
 	relField, ok := bodyField.(*RelationField)
 	if !ok {
 		return nil, fmt.Errorf("failed to initialize data relation field %q", bodyField.GetName())
@@ -360,10 +395,10 @@ func (r *runner) processRequestInfoRelationField(bodyField Field) (*search.Resol
 	}

 	r.activeCollectionName = dataRelCollection.Name
-	r.activeTableAlias = inflector.Columnify("__data_" + dataRelCollection.Name + "_" + relField.Name)
+	r.activeTableAlias = inflector.Columnify("__data_"+dataRelCollection.Name+"_"+relField.Name) + r.resolver.joinAliasSuffix

 	// join the data rel collection to the main collection
-	r.resolver.registerJoin(
+	err = r.resolver.registerJoin(
 		r.activeCollectionName,
 		r.activeTableAlias,
 		dbx.In(
@@ -371,19 +406,22 @@ func (r *runner) processRequestInfoRelationField(bodyField Field) (*search.Resol
 			list.ToInterfaceSlice(dataRelIds)...,
 		),
 	)
+	if err != nil {
+		return nil, err
+	}

 	if relField.IsMultiple() {
 		r.withMultiMatch = true
 	}

 	// join the data rel collection to the multi-match subquery
-	r.multiMatchActiveTableAlias = inflector.Columnify("__data_mm_" + dataRelCollection.Name + "_" + relField.Name)
-	r.multiMatch.joins = append(
-		r.multiMatch.joins,
-		&join{
-			tableName:  r.activeCollectionName,
-			tableAlias: r.multiMatchActiveTableAlias,
-			on: dbx.In(
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.Joins = append(
+		r.multiMatch.Joins,
+		&search.Join{
+			TableName:  r.activeCollectionName,
+			TableAlias: r.multiMatchActiveTableAlias,
+			On: dbx.In(
 				fmt.Sprintf("[[%s.id]]", r.multiMatchActiveTableAlias),
 				list.ToInterfaceSlice(dataRelIds)...,
 			),
@@ -399,6 +437,7 @@ func (r *runner) processRequestInfoRelationField(bodyField Field) (*search.Resol

 var viaRegex = regexp.MustCompile(`^(\w+)_via_(\w+)$`)

+// @todo refactor and abstract lastProp processing with the support of field plugins
 func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 	totalProps := len(r.activeProps)

@@ -410,17 +449,17 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {

 		// last prop
 		if i == totalProps-1 {
-			return r.processLastProp(collection, prop)
+			return r.finalizeActivePropsProcessing(collection, prop, i)
 		}

 		field := collection.Fields.GetByName(prop)

-		if field != nil && field.GetHidden() && !r.allowHiddenFields {
+		if field != nil && field.GetHidden() && !r.resolver.allowHiddenFields {
 			return nil, fmt.Errorf("non-filterable field %q", prop)
 		}

+		// @todo consider moving to the finalizer and converting to "JSONExtractable" interface with optional extra validation for the remaining props?
 		// json or geoPoint field -> treat the rest of the props as json path
-		// @todo consider converting to "JSONExtractable" interface with optional extra validation for the remaining props?
 		if field != nil && (field.Type() == FieldTypeJSON || field.Type() == FieldTypeGeoPoint) {
 			var jsonPath strings.Builder
 			for j, p := range r.activeProps[i+1:] {
@@ -438,12 +477,12 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 			jsonPathStr := jsonPath.String()

 			result := &search.ResolverResult{
-				NoCoalesce: true,
-				Identifier: dbutils.JSONExtract(r.activeTableAlias+"."+inflector.Columnify(prop), jsonPathStr),
+				NullFallback: search.NullFallbackDisabled,
+				Identifier:   dbutils.JSONExtract(r.activeTableAlias+"."+inflector.Columnify(prop), jsonPathStr),
 			}

 			if r.withMultiMatch {
-				r.multiMatch.valueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+inflector.Columnify(prop), jsonPathStr)
+				r.multiMatch.ValueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+inflector.Columnify(prop), jsonPathStr)
 				result.MultiMatchSubQuery = r.multiMatch
 			}

@@ -488,7 +527,7 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 				return nil, fmt.Errorf("invalid back relation field %q", parts[2])
 			}

-			if backField.GetHidden() && !r.allowHiddenFields {
+			if backField.GetHidden() && !r.resolver.allowHiddenFields {
 				return nil, fmt.Errorf("non-filterable back relation field %q", backField.GetName())
 			}

@@ -508,25 +547,24 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 			// ---
 			cleanProp := inflector.Columnify(prop)
 			cleanBackFieldName := inflector.Columnify(backRelField.Name)
-			newTableAlias := r.activeTableAlias + "_" + cleanProp
+
+			newTableAlias := r.activeTableAlias + "_" + cleanProp + r.resolver.joinAliasSuffix
 			newCollectionName := inflector.Columnify(backCollection.Name)

 			isBackRelMultiple := backRelField.IsMultiple()
-			if !isBackRelMultiple {
-				// additionally check if the rel field has a single column unique index
-				_, hasUniqueIndex := dbutils.FindSingleColumnUniqueIndex(backCollection.Indexes, backRelField.Name)
-				isBackRelMultiple = !hasUniqueIndex
-			}

 			if !isBackRelMultiple {
-				r.resolver.registerJoin(
+				err := r.resolver.registerJoin(
 					newCollectionName,
 					newTableAlias,
 					dbx.NewExp(fmt.Sprintf("[[%s.%s]] = [[%s.id]]", newTableAlias, cleanBackFieldName, r.activeTableAlias)),
 				)
+				if err != nil {
+					return nil, err
+				}
 			} else {
-				jeAlias := r.activeTableAlias + "_" + cleanProp + "_je"
-				r.resolver.registerJoin(
+				jeAlias := "__je_" + newTableAlias
+				err := r.resolver.registerJoin(
 					newCollectionName,
 					newTableAlias,
 					dbx.NewExp(fmt.Sprintf(
@@ -537,6 +575,9 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 						jeAlias,
 					)),
 				)
+				if err != nil {
+					return nil, err
+				}
 			}

 			r.activeCollectionName = newCollectionName
@@ -547,27 +588,32 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 			// ---
 			if isBackRelMultiple {
 				r.withMultiMatch = true // enable multimatch if not already
+			} else if !r.withMultiMatch {
+				// additionally check if the rel field has a single column unique index;
+				// if not - apply a multi-match check
+				_, hasUniqueIndex := dbutils.FindSingleColumnUniqueIndex(backCollection.Indexes, backRelField.Name)
+				r.withMultiMatch = !hasUniqueIndex
 			}

-			newTableAlias2 := r.multiMatchActiveTableAlias + "_" + cleanProp
+			newTableAlias2 := r.multiMatchActiveTableAlias + "_" + cleanProp + r.resolver.joinAliasSuffix

 			if !isBackRelMultiple {
-				r.multiMatch.joins = append(
-					r.multiMatch.joins,
-					&join{
-						tableName:  newCollectionName,
-						tableAlias: newTableAlias2,
-						on:         dbx.NewExp(fmt.Sprintf("[[%s.%s]] = [[%s.id]]", newTableAlias2, cleanBackFieldName, r.multiMatchActiveTableAlias)),
+				r.multiMatch.Joins = append(
+					r.multiMatch.Joins,
+					&search.Join{
+						TableName:  newCollectionName,
+						TableAlias: newTableAlias2,
+						On:         dbx.NewExp(fmt.Sprintf("[[%s.%s]] = [[%s.id]]", newTableAlias2, cleanBackFieldName, r.multiMatchActiveTableAlias)),
 					},
 				)
 			} else {
-				jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanProp + "_je"
-				r.multiMatch.joins = append(
-					r.multiMatch.joins,
-					&join{
-						tableName:  newCollectionName,
-						tableAlias: newTableAlias2,
-						on: dbx.NewExp(fmt.Sprintf(
+				jeAlias2 := "__je_" + newTableAlias2
+				r.multiMatch.Joins = append(
+					r.multiMatch.Joins,
+					&search.Join{
+						TableName:  newCollectionName,
+						TableAlias: newTableAlias2,
+						On: dbx.NewExp(fmt.Sprintf(
 							"[[%s.id]] IN (SELECT [[%s.value]] FROM %s {{%s}})",
 							r.multiMatchActiveTableAlias,
 							jeAlias2,
@@ -607,28 +653,39 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 		if !relField.IsMultiple() &&
 			// the penultimate prop is "id"
 			i == totalProps-2 && r.activeProps[i+1] == FieldNameId {
-			return r.processLastProp(collection, relField.Name)
+			return r.finalizeActivePropsProcessing(collection, relField.Name, i)
 		}

 		cleanFieldName := inflector.Columnify(relField.Name)
 		prefixedFieldName := r.activeTableAlias + "." + cleanFieldName
-		newTableAlias := r.activeTableAlias + "_" + cleanFieldName
+		newTableAlias := r.activeTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix
 		newCollectionName := relCollection.Name

 		if !relField.IsMultiple() {
-			r.resolver.registerJoin(
+			err := r.resolver.registerJoin(
 				inflector.Columnify(newCollectionName),
 				newTableAlias,
 				dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s]]", newTableAlias, prefixedFieldName)),
 			)
+			if err != nil {
+				return nil, err
+			}
 		} else {
-			jeAlias := r.activeTableAlias + "_" + cleanFieldName + "_je"
-			r.resolver.registerJoin(dbutils.JSONEach(prefixedFieldName), jeAlias, nil)
-			r.resolver.registerJoin(
+			jeAlias := "__je_" + newTableAlias
+
+			err := r.resolver.registerJoin(dbutils.JSONEach(prefixedFieldName), jeAlias, nil)
+			if err != nil {
+				return nil, err
+			}
+
+			err = r.resolver.registerJoin(
 				inflector.Columnify(newCollectionName),
 				newTableAlias,
 				dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias, jeAlias)),
 			)
+			if err != nil {
+				return nil, err
+			}
 		}

 		r.activeCollectionName = newCollectionName
@@ -645,26 +702,26 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 		prefixedFieldName2 := r.multiMatchActiveTableAlias + "." + cleanFieldName

 		if !relField.IsMultiple() {
-			r.multiMatch.joins = append(
-				r.multiMatch.joins,
-				&join{
-					tableName:  inflector.Columnify(newCollectionName),
-					tableAlias: newTableAlias2,
-					on:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s]]", newTableAlias2, prefixedFieldName2)),
+			r.multiMatch.Joins = append(
+				r.multiMatch.Joins,
+				&search.Join{
+					TableName:  inflector.Columnify(newCollectionName),
+					TableAlias: newTableAlias2,
+					On:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s]]", newTableAlias2, prefixedFieldName2)),
 				},
 			)
 		} else {
 			jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName + "_je"
-			r.multiMatch.joins = append(
-				r.multiMatch.joins,
-				&join{
-					tableName:  dbutils.JSONEach(prefixedFieldName2),
-					tableAlias: jeAlias2,
+			r.multiMatch.Joins = append(
+				r.multiMatch.Joins,
+				&search.Join{
+					TableName:  dbutils.JSONEach(prefixedFieldName2),
+					TableAlias: jeAlias2,
 				},
-				&join{
-					tableName:  inflector.Columnify(newCollectionName),
-					tableAlias: newTableAlias2,
-					on:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias2, jeAlias2)),
+				&search.Join{
+					TableName:  inflector.Columnify(newCollectionName),
+					TableAlias: newTableAlias2,
+					On:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias2, jeAlias2)),
 				},
 			)
 		}
@@ -676,7 +733,7 @@ func (r *runner) processActiveProps() (*search.ResolverResult, error) {
 	return nil, fmt.Errorf("failed to resolve field %q", r.fieldName)
 }

-func (r *runner) processLastProp(collection *Collection, prop string) (*search.ResolverResult, error) {
+func (r *runner) finalizeActivePropsProcessing(collection *Collection, prop string, propDepth int) (*search.ResolverResult, error) {
 	name, modifier, err := splitModifier(prop)
 	if err != nil {
 		return nil, err
@@ -690,7 +747,7 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 		return nil, fmt.Errorf("unknown field %q", name)
 	}

-	if field.GetHidden() && !r.allowHiddenFields {
+	if field.GetHidden() && !r.resolver.allowHiddenFields {
 		return nil, fmt.Errorf("non-filterable field %q", name)
 	}

@@ -709,7 +766,7 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R

 		if r.withMultiMatch {
 			jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
-			r.multiMatch.valueIdentifier = dbutils.JSONArrayLength(jePair2)
+			r.multiMatch.ValueIdentifier = dbutils.JSONArrayLength(jePair2)
 			result.MultiMatchSubQuery = r.multiMatch
 		}

@@ -720,8 +777,12 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 	// -------------------------------------------------------
 	if modifier == eachModifier && isMultivaluer {
 		jePair := r.activeTableAlias + "." + cleanFieldName
-		jeAlias := r.activeTableAlias + "_" + cleanFieldName + "_je"
-		r.resolver.registerJoin(dbutils.JSONEach(jePair), jeAlias, nil)
+		jeAlias := "__je_" + r.activeTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix
+
+		err := r.resolver.registerJoin(dbutils.JSONEach(jePair), jeAlias, nil)
+		if err != nil {
+			return nil, err
+		}

 		result := &search.ResolverResult{
 			Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
@@ -733,13 +794,13 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R

 		if r.withMultiMatch {
 			jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
-			jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName + "_je"
+			jeAlias2 := "__je_" + r.multiMatchActiveTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix

-			r.multiMatch.joins = append(r.multiMatch.joins, &join{
-				tableName:  dbutils.JSONEach(jePair2),
-				tableAlias: jeAlias2,
+			r.multiMatch.Joins = append(r.multiMatch.Joins, &search.Join{
+				TableName:  dbutils.JSONEach(jePair2),
+				TableAlias: jeAlias2,
 			})
-			r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+			r.multiMatch.ValueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)

 			result.MultiMatchSubQuery = r.multiMatch
 		}
@@ -754,12 +815,12 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 	}

 	if r.withMultiMatch {
-		r.multiMatch.valueIdentifier = "[[" + r.multiMatchActiveTableAlias + "." + cleanFieldName + "]]"
+		r.multiMatch.ValueIdentifier = "[[" + r.multiMatchActiveTableAlias + "." + cleanFieldName + "]]"
 		result.MultiMatchSubQuery = r.multiMatch
 	}

 	// allow querying only auth records with emails marked as public
-	if field.GetName() == FieldNameEmail && !r.allowHiddenFields && collection.IsAuth() {
+	if field.GetName() == FieldNameEmail && !r.resolver.allowHiddenFields && collection.IsAuth() {
 		result.AfterBuild = func(expr dbx.Expression) dbx.Expression {
 			return dbx.Enclose(dbx.And(expr, dbx.NewExp(fmt.Sprintf(
 				"[[%s.%s]] = TRUE",
@@ -773,10 +834,10 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 	// stored as json work correctly when compared to their SQL equivalent
 	// (https://github.com/pocketbase/pocketbase/issues/4068)
 	if field.Type() == FieldTypeJSON {
-		result.NoCoalesce = true
+		result.NullFallback = search.NullFallbackDisabled
 		result.Identifier = dbutils.JSONExtract(r.activeTableAlias+"."+cleanFieldName, "")
 		if r.withMultiMatch {
-			r.multiMatch.valueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+cleanFieldName, "")
+			r.multiMatch.ValueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+cleanFieldName, "")
 		}
 	}

@@ -784,7 +845,7 @@ func (r *runner) processLastProp(collection *Collection, prop string) (*search.R
 	if modifier == lowerModifier {
 		result.Identifier = "LOWER(" + result.Identifier + ")"
 		if r.withMultiMatch {
-			r.multiMatch.valueIdentifier = "LOWER(" + r.multiMatch.valueIdentifier + ")"
+			r.multiMatch.ValueIdentifier = "LOWER(" + r.multiMatch.ValueIdentifier + ")"
 		}
 	}

@@ -314,9 +314,19 @@ func (app *BaseApp) FindAllRecords(collectionModelOrIdentifier any, exprs ...dbx
 // FindFirstRecordByData returns the first found record matching
 // the provided key-value pair.
 func (app *BaseApp) FindFirstRecordByData(collectionModelOrIdentifier any, key string, value any) (*Record, error) {
+	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if err != nil {
+		return nil, err
+	}
+
+	field := collection.Fields.GetByName(key)
+	if field == nil {
+		return nil, errors.New("invalid or missing field " + key)
+	}
+
 	record := &Record{}

-	err := app.RecordQuery(collectionModelOrIdentifier).
+	err = app.RecordQuery(collection).
 		AndWhere(dbx.HashExp{inflector.Columnify(key): value}).
 		Limit(1).
 		One(record)
@@ -397,7 +407,10 @@ func (app *BaseApp) FindRecordsByFilter(
 		}
 	}

-	resolver.UpdateQuery(q) // attaches any adhoc joins and aliases
+	err = resolver.UpdateQuery(q) // attaches any adhoc joins and aliases
+	if err != nil {
+		return nil, err
+	}
 	// ---

 	if offset > 0 {
@@ -611,7 +624,11 @@ func (app *BaseApp) CanAccessRecord(record *Record, requestInfo *RequestInfo, ac
 	if err != nil {
 		return false, err
 	}
-	resolver.UpdateQuery(query)
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return false, err
+	}

 	err = query.AndWhere(expr).Limit(1).Row(&exists)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
@@ -525,6 +525,13 @@ func TestFindFirstRecordByData(t *testing.T) {
 			"",
 			true,
 		},
+		{
+			"demo2",
+			"invalid_or_missing",
+			"llvuca81nly1qls",
+			"",
+			true,
+		},
 		{
 			"demo2",
 			"id",
@@ -423,7 +423,7 @@ type BatchConfig struct {
 	// MaxRequests is the maximum allowed batch request to execute.
 	MaxRequests int `form:"maxRequests" json:"maxRequests"`

-	// Timeout is the the max duration in seconds to wait before cancelling the batch transaction.
+	// Timeout is the max duration in seconds to wait before cancelling the batch transaction.
 	Timeout int64 `form:"timeout" json:"timeout"`

 	// MaxBodySize is the maximum allowed batch request body size in bytes.
@@ -449,7 +449,7 @@ type BackupsConfig struct {
 	// Leave it empty to disable the auto backups functionality.
 	Cron string `form:"cron" json:"cron"`

-	// CronMaxKeep is the the max number of cron generated backups to
+	// CronMaxKeep is the max number of cron generated backups to
 	// keep before removing older entries.
 	//
 	// This field works only when the cron config has valid cron expression.
@@ -676,8 +676,8 @@ type RateLimitRule struct {

 	// Audience specifies the auth group the rule should apply for:
 	//   - ""      - both guests and authenticated users (default)
-	//   - "guest" - only for guests
-	//   - "auth"  - only for authenticated users
+	//   - "@guest" - only for guests
+	//   - "@auth"  - only for authenticated users
 	Audience string `form:"audience" json:"audience"`

 	// Duration specifies the interval (in seconds) per which to reset
@@ -704,3 +704,13 @@ func (c RateLimitRule) Validate() error {
 func (c RateLimitRule) DurationTime() time.Duration {
 	return time.Duration(c.Duration) * time.Second
 }
+
+// String returns a string representation of the rule.
+func (c RateLimitRule) String() string {
+	raw, err := json.Marshal(c)
+	if err != nil {
+		return c.Label // extremely rare case
+	}
+
+	return string(raw)
+}
@@ -687,7 +687,7 @@ func TestRateLimitsFindRateLimitRule(t *testing.T) {
 func TestRateLimitRuleValidate(t *testing.T) {
 	scenarios := []struct {
 		name           string
-		config         core.RateLimitRule
+		rule           core.RateLimitRule
 		expectedErrors []string
 	}{
 		{
@@ -784,7 +784,7 @@ func TestRateLimitRuleValidate(t *testing.T) {

 	for _, s := range scenarios {
 		t.Run(s.name, func(t *testing.T) {
-			result := s.config.Validate()
+			result := s.rule.Validate()

 			tests.TestValidationErrors(t, result, s.expectedErrors)
 		})
@@ -793,7 +793,7 @@ func TestRateLimitRuleValidate(t *testing.T) {

 func TestRateLimitRuleDurationTime(t *testing.T) {
 	scenarios := []struct {
-		config   core.RateLimitRule
+		rule     core.RateLimitRule
 		expected time.Duration
 	}{
 		{core.RateLimitRule{}, 0 * time.Second},
@@ -801,8 +801,8 @@ func TestRateLimitRuleDurationTime(t *testing.T) {
 	}

 	for i, s := range scenarios {
-		t.Run(fmt.Sprintf("%d_%d", i, s.config.Duration), func(t *testing.T) {
-			result := s.config.DurationTime()
+		t.Run(fmt.Sprintf("%d_%d", i, s.rule.Duration), func(t *testing.T) {
+			result := s.rule.DurationTime()

 			if result != s.expected {
 				t.Fatalf("Expected duration %d, got %d", s.expected, result)
@@ -810,3 +810,37 @@ func TestRateLimitRuleDurationTime(t *testing.T) {
 		})
 	}
 }
+
+func TestRateLimitRuleString(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		rule     core.RateLimitRule
+		expected string
+	}{
+		{
+			"empty",
+			core.RateLimitRule{},
+			`{"label":"","audience":"","duration":0,"maxRequests":0}`,
+		},
+		{
+			"all fields",
+			core.RateLimitRule{
+				Label:       "POST /a/b/",
+				Duration:    1,
+				MaxRequests: 2,
+				Audience:    core.RateLimitRuleAudienceAuth,
+			},
+			`{"label":"POST /a/b/","audience":"@auth","duration":1,"maxRequests":2}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.rule.String()
+
+			if result != s.expected {
+				t.Fatalf("Expected string\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
@@ -0,0 +1,10 @@
+//go:build !(js && wasm)
+
+package core
+
+import "syscall"
+
+// execve invokes the execve(2) system call.
+func execve(argv0 string, argv []string, envv []string) error {
+	return syscall.Exec(argv0, argv, envv)
+}
@@ -0,0 +1,10 @@
+//go:build js && wasm
+
+package core
+
+import "errors"
+
+// https://github.com/pocketbase/pocketbase/pull/7116
+func execve(argv0 string, argv []string, envv []string) error {
+	return errors.ErrUnsupported
+}
@@ -19,11 +19,11 @@ import (
 // This method is a no-op if a view with the provided name doesn't exist.
 //
 // NB! Be aware that this method is vulnerable to SQL injection and the
-// "name" argument must come only from trusted input!
-func (app *BaseApp) DeleteView(name string) error {
+// "dangerousViewName" argument must come only from trusted input!
+func (app *BaseApp) DeleteView(dangerousViewName string) error {
 	_, err := app.DB().NewQuery(fmt.Sprintf(
 		"DROP VIEW IF EXISTS {{%s}}",
-		name,
+		dangerousViewName,
 	)).Execute()

 	return err
@@ -31,19 +31,19 @@ func (app *BaseApp) DeleteView(name string) error {

 // SaveView creates (or updates already existing) persistent SQL view.
 //
-// NB! Be aware that this method is vulnerable to SQL injection and the
-// "selectQuery" argument must come only from trusted input!
-func (app *BaseApp) SaveView(name string, selectQuery string) error {
+// NB! Be aware that this method is vulnerable to SQL injection and
+// its arguments must come only from trusted input!
+func (app *BaseApp) SaveView(dangerousViewName string, dangerousSelectQuery string) error {
 	return app.RunInTransaction(func(txApp App) error {
 		// delete old view (if exists)
-		if err := txApp.DeleteView(name); err != nil {
+		if err := txApp.DeleteView(dangerousViewName); err != nil {
 			return err
 		}

-		selectQuery = strings.Trim(strings.TrimSpace(selectQuery), ";")
+		dangerousSelectQuery = strings.Trim(strings.TrimSpace(dangerousSelectQuery), ";")

 		// try to loosely detect multiple inline statements
-		tk := tokenizer.NewFromString(selectQuery)
+		tk := tokenizer.NewFromString(dangerousSelectQuery)
 		tk.Separators(';')
 		if queryParts, _ := tk.ScanAll(); len(queryParts) > 1 {
 			return errors.New("multiple statements are not supported")
@@ -53,17 +53,17 @@ func (app *BaseApp) SaveView(name string, selectQuery string) error {
 		//
 		// note: the query is wrapped in a secondary SELECT as a rudimentary
 		// measure to discourage multiple inline sql statements execution
-		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, selectQuery)
+		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", dangerousViewName, dangerousSelectQuery)
 		if _, err := txApp.DB().NewQuery(viewQuery).Execute(); err != nil {
 			return err
 		}

 		// fetch the view table info to ensure that the view was created
 		// because missing tables or columns won't return an error
-		if _, err := txApp.TableInfo(name); err != nil {
+		if _, err := txApp.TableInfo(dangerousViewName); err != nil {
 			// manually cleanup previously created view in case the func
 			// is called in a nested transaction and the error is discarded
-			txApp.DeleteView(name)
+			txApp.DeleteView(dangerousViewName)

 			return err
 		}
@@ -77,18 +77,21 @@ func (app *BaseApp) SaveView(name string, selectQuery string) error {
 // There are some caveats:
 // - The select query must have an "id" column.
 // - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
-func (app *BaseApp) CreateViewFields(selectQuery string) (FieldsList, error) {
+//
+// NB! Be aware that this method is vulnerable to SQL injection and the
+// "dangerousSelectQuery" argument must come only from trusted input!
+func (app *BaseApp) CreateViewFields(dangerousSelectQuery string) (FieldsList, error) {
 	result := NewFieldsList()

-	suggestedFields, err := parseQueryToFields(app, selectQuery)
+	suggestedFields, err := parseQueryToFields(app, dangerousSelectQuery)
 	if err != nil {
 		return result, err
 	}

-	// note wrap in a transaction in case the selectQuery contains
+	// note wrap in a transaction in case the dangerousSelectQuery contains
 	// multiple statements allowing us to rollback on any error
 	txErr := app.RunInTransaction(func(txApp App) error {
-		info, err := getQueryTableInfo(txApp, selectQuery)
+		info, err := getQueryTableInfo(txApp, dangerousSelectQuery)
 		if err != nil {
 			return err
 		}
@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"strings"

 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/apis"
@@ -14,6 +13,7 @@ import (
 	"github.com/pocketbase/pocketbase/plugins/jsvm"
 	"github.com/pocketbase/pocketbase/plugins/migratecmd"
 	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 )

 func main() {
@@ -123,8 +123,7 @@ func main() {

 // the default pb_public dir location is relative to the executable
 func defaultPublicDir() string {
-	if strings.HasPrefix(os.Args[0], os.TempDir()) {
-		// most likely ran with go run
+	if osutils.IsProbablyGoRun() {
 		return "./pb_public"
 	}

@@ -7,6 +7,7 @@ import (
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/types"
 )

 const (
@@ -109,7 +110,8 @@ func (form *TestEmailSend) Submit() error {
 	case TestTemplateOTP:
 		return mails.SendRecordOTP(form.app, record, "_PB_TEST_OTP_ID_", "123456")
 	case TestTemplateAuthAlert:
-		return mails.SendRecordAuthAlert(form.app, record)
+		testEvent := types.NowDateTime().String() + " - TEST_IP TEST_USER_AGENT"
+		return mails.SendRecordAuthAlert(form.app, record, testEvent)
 	default:
 		return errors.New("unknown template " + form.Template)
 	}
@@ -1,28 +1,28 @@
 module github.com/pocketbase/pocketbase

-go 1.23.0
+go 1.24.0

 require (
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.6.2
-	github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c
-	github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0
+	github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3
+	github.com/dop251/goja_nodejs v0.0.0-20260212111938-1f56ff5bcf14
 	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/gabriel-vasile/mimetype v1.4.9
+	github.com/gabriel-vasile/mimetype v1.4.13
 	github.com/ganigeorgiev/fexpr v0.5.0
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
-	github.com/golang-jwt/jwt/v5 v5.2.2
-	github.com/pocketbase/dbx v1.11.0
-	github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119
-	github.com/spf13/cast v1.9.2
-	github.com/spf13/cobra v1.9.1
-	golang.org/x/crypto v0.39.0
-	golang.org/x/image v0.28.0
-	golang.org/x/net v0.41.0
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sync v0.15.0
-	modernc.org/sqlite v1.38.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/pocketbase/dbx v1.12.0
+	github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f
+	github.com/spf13/cast v1.10.0
+	github.com/spf13/cobra v1.10.2
+	golang.org/x/crypto v0.48.0
+	golang.org/x/image v0.36.0
+	golang.org/x/net v0.50.0
+	golang.org/x/oauth2 v0.35.0
+	golang.org/x/sync v0.19.0
+	modernc.org/sqlite v1.46.1
 )

 require (
@@ -31,20 +31,20 @@ require (
 	github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
-	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
+	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476 // indirect
-	golang.org/x/mod v0.25.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
-	modernc.org/libc v1.65.10 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
+	modernc.org/libc v1.67.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
@@ -14,10 +14,10 @@ github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCO
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 h1:16iT9CBDOniJwFGPI41MbUDfEk74hFaKTqudrX8kenY=
 github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217/go.mod h1:eIb+f24U+eWQCIsj9D/ah+MD9UP+wdxuqzsdLD+mhGM=
-github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c h1:mxWGS0YyquJ/ikZOjSrRjjFIbUqIP9ojyYQ+QZTU3Rg=
-github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
-github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0 h1:jTwdYTGERaZ/3+glBUVQZV2NwGodd9HlkXJbTBUPLLo=
-github.com/dop251/goja_nodejs v0.0.0-20250314160716-c55ecee183c0/go.mod h1:Tb7Xxye4LX7cT3i8YLvmPMGCV92IOi4CDZvm/V8ylc0=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3 h1:bVp3yUzvSAJzu9GqID+Z96P+eu5TKnIMJSV4QaZMauM=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
+github.com/dop251/goja_nodejs v0.0.0-20260212111938-1f56ff5bcf14 h1:3U8dTgyNBhEQ/GVw0jZW5q+93Zw2gAZPRWhJ9TwV3rM=
+github.com/dop251/goja_nodejs v0.0.0-20260212111938-1f56ff5bcf14/go.mod h1:Tb7Xxye4LX7cT3i8YLvmPMGCV92IOi4CDZvm/V8ylc0=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
@@ -26,8 +26,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
-github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
 github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
@@ -36,15 +36,17 @@ github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TC
 github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -55,73 +57,78 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU=
-github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119 h1:TjQtEReJDTpvlNFTRjuHvPQpJHAeJdcQF130eCAAT/o=
-github.com/pocketbase/tygoja v0.0.0-20250103200817-ca580d8c5119/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
+github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
+github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f h1:ahrn66FNJYsFkO0EOTStYs+jdBKBop/anp9hoQSzZjI=
+github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
-github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
-golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
-golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476 h1:bsqhLWFR6G6xiQcb+JoGqdKdRU6WzPWmK8E0jxTjzo4=
-golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.28.0 h1:gdem5JW1OLS4FbkWgLO+7ZeFzYtL3xClb97GaUzYMFE=
-golang.org/x/image v0.28.0/go.mod h1:GUJYXtnGKEUgggyzh+Vxt+AviiCcyiwpsl8iQ8MvwGY=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
+golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
-golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
-golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 google.golang.org/appengine v1.6.5 h1:tycE03LOZYQNhDpS27tcQdAzLCVMaj7QT2SXxebnpCM=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
-modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
-modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
-modernc.org/fileutil v1.3.3 h1:3qaU+7f7xxTUmvU1pJTZiDLAIoJVdUSSauJNHg9yXoA=
-modernc.org/fileutil v1.3.3/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
+modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/libc v1.65.10 h1:ZwEk8+jhW7qBjHIT+wd0d9VjitRyQef9BnzlzGwMODc=
-modernc.org/libc v1.65.10/go.mod h1:StFvYpx7i/mXtBAfVOjaU0PWZOvIRoZSgXhrwXzr8Po=
+modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
+modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
+modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -130,8 +137,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.38.0 h1:+4OrfPQ8pxHKuWG4md1JpR/EYAh3Md7TdejuuzE7EUI=
-modernc.org/sqlite v1.38.0/go.mod h1:1Bj+yES4SVvBZ4cBOpVZ6QgesMCKpJZDq0nxYzOpmNE=
+modernc.org/sqlite v1.46.1 h1:eFJ2ShBLIEnUWlLy12raN0Z1plqmFX9Qe3rjQTKt6sU=
+modernc.org/sqlite v1.46.1/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -1,6 +1,5 @@
 version: "2"
 run:
-  go: 1.23
  concurrency: 4
  timeout: 10m
 linters:
@@ -12,10 +12,14 @@ import (
 )

 // SendRecordAuthAlert sends a new device login alert to the specified auth record.
-func SendRecordAuthAlert(app core.App, authRecord *core.Record) error {
+func SendRecordAuthAlert(app core.App, authRecord *core.Record, info string) error {
 	mailClient := app.NewMailClient()

-	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().AuthAlert.EmailTemplate, nil)
+	info = html.EscapeString(info)
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().AuthAlert.EmailTemplate, map[string]any{
+		core.EmailPlaceholderAlertInfo: info,
+	})
 	if err != nil {
 		return err
 	}
@@ -35,6 +39,9 @@ func SendRecordAuthAlert(app core.App, authRecord *core.Record) error {
 	event.Mailer = mailClient
 	event.Message = message
 	event.Record = authRecord
+	event.Meta = map[string]any{
+		"info": info,
+	}

 	return app.OnMailerRecordAuthAlertSend().Trigger(event, func(e *core.MailerRecordEvent) error {
 		return e.Mailer.Send(e.Message)
@@ -15,12 +15,14 @@ func TestSendRecordAuthAlert(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

+	info := "<p>test_info</p>"
+
 	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")

 	// to test that it is escaped
 	user.Set("name", "<p>"+user.GetString("name")+"</p>")

-	err := mails.SendRecordAuthAlert(testApp, user)
+	err := mails.SendRecordAuthAlert(testApp, user, info)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -34,6 +36,7 @@ func TestSendRecordAuthAlert(t *testing.T) {
 		"login to your " + testApp.Settings().Meta.AppName + " account from a new location",
 		"If this was you",
 		"If this wasn't you",
+		html.EscapeString(info),
 	}
 	for _, part := range expectedParts {
 		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
@@ -0,0 +1,62 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const oldAuthAlertTemplate = `<p>Hello,</p>
+<p>We noticed a login to your {APP_NAME} account from a new location.</p>
+<p>If this was you, you may disregard this email.</p>
+<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>
+<p>
+  Thanks,<br/>
+  {APP_NAME} team
+</p>`
+
+func init() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		collections, err := txApp.FindAllCollections(core.CollectionTypeAuth)
+		if err != nil {
+			return err
+		}
+
+		newTemplate := core.NewAuthCollection("up").AuthAlert.EmailTemplate.Body
+
+		for _, c := range collections {
+			if c.AuthAlert.EmailTemplate.Body != oldAuthAlertTemplate {
+				continue
+			}
+
+			c.AuthAlert.EmailTemplate.Body = newTemplate
+
+			err = txApp.Save(c)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, func(txApp core.App) error {
+		collections, err := txApp.FindAllCollections(core.CollectionTypeAuth)
+		if err != nil {
+			return err
+		}
+
+		newTemplate := core.NewAuthCollection("down").AuthAlert.EmailTemplate.Body
+
+		for _, c := range collections {
+			if c.AuthAlert.EmailTemplate.Body != newTemplate {
+				continue
+			}
+
+			c.AuthAlert.EmailTemplate.Body = oldAuthAlertTemplate
+
+			err = txApp.Save(c)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
@@ -10,8 +10,8 @@ import (
 )

 const (
-	expectedDriverVersion = "v1.38.0"
-	expectedLibcVersion   = "v1.65.10"
+	expectedDriverVersion = "v1.46.1"
+	expectedLibcVersion   = "v1.67.6"

 	// ModerncDepsCheckHookId is the id of the hook that performs the modernc.org/* deps checks.
 	// It could be used for removing/unbinding the hook if you don't want the checks.
@@ -309,6 +309,44 @@ func baseBinds(vm *goja.Runtime) {
 		return string(bodyBytes), nil
 	})

+	// note: throw only on reader error
+	vm.Set("toBytes", func(raw any, maxReaderBytes int) ([]byte, error) {
+		switch v := raw.(type) {
+		case nil:
+			return []byte{}, nil
+		case string:
+			return []byte(v), nil
+		case []byte:
+			return v, nil
+		case types.JSONRaw:
+			return v, nil
+		case io.Reader:
+			if maxReaderBytes == 0 {
+				maxReaderBytes = router.DefaultMaxMemory
+			}
+
+			limitReader := io.LimitReader(v, int64(maxReaderBytes))
+
+			return io.ReadAll(limitReader)
+		default:
+			b, err := cast.ToUint8SliceE(v)
+			if err == nil {
+				return b, nil
+			}
+
+			str, err := cast.ToStringE(v)
+			if err == nil {
+				return []byte(str), nil
+			}
+
+			// as a last attempt try to json encode the value
+			rawBytes, _ := json.Marshal(raw)
+
+			return rawBytes, nil
+		}
+	})
+
+	// note: throw only on reader error
 	vm.Set("toString", func(raw any, maxReaderBytes int) (string, error) {
 		switch v := raw.(type) {
 		case io.Reader:
@@ -393,6 +431,32 @@ func baseBinds(vm *goja.Runtime) {
 		return instanceValue
 	})

+	// nullable helpers usually used as DynamicModel shape values
+	vm.Set("nullString", func() *string {
+		var v string
+		return &v
+	})
+	vm.Set("nullFloat", func() *float64 {
+		var v float64
+		return &v
+	})
+	vm.Set("nullInt", func() *int64 {
+		var v int64
+		return &v
+	})
+	vm.Set("nullBool", func() *bool {
+		var v bool
+		return &v
+	})
+	vm.Set("nullArray", func() *types.JSONArray[any] {
+		var v types.JSONArray[any]
+		return &v
+	})
+	vm.Set("nullObject", func() *types.JSONMap[any] {
+		var v types.JSONMap[any]
+		return &v
+	})
+
 	vm.Set("Record", func(call goja.ConstructorCall) *goja.Object {
 		var instance *core.Record

@@ -625,6 +689,7 @@ func mailsBinds(vm *goja.Runtime) {
 	obj.Set("sendRecordVerification", mails.SendRecordVerification)
 	obj.Set("sendRecordChangeEmail", mails.SendRecordChangeEmail)
 	obj.Set("sendRecordOTP", mails.SendRecordOTP)
+	obj.Set("sendRecordAuthAlert", mails.SendRecordAuthAlert)
 }

 func securityBinds(vm *goja.Runtime) {
@@ -674,6 +739,8 @@ func filesystemBinds(vm *goja.Runtime) {
 	obj := vm.NewObject()
 	vm.Set("$filesystem", obj)

+	obj.Set("s3", filesystem.NewS3)
+	obj.Set("local", filesystem.NewLocal)
 	obj.Set("fileFromPath", filesystem.NewFileFromPath)
 	obj.Set("fileFromBytes", filesystem.NewFileFromBytes)
 	obj.Set("fileFromMultipart", filesystem.NewFileFromMultipart)
@@ -732,6 +799,8 @@ func osBinds(vm *goja.Runtime) {
 	obj.Set("rename", os.Rename)
 	obj.Set("remove", os.Remove)
 	obj.Set("removeAll", os.RemoveAll)
+	obj.Set("openRoot", os.OpenRoot)
+	obj.Set("openInRoot", os.OpenInRoot)
 }

 func formsBinds(vm *goja.Runtime) {
@@ -1059,12 +1128,19 @@ var cachedDynamicModelStructs = store.New[string, reflect.Type](nil)
 // on the specified "shape".
 //
 // The "shape" values are used as defaults and could be of type:
-// - int (ex. 0)
-// - float (ex. -0)
-// - string (ex. "")
-// - bool (ex. false)
-// - slice (ex. [])
-// - map (ex. map[string]any{})
+//
+//   - int64      (ex.: 0)
+//   - *int64     (ex.: nullInt())
+//   - float64    (ex.: -0)
+//   - *float64   (ex.: nullFloat())
+//   - string     (ex.: "")
+//   - *string    (ex.: nullString())
+//   - bool       (ex.: false)
+//   - *bool      (ex.: nullBool())
+//   - slice/arr  (ex.: [])
+//   - *slice/arr (ex.: nullArray())
+//   - map        (ex.: {})
+//   - *map       (ex.: nullObject())
 //
 // Example:
 //
@@ -1100,6 +1176,9 @@ func newDynamicModel(shape map[string]any) any {
 			newV.Scan(raw)
 			v = newV
 			vt = reflect.TypeOf(newV)
+		case reflect.Pointer:
+			// for pointers always fallback to nil as their default value
+			v = nil
 		}

 		hash.WriteString(k)
@@ -1128,6 +1207,9 @@ func newDynamicModel(shape map[string]any) any {

 	// load default values into the new model
 	for i, item := range info {
+		if item.value == nil {
+			continue
+		}
 		elem.Field(i).Set(reflect.ValueOf(item.value))
 	}

@@ -1,6 +1,7 @@
 package jsvm

 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -8,6 +9,7 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -22,6 +24,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 )

@@ -44,7 +47,7 @@ func TestBaseBindsCount(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)

-	testBindsCount(vm, "this", 34, t)
+	testBindsCount(vm, "this", 41, t)
 }

 func TestBaseBindsSleep(t *testing.T) {
@@ -83,7 +86,7 @@ func TestBaseBindsReaderToString(t *testing.T) {
 	}
 }

-func TestBaseBindsToStringAndToBytes(t *testing.T) {
+func TestBaseBindsToString(t *testing.T) {
 	vm := goja.New()
 	baseBinds(vm)
 	vm.Set("scenarios", []struct {
@@ -106,10 +109,49 @@ func TestBaseBindsToStringAndToBytes(t *testing.T) {

 	_, err := vm.RunString(`
 		for (let s of scenarios) {
-			let result = toString(s.value)
+			let str = toString(s.value)
+			if (str != s.expected) {
+				throw new Error('[' + s.name + '] Expected string ' + s.expected + ', got ' + str);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}

-			if (result != s.expected) {
-				throw new Error('[' + s.name + '] Expected string ' + s.expected + ', got ' + result);
+func TestBaseBindsToBytes(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("bytesEqual", bytes.Equal)
+	vm.Set("scenarios", []struct {
+		Name     string
+		Value    any
+		Expected []byte
+	}{
+		{"null", nil, []byte{}},
+		{"string", "test", []byte("test")},
+		{"number", -12.4, []byte("-12.4")},
+		{"bool", true, []byte("true")},
+		{"arr", []int{1, 2, 3}, []byte{1, 2, 3}},
+		{"jsonraw", types.JSONRaw{1, 2, 3}, []byte{1, 2, 3}},
+		{"reader", strings.NewReader("test"), []byte("test")},
+		{"obj", map[string]any{"test": 123}, []byte(`{"test":123}`)},
+		{"struct", struct {
+			Name    string
+			private string
+		}{Name: "123", private: "456"}, []byte(`{"Name":"123"}`)},
+	})
+
+	_, err := vm.RunString(`
+		for (let s of scenarios) {
+			let b = toBytes(s.value)
+			if (!Array.isArray(b)) {
+				throw new Error('[' + s.name + '] Expected toBytes to return an array');
+			}
+
+			if (!bytesEqual(b, s.expected)) {
+				throw new Error('[' + s.name + '] Expected bytes ' + s.expected + ', got ' + b);
 			}
 		}
 	`)
@@ -754,7 +796,7 @@ func TestMailsBindsCount(t *testing.T) {
 	vm := goja.New()
 	mailsBinds(vm)

-	testBindsCount(vm, "$mails", 4, t)
+	testBindsCount(vm, "$mails", 5, t)
 }

 func TestMailsBinds(t *testing.T) {
@@ -792,6 +834,11 @@ func TestMailsBinds(t *testing.T) {
 		if (!$app.testMailer.lastMessage().html.includes("test_otp_pass")) {
 			throw new Error("Expected record OTP email, got:" + JSON.stringify($app.testMailer.lastMessage()))
 		}
+
+		$mails.sendRecordAuthAlert($app, record, "test_alert_info");
+		if (!$app.testMailer.lastMessage().html.includes("test_alert_info")) {
+			throw new Error("Expected record OTP email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
 	`)
 	if vmErr != nil {
 		t.Fatal(vmErr)
@@ -962,14 +1009,47 @@ func TestFilesystemBinds(t *testing.T) {
 	}))
 	defer srv.Close()

+	tmpDir, err := os.MkdirTemp("", "jsvm")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
+
 	vm := goja.New()
 	vm.Set("mh", &multipart.FileHeader{Filename: "test"})
+	vm.Set("tmpDir", tmpDir)
 	vm.Set("testFile", filepath.Join(app.DataDir(), "data.db"))
 	vm.Set("baseURL", srv.URL)
 	baseBinds(vm)
 	filesystemBinds(vm)

-	testBindsCount(vm, "$filesystem", 4, t)
+	testBindsCount(vm, "$filesystem", 6, t)
+
+	// s3
+	{
+		v, err := vm.RunString(`$filesystem.s3("bucketName", "region", "endpoint", "accessKey", "secretKey", true)`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		fsys, ok := v.Export().(*filesystem.System)
+		if !ok {
+			t.Fatalf("[s3] Expected System instance got %v", fsys)
+		}
+	}
+
+	// local
+	{
+		v, err := vm.RunString(`$filesystem.local(tmpDir)`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		fsys, ok := v.Export().(*filesystem.System)
+		if !ok {
+			t.Fatalf("[s3] Expected System instance got %v", fsys)
+		}
+	}

 	// fileFromPath
 	{
@@ -1116,44 +1196,89 @@ func TestLoadingDynamicModel(t *testing.T) {

 	_, err := vm.RunString(`
 		let result = new DynamicModel({
-			text:        "",
-			bool:        false,
-			number:      0,
-			select_many: [],
-			json:        [],
-			// custom map-like field
-			obj: {},
+			string:          "",
+			nullString:      nullString(),
+			nullStringEmpty: nullString(),
+
+			bool:            false,
+			nullBool:        nullBool(),
+			nullBoolEmpty:   nullBool(),
+
+			int:             0,
+			nullInt:         nullInt(),
+			nullIntEmpty:    nullInt(),
+
+			float:           -0,
+			nullFloat:       nullFloat(),
+			nullFloatEmpty:  nullFloat(),
+
+			array:           [],
+			nullArray:       nullArray(),
+			nullArrayEmpty:  nullArray(),
+
+			object:          {},
+			nullObject:      nullObject(),
+			nullObjectEmpty: nullObject(),
 		})

+		const expectations = {
+			"string":          "a",
+			"nullString":      "b",
+			"nullStringEmpty": null,
+
+			"bool":          false,
+			"nullBool":      true,
+			"nullBoolEmpty": null,
+
+			"int":          1,
+			"nullInt":      2,
+			"nullIntEmpty": null,
+
+			"float":          1.1,
+			"nullFloat":      1.2,
+			"nullFloatEmpty": null,
+
+			"array":          [1,2],
+			"nullArray":      [3,4],
+			"nullArrayEmpty": null,
+
+			"object":          {a:1},
+			"nullObject":      {a:2},
+			"nullObjectEmpty": null,
+		};
+
+		// constuct dummy SELECT column value literals based on the expectations
+		const selectColumns = [];
+		for (const col in expectations) {
+			const val = expectations[col]
+
+			if (val === null) {
+				selectColumns.push("null as [[" + col + "]]")
+			} else if (typeof val === "string") {
+				selectColumns.push("'" + val + "' as [[" + col + "]]")
+			} else if (typeof val === "object") {
+				selectColumns.push("'" + JSON.stringify(val) + "' as [[" + col + "]]")
+			} else {
+				selectColumns.push(val + " as [[" + col + "]]")
+			}
+		}
+
 		$app.db()
-			.select("text", "bool", "number", "select_many", "json", "('{\"test\": 1}') as obj")
-			.from("demo1")
-			.where($dbx.hashExp({"id": "84nmscqy84lsi1t"}))
-			.limit(1)
+			.newQuery("SELECT " + selectColumns.join(", "))
 			.one(result)

-		if (result.text != "test") {
-			throw new Error('Expected text "test", got ' + result.text);
-		}
+		for (const col in expectations) {
+			let expVal = expectations[col];
+			let resVal = result[col];

-		if (result.bool != true) {
-			throw new Error('Expected bool true, got ' + result.bool);
-		}
+			if (expVal !== null && typeof expVal === "object") {
+				expVal = JSON.stringify(expVal)
+				resVal = JSON.stringify(resVal)
+			}

-		if (result.number != 123456) {
-			throw new Error('Expected number 123456, got ' + result.number);
-		}
-
-		if (result.select_many.length != 2 || result.select_many[0] != "optionB" || result.select_many[1] != "optionC") {
-			throw new Error('Expected select_many ["optionB", "optionC"], got ' + result.select_many);
-		}
-
-		if (result.json.length != 3 || result.json[0] != 1 || result.json[1] != 2 || result.json[2] != 3) {
-			throw new Error('Expected json [1, 2, 3], got ' + result.json);
-		}
-
-		if (result.obj.get("test") != 1) {
-			throw new Error('Expected obj.get("test") 1, got ' + JSON.stringify(result.obj));
+			if (expVal != resVal) {
+				throw new Error("Expected '" + col + "' value " + expVal + ", got " + resVal);
+			}
 		}
 	`)
 	if err != nil {
@@ -1741,5 +1866,5 @@ func TestOsBindsCount(t *testing.T) {
 	vm := goja.New()
 	osBinds(vm)

-	testBindsCount(vm, "$os", 18, t)
+	testBindsCount(vm, "$os", 20, t)
 }
@@ -157,8 +157,6 @@ declare var $app: PocketBase
 * ).render({"name": "John"})
 * ` + "```" + `
 *
- * _Note that this method is available only in pb_hooks context._
- *
 * @namespace
 * @group PocketBase
 */
@@ -186,14 +184,46 @@ declare function readerToString(reader: any, maxBytes?: number): string;
 * // io.Reader
 * const ex1 = toString(e.request.body)
 *
- * // slice of bytes ("hello")
- * const ex2 = toString([104 101 108 108 111])
+ * // slice of bytes
+ * const ex2 = toString([104 101 108 108 111]) // "hello"
+ *
+ * // null
+ * const ex3 = toString(null) // ""
 * ` + "```" + `
 *
 * @group PocketBase
 */
 declare function toString(val: any, maxBytes?: number): string;

+/**
+ * toBytes converts the specified value into a bytes slice.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have Go slice representation (bool, objects, etc.)
+ * are serialized to UTF8 string and its bytes slice is returned.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * // io.Reader
+ * const ex1 = toBytes(e.request.body)
+ *
+ * // string
+ * const ex2 = toBytes("hello") // [104 101 108 108 111]
+ *
+ * // object (the same as the string '{"test":1}')
+ * const ex3 = toBytes({"test":1}) // [123 34 116 101 115 116 34 58 49 125]
+ *
+ * // null
+ * const ex4 = toBytes(null) // []
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function toBytes(val: any, maxBytes?: number): Array<number>;
+
 /**
 * sleep pauses the current goroutine for at least the specified user duration (in ms).
 * A zero or negative duration returns immediately.
@@ -227,27 +257,80 @@ declare function arrayOf<T>(model: T): Array<T>;
 /**
 * DynamicModel creates a new dynamic model with fields from the provided data shape.
 *
- * Note that in order to use 0 as double/float initialization number you have to use negative zero (` + "`-0`" + `).
+ * Caveats:
+ * - In order to use 0 as double/float initialization number you have to negate it (` + "`-0`" + `).
+ * - You need to use lowerCamelCase when accessing the model fields (e.g. ` + "`model.roles`" + ` and not ` + "`model.Roles`" + ` even if in the model shape and in the DB table the column is capitalized).
+ * - Objects are loaded into types.JSONMap, meaning that they need to be accessed with ` + "`get(key)`" + ` (e.g. ` + "`model.meta.get('something')`" + `).
+ * - For describing nullable types you can use the ` + "`null*()`" + ` helpers - ` + "`nullString()`" + `, ` + "`nullInt()`" + `, ` + "`nullFloat()`" + `, ` + "`nullBool()`" + `, ` + "`nullArray()`" + `, ` + "`nullObject()`" + `.
 *
 * Example:
 *
 * ` + "```" + `js
 * const model = new DynamicModel({
- *     name:       ""
- *     age:        0,  // int64
- *     totalSpent: -0, // float64
- *     active:     false,
- *     roles:      [],
- *     meta:       {}
+ *     name:       ""     // or nullString() if nullable
+ *     age:        0,     // or nullInt() if nullable
+ *     totalSpent: -0,    // or nullFloat() if nullable
+ *     active:     false, // or nullBool() if nullable
+ *     Roles:      [],    // or nullArray() if nullable; maps to "Roles" in the DB/JSON but the prop would be accessible via "model.roles"
+ *     meta:       {},    // or nullObject() if nullable
 * })
 * ` + "```" + `
 *
 * @group PocketBase
 */
 declare class DynamicModel {
+  [key: string]: any;
  constructor(shape?: { [key:string]: any })
 }

+/**
+ * nullString creates an empty Go string pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` string value.
+ *
+ * @group PocketBase
+ */
+declare function nullString(): string;
+
+/**
+ * nullInt creates an empty Go int64 pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` int value.
+ *
+ * @group PocketBase
+ */
+declare function nullInt(): number;
+
+/**
+ * nullFloat creates an empty Go float64 pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` float value.
+ *
+ * @group PocketBase
+ */
+declare function nullFloat(): number;
+
+/**
+ * nullBool creates an empty Go bool pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` bool value.
+ *
+ * @group PocketBase
+ */
+declare function nullBool(): boolean;
+
+/**
+ * nullArray creates an empty Go types.JSONArray pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` JSON array value.
+ *
+ * @group PocketBase
+ */
+declare function nullArray(): Array<any>;
+
+/**
+ * nullObject creates an empty Go types.JSONMap pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` JSON object value.
+ *
+ * @group PocketBase
+ */
+declare function nullObject(): { get(key:string):any; set(key:string,value:any):void };
+
 interface Context extends context.Context{} // merge
 /**
 * Context creates a new empty Go context.Context.
@@ -756,6 +839,7 @@ declare namespace $mails {
  let sendRecordVerification:  mails.sendRecordVerification
  let sendRecordChangeEmail:   mails.sendRecordChangeEmail
  let sendRecordOTP:           mails.sendRecordOTP
+  let sendRecordAuthAlert:     mails.sendRecordAuthAlert
 }

 // -------------------------------------------------------------------
@@ -786,17 +870,17 @@ declare namespace $security {
  /**
   * {@inheritDoc security.newJWT}
   */
-  export function createJWT(payload: { [key:string]: any }, signingKey: string, secDuration: number): string
+  function createJWT(payload: { [key:string]: any }, signingKey: string, secDuration: number): string

  /**
   * {@inheritDoc security.parseUnverifiedJWT}
   */
-  export function parseUnverifiedJWT(token: string): _TygojaDict
+  function parseUnverifiedJWT(token: string): _TygojaDict

  /**
   * {@inheritDoc security.parseJWT}
   */
-  export function parseJWT(token: string, verificationKey: string): _TygojaDict
+  function parseJWT(token: string, verificationKey: string): _TygojaDict
 }

 // -------------------------------------------------------------------
@@ -814,6 +898,24 @@ declare namespace $filesystem {
  let fileFromBytes:     filesystem.newFileFromBytes
  let fileFromMultipart: filesystem.newFileFromMultipart

+  /**
+   * Initializes a new S3-only filesystem instance
+   * (make sure to call ` + "`" + `close()` + "`" + ` after you are done working with it).
+   *
+   * Most users should prefer ` + "`" + `$app.newFilesystem()` + "`" + ` which will
+   * construct a local or S3 filesystem based on the configured application settings.
+   */
+  let s3: filesystem.newS3
+
+  /**
+   * Initializes a new local-only filesystem instance
+   * (make sure to call ` + "`" + `close()` + "`" + ` after you are done working with it).
+   *
+   * Most users should prefer ` + "`" + `$app.newFilesystem()` + "`" + ` which will
+   * construct a local or S3 filesystem based on the configured application settings.
+   */
+  let local: filesystem.newLocal
+
  /**
   * fileFromURL creates a new File from the provided url by
   * downloading the resource and creating a BytesReader.
@@ -828,7 +930,7 @@ declare namespace $filesystem {
   * const file2 = $filesystem.fileFromURL("https://...", 15)
   * ` + "```" + `
   */
-  export function fileFromURL(url: string, secTimeout?: number): filesystem.File
+  function fileFromURL(url: string, secTimeout?: number): filesystem.File
 }

 // -------------------------------------------------------------------
@@ -842,21 +944,21 @@ declare namespace $filesystem {
 * @group PocketBase
 */
 declare namespace $filepath {
-  export let base:      filepath.base
-  export let clean:     filepath.clean
-  export let dir:       filepath.dir
-  export let ext:       filepath.ext
-  export let fromSlash: filepath.fromSlash
-  export let glob:      filepath.glob
-  export let isAbs:     filepath.isAbs
-  export let join:      filepath.join
-  export let match:     filepath.match
-  export let rel:       filepath.rel
-  export let split:     filepath.split
-  export let splitList: filepath.splitList
-  export let toSlash:   filepath.toSlash
-  export let walk:      filepath.walk
-  export let walkDir:   filepath.walkDir
+  let base:      filepath.base
+  let clean:     filepath.clean
+  let dir:       filepath.dir
+  let ext:       filepath.ext
+  let fromSlash: filepath.fromSlash
+  let glob:      filepath.glob
+  let isAbs:     filepath.isAbs
+  let join:      filepath.join
+  let match:     filepath.match
+  let rel:       filepath.rel
+  let split:     filepath.split
+  let splitList: filepath.splitList
+  let toSlash:   filepath.toSlash
+  let walk:      filepath.walk
+  let walkDir:   filepath.walkDir
 }

 // -------------------------------------------------------------------
@@ -873,7 +975,7 @@ declare namespace $os {
  /**
   * Legacy alias for $os.cmd().
   */
-  export let exec: exec.command
+  let exec: exec.command

  /**
   * Prepares an external OS command.
@@ -888,28 +990,30 @@ declare namespace $os {
   * const output = toString(cmd.output());
   * ` + "```" + `
   */
-  export let cmd: exec.command
+  let cmd: exec.command

  /**
   * Args hold the command-line arguments, starting with the program name.
   */
-  export let args: Array<string>
+  let args: Array<string>

-  export let exit:      os.exit
-  export let getenv:    os.getenv
-  export let dirFS:     os.dirFS
-  export let readFile:  os.readFile
-  export let writeFile: os.writeFile
-  export let stat:      os.stat
-  export let readDir:   os.readDir
-  export let tempDir:   os.tempDir
-  export let truncate:  os.truncate
-  export let getwd:     os.getwd
-  export let mkdir:     os.mkdir
-  export let mkdirAll:  os.mkdirAll
-  export let rename:    os.rename
-  export let remove:    os.remove
-  export let removeAll: os.removeAll
+  let exit:       os.exit
+  let getenv:     os.getenv
+  let dirFS:      os.dirFS
+  let readFile:   os.readFile
+  let writeFile:  os.writeFile
+  let stat:       os.stat
+  let readDir:    os.readDir
+  let tempDir:    os.tempDir
+  let truncate:   os.truncate
+  let getwd:      os.getwd
+  let mkdir:      os.mkdir
+  let mkdirAll:   os.mkdirAll
+  let rename:     os.rename
+  let remove:     os.remove
+  let removeAll:  os.removeAll
+  let openRoot:   os.openRoot
+  let openInRoot: os.openInRoot
 }

 // -------------------------------------------------------------------
@@ -1038,7 +1142,7 @@ declare namespace $apis {
   * If a file resource is missing and indexFallback is set, the request
   * will be forwarded to the base index.html (useful for SPA).
   */
-  export function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void
+  function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void

  let requireGuestOnly:              apis.requireGuestOnly
  let requireAuth:                   apis.requireAuth
@@ -1060,7 +1164,7 @@ declare namespace $apis {
   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
   * (can be also adjusted additionally via the onRecordAuthRequest hook).
   */
-  export function recordAuthResponse(e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta?: any): void
+  function recordAuthResponse(e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta?: any): void
 }

 // -------------------------------------------------------------------
@@ -184,7 +184,13 @@ func (p *plugin) registerMigrations() error {
 		return err
 	}

+	absHooksDir, err := filepath.Abs(p.config.HooksDir)
+	if err != nil {
+		return err
+	}
+
 	registry := new(require.Registry) // this can be shared by multiple runtimes
+	templateRegistry := template.NewRegistry()

 	for file, content := range files {
 		vm := goja.New()
@@ -200,6 +206,12 @@ func (p *plugin) registerMigrations() error {
 		osBinds(vm)
 		filepathBinds(vm)
 		httpClientBinds(vm)
+		filesystemBinds(vm)
+		formsBinds(vm)
+		mailsBinds(vm)
+
+		vm.Set("$template", templateRegistry)
+		vm.Set("__hooks", absHooksDir)

 		vm.Set("migrate", func(up, down func(txApp core.App) error) {
 			core.AppMigrations.Register(up, down, file)
@@ -365,7 +377,7 @@ func (p *plugin) watchHooks() error {
 	if hooksDirInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
 		watchDir, err = filepath.EvalSymlinks(p.config.HooksDir)
 		if err != nil {
-			return fmt.Errorf("failed to resolve hooksDir symink: %w", err)
+			return fmt.Errorf("failed to resolve hooksDir symlink: %w", err)
 		}
 	}

@@ -29,7 +29,7 @@ migrate((app) => {
  const collection = new Collection({
    "authAlert": {
      "emailTemplate": {
-        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
        "subject": "Login from a new location"
      },
      "enabled": true
@@ -205,7 +205,7 @@ func init() {
 		jsonData := ` + "`" + `{
 			"authAlert": {
 				"emailTemplate": {
-					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
 					"subject": "Login from a new location"
 				},
 				"enabled": true
@@ -470,7 +470,7 @@ migrate((app) => {
  const collection = new Collection({
    "authAlert": {
      "emailTemplate": {
-        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
        "subject": "Login from a new location"
      },
      "enabled": true
@@ -649,7 +649,7 @@ func init() {
 		jsonData := ` + "`" + `{
 			"authAlert": {
 				"emailTemplate": {
-					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
 					"subject": "Login from a new location"
 				},
 				"enabled": true
@@ -14,6 +14,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/osutils"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/spf13/cobra"

@@ -204,6 +205,8 @@ func (pb *PocketBase) Execute() error {
 	<-done

 	// trigger cleanups
+	//
+	// @todo consider skipping and just call the finalizer in case OnTerminate was already invoked manually?
 	event := new(core.TerminateEvent)
 	event.App = pb
 	return pb.OnTerminate().Trigger(event, func(e *core.TerminateEvent) error {
@@ -293,7 +296,7 @@ func (pb *PocketBase) skipBootstrap() bool {
 // note: we are using os.Args[0] and not os.Executable() since it could
 // break existing aliased binaries (eg. the community maintained homebrew package)
 func inspectRuntime() (baseDir string, withGoRun bool) {
-	if strings.HasPrefix(os.Args[0], os.TempDir()) {
+	if osutils.IsProbablyGoRun() {
 		// probably ran with go run
 		withGoRun = true
 		baseDir, _ = os.Getwd()
@@ -48,6 +48,14 @@ type ApiScenario struct {
 	// A zero or negative value means that there will be no timeout.
 	Timeout time.Duration

+	// DisableTestAppCleanup disables the builtin TestApp cleanup at
+	// the end of the ApiScenario execution.
+	//
+	// This option works only when explicit TestAppFactory is specified
+	// and means that the developer is responsible to do the necessary
+	// after test cleanup on their own (e.g. by manually calling testApp.Cleanup()).
+	DisableTestAppCleanup bool
+
 	// expectations
 	// ---------------------------------------------------------------

@@ -75,7 +83,7 @@ type ApiScenario struct {
 	//
 	//	map[string]int{ "*": 0 } // no hook events were fired
 	//	map[string]int{ "*": 0, "EventA": 2 } // no hook events, except EventA were fired
-	//	map[string]int{ EventA": 2, "EventB": 0 } // ensures that EventA was fired exactly 2 times and EventB exactly 0 times.
+	//	map[string]int{ "EventA": 2, "EventB": 0 } // ensures that EventA was fired exactly 2 times and EventB exactly 0 times.
 	ExpectedEvents map[string]int

 	// test hooks
@@ -172,7 +180,11 @@ func (scenario *ApiScenario) test(t testing.TB) {
 			t.Fatalf("Failed to initialize the test app instance: %v", testAppErr)
 		}
 	}
-	defer testApp.Cleanup()
+
+	// https://github.com/pocketbase/pocketbase/discussions/7267
+	if scenario.TestAppFactory == nil || !scenario.DisableTestAppCleanup {
+		defer testApp.Cleanup()
+	}

 	baseRouter, err := apis.NewRouter(testApp)
 	if err != nil {
@@ -220,7 +232,8 @@ func (scenario *ApiScenario) test(t testing.TB) {

 		// set scenario headers
 		for k, v := range scenario.Headers {
-			req.Header.Set(k, v)
+			// trim whitespaces for consistency with the net/http request parsing
+			req.Header.Set(k, strings.TrimSpace(v))
 		}

 		// execute request
@@ -147,6 +147,7 @@ func NewTestAppWithConfig(config core.BaseAppConfig) (*TestApp, error) {
 	t.OnServe().Bind(&hook.Handler[*core.ServeEvent]{
 		Func: func(e *core.ServeEvent) error {
 			t.registerEventCall("OnServe")
+			e.InstallerFunc = nil // https://github.com/pocketbase/pocketbase/discussions/7202
 			return e.Next()
 		},
 		Priority: -99999,
@@ -0,0 +1 @@
+test
@@ -4,9 +4,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strings"
+	"fmt"

 	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
 	"golang.org/x/oauth2"
@@ -23,7 +24,7 @@ const NameApple string = "apple"

 // Apple allows authentication via Apple OAuth2.
 //
-// [OIDC differences]: https://bitbucket.org/openid/connect/src/master/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md
+// OIDC differences: https://bitbucket.org/openid/connect/src/master/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md.
 type Apple struct {
 	BaseProvider

@@ -47,7 +48,7 @@ func NewAppleProvider() *Apple {

 // FetchAuthUser returns an AuthUser instance based on the provided token.
 //
-// API reference: https://developer.apple.com/documentation/sign_in_with_apple/tokenresponse.
+// API reference: https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple#Retrieve-the-users-information-from-Apple-ID-servers.
 func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	data, err := p.FetchRawUserInfo(token)
 	if err != nil {
@@ -60,16 +61,13 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	}

 	extracted := struct {
-		Id            string `json:"sub"`
-		Name          string `json:"name"`
-		Email         string `json:"email"`
 		EmailVerified any    `json:"email_verified"` // could be string or bool
-		User          struct {
-			Name struct {
-				FirstName string `json:"firstName"`
-				LastName  string `json:"lastName"`
-			} `json:"name"`
-		} `json:"user"`
+		Email         string `json:"email"`
+		Id            string `json:"sub"`
+
+		// not returned at the time of writing and it is usually
+		// manually populated in apis.recordAuthWithOAuth2
+		Name string `json:"name"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
 		return nil, err
@@ -89,17 +87,13 @@ func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		user.Email = extracted.Email
 	}

-	if user.Name == "" {
-		user.Name = strings.TrimSpace(extracted.User.Name.FirstName + " " + extracted.User.Name.LastName)
-	}
-
 	return user, nil
 }

 // FetchRawUserInfo implements Provider.FetchRawUserInfo interface.
 //
-// Apple doesn't have a UserInfo endpoint and claims about users
-// are instead included in the "id_token" (https://openid.net/specs/openid-connect-core-1_0.html#id_tokenExample)
+// Note that Apple doesn't have a UserInfo endpoint and claims about
+// the users are included in the id_token (without the name - see #7090).
 func (p *Apple) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
 	idToken, _ := token.Extra("id_token").(string)

@@ -108,18 +102,6 @@ func (p *Apple) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
 		return nil, err
 	}

-	// Apple only returns the user object the first time the user authorizes the app
-	// https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292
-	rawUser, _ := token.Extra("user").(string)
-	if rawUser != "" {
-		user := map[string]any{}
-		err = json.Unmarshal([]byte(rawUser), &user)
-		if err != nil {
-			return nil, err
-		}
-		claims["user"] = user
-	}
-
 	return json.Marshal(claims)
 }

@@ -128,10 +110,10 @@ func (p *Apple) parseAndVerifyIdToken(idToken string) (jwt.MapClaims, error) {
 		return nil, errors.New("empty id_token")
 	}

-	// extract the token header params and claims
+	// extract the token claims
 	// ---
 	claims := jwt.MapClaims{}
-	t, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
+	_, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
 	if err != nil {
 		return nil, err
 	}
@@ -156,10 +138,9 @@ func (p *Apple) parseAndVerifyIdToken(idToken string) (jwt.MapClaims, error) {
 	// the token which is a result of direct TLS communication with the provider
 	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
 	// ---
-	kid, _ := t.Header["kid"].(string)
-	err = validateIdTokenSignature(p.ctx, idToken, p.jwksURL, kid)
+	err = jwk.ValidateTokenSignature(p.ctx, idToken, p.jwksURL)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("id_token validation failed: %w", err)
 	}

 	return claims, nil
@@ -7,7 +7,7 @@ import (
 )

 func TestProvidersCount(t *testing.T) {
-	expected := 30
+	expected := 32

 	if total := len(auth.Providers); total != expected {
 		t.Fatalf("Expected %d providers, got %d", expected, total)
@@ -279,6 +279,15 @@ func TestNewProviderByName(t *testing.T) {
 		t.Error("Expected to be instance of *auth.Wakatime")
 	}

+	// box
+	p, err = auth.NewProviderByName(auth.NameBox)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Box); !ok {
+		t.Error("Expected to be instance of *auth.Box")
+	}
+
 	// linear
 	p, err = auth.NewProviderByName(auth.NameLinear)
 	if err != nil {
@@ -296,4 +305,13 @@ func TestNewProviderByName(t *testing.T) {
 	if _, ok := p.(*auth.Trakt); !ok {
 		t.Error("Expected to be instance of *auth.Trakt")
 	}
+
+	// lark
+	p, err = auth.NewProviderByName(auth.NameLark)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Lark); !ok {
+		t.Error("Expected to be instance of *auth.Lark")
+	}
 }
@@ -0,0 +1,81 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameBox] = wrapFactory(NewBoxProvider)
+}
+
+var _ Provider = (*Box)(nil)
+
+// NameBox is the unique name of the Box provider.
+const NameBox = "box"
+
+// Box is an auth provider for Box.
+type Box struct {
+	BaseProvider
+}
+
+// NewBoxProvider creates a new Box provider instance with some defaults.
+func NewBoxProvider() *Box {
+	return &Box{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Box",
+		pkce:        true,
+		scopes:      []string{"root_readonly"},
+		authURL:     "https://account.box.com/api/oauth2/authorize",
+		tokenURL:    "https://api.box.com/oauth2/token",
+		userInfoURL: "https://api.box.com/2.0/users/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Box's user API.
+//
+// API reference: https://developer.box.com/reference/get-users-me/
+func (p *Box) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id        string `json:"id"`
+		Name      string `json:"name"`
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+		Status    string `json:"status"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if extracted.Status != "active" {
+		return nil, fmt.Errorf("Box user account is not active (status: %q)", extracted.Status)
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		AvatarURL:    extracted.AvatarURL,
+		Email:        extracted.Login, // Box requires verified email for OAuth authorization
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
@@ -0,0 +1,163 @@
+// Package jwk implements some common utilities for interacting with JWKs
+// (mostly used with OIDC providers).
+package jwk
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math/big"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type JWK struct {
+	Kty string `json:"kty"`
+	Kid string `json:"kid"`
+	Use string `json:"use"`
+	Alg string `json:"alg"`
+	// RS256 (RSA)
+	E string `json:"e"`
+	N string `json:"n"`
+	// Ed25519 (OKP)
+	Crv string `json:"crv"`
+	X   string `json:"x"`
+}
+
+// PublicKey reconstructs and returns the public key from the current JWK.
+func (key *JWK) PublicKey() (any, error) {
+	switch key.Kty {
+	case "RSA":
+		// RFC 7518
+		// https://datatracker.ietf.org/doc/html/rfc7518#section-6.3
+		// https://datatracker.ietf.org/doc/html/rfc7517#appendix-A.1
+		exponent, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.E, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		modulus, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.N, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		return &rsa.PublicKey{
+			E: int(big.NewInt(0).SetBytes(exponent).Uint64()),
+			N: big.NewInt(0).SetBytes(modulus),
+		}, nil
+	case "OKP":
+		// RFC 8037
+		// https://datatracker.ietf.org/doc/html/rfc8037#section-2
+		// https://datatracker.ietf.org/doc/html/rfc8037#appendix-A
+		if key.Crv != "Ed25519" {
+			return nil, fmt.Errorf("unsupported OKP curve (must be Ed25519): %q", key.Crv)
+		}
+
+		x, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.X, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		if l := len(x); l != ed25519.PublicKeySize {
+			return nil, fmt.Errorf("invalid Ed25519 key length: %d", l)
+		}
+
+		return ed25519.PublicKey(x), nil
+	default:
+		return nil, fmt.Errorf("unsupported kty (must be RSA or OKP): %q", key.Kty)
+	}
+}
+
+// Fetch retrieves the JSON Web Key Set located at jwksURL and returns
+// the first key that matches the specified kid.
+func Fetch(ctx context.Context, jwksURL string, kid string) (*JWK, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", jwksURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	rawBody, err := io.ReadAll(res.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	// http.Client.Get doesn't treat non 2xx responses as error
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf(
+			"failed to fetch JSON Web Key Set from %s (%d):\n%s",
+			jwksURL,
+			res.StatusCode,
+			string(rawBody),
+		)
+	}
+
+	jwks := struct {
+		Keys []*JWK
+	}{}
+
+	err = json.Unmarshal(rawBody, &jwks)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, key := range jwks.Keys {
+		if key.Kid == kid {
+			return key, nil
+		}
+	}
+
+	return nil, fmt.Errorf("JWK with kid %q was not found", kid)
+}
+
+// ValidateTokenSignature validates the signature of a token with the
+// public key retrievied from a remote JWKS.
+func ValidateTokenSignature(ctx context.Context, token string, jwksURL string) error {
+	// extract the kid token header
+	// ---
+	t, _, err := jwt.NewParser().ParseUnverified(token, jwt.MapClaims{})
+	if err != nil {
+		return err
+	}
+
+	kid, _ := t.Header["kid"].(string)
+	if kid == "" {
+		return errors.New("missing kid header value")
+	}
+
+	// fetch the public key set
+	// ---
+	key, err := Fetch(ctx, jwksURL, kid)
+	if err != nil {
+		return err
+	}
+
+	// verify the signature
+	// ---
+	parser := jwt.NewParser(jwt.WithValidMethods([]string{key.Alg}))
+
+	parsedToken, err := parser.Parse(token, func(t *jwt.Token) (any, error) {
+		return key.PublicKey()
+	})
+	if err != nil {
+		return err
+	}
+
+	if !parsedToken.Valid {
+		return errors.New("the parsed token is invalid")
+	}
+
+	return nil
+}
@@ -0,0 +1,314 @@
+package jwk_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
+)
+
+type publicKey interface {
+	Equal(x crypto.PublicKey) bool
+}
+
+func TestJWK_PublicKey(t *testing.T) {
+	t.Parallel()
+
+	rsaPrivate, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		key         *jwk.JWK
+		expectError bool
+		expectKey   crypto.PublicKey
+	}{
+		{
+			"empty",
+			&jwk.JWK{},
+			true,
+			nil,
+		},
+		{
+			"invalid kty",
+			&jwk.JWK{
+				Kty: "invalid",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+			true,
+			nil,
+		},
+		{
+			"RSA",
+			&jwk.JWK{
+				Kty: "RSA",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+			false,
+			&rsaPrivate.PublicKey,
+		},
+		{
+			"OKP with unsupported curve",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "invalid",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+			},
+			true,
+			nil,
+		},
+		{
+			"OKP with invalid public key length",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize-1))),
+			},
+			true,
+			nil,
+		},
+		{
+			"valid OKP",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+			},
+			false,
+			ed25519.PublicKey([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := s.key.PublicKey()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr && result == nil {
+				return
+			}
+
+			k, ok := result.(publicKey)
+			if !ok {
+				t.Fatalf("The returned public key %T doesn't satisfy the expected common interface", k)
+			}
+
+			if !k.Equal(s.expectKey) {
+				t.Fatalf("The returned public key doesn't match with the expected one:\n%v\n%v", k, s.expectKey)
+			}
+		})
+	}
+}
+
+func TestFetch(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		if req.URL.Query().Has("error") {
+			res.WriteHeader(http.StatusBadRequest)
+		}
+
+		fmt.Fprintf(res, `{
+			"keys": [
+				{
+					"kid": "abc",
+					"kty": "OKP",
+					"crv": "Ed25519",
+					"x":   "test_x"
+				},
+				{
+					"kid": "def",
+					"kty": "RSA",
+					"alg": "RS256",
+					"n":   "test_n",
+					"e":   "test_e"
+				}
+			]
+		}`)
+	}))
+	defer server.Close()
+
+	scenarios := []struct {
+		name        string
+		kid         string
+		expectError bool
+		contains    []string
+	}{
+		{
+			"error response",
+			"def",
+			true,
+			nil,
+		},
+		{
+			"non-matching kid",
+			"missing",
+			true,
+			nil,
+		},
+		{
+			"matching kid",
+			"def",
+			false,
+			[]string{
+				`"kid":"def"`,
+				`"kty":"RSA"`,
+				`"alg":"RS256"`,
+				`"n":"test_n"`,
+				`"e":"test_e"`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			url := server.URL
+			if s.expectError {
+				url += "?error"
+			}
+
+			key, err := jwk.Fetch(context.Background(), url, s.kid)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			raw, err := json.Marshal(key)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			for _, substr := range s.contains {
+				if !strings.Contains(rawStr, substr) {
+					t.Fatalf("Missing expected substring\n%s\nin\n%s", substr, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTokenSignature(t *testing.T) {
+	t.Parallel()
+
+	rsaPrivate, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ed25519Public, ed25519Private, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	nonmatchingKidToken := jwt.New(&jwt.SigningMethodEd25519{})
+	nonmatchingKidToken.Header["kid"] = "missing"
+	nonmatchingKidTokenStr, err := nonmatchingKidToken.SignedString(ed25519Private)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key1Token := jwt.New(&jwt.SigningMethodEd25519{})
+	key1Token.Header["kid"] = "key1"
+	key1TokenStr, err := key1Token.SignedString(ed25519Private)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key2Token := jwt.New(jwt.SigningMethodRS256)
+	key2Token.Header["kid"] = "key2"
+	key2TokenStr, err := key2Token.SignedString(rsaPrivate)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		_ = json.NewEncoder(res).Encode(map[string]any{"keys": []*jwk.JWK{
+			{
+				Kid: "key1",
+				Kty: "OKP",
+				Alg: "EdDSA",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString(ed25519Public),
+			},
+			{
+				Kid: "key2",
+				Kty: "RSA",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+		}})
+	}))
+	defer server.Close()
+
+	scenarios := []struct {
+		name        string
+		token       string
+		expectError bool
+	}{
+		{
+			"empty token",
+			"",
+			true,
+		},
+		{
+			"invlaid token",
+			"abc",
+			true,
+		},
+		{
+			"no matching kid",
+			nonmatchingKidTokenStr,
+			true,
+		},
+		{
+			"valid Ed25519 token",
+			key1TokenStr,
+			false,
+		},
+		{
+			"valid RSA token",
+			key2TokenStr,
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := jwk.ValidateTokenSignature(
+				context.Background(),
+				s.token,
+				server.URL,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameLark] = wrapFactory(NewLarkProvider)
+}
+
+var _ Provider = (*Lark)(nil)
+
+// NameLark is the unique name of the Lark provider.
+const NameLark string = "lark"
+
+// Lark allows authentication via Lark OAuth2.
+type Lark struct {
+	BaseProvider
+}
+
+// NewLarkProvider creates new Lark provider instance with some defaults.
+func NewLarkProvider() *Lark {
+	return &Lark{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Lark",
+		pkce:        true,
+		// Lark has two domains with the same API: feishu.cn and larksuite.com.
+		// The former is used in China and the latter is used in the other regions.
+		// We choose feishu.cn as a default, matching the behavior of Lark's official SDK.
+		// Endpoint URLs can be overridden from the frontend if needed.
+		// SDK Reference: https://github.com/larksuite/oapi-sdk-go
+		authURL:     "https://accounts.feishu.cn/open-apis/authen/v1/authorize",
+		tokenURL:    "https://open.feishu.cn/open-apis/authen/v2/oauth/token",
+		userInfoURL: "https://open.feishu.cn/open-apis/authen/v1/user_info",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Lark's user api.
+//
+// API reference: https://open.feishu.cn/document/server-docs/authentication-management/login-state-management/get
+func (p *Lark) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			// https://open.feishu.cn/document/platform-overveiw/basic-concepts/user-identity-introduction/introduction#3f2d4b63
+			UnionId   string `json:"union_id"`
+			Name      string `json:"name"`
+			AvatarURL string `json:"avatar_url"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.UnionId,
+		Name:         extracted.Data.Name,
+		AvatarURL:    extracted.Data.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
@@ -2,20 +2,15 @@ package auth

 import (
 	"context"
-	"crypto/rsa"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
-	"math/big"
-	"net/http"
 	"os"
 	"strconv"
-	"strings"
 	"time"

 	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/spf13/cast"
@@ -140,7 +135,7 @@ func (p *OIDC) parseIdToken(token *oauth2.Token) (jwt.MapClaims, error) {
 	}

 	claims := jwt.MapClaims{}
-	t, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
+	_, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
 	if err != nil {
 		return nil, err
 	}
@@ -181,112 +176,11 @@ func (p *OIDC) parseIdToken(token *oauth2.Token) (jwt.MapClaims, error) {
 	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
 	jwksURL := cast.ToString(p.Extra()["jwksURL"])
 	if jwksURL != "" {
-		kid, _ := t.Header["kid"].(string)
-		err = validateIdTokenSignature(p.ctx, idToken, jwksURL, kid)
+		err = jwk.ValidateTokenSignature(p.ctx, idToken, jwksURL)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("id_token validation failed: %w", err)
 		}
 	}

 	return claims, nil
 }
-
-func validateIdTokenSignature(ctx context.Context, idToken string, jwksURL string, kid string) error {
-	// fetch the public key set
-	// ---
-	if kid == "" {
-		return errors.New("missing kid header value")
-	}
-
-	key, err := fetchJWK(ctx, jwksURL, kid)
-	if err != nil {
-		return err
-	}
-
-	// decode the key params per RFC 7518 (https://tools.ietf.org/html/rfc7518#section-6.3)
-	// and construct a valid publicKey from them
-	// ---
-	exponent, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.E, "="))
-	if err != nil {
-		return err
-	}
-
-	modulus, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.N, "="))
-	if err != nil {
-		return err
-	}
-
-	publicKey := &rsa.PublicKey{
-		// https://tools.ietf.org/html/rfc7517#appendix-A.1
-		E: int(big.NewInt(0).SetBytes(exponent).Uint64()),
-		N: big.NewInt(0).SetBytes(modulus),
-	}
-
-	// verify the signiture
-	// ---
-	parser := jwt.NewParser(jwt.WithValidMethods([]string{key.Alg}))
-
-	parsedToken, err := parser.Parse(idToken, func(t *jwt.Token) (any, error) {
-		return publicKey, nil
-	})
-	if err != nil {
-		return err
-	}
-
-	if !parsedToken.Valid {
-		return errors.New("the parsed id_token is invalid")
-	}
-
-	return nil
-}
-
-type jwk struct {
-	Kty string
-	Kid string
-	Use string
-	Alg string
-	N   string
-	E   string
-}
-
-func fetchJWK(ctx context.Context, jwksURL string, kid string) (*jwk, error) {
-	req, err := http.NewRequestWithContext(ctx, "GET", jwksURL, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	res, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer res.Body.Close()
-
-	rawBody, err := io.ReadAll(res.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	// http.Client.Get doesn't treat non 2xx responses as error
-	if res.StatusCode >= 400 {
-		return nil, fmt.Errorf(
-			"failed to verify the provided id_token (%d):\n%s",
-			res.StatusCode,
-			string(rawBody),
-		)
-	}
-
-	jwks := struct {
-		Keys []*jwk
-	}{}
-	if err := json.Unmarshal(rawBody, &jwks); err != nil {
-		return nil, err
-	}
-
-	for _, key := range jwks.Keys {
-		if key.Kid == kid {
-			return key, nil
-		}
-	}
-
-	return nil, fmt.Errorf("jwk with kid %q was not found", kid)
-}
@@ -26,24 +26,25 @@ type Twitter struct {
 func NewTwitterProvider() *Twitter {
 	return &Twitter{BaseProvider{
 		ctx:         context.Background(),
-		displayName: "Twitter",
+		displayName: "X/Twitter",
 		pkce:        true,
 		scopes: []string{
 			"users.read",
+			"users.email",

-			// we don't actually use this scope, but for some reason it is required by the `/2/users/me` endpoint
-			// (see https://developer.twitter.com/en/docs/twitter-api/users/lookup/api-reference/get-users-me)
+			// we don't actually use this scope, but for some reason the `/2/users/me` endpoint fails with 403 without it
+			// (see https://docs.x.com/fundamentals/authentication/guides/v2-authentication-mapping#x-api-v2-authentication-mapping)
 			"tweet.read",
 		},
-		authURL:     "https://twitter.com/i/oauth2/authorize",
-		tokenURL:    "https://api.twitter.com/2/oauth2/token",
-		userInfoURL: "https://api.twitter.com/2/users/me?user.fields=id,name,username,profile_image_url",
+		authURL:     "https://x.com/i/oauth2/authorize",
+		tokenURL:    "https://api.x.com/2/oauth2/token",
+		userInfoURL: "https://api.x.com/2/users/me?user.fields=id,name,username,profile_image_url,confirmed_email",
 	}}
 }

 // FetchAuthUser returns an AuthUser instance based on the Twitter's user api.
 //
-// API reference: https://developer.twitter.com/en/docs/twitter-api/users/lookup/api-reference/get-users-me
+// API reference: https://docs.x.com/x-api/users/user-lookup-me
 func (p *Twitter) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 	data, err := p.FetchRawUserInfo(token)
 	if err != nil {
@@ -60,11 +61,8 @@ func (p *Twitter) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 			Id              string `json:"id"`
 			Name            string `json:"name"`
 			Username        string `json:"username"`
+			Email           string `json:"confirmed_email"`
 			ProfileImageURL string `json:"profile_image_url"`
-
-			// NB! At the time of writing, Twitter OAuth2 doesn't support returning the user email address
-			// (see https://twittercommunity.com/t/which-api-to-get-user-after-oauth2-authorization/162417/33)
-			// Email string `json:"email"`
 		} `json:"data"`
 	}{}
 	if err := json.Unmarshal(data, &extracted); err != nil {
@@ -75,6 +73,7 @@ func (p *Twitter) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
 		Id:           extracted.Data.Id,
 		Name:         extracted.Data.Name,
 		Username:     extracted.Data.Username,
+		Email:        extracted.Data.Email,
 		AvatarURL:    extracted.Data.ProfileImageURL,
 		RawUser:      rawUser,
 		AccessToken:  token.AccessToken,
@@ -3,6 +3,7 @@ package cron
 import (
 	"encoding/json"
 	"slices"
+	"sync"
 	"testing"
 	"time"
 )
@@ -253,53 +254,63 @@ func TestCronJobs(t *testing.T) {
 func TestCronStartStop(t *testing.T) {
 	t.Parallel()

+	var mu sync.Mutex
+
 	test1 := 0
 	test2 := 0

 	c := New()

-	c.SetInterval(500 * time.Millisecond)
+	c.SetInterval(250 * time.Millisecond)

 	c.Add("test1", "* * * * *", func() {
+		mu.Lock()
+		defer mu.Unlock()
 		test1++
 	})

 	c.Add("test2", "* * * * *", func() {
+		mu.Lock()
+		defer mu.Unlock()
 		test2++
 	})

-	expectedCalls := 2
-
 	// call twice Start to check if the previous ticker will be reseted
 	c.Start()
 	c.Start()

-	time.Sleep(1 * time.Second)
+	time.Sleep(505 * time.Millisecond) // slightly larger to minimize flakiness

 	// call twice Stop to ensure that the second stop is no-op
 	c.Stop()
 	c.Stop()

+	expectedCalls := 2
+
+	mu.Lock()
 	if test1 != expectedCalls {
 		t.Fatalf("Expected %d test1, got %d", expectedCalls, test1)
 	}
 	if test2 != expectedCalls {
 		t.Fatalf("Expected %d test2, got %d", expectedCalls, test2)
 	}
+	mu.Unlock()

-	// resume for 2 seconds
+	// resume for 1 seconds
 	c.Start()

-	time.Sleep(2 * time.Second)
+	time.Sleep(1005 * time.Millisecond) // slightly larger to minimize flakiness

 	c.Stop()

 	expectedCalls += 4

+	mu.Lock()
 	if test1 != expectedCalls {
 		t.Fatalf("Expected %d test1, got %d", expectedCalls, test1)
 	}
 	if test2 != expectedCalls {
 		t.Fatalf("Expected %d test2, got %d", expectedCalls, test2)
 	}
+	mu.Unlock()
 }
@@ -9,7 +9,7 @@ import (
 // some normalizations for non-json columns.
 func JSONEach(column string) string {
 	// note: we are not using the new and shorter "if(x,y)" syntax for
-	// compatability with custom drivers that use older SQLite version
+	// compatibility with custom drivers that use older SQLite version
 	return fmt.Sprintf(
 		`json_each(CASE WHEN iif(json_valid([[%s]]), json_type([[%s]])='array', FALSE) THEN [[%s]] ELSE json_array([[%s]]) END)`,
 		column, column, column, column,
@@ -24,7 +24,7 @@ func JSONEach(column string) string {
 // Returns 0 for empty string or NULL column values.
 func JSONArrayLength(column string) string {
 	// note: we are not using the new and shorter "if(x,y)" syntax for
-	// compatability with custom drivers that use older SQLite version
+	// compatibility with custom drivers that use older SQLite version
 	return fmt.Sprintf(
 		`json_array_length(CASE WHEN iif(json_valid([[%s]]), json_type([[%s]])='array', FALSE) THEN [[%s]] ELSE (CASE WHEN [[%s]] = '' OR [[%s]] IS NULL THEN json_array() ELSE json_array([[%s]]) END) END)`,
 		column, column, column, column, column, column,
@@ -0,0 +1,18 @@
+package dbutils
+
+import "regexp"
+
+// Regexp for columns and tables (the same as the one in dbx).
+var selectRegex = regexp.MustCompile(`(?i:\s+as\s+|\s+)([\w\-_\.]+)$`)
+
+// AliasOrIdentifier returns the alias from a column or table identifier.
+// Returns the identifier unmodified if no alias was found.
+func AliasOrIdentifier(columnOrTableIdentifier string) string {
+	matches := selectRegex.FindStringSubmatch(columnOrTableIdentifier)
+
+	if len(matches) > 0 && matches[1] != "" {
+		return matches[1]
+	}
+
+	return columnOrTableIdentifier
+}
@@ -0,0 +1,38 @@
+package dbutils_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+)
+
+func TestAliasOrIdentifier(t *testing.T) {
+	scenarios := []struct {
+		value    string
+		expected string
+	}{
+		{"", ""},
+		{"abc", "abc"},
+		{"abc  ", "abc  "}, // return unmodified
+		{"abc.def", "abc.def"},
+		{"abc.123 def", "def"},
+		{"abc.123 as def.456", "def.456"},
+		{"(abc) def", "def"},
+		{"(abc) as def", "def"},
+		{"abc   def", "def"},
+		{"abc as   def", "def"},
+		// technically invalid identifier but consistent with the dbx regex matching
+		{"a b c d", "d"},
+		{"a b c as d", "d"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.value, func(t *testing.T) {
+			result := dbutils.AliasOrIdentifier(s.value)
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, result)
+			}
+		})
+	}
+}
@@ -173,7 +173,7 @@ func (r *Reader) WriteTo(w io.Writer) (int64, error) {
 func readFromWriteTo(r io.Reader, w io.Writer) (int64, int64, error) {
 	// Note: can't use io.Copy because it will try to use r.WriteTo
 	// or w.WriteTo, which is recursive in this context.
-	buf := make([]byte, 1024)
+	buf := make([]byte, 4096)
 	var totalRead, totalWritten int64
 	for {
 		numRead, rerr := r.Read(buf)
@@ -193,22 +193,32 @@ var extInvalidCharsRegex = regexp.MustCompile(`[^\w\.\*\-\+\=\#]+`)
 const randomAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789"

 func normalizeName(fr FileReader, name string) string {
+	// cut the name even if it is not multibyte safe to avoid operating on too large strings
+	// ---
+	originalLength := len(name)
+	if originalLength > 300 {
+		name = name[originalLength-300:]
+	}
+
 	// extension
 	// ---
 	originalExt := extractExtension(name)
-	cleanExt := extInvalidCharsRegex.ReplaceAllString(originalExt, "")
-	if cleanExt == "" {
+	cleanExt := "." + strings.Trim(extInvalidCharsRegex.ReplaceAllString(originalExt, ""), ".")
+	if cleanExt == "." {
 		// try to detect the extension from the file content
 		cleanExt, _ = detectExtension(fr)
 	}
 	if extLength := len(cleanExt); extLength > 20 {
 		// keep only the last 20 characters (it is multibyte safe after the regex replace)
-		cleanExt = "." + cleanExt[extLength-20:]
+		cleanExt = "." + strings.Trim(cleanExt[extLength-20:], ".")
 	}

 	// name
+	//
+	// note: leading dot is trimmed to prevent various subtle issues with files
+	// sync programs as they sometimes have special handling for "invisible" files
 	// ---
-	cleanName := inflector.Snakecase(strings.TrimSuffix(name, originalExt))
+	cleanName := inflector.Snakecase(strings.Trim(strings.TrimSuffix(name, originalExt), "."))
 	if length := len(cleanName); length < 3 {
 		// the name is too short so we concatenate an additional random part
 		cleanName += security.RandomStringWithAlphabet(10, randomAlphabet)
@@ -52,8 +52,8 @@ func TestNewFileFromPath(t *testing.T) {
 	}

 	// existing file
-	originalName := "image_! noext"
-	normalizedNamePattern := regexp.QuoteMeta("image_noext_") + `\w{10}` + regexp.QuoteMeta(".png")
+	originalName := "image_!@ special"
+	normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".png")
 	f, err := filesystem.NewFileFromPath(filepath.Join(testDir, originalName))
 	if err != nil {
 		t.Fatalf("Expected nil error, got %v", err)
@@ -83,8 +83,8 @@ func TestNewFileFromBytes(t *testing.T) {
 		t.Fatal("Expected error, got nil")
 	}

-	originalName := "image_! noext"
-	normalizedNamePattern := regexp.QuoteMeta("image_noext_") + `\w{10}` + regexp.QuoteMeta(".txt")
+	originalName := "image_!@ special"
+	normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".txt")
 	f, err := filesystem.NewFileFromBytes([]byte("text\n"), originalName)
 	if err != nil {
 		t.Fatal(err)
@@ -175,8 +175,8 @@ func TestNewFileFromURLTimeout(t *testing.T) {

 	// valid response
 	{
-		originalName := "image_! noext"
-		normalizedNamePattern := regexp.QuoteMeta("image_noext_") + `\w{10}` + regexp.QuoteMeta(".txt")
+		originalName := "image_!@ special"
+		normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".txt")

 		f, err := filesystem.NewFileFromURL(context.Background(), srv.URL+"/"+originalName)
 		if err != nil {
@@ -211,10 +211,14 @@ func TestFileNameNormalizations(t *testing.T) {
 		{".png", `^\w{10}_\w{10}\.png$`},
 		{".tar.gz", `^\w{10}_\w{10}\.tar\.gz$`},
 		{"a.tar.gz", `^a\w{10}_\w{10}\.tar\.gz$`},
+		{"....abc", `^\w{10}_\w{10}\.abc$`},
+		{"a.b.c.?.?.?.2", `^a_b_c_\w{10}\.2$`},
 		{"a.b.c.d.tar.gz", `^a_b_c_d_\w{10}\.tar\.gz$`},
 		{"abcd", `^abcd_\w{10}\.txt$`},
-		{"a  b! c d  . 456", `^a_b_c_d_\w{10}\.456$`},                                        // normalize spaces
-		{strings.Repeat("a", 101) + "." + strings.Repeat("b", 21), `^a{100}_\w{10}\.b{20}$`}, // name and extension length trim
+		{".abcd.123.", `^abcd_\w{10}\.123$`},
+		{"a  b! c d  . 456", `^a_b_c_d_\w{10}\.456$`},                                              // normalize spaces
+		{strings.Repeat("a", 101) + "." + strings.Repeat("b", 21), `^a{100}_\w{10}\.b{20}$`},       // name and extension length cut
+		{"abc" + strings.Repeat("d", 290) + "." + strings.Repeat("b", 9), `^d{100}_\w{10}\.b{9}$`}, // initial total length cut
 	}

 	for i, s := range scenarios {
@@ -223,7 +227,8 @@ func TestFileNameNormalizations(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			if match, err := regexp.Match(s.pattern, []byte(f.Name)); !match {
+			match, err := regexp.Match(s.pattern, []byte(f.Name))
+			if !match {
 				t.Fatalf("Expected Name to match %v, got %q (%v)", s.pattern, f.Name, err)
 			}
 		})
@@ -38,7 +38,7 @@ type System struct {
 	bucket *blob.Bucket
 }

-// NewS3 initializes an S3 filesystem instance.
+// NewS3 initializes a new S3 filesystem instance.
 //
 // NB! Make sure to call `Close()` after you are done working with it.
 func NewS3(
@@ -536,25 +536,38 @@ func (s *System) CreateThumb(originalKey string, thumbKey, thumbSize string) err
 		}
 	}

+	originalContentType := r.ContentType()
+
 	opts := &blob.WriterOptions{
-		ContentType: r.ContentType(),
+		ContentType: originalContentType,
 	}

-	// open a thumb storage writer (aka. prepare for upload)
-	w, writerErr := s.bucket.NewWriter(s.ctx, thumbKey, opts)
-	if writerErr != nil {
-		return writerErr
-	}
+	var format imaging.Format

-	// try to detect the thumb format based on the original file name
-	// (fallbacks to png on error)
-	format, err := imaging.FormatFromFilename(thumbKey)
-	if err != nil {
+	switch originalContentType {
+	case "image/jpeg":
+		format = imaging.JPEG
+	case "image/gif":
+		format = imaging.GIF
+	case "image/tiff":
+		format = imaging.TIFF
+	case "image/bmp":
+		format = imaging.BMP
+	default:
+		// fallback to PNG (this includes webp!)
+		opts.ContentType = "image/png"
 		format = imaging.PNG
 	}

+	// open a thumb storage writer (aka. prepare for upload)
+	w, err := s.bucket.NewWriter(s.ctx, thumbKey, opts)
+	if err != nil {
+		return err
+	}
+
 	// thumb encode (aka. upload)
-	if err := imaging.Encode(w, thumbImg, format); err != nil {
+	err = imaging.Encode(w, thumbImg, format)
+	if err != nil {
 		w.Close()
 		return err
 	}
@@ -600,6 +600,7 @@ func TestFileSystemGetReuploadableFile(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
+		defer r.Close()

 		raw, err := io.ReadAll(r)
 		if err != nil {
@@ -677,12 +678,13 @@ func TestFileSystemCopy(t *testing.T) {
 	if err := fsys.Copy(src, dst); err != nil {
 		t.Fatalf("Failed to copy %q to %q: %v", src, dst, err)
 	}
+
 	f, err := fsys.GetReader(dst)
-	//nolint
-	defer f.Close()
 	if err != nil {
 		t.Fatalf("Missing copied file %q: %v", dst, err)
 	}
+	defer f.Close()
+
 	if f.Size() != 73 {
 		t.Fatalf("Expected file size %d, got %d", 73, f.Size())
 	}
@@ -709,7 +711,8 @@ func TestFileSystemList(t *testing.T) {
 				"image.jpg",
 				"image.svg",
 				"image.webp",
-				"image_! noext",
+				"image_!@ special",
+				"image_noext",
 				"style.css",
 				"main.js",
 				"main.mjs",
@@ -861,6 +864,8 @@ func TestFileSystemCreateThumb(t *testing.T) {
 		{"image.jpg", "thumb.jpg", "100x100", "image/jpeg"},
 		// webp (should produce png)
 		{"image.webp", "thumb.webp", "100x100", "image/png"},
+		// without extension (should extract the mimetype from its stored ContentType)
+		{"image_noext", "image_noext.jpeg", "100x100", "image/jpeg"},
 	}

 	for _, s := range scenarios {
@@ -884,13 +889,20 @@ func TestFileSystemCreateThumb(t *testing.T) {
 			}
 			defer f.Close()

+			attrsMimeType := f.ContentType()
+
 			mt, err := mimetype.DetectReader(f)
 			if err != nil {
 				t.Fatalf("Failed to detect thumb %s mimetype (%v)", s.thumb, err)
 			}
+			fileMimeType := mt.String()

-			if mtStr := mt.String(); mtStr != s.expectedMimeType {
-				t.Fatalf("Expected thumb %s MimeType %q, got %q", s.thumb, s.expectedMimeType, mtStr)
+			if fileMimeType != s.expectedMimeType {
+				t.Fatalf("Expected thumb file %s MimeType %q, got %q", s.thumb, s.expectedMimeType, fileMimeType)
+			}
+
+			if attrsMimeType != s.expectedMimeType {
+				t.Fatalf("Expected thumb attrs %s MimeType %q, got %q", s.thumb, s.expectedMimeType, attrsMimeType)
 			}
 		})
 	}
@@ -975,16 +987,33 @@ func createTestDir(t *testing.T) string {
 		}
 	}

-	// no extension and invalid characters
+	// invalid/special characters
 	{
-		file, err := os.OpenFile(filepath.Join(dir, "image_! noext"), os.O_WRONLY|os.O_CREATE, 0644)
+		file, err := os.OpenFile(filepath.Join(dir, "image_!@ special"), os.O_WRONLY|os.O_CREATE, 0644)
 		if err != nil {
 			t.Fatal(err)
 		}
-		_ = png.Encode(file, image.Rect(0, 0, 1, 1)) // tiny 1x1 png
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 png
+		_ = png.Encode(file, imgRect)
 		file.Close()
 	}

+	// no extension
+	{
+		fullPath := filepath.Join(dir, "image_noext")
+		file, err := os.OpenFile(fullPath, os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 jpg
+		_ = jpeg.Encode(file, imgRect, nil)
+		file.Close()
+		err = os.WriteFile(fullPath+".attrs", []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/jpeg","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
 	// css
 	{
 		file, err := os.OpenFile(filepath.Join(dir, "style.css"), os.O_WRONLY|os.O_CREATE, 0644)
@@ -377,6 +377,7 @@ func (drv *driver) NewRangeReader(ctx context.Context, key string, offset, lengt
 		return nil, err
 	}

+	// @todo consider replacing with os.Root
 	f, err := os.Open(path)
 	if err != nil {
 		return nil, err
@@ -17,7 +17,7 @@ func TestS3CopyObject(t *testing.T) {
 	httpClient := tests.NewClient(
 		&tests.RequestStub{
 			Method: http.MethodPut,
-			URL:    "http://test_bucket.example.com/@dst_test",
+			URL:    "http://test_bucket.example.com/%40dst_test",
 			Match: func(req *http.Request) bool {
 				return tests.ExpectHeaders(req.Header, map[string]string{
 					"test_header":       "test",
@@ -62,6 +62,13 @@ type S3 struct {
 }

 // URL constructs an S3 request URL based on the current configuration.
+//
+// Note that the path will be URL escaped based on the AWS [UriEncode rules]
+// for broader compatibility with some providers that expect the same
+// path format as the one in the canonical signed header
+// (see also https://github.com/pocketbase/pocketbase/issues/7153).
+//
+// [UriEncode rules]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
 func (s3 *S3) URL(path string) string {
 	scheme := "https"
 	endpoint := strings.TrimRight(s3.Endpoint, "/")
@@ -72,6 +79,23 @@ func (s3 *S3) URL(path string) string {
 		scheme = "http"
 	}

+	// to prevent double escaping we first parse/unescape it
+	parsed, err := url.Parse(path)
+	if err != nil {
+		// truly rare case, keep the path as it is
+	} else {
+		path = escapePath(parsed.Path)
+
+		// the rest is usually not expected to be part of the S3 path but it is kept to avoid surprises
+		// (it will be further escaped if necessery by the Go HTTP client)
+		if parsed.RawQuery != "" {
+			path += "?" + parsed.RawQuery
+		}
+		if parsed.RawFragment != "" {
+			path += "#" + parsed.RawFragment
+		}
+	}
+
 	path = strings.TrimLeft(path, "/")

 	if s3.UsePathStyle {
@@ -126,6 +150,12 @@ func (s3 *S3) SignAndSend(req *http.Request) (*http.Response, error) {

 // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-signed-request-steps
 func (s3 *S3) sign(req *http.Request) {
+	// explicitly set Accept-Encoding to avoid transparent decompression
+	// and Content-Length zeroing (https://github.com/pocketbase/pocketbase/issues/7523)
+	if req.Header.Get("Accept-Encoding") == "" {
+		req.Header.Set("Accept-Encoding", "identity")
+	}
+
 	// fallback to the Unsigned payload option
 	// (data integrity checks could be still applied via the content-md5 or x-amz-checksum-* headers)
 	if req.Header.Get("x-amz-content-sha256") == "" {
@@ -13,6 +13,12 @@ import (
 func TestS3URL(t *testing.T) {
 	t.Parallel()

+	path := "/test_key/a/b c@d?a=@1&b=!2#@a b c"
+
+	// note: query params and fragments are kept as it is
+	// since they are later escaped if necessery by the Go HTTP client
+	expectedPath := "/test_key/a/b%20c%40d?a=@1&b=!2#@a b c"
+
 	scenarios := []struct {
 		name     string
 		s3Client *s3.S3
@@ -27,7 +33,7 @@ func TestS3URL(t *testing.T) {
 				AccessKey: "123",
 				SecretKey: "abc",
 			},
-			"https://test_bucket.example.com/test_key/a/b/c?q=1",
+			"https://test_bucket.example.com" + expectedPath,
 		},
 		{
 			"with https schema",
@@ -38,7 +44,7 @@ func TestS3URL(t *testing.T) {
 				AccessKey: "123",
 				SecretKey: "abc",
 			},
-			"https://test_bucket.example.com/test_key/a/b/c?q=1",
+			"https://test_bucket.example.com" + expectedPath,
 		},
 		{
 			"with http schema",
@@ -49,7 +55,7 @@ func TestS3URL(t *testing.T) {
 				AccessKey: "123",
 				SecretKey: "abc",
 			},
-			"http://test_bucket.example.com/test_key/a/b/c?q=1",
+			"http://test_bucket.example.com" + expectedPath,
 		},
 		{
 			"path style addressing (non-explicit schema)",
@@ -61,7 +67,7 @@ func TestS3URL(t *testing.T) {
 				SecretKey:    "abc",
 				UsePathStyle: true,
 			},
-			"https://example.com/test_bucket/test_key/a/b/c?q=1",
+			"https://example.com/test_bucket" + expectedPath,
 		},
 		{
 			"path style addressing (explicit schema)",
@@ -73,13 +79,13 @@ func TestS3URL(t *testing.T) {
 				SecretKey:    "abc",
 				UsePathStyle: true,
 			},
-			"http://example.com/test_bucket/test_key/a/b/c?q=1",
+			"http://example.com/test_bucket" + expectedPath,
 		},
 	}

 	for _, s := range scenarios {
 		t.Run(s.name, func(t *testing.T) {
-			result := s.s3Client.URL("/test_key/a/b/c?q=1")
+			result := s.s3Client.URL(path)
 			if result != s.expected {
 				t.Fatalf("Expected URL\n%s\ngot\n%s", s.expected, result)
 			}
@@ -122,6 +128,7 @@ func TestS3SignAndSend(t *testing.T) {
 						return tests.ExpectHeaders(req.Header, map[string]string{
 							"Authorization":        "AWS4-HMAC-SHA256 Credential=123/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=ea093662bc1deef08dfb4ac35453dfaad5ea89edf102e9dd3b7156c9a27e4c1f",
 							"Host":                 "test_bucket.example.com",
+							"Accept-Encoding":      "identity",
 							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
 							"X-Amz-Date":           "20250102T150405Z",
 						})
@@ -149,6 +156,7 @@ func TestS3SignAndSend(t *testing.T) {
 						return tests.ExpectHeaders(req.Header, map[string]string{
 							"Authorization":        "AWS4-HMAC-SHA256 Credential=456/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=17510fa1f724403dd0a563b61c9b31d1d718f877fcbd75455620d17a8afce5fb",
 							"Host":                 "test_bucket.example.com",
+							"Accept-Encoding":      "identity",
 							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
 							"X-Amz-Date":           "20250102T150405Z",
 						})
@@ -158,7 +166,7 @@ func TestS3SignAndSend(t *testing.T) {
 		},
 		{
 			"minimal with special characters",
-			"/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$^&*()=/@sub?a=1&@b=@2",
+			"/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 -_.~!@&*():=$()?a=1&@b=@2#@a b c",
 			func(req *http.Request) {
 				req.Header.Set("x-amz-date", "20250102T150405Z")
 			},
@@ -170,12 +178,13 @@ func TestS3SignAndSend(t *testing.T) {
 				SecretKey: "def",
 				Client: tests.NewClient(&tests.RequestStub{
 					Method:   http.MethodGet,
-					URL:      "https://test_bucket.example.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~!@#$%5E&*()=/@sub?a=1&@b=@2",
+					URL:      "https://test_bucket.example.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789%20-_.~%21%40%26%2A%28%29%3A%3D%24%28%29?a=1&@b=@2#@a%20b%20c",
 					Response: testResponse(),
 					Match: func(req *http.Request) bool {
 						return tests.ExpectHeaders(req.Header, map[string]string{
-							"Authorization":        "AWS4-HMAC-SHA256 Credential=456/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=e0001982deef1652704f74503203e77d83d4c88369421f9fca644d96f2a62a3c",
+							"Authorization":        "AWS4-HMAC-SHA256 Credential=456/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=9458a033554f52913801b3de16f54409b36ed25c6da3aed14e64439500e2c5e1",
 							"Host":                 "test_bucket.example.com",
+							"Accept-Encoding":      "identity",
 							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
 							"X-Amz-Date":           "20250102T150405Z",
 						})
@@ -192,6 +201,7 @@ func TestS3SignAndSend(t *testing.T) {
 				req.Header.Set("x-amz-example", "123")
 				req.Header.Set("x-amz-meta-a", "456")
 				req.Header.Set("content-type", "image/png")
+				req.Header.Set("accept-encoding", "custom")
 				req.Header.Set("x-test", "789") // shouldn't be included in the signing headers
 			},
 			&s3.S3{
@@ -208,6 +218,7 @@ func TestS3SignAndSend(t *testing.T) {
 						return tests.ExpectHeaders(req.Header, map[string]string{
 							"authorization":        "AWS4-HMAC-SHA256 Credential=123/20250102/test_region/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date;x-amz-example;x-amz-meta-a, Signature=86dccbcd012c33073dc99e9d0a9e0b717a4d8c11c37848cfa9a4a02716bc0db3",
 							"host":                 "test_bucket.example.com",
+							"accept-encoding":      "custom",
 							"x-amz-date":           "20250102T150405Z",
 							"x-amz-content-sha256": "test_sha256",
 							"x-amz-example":        "123",
@@ -334,10 +334,10 @@ func (u *Uploader) multipartUpload(ctx context.Context, initPart []byte, optReqF
 	var g errgroup.Group
 	g.SetLimit(u.MaxConcurrency)

-	totalParallel := u.MaxConcurrency
+	totalWorkers := u.MaxConcurrency

 	if len(initPart) != 0 {
-		totalParallel--
+		totalWorkers--
 		initPartNumber := u.lastPartNumber
 		g.Go(func() error {
 			mp, err := u.uploadPart(ctx, initPartNumber, initPart, optReqFuncs...)
@@ -353,7 +353,9 @@ func (u *Uploader) multipartUpload(ctx context.Context, initPart []byte, optReqF
 		})
 	}

-	for i := 0; i < totalParallel; i++ {
+	totalWorkers = max(totalWorkers, 1)
+
+	for i := 0; i < totalWorkers; i++ {
 		g.Go(func() error {
 			for {
 				part, num, err := u.nextPart()
@@ -4,6 +4,7 @@ import (
 	"context"
 	"io"
 	"net/http"
+	"strconv"
 	"strings"
 	"testing"

@@ -124,20 +125,24 @@ func TestUploaderSingleUpload(t *testing.T) {
 func TestUploaderMultipartUploadSuccess(t *testing.T) {
 	t.Parallel()

-	httpClient := tests.NewClient(
-		&tests.RequestStub{
-			Method: http.MethodPost,
-			URL:    "http://test_bucket.example.com/test_key?uploads",
-			Match: func(req *http.Request) bool {
-				return tests.ExpectHeaders(req.Header, map[string]string{
-					"x-amz-meta-a":  "123",
-					"x-amz-meta-b":  "456",
-					"test_header":   "test",
-					"Authorization": "^.+Credential=123/.+$",
-				})
-			},
-			Response: &http.Response{
-				Body: io.NopCloser(strings.NewReader(`
+	maxConcurrencies := []int{-1, 0, 1, 10}
+
+	for _, mc := range maxConcurrencies {
+		t.Run("MaxConcurrency_"+strconv.Itoa(mc), func(t *testing.T) {
+			httpClient := tests.NewClient(
+				&tests.RequestStub{
+					Method: http.MethodPost,
+					URL:    "http://test_bucket.example.com/test_key?uploads",
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"x-amz-meta-a":  "123",
+							"x-amz-meta-b":  "456",
+							"test_header":   "test",
+							"Authorization": "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Body: io.NopCloser(strings.NewReader(`
 					<?xml version="1.0" encoding="UTF-8"?>
 					<InitiateMultipartUploadResult>
 					   <Bucket>test_bucket</Bucket>
@@ -145,108 +150,111 @@ func TestUploaderMultipartUploadSuccess(t *testing.T) {
 					   <UploadId>test_id</UploadId>
 					</InitiateMultipartUploadResult>
 				`)),
-			},
-		},
-		&tests.RequestStub{
-			Method: http.MethodPut,
-			URL:    "http://test_bucket.example.com/test_key?partNumber=1&uploadId=test_id",
-			Match: func(req *http.Request) bool {
-				body, err := io.ReadAll(req.Body)
-				if err != nil {
-					return false
-				}
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=1&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}

-				return string(body) == "abc" && tests.ExpectHeaders(req.Header, map[string]string{
-					"Content-Length": "3",
-					"test_header":    "test",
-					"Authorization":  "^.+Credential=123/.+$",
-				})
-			},
-			Response: &http.Response{
-				Header: http.Header{"Etag": []string{"etag1"}},
-			},
-		},
-		&tests.RequestStub{
-			Method: http.MethodPut,
-			URL:    "http://test_bucket.example.com/test_key?partNumber=2&uploadId=test_id",
-			Match: func(req *http.Request) bool {
-				body, err := io.ReadAll(req.Body)
-				if err != nil {
-					return false
-				}
+						return string(body) == "abc" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "3",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag1"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=2&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}

-				return string(body) == "def" && tests.ExpectHeaders(req.Header, map[string]string{
-					"Content-Length": "3",
-					"test_header":    "test",
-					"Authorization":  "^.+Credential=123/.+$",
-				})
-			},
-			Response: &http.Response{
-				Header: http.Header{"Etag": []string{"etag2"}},
-			},
-		},
-		&tests.RequestStub{
-			Method: http.MethodPut,
-			URL:    "http://test_bucket.example.com/test_key?partNumber=3&uploadId=test_id",
-			Match: func(req *http.Request) bool {
-				body, err := io.ReadAll(req.Body)
-				if err != nil {
-					return false
-				}
-				return string(body) == "g" && tests.ExpectHeaders(req.Header, map[string]string{
-					"Content-Length": "1",
-					"test_header":    "test",
-					"Authorization":  "^.+Credential=123/.+$",
-				})
-			},
-			Response: &http.Response{
-				Header: http.Header{"Etag": []string{"etag3"}},
-			},
-		},
-		&tests.RequestStub{
-			Method: http.MethodPost,
-			URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
-			Match: func(req *http.Request) bool {
-				body, err := io.ReadAll(req.Body)
-				if err != nil {
-					return false
-				}
+						return string(body) == "def" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "3",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag2"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=3&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}
+						return string(body) == "g" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "1",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag3"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPost,
+					URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}

-				expected := `<CompleteMultipartUpload><Part><ETag>etag1</ETag><PartNumber>1</PartNumber></Part><Part><ETag>etag2</ETag><PartNumber>2</PartNumber></Part><Part><ETag>etag3</ETag><PartNumber>3</PartNumber></Part></CompleteMultipartUpload>`
+						expected := `<CompleteMultipartUpload><Part><ETag>etag1</ETag><PartNumber>1</PartNumber></Part><Part><ETag>etag2</ETag><PartNumber>2</PartNumber></Part><Part><ETag>etag3</ETag><PartNumber>3</PartNumber></Part></CompleteMultipartUpload>`

-				return strings.Contains(string(body), expected) && tests.ExpectHeaders(req.Header, map[string]string{
-					"test_header":   "test",
-					"Authorization": "^.+Credential=123/.+$",
-				})
-			},
-		},
-	)
+						return strings.Contains(string(body), expected) && tests.ExpectHeaders(req.Header, map[string]string{
+							"test_header":   "test",
+							"Authorization": "^.+Credential=123/.+$",
+						})
+					},
+				},
+			)

-	uploader := &s3.Uploader{
-		S3: &s3.S3{
-			Client:    httpClient,
-			Region:    "test_region",
-			Bucket:    "test_bucket",
-			Endpoint:  "http://example.com",
-			AccessKey: "123",
-			SecretKey: "abc",
-		},
-		Key:         "test_key",
-		Payload:     strings.NewReader("abcdefg"),
-		Metadata:    map[string]string{"a": "123", "b": "456"},
-		MinPartSize: 3,
-	}
+			uploader := &s3.Uploader{
+				S3: &s3.S3{
+					Client:    httpClient,
+					Region:    "test_region",
+					Bucket:    "test_bucket",
+					Endpoint:  "http://example.com",
+					AccessKey: "123",
+					SecretKey: "abc",
+				},
+				Key:            "test_key",
+				Payload:        strings.NewReader("abcdefg"),
+				Metadata:       map[string]string{"a": "123", "b": "456"},
+				MinPartSize:    3,
+				MaxConcurrency: mc,
+			}

-	err := uploader.Upload(context.Background(), func(r *http.Request) {
-		r.Header.Set("test_header", "test")
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
+			err := uploader.Upload(context.Background(), func(r *http.Request) {
+				r.Header.Set("test_header", "test")
+			})
+			if err != nil {
+				t.Fatal(err)
+			}

-	err = httpClient.AssertNoRemaining()
-	if err != nil {
-		t.Fatal(err)
+			err = httpClient.AssertNoRemaining()
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
 	}
 }

@@ -46,7 +46,7 @@ import (

 const defaultPageSize = 1000

-// New creates a new instance of the S3 driver backed by the the internal S3 client.
+// New creates a new instance of the S3 driver backed by the internal S3 client.
 func New(s3Client *s3.S3) (blob.Driver, error) {
 	if s3Client.Bucket == "" {
 		return nil, errors.New("s3blob.New: missing bucket name")
@@ -0,0 +1,32 @@
+package osutils
+
+import (
+	"os"
+	"strings"
+)
+
+var runDirs = []string{os.TempDir(), cacheDir()}
+
+// IsProbablyGoRun loosely checks if the current program was started with "go run".
+func IsProbablyGoRun() bool {
+	for _, dir := range runDirs {
+		if dir != "" && strings.HasPrefix(os.Args[0], dir) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func cacheDir() string {
+	dir := os.Getenv("GOCACHE")
+	if dir == "off" {
+		return ""
+	}
+
+	if dir == "" {
+		dir, _ = os.UserCacheDir()
+	}
+
+	return dir
+}
@@ -0,0 +1,45 @@
+package osutils
+
+import (
+	"os"
+	"strconv"
+	"testing"
+)
+
+func TestIsProbablyGoRun(t *testing.T) {
+	scenarios := []struct {
+		arg0     string
+		runDirs  []string
+		expected bool
+	}{
+		{"", nil, false},
+		{"/a/b", nil, false},
+		{"/a/b", []string{""}, false},
+		{"/a/b", []string{"/b/"}, false},
+		{"/a/b", []string{"/a/"}, true},
+		{"/a/b", []string{"", "/b/", "/a/"}, true},
+	}
+
+	originalArgs := os.Args
+	defer func() {
+		os.Args = originalArgs
+	}()
+
+	originalRunDirs := runDirs
+	defer func() {
+		runDirs = originalRunDirs
+	}()
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i)+"_"+s.arg0, func(t *testing.T) {
+			os.Args = []string{s.arg0}
+			runDirs = s.runDirs
+
+			result := IsProbablyGoRun()
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
@@ -354,19 +354,19 @@ func TestEventString(t *testing.T) {
 	scenarios := []testResponseWriteScenario[string]{
 		{
 			name:            "no explicit content-type",
-			status:          123,
+			status:          234,
 			headers:         nil,
 			body:            "test",
-			expectedStatus:  123,
+			expectedStatus:  234,
 			expectedHeaders: map[string]string{"content-type": "text/plain; charset=utf-8"},
 			expectedBody:    "test",
 		},
 		{
 			name:            "with explicit content-type",
-			status:          123,
+			status:          234,
 			headers:         map[string]string{"content-type": "text/test"},
 			body:            "test",
-			expectedStatus:  123,
+			expectedStatus:  234,
 			expectedHeaders: map[string]string{"content-type": "text/test"},
 			expectedBody:    "test",
 		},
@@ -383,19 +383,19 @@ func TestEventHTML(t *testing.T) {
 	scenarios := []testResponseWriteScenario[string]{
 		{
 			name:            "no explicit content-type",
-			status:          123,
+			status:          234,
 			headers:         nil,
 			body:            "test",
-			expectedStatus:  123,
+			expectedStatus:  234,
 			expectedHeaders: map[string]string{"content-type": "text/html; charset=utf-8"},
 			expectedBody:    "test",
 		},
 		{
 			name:            "with explicit content-type",
-			status:          123,
+			status:          234,
 			headers:         map[string]string{"content-type": "text/test"},
 			body:            "test",
-			expectedStatus:  123,
+			expectedStatus:  234,
 			expectedHeaders: map[string]string{"content-type": "text/test"},
 			expectedBody:    "test",
 		},
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Gani Georgiev	ab0edb80df	updated CHANGELOG	2026-02-21 13:31:48 +02:00
Gani Georgiev	233dd2ac67	bumped app version	2026-02-18 20:00:31 +02:00
Gani Georgiev	21d58d389f	updated golang.org/x/ deps	2026-02-18 19:44:13 +02:00
Gani Georgiev	7f21e31145	updated modernc.org/sqlite to 1.46.1	2026-02-18 19:24:38 +02:00
Gani Georgiev	19ad2f3b04	[#7532 ] added compositionend listener	2026-02-17 18:20:07 +02:00
Gani Georgiev	f6675702ea	[#7532 ] pause collection and fields name normalization while in IME mode	2026-02-17 17:29:38 +02:00
Gani Georgiev	3b9f2141fe	updated jsvm types	2026-02-16 22:04:19 +02:00
Gani Georgiev	2b39757fbc	bumped app version	2026-02-16 21:08:13 +02:00
Gani Georgiev	15091999e3	use temp dir for the $filesystem.local test	2026-02-14 12:08:57 +02:00
Gani Georgiev	fcc680794c	[#7526 ] added $filesystem.s3 and $filesystem.local JSVM bindings	2026-02-14 11:49:50 +02:00
Gani Georgiev	bc72525013	[#7525 ] made Bearer prefix case-insensitive	2026-02-14 11:19:13 +02:00
Gani Georgiev	23ca5a77e1	fixed changelog typo	2026-02-13 21:00:25 +02:00
Gani Georgiev	266b56ecbb	updated goja deps	2026-02-13 20:07:31 +02:00
Gani Georgiev	ac8a4583cb	updated test status codes to 2xx due to go 1.26.0 stricter checks	2026-02-13 20:02:55 +02:00
Gani Georgiev	1d72c8487e	bumped app version	2026-02-13 17:21:34 +02:00
Gani Georgiev	97eb9b300b	renamed arguments to make it more clear that they are dangeous	2026-02-13 16:40:29 +02:00
Gani Georgiev	5b2cae8509	[#7523 ] added Accept-Encoding:identity to the S3 requests	2026-02-13 16:16:12 +02:00
Gani Georgiev	5715e11e52	bumped go deps	2026-02-11 15:02:38 +02:00
Gani Georgiev	90e9fa705d	bumped app version	2026-02-01 09:40:10 +02:00
Gani Georgiev	d4101be9f6	updated go deps	2026-02-01 09:34:17 +02:00
Gani Georgiev	6cec679f02	updated changelog	2026-01-28 11:52:56 +02:00
Gani Georgiev	0e0b862bd7	silenced race detector errors per #7484	2026-01-28 11:52:08 +02:00
Gani Georgiev	b2bf26122f	updated changelog	2026-01-27 16:53:09 +02:00
Gani Georgiev	adc5c3cf18	updated goja	2026-01-27 16:51:55 +02:00
Gani Georgiev	4a1e3aed6e	added extra collection field exist check to minimize misuse and have a more clear error message	2026-01-27 16:46:04 +02:00
Gani Georgiev	55e24344ff	updated modernc.org/sqlite to v1.44.3	2026-01-23 00:44:23 +02:00
Gani Georgiev	17086722f4	updated thumb style and title for non-previewable files	2026-01-23 00:34:58 +02:00
Gani Georgiev	9b036fb10f	updated modernc.org/sqlite to 1.44.2	2026-01-18 18:57:18 +02:00
Gani Georgiev	8e3f0f2e32	regenerated jsvm types and bumped app version	2026-01-18 18:53:03 +02:00
Gani Georgiev	65750bca8d	revert GROUP BY optimization	2026-01-18 18:38:40 +02:00
Gani Georgiev	adb991eb02	fixed comment typos	2026-01-17 10:58:12 +02:00
Gani Georgiev	d87a887673	fixed docs link in the changelog	2026-01-16 06:55:02 +02:00
Gani Georgiev	f2eb295fa2	updated modernc.org deps	2026-01-16 06:27:55 +02:00
Gani Georgiev	d11a9f9d99	updated JSVM types and bumped app version	2026-01-15 22:24:07 +02:00
Gani Georgiev	bbd7f4e4ae	replaced NoCoalesce with NullFallback and updated tests	2026-01-15 18:06:15 +02:00
Gani Georgiev	b0a5bce4c4	updated 0.35.1 changelog to reflect the modernc.org/sqlite 1.42.0 retraction and updated the driver to 1.44.0	2026-01-15 14:45:26 +02:00
Gani Georgiev	9234cbf0d1	updated changelog	2026-01-15 14:34:45 +02:00
Gani Georgiev	6bf5eccfa7	added strftime filter function	2026-01-15 14:27:53 +02:00
Gani Georgiev	8bbd0c2d77	updated changelog	2026-01-13 22:30:31 +02:00
Gani Georgiev	2af60a85c5	fixed typo and updated changelog	2026-01-13 22:23:23 +02:00
Gani Georgiev	56e53e885c	added more UpdateQuery tests	2026-01-13 22:15:50 +02:00
Gani Georgiev	3115f08d4a	updated ui version	2026-01-13 18:56:23 +02:00
Gani Georgiev	0b9a646d41	use group by instead of distinct when possible	2026-01-13 18:47:32 +02:00
Gani Georgiev	5f8cce3558	[#7444 ] remove unnecessery subquery when resolving single back-relation fields	2026-01-13 14:54:35 +02:00
Gani Georgiev	3da2c00f32	updated modernc.org/sqlite to 1.43.0	2026-01-10 10:57:33 +02:00
Gani Georgiev	352ee72740	normalized multiple to single field confirmation detection	2026-01-06 18:33:44 +02:00
Gani Georgiev	98510103c3	normalized relations picker maxSelect value	2026-01-06 18:19:01 +02:00
Gani Georgiev	25c044a3a2	updated changelog	2026-01-03 14:25:04 +02:00
Gani Georgiev	0536c779d5	updated modernc.org/sqlite to 1.42.2	2026-01-03 11:23:26 +02:00
Gani Georgiev	b1da83e516	fixed comment typo	2025-12-21 09:24:07 +02:00
Gani Georgiev	6b5d7b216b	bumped go deps and updated jsvm types	2025-12-21 08:11:36 +02:00
Gani Georgiev	26d6a98355	updated ui/dist	2025-12-19 19:25:08 +02:00
Gani Georgiev	4abc018d7c	upgraded to math/rand/v2	2025-12-19 19:08:56 +02:00
Gani Georgiev	f0a9cbf31b	updated modernc.org/sqlite to v1.41.0	2025-12-19 17:11:21 +02:00
Gani Georgiev	d08da7594a	cap the file name before normalization	2025-12-19 16:58:08 +02:00
Gani Georgiev	c2d6530065	added test for file name normalization with leading dot	2025-12-19 16:30:11 +02:00
Gani Georgiev	94c4d4ec65	removed legacy and unnecessery call	2025-12-19 10:49:34 +02:00
Gani Georgiev	be7ec34516	fixed error msg typo	2025-12-19 10:19:31 +02:00
Gani Georgiev	27cb36ffd7	[#7396 ] added nullable JSVM type helpers	2025-12-17 19:27:17 +02:00
Gani Georgiev	e7af58efac	updated goja	2025-12-12 09:05:04 +02:00
Gani Georgiev	ab51b3c038	updated ui/dist	2025-12-12 08:55:08 +02:00
Gani Georgiev	5773f46fea	replace TrimSuffix with Trim	2025-12-12 08:52:22 +02:00
Gani Georgiev	4d5b7cc1d0	updated go deps	2025-12-12 08:50:33 +02:00
Gani Georgiev	7286f34104	trim normalized file extension	2025-12-12 08:49:10 +02:00
Gani Georgiev	4399a6c1ab	added small threshold for the cron time based tests	2025-12-12 08:48:29 +02:00
Gani Georgiev	e89603497f	store the correct image/png as attrs content type when generating a thumb fallback	2025-12-09 17:09:32 +02:00
Gani Georgiev	abb6bcd6de	[#7369 ] bumped JS SDK to fix Safari AbortError detection introduced with the previous release	2025-12-04 14:46:28 +02:00
Gani Georgiev	5604fe672e	updated changelog	2025-12-02 20:20:41 +02:00
Gani Georgiev	7825baab13	updated v0.22 changelog and bumped actions/setup-go to v6	2025-12-02 20:20:27 +02:00
Gani Georgiev	68b9d0e403	updated go deps and bumped min go github version	2025-12-02 19:28:27 +02:00
Gani Georgiev	85232ed6e4	updated js sdk	2025-12-02 19:23:21 +02:00
Gani Georgiev	d76d4089cf	[#7357 ] added Copy raw JSON collection dropdown option	2025-12-02 08:21:20 +02:00
Gani Georgievandjb.muscat	2e5f8bff63	[#7353 ] added missing : char to the autocomplete regex Co-authored-by: jb.muscat <jb.muscat@criteo.com>	2025-12-02 07:56:54 +02:00
Gani Georgiev	90d896e1cc	updated changelog	2025-11-22 10:59:25 +02:00
Gani Georgiev	c13d83adb1	updated jsvm types	2025-11-22 10:59:15 +02:00
Gani Georgiev	9b73295a7c	added dumy request info to directly return an error on invalid API rule	2025-11-22 10:58:32 +02:00
Gani Georgiev	3c6ce2de74	updated go deps	2025-11-22 09:36:50 +02:00
Gani Georgiev	63b89533a9	use TEST_IP for the test auth alert email	2025-11-22 09:36:20 +02:00
Gani Georgiev	779059eca3	added short info about the backup restore steps	2025-11-22 09:36:02 +02:00
Gani Georgiev	9abdadf0dc	updated modernc.org/sqlite	2025-11-18 22:24:49 +02:00
Gani Georgiev	6500b8c518	renamed outdated rate limit struct name and added reminder to reavulate the algorithm	2025-11-18 22:23:59 +02:00
Stephen Daves	91f1ca273d	[#7333 ] updated CHANGELOG with typo fixed for geoDistance url	2025-11-18 07:39:28 +02:00
Gani Georgiev	6e739fd33d	added :changed request body modifier	2025-11-17 13:58:43 +02:00
Gani Georgiev	2525f29c1c	adde auth alert info as OnMailerRecordAuthAlertSend meta	2025-11-15 21:21:06 +02:00
Gani Georgiev	1dc5e061b8	updated changelog and ui/dist	2025-11-13 15:51:51 +02:00
Gani Georgiev	09d7f6a7c3	added missing mails.sendRecordAuthAlert jsvm binding	2025-11-13 10:45:33 +02:00
Gani Georgiev	1775585b68	updated goja and migrate timestamp	2025-11-13 09:59:14 +02:00
Gani Georgiev	f4e6c5edee	updated x/sync and other go deps	2025-11-12 15:17:36 +02:00
Gani Georgiev	94b11bf2c3	added test for escaped alert info	2025-11-12 15:15:54 +02:00
Gani Georgiev	ddb8c88a37	replaced placeholder in migration and updated jsvm types	2025-11-10 17:59:11 +02:00
Gani Georgiev	0f5411d81c	[#7314 ] added ALERT_INFO placeholder to the auth alert mail template	2025-11-10 17:56:36 +02:00
Gani Georgiev	423d234da1	added pk test for * character	2025-11-10 07:17:01 +02:00
Gani Georgiev	6184b31d82	[#7312 ] added extra id validations	2025-11-09 15:24:24 +02:00
Gani Georgiev	63a9d045a1	[#7312 ] excluded id from the excerpt list	2025-11-08 23:32:30 +02:00
Gani Georgiev	501ab0e6be	updated modernc.org/sqlite to 1.40.0	2025-11-08 11:17:26 +02:00
Gani Georgiev	7ad08ef6bf	updated changelog	2025-11-08 10:57:22 +02:00
Gani Georgiev	6210f361b0	bumped app version and updated ui/dist	2025-11-08 10:49:41 +02:00
Gani GeorgievandFelix	fcb5b5dd67	[#7305 ] fixed deadlock when manually triggering the OnTerminate hook Co-authored-by: Felix <FelixM@yer.tools>	2025-11-07 17:03:15 +02:00
Gani Georgiev	41607679a0	updated readme	2025-11-04 13:03:30 +02:00
Gani Georgiev	ca7e5b7f7b	updated jsvm types	2025-11-04 11:23:35 +02:00
Gani Georgiev	593721dcea	flatten relation joins	2025-11-03 14:21:01 +02:00
Gani Georgiev	153ad12e64	set allowHiddenFields to prevent infinite recursion	2025-11-01 14:54:22 +02:00
Gani Georgiev	482fe2bce0	updated ui/dist	2025-10-31 22:41:52 +02:00
Gani Georgiev	48489b6a07	updated jsvm types	2025-10-31 22:24:47 +02:00
Gani Georgiev	67ee431585	add extra subquery check for client-side relation filtering	2025-10-31 22:22:28 +02:00
Gani Georgiev	d5dcd01551	updated ui/dist	2025-10-23 22:33:12 +03:00
Gani Georgiev	749bf7815c	updated changelog	2025-10-23 20:28:13 +03:00
Gani Georgiev	ceae5e005f	updated jsvm types and npm deps	2025-10-23 18:21:34 +03:00
Gani Georgiev	7b6b71e18d	disallow client-side filtering and sorting of relations where the collection of the last targeted field has superusers only List/Search API rule	2025-10-23 17:22:47 +03:00
Gani Georgiev	885d907beb	updated jsvm types	2025-10-23 13:15:03 +03:00
Gani Georgiev	afb942bc41	updated thumb error message	2025-10-23 11:55:19 +03:00
Gani Georgiev	83a26d436e	[#7268 ] added FileDownloadRequestEvent.ThumbError field	2025-10-23 11:48:59 +03:00
Gani Georgiev	7b52d0b56a	[#7267 ] added tests.ApiScenario.DisableTestAppCleanup optional field	2025-10-23 11:13:49 +03:00
Gani Georgiev	5a8eae7089	add fallback in case the collection name in the response was stripped	2025-10-23 10:55:04 +03:00
Gani Georgiev	0bd712752f	moved ValidateTokenSignature to jwk and added tests	2025-10-19 18:19:26 +03:00
Gani Georgiev	0b6157e1cc	added no bounties note in the security policy	2025-10-19 15:49:10 +03:00
Gani Georgiev	c8980edf85	updated npm deps	2025-10-19 15:41:07 +03:00
Gani Georgiev	a7ebb98e20	wrap record info fields separatedly from link btn	2025-10-19 15:38:21 +03:00
Gani Georgiev	69be986132	limit max expanded presentable relations to 2	2025-10-19 14:03:28 +03:00
Gani Georgiev	58da159641	[#7252 ] support ed25519 oidc id_token signature validation	2025-10-19 13:49:39 +03:00
Gani Georgiev	8acb48b884	updated record-info-excerpt styles	2025-10-17 19:11:21 +03:00
Gani Georgiev	91b521595a	[#7260 ] print nested presentable multiple relation fields	2025-10-17 14:43:36 +03:00
Gani Georgiev	52a53b5b91	updated ui/dist	2025-10-17 10:47:48 +03:00
Gani Georgiev	1137a35ded	unify code-editor wrapper fields padding	2025-10-17 10:45:24 +03:00
Gani Georgiev	280005e35c	[#7259 ] fixed json field overflow	2025-10-17 10:27:04 +03:00
Gani Georgiev	6656d9820a	[#7223 ] workaround firefox overflow issue	2025-10-15 20:31:40 +03:00
Gani Georgiev	0d8b426b0c	updated modernc.org/sqlite	2025-10-15 20:27:35 +03:00
Gani Georgiev	acd12ce9dd	[#7256 ] fixed legacy identitity field priority check when a username is a valid email address	2025-10-15 17:25:51 +03:00
Gani Georgiev	47d3da28d5	updated supported modernc.org build targets list	2025-10-08 20:08:16 +03:00
Gani Georgiev	6f8524961f	updated go deps	2025-10-08 19:44:46 +03:00
Gani Georgiev	fda6ad8d5d	bumped min go action version	2025-10-08 17:55:23 +03:00
Gani Georgiev	a8321498fd	updated changelog	2025-10-03 09:06:03 +03:00
Gani Georgiev	ca4902a808	updated ui/dist	2025-10-03 08:53:37 +03:00
Gani Georgiev	348ccfc580	removed explicit golangci go version and fallback to the one from go.mod	2025-10-02 21:01:30 +03:00
Gani Georgiev	77c05dbd2a	support Uploader.MaxConcurrency=1 and updated tests	2025-10-02 20:52:36 +03:00
Gani Georgiev	44289a93a2	disable installer when running tests	2025-10-02 20:51:32 +03:00
Gani GeorgievandLoic B.	6b6d3b36d3	[#7208 ] exlude lost+found from the backups Co-authored-by: Loic B. <lbndev@yahoo.fr>	2025-09-28 08:28:28 +03:00
Gani Georgiev	e26905f8e2	updated go deps	2025-09-22 23:04:20 +03:00
Gani Georgiev	6ad42bde29	added DefaultClient.Send panic/recover handling as an extra precaution	2025-09-22 22:52:58 +03:00
Gani Georgiev	54fb4293c5	revert sqlite dep update	2025-09-22 21:30:54 +03:00
Gani Georgiev	a8dd8be524	updated sqlite dep	2025-09-22 20:44:04 +03:00
Gani Georgiev	76a6b9834b	fixed Message.WriteSSE example	2025-09-13 23:46:13 +03:00
Gani Georgiev	68ab174f69	wrap DefaultClient.Send with a single lock/unlock and rename mux to mu for consistency	2025-09-13 23:42:46 +03:00
Gani Georgiev	a095549304	bumped action min go version	2025-09-07 08:02:36 +03:00
Gani Georgiev	6af4d88529	fixed active index label match	2025-09-07 08:01:36 +03:00
Gani Georgiev	5c9570c8de	updated jsvm types	2025-09-06 21:45:20 +03:00
Gani Georgiev	546ea248df	updated changelog	2025-09-06 21:45:04 +03:00
Gani Georgiev	eda90d4555	check the default user cachedir if GOCACHE is not explicitly set	2025-09-06 21:20:13 +03:00
Gani Georgiev	40f2ba731c	added osutils.IsProbablyGoRun	2025-09-06 19:52:51 +03:00
Gani Georgiev	a088cf6379	updated jsvm types	2025-09-06 15:18:48 +03:00
Gani Georgiev	8d3ec418e9	enabled seconds in the datepicker	2025-09-06 15:13:06 +03:00
Gani Georgiev	f2056f61bd	added os.Root bindings to the JSVM	2025-09-06 14:51:27 +03:00
Gani Georgiev	6a5e449b3c	bumped go deps	2025-09-06 14:22:07 +03:00
Gani Georgiev	1359a6f8fd	[#7153 ] eagerly escape the S3 path in accordance with the S3 UriEncode signing rules	2025-09-06 11:59:32 +03:00
Gani Georgiev	28de01a188	updated changelog	2025-09-01 21:11:19 +03:00
Gani Georgiev	9e13418565	retry the random func to minimize tests flakiness	2025-08-31 23:35:01 +03:00
Gani Georgiev	172b1f96f7	[#7123 ] updated exp of test valid jwt tokens	2025-08-31 23:14:55 +03:00
Gani Georgiev	41cc4fd36b	increased slightly the wait time to minimize tests flakiness	2025-08-31 20:31:45 +03:00
Gani Georgievandmashizora	45af9e201c	[#7130 ] added Lark OAuth2 provider Co-authored-by: mashizora <30516315+mashizora@users.noreply.github.com>	2025-08-30 12:57:14 +03:00
Gani Georgiev	cc902f2df8	updated scaffold apis to use random id during the collections initialization and made index columns check on the UI case insensitive	2025-08-26 22:02:00 +03:00
Gani Georgiev	5e67ec1c1c	[#7135 ] merge scaffold collection indexes	2025-08-26 21:09:44 +03:00
Gani Georgiev	ee8c0a66b6	[#7135 ] merge scaffold collection indexes	2025-08-26 21:07:20 +03:00
Gani Georgiev	5d964c1b1d	tidy go.sum	2025-08-23 09:26:08 +03:00
Gani Georgiev	c0d37fc64a	regenerated jsvm types	2025-08-23 09:20:51 +03:00
Gani Georgiev	58b564557f	enabled __hooks in the jsvm migrations	2025-08-23 08:44:30 +03:00
Gani Georgiev	95787da4df	updated changelog	2025-08-23 07:54:20 +03:00
Gani Georgiev	b99095430a	[#7125 ] registered missing jsvm migrations bindings	2025-08-23 07:45:28 +03:00
Gani Georgiev	ad814c5a37	updated changelog	2025-08-22 22:25:27 +03:00
Gani Georgiev	c6621ea1ed	regenerated ui/dist and jsvm types	2025-08-22 21:32:03 +03:00
Gani Georgiev	bda4baac15	updated go deps	2025-08-22 21:24:39 +03:00
Gani Georgiev	a2b1b19342	updated random generator tests	2025-08-22 21:20:30 +03:00
Gani Georgiev	819ec1ad5c	renamed to execve to make it more clear	2025-08-22 20:47:58 +03:00
Jesse Sivonen	3ca6321907	[#7116 ] exclude `syscall.Exec` for WASM	2025-08-22 20:44:13 +03:00
Gani Georgiev	b8f18bd97d	added more tests and extra debug log	2025-08-20 22:41:33 +03:00
Gani Georgiev	50dbb7f94f	[#7090 ] try to forward the Apple OAuth2 redirect user's name to the auth handler	2025-08-16 21:30:43 +03:00
Gani Georgiev	09ce863a40	[#7098 ] fixed RateLimitRule.Audience code comment	2025-08-15 19:29:42 +03:00
Gani Georgiev	13cec96013	regenerated JSVM types	2025-08-12 21:46:18 +03:00
Gani Georgiev	b1f1d19d7f	bumped min go github action version	2025-08-09 10:13:51 +03:00
Gani Georgiev	5200f9c493	regenerated jsvm types	2025-08-02 08:40:44 +03:00
Gani Georgiev	2c8aa2e5fa	removed duplicated CHANGELOG entry	2025-08-02 08:38:46 +03:00
Gani Georgiev	eeae1f64ee	updated changelog	2025-08-02 08:24:39 +03:00
Gani Georgiev	506172c495	removed unnecessary space	2025-08-02 08:24:27 +03:00
Gani Georgiev	d75f5f663c	[#7067 ] explain more clearly the DynamicModel caveats	2025-08-02 08:13:15 +03:00
Gani Georgiev	92e15c287e	updated modernc.org/sqlite to 1.38.2	2025-08-02 08:05:06 +03:00
Gani GeorgievandBlake Patteson	dd895dee01	[#7056 ] added Box OAuth2 provider Co-authored-by: Blake Patteson <bpatteson@me.com>	2025-08-02 07:50:49 +03:00
Gani Georgiev	4b2e75992b	updated ui/dist	2025-07-26 23:10:46 +03:00
Gani Georgiev	c498c918ec	updated go deps	2025-07-26 22:49:17 +03:00
Gani Georgiev	125e99e4c8	[#7035 ] updated the X/Twitter provider to return the confirmed_email field and to use the x.com domain	2025-07-26 22:45:02 +03:00
Gani Georgiev	5461120b04	[#7049 ] fixed list api example response	2025-07-25 19:56:41 +03:00
Gani Georgiev	4a7fb95650	updated jsvm types	2025-07-19 11:31:26 +03:00
Gani Georgiev	444fa78252	updated go deps	2025-07-19 11:01:35 +03:00
Gani Georgiev	641aa54cfc	use the nonconcurrent pool for running PRAGMA optimize	2025-07-19 10:02:44 +03:00
Gani Georgiev	f015911594	updated npm deps and clarified trusted proxy headers input label	2025-07-19 09:41:40 +03:00
Gani Georgiev	fadb2e68a2	increased filesystem read buffer to speedup writes	2025-07-19 09:34:01 +03:00
Gani Georgiev	5ca79eb85d	[#7022 ] added support for unmarshaling into interface fields	2025-07-18 23:11:05 +03:00
Gani Georgiev	62c8523070	updated ui/dist	2025-06-29 20:41:36 +03:00
Gani Georgiev	8debafa755	synced with master	2025-06-29 20:30:33 +03:00
Gani Georgiev	0089ceb904	[#6982 ] disable separator escaping for the page title	2025-06-29 20:28:36 +03:00
Gani Georgiev	6443f2f159	[#3233 ] added optional ServeEvent.Listener field	2025-06-29 15:41:55 +03:00
Gani Georgiev	0e12169546	updated TestRandomStringByRegex to avoid collisions	2025-06-29 11:51:21 +03:00
Gani Georgiev	9d7856a9eb	fixed changelog copy/paste error	2025-06-29 11:33:43 +03:00
Gani Georgiev	306045fa2f	updated ui/dist	2025-06-29 11:31:49 +03:00
Gani Georgiev	a9c42d0282	[#718 ] enabled calling auth-refresh with impersonate token	2025-06-29 11:24:50 +03:00
Gani Georgiev	f318f461ea	updated npm deps	2025-06-26 22:21:17 +03:00
Gani Georgiev	51bc9f3982	[#6972 ] wrapped backup restore in a transaction as an extra precaution	2025-06-26 22:21:04 +03:00
Gani Georgiev	2c6f99418f	added the triggered rate limit rule in the error log details	2025-06-25 20:32:58 +03:00
Gani Georgiev	3f3b77dcd4	print go run in the superuser create installer suggestion if temp dir location is detected	2025-06-24 08:56:53 +03:00
Gani Georgiev	db679f9620	regenerated jsvm types	2025-06-21 10:51:52 +03:00
Gani Georgiev	c76ee987bd	fixed comment typo	2025-06-21 10:51:40 +03:00
Gani Georgiev	0d4da9c3be	updated changelog	2025-06-21 10:30:35 +03:00
Gani Georgiev	fab56f688d	clarified batch max requests input	2025-06-21 10:29:54 +03:00
Felix	1610729d92	[#6947 ] fixed probability distribution in RandomStringByRegex	2025-06-21 08:03:21 +03:00
Gani Georgiev	6522bc55b1	fixed comment typo	2025-06-18 19:01:36 +03:00
Gani Georgiev	c8776b7cd9	updated jsvm types	2025-06-17 21:23:19 +03:00
Gani Georgiev	262e78c04e	[#6935 ] added toBytes JSVM helper	2025-06-17 21:15:34 +03:00