[#488] added X-Accel-Buffering:no sse header

Co-authored-by: Olle Månsson <olle.mansson@zenseact.com>

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '1.19.0-beta.1'
+          go-version: '>=1.19.0'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

.goreleaser.yaml

@@ -20,13 +20,20 @@ builds:
     goarch:
       - amd64
       - arm64
+      - arm
+    goarm:
+      - 7
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: darwin
+        goarch: arm
 
 release:
   draft: true
 
 archives:
-  -
-    format: zip
+  - format: zip
     files:
       - LICENSE*
       - CHANGELOG*
@@ -35,7 +42,7 @@ checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  name_template: '{{ incpatch .Version }}-next'
 
 changelog:
   sort: asc

README.md

@@ -34,7 +34,7 @@ The easiest way to interact with the API is to use one of the official SDK clien
 
 ## Overview
 
-PocketBase could be used as a standalone app or as a Go framework/toolkit that enables you to build
+PocketBase could be [downloaded directly as a standalone app](https://github.com/pocketbase/pocketbase/releases) or it could be used as a Go framework/toolkit which allows you to build
 your own custom app specific business logic and still have a single portable executable at the end.
 
 ### Installation
@@ -91,7 +91,7 @@ Running/building the application is the same as for any other Go program, aka. j
 
 **PocketBase embeds SQLite, but doesn't require CGO.**
 
-If CGO is enabled, it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite). You can enable and disable CGO by setting the `CGO_ENABLED` enviroment variable to `1` or `0` respectively. 
+If CGO is enabled, it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite). You can enable and disable CGO by setting the `CGO_ENABLED` environment variable to `1` or `0` respectively.
 
 Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
 

apis/admin.go

@@ -66,7 +66,7 @@ func (api *adminApi) refresh(c echo.Context) error {
 func (api *adminApi) emailAuth(c echo.Context) error {
 	form := forms.NewAdminLogin(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	admin, submitErr := form.Submit()
@@ -80,7 +80,7 @@ func (api *adminApi) emailAuth(c echo.Context) error {
 func (api *adminApi) requestPasswordReset(c echo.Context) error {
 	form := forms.NewAdminPasswordResetRequest(api.app)
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	if err := form.Validate(); err != nil {
@@ -101,7 +101,7 @@ func (api *adminApi) requestPasswordReset(c echo.Context) error {
 func (api *adminApi) confirmPasswordReset(c echo.Context) error {
 	form := forms.NewAdminPasswordResetConfirm(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	admin, submitErr := form.Submit()

apis/admin_test.go

@@ -119,7 +119,7 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// simulate recent password request
 				admin, err := app.Dao().FindAdminByEmail("test@example.com")
 				if err != nil {
@@ -446,7 +446,7 @@ func TestAdminDelete(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins except the authorized one
 				adminModel := &models.Admin{}
 				_, err := app.Dao().DB().Delete(adminModel.TableName(), dbx.Not(dbx.HashExp{
@@ -483,7 +483,7 @@ func TestAdminCreate(t *testing.T) {
 			Method: http.MethodPost,
 			Url:    "/api/admins",
 			Body:   strings.NewReader(`{"email":"testnew@example.com","password":"1234567890","passwordConfirm":"1234567890","avatar":3}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins
 				_, err := app.Dao().DB().NewQuery("DELETE FROM {{_admins}}").Execute()
 				if err != nil {

apis/base.go

@@ -18,6 +18,8 @@ import (
 	"github.com/spf13/cast"
 )
 
+const trailedAdminPath = "/_/"
+
 // InitApi creates a configured echo instance with registered
 // system and app specific routes and middlewares.
 func InitApi(app core.App) (*echo.Echo, error) {
@@ -25,7 +27,12 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	e.Debug = app.IsDebug()
 
 	// default middlewares
-	e.Pre(middleware.RemoveTrailingSlash())
+	e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{
+		Skipper: func(c echo.Context) bool {
+			// ignore Admin UI route(s)
+			return strings.HasPrefix(c.Request().URL.Path, trailedAdminPath)
+		},
+	}))
 	e.Use(middleware.Recover())
 	e.Use(middleware.Secure())
 	e.Use(LoadAuthContext(app))
@@ -128,21 +135,20 @@ func StaticDirectoryHandler(fileSystem fs.FS, disablePathUnescaping bool) echo.H
 
 // bindStaticAdminUI registers the endpoints that serves the static admin UI.
 func bindStaticAdminUI(app core.App, e *echo.Echo) error {
-	// serves /ui/dist/index.html file
-	// (explicit route is used to avoid conflicts with `RemoveTrailingSlash` middleware)
-	e.FileFS(
-		"/_",
-		"index.html",
-		ui.DistIndexHTML,
-		middleware.Gzip(),
-		installerRedirect(app),
+	// redirect to trailing slash to ensure that relative urls will still work properly
+	e.GET(
+		strings.TrimRight(trailedAdminPath, "/"),
+		func(c echo.Context) error {
+			return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath)
+		},
 	)
 
 	// serves static files from the /ui/dist directory
 	// (similar to echo.StaticFS but with gzip middleware enabled)
 	e.GET(
-		"/_/*",
-		StaticDirectoryHandler(ui.DistDirFS, false),
+		trailedAdminPath+"*",
+		echo.StaticDirectoryHandler(ui.DistDirFS, false),
+		installerRedirect(app),
 		middleware.Gzip(),
 	)
 
@@ -175,6 +181,12 @@ func installerRedirect(app core.App) echo.MiddlewareFunc {
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
+			// skip redirect checks for non-root level index.html requests
+			path := c.Request().URL.Path
+			if path != trailedAdminPath && path != trailedAdminPath+"index.html" {
+				return next(c)
+			}
+
 			// load into cache (if not already)
 			if !app.Cache().Has(totalAdminsCacheKey) {
 				if err := updateTotalAdminsCache(app); err != nil {
@@ -188,12 +200,12 @@ func installerRedirect(app core.App) echo.MiddlewareFunc {
 
 			if totalAdmins == 0 && !hasInstallerParam {
 				// redirect to the installer page
-				return c.Redirect(http.StatusTemporaryRedirect, "/_/?installer#")
+				return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath+"?installer#")
 			}
 
 			if totalAdmins != 0 && hasInstallerParam {
 				// redirect to the home page
-				return c.Redirect(http.StatusTemporaryRedirect, "/_/#/")
+				return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath+"#/")
 			}
 
 			return next(c)

apis/base_test.go

@@ -54,7 +54,7 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "custom route",
 			Method: http.MethodGet,
 			Url:    "/custom",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/custom",
@@ -70,7 +70,7 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "route with HTTPError",
 			Method: http.MethodGet,
 			Url:    "/http-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/http-error",
@@ -86,7 +86,7 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "route with api error",
 			Method: http.MethodGet,
 			Url:    "/api-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/api-error",
@@ -102,7 +102,7 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "route with plain error",
 			Method: http.MethodGet,
 			Url:    "/plain-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/plain-error",

apis/collection.go

@@ -21,6 +21,7 @@ func BindCollectionApi(app core.App, rg *echo.Group) {
 	subGroup.GET("/:collection", api.view)
 	subGroup.PATCH("/:collection", api.update)
 	subGroup.DELETE("/:collection", api.delete)
+	subGroup.PUT("/import", api.bulkImport)
 }
 
 type collectionApi struct {
@@ -167,3 +168,38 @@ func (api *collectionApi) delete(c echo.Context) error {
 
 	return handlerErr
 }
+
+func (api *collectionApi) bulkImport(c echo.Context) error {
+	form := forms.NewCollectionsImport(api.app)
+
+	// load request data
+	if err := c.Bind(form); err != nil {
+		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := &core.CollectionsImportEvent{
+		HttpContext: c,
+		Collections: form.Collections,
+	}
+
+	// import collections
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
+		return func() error {
+			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+				form.Collections = e.Collections // ensures that the form always has the latest changes
+
+				if err := next(); err != nil {
+					return rest.NewBadRequestError("Failed to import the submitted collections.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		api.app.OnCollectionsAfterImportRequest().Trigger(event)
+	}
+
+	return submitErr
+}

apis/collection_test.go

@@ -5,6 +5,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -440,3 +442,266 @@ func TestCollectionUpdate(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestCollectionImport(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPut,
+			Url:             "/api/collections/import",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + empty collections",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			Body:   strings.NewReader(`{"collections":[]}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"validation_required"`,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collections := []*models.Collection{}
+				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				if len(collections) != 5 {
+					t.Fatalf("Expected %d collections, got %d", 5, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as admin + trying to delete system collections",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			Body:   strings.NewReader(`{"deleteMissing": true, "collections":[{"name": "test123"}]}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"collections_import_failure"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnCollectionsBeforeImportRequest": 1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collections := []*models.Collection{}
+				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				if len(collections) != 5 {
+					t.Fatalf("Expected %d collections, got %d", 5, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as admin + collections validator failure",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{
+						"name": "import1",
+						"schema": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					},
+					{"name": "import2"}
+				]
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"collections_import_failure"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnCollectionsBeforeImportRequest": 1,
+				"OnModelBeforeCreate":              2,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collections := []*models.Collection{}
+				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				if len(collections) != 5 {
+					t.Fatalf("Expected %d collections, got %d", 5, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as admin + successful collections save",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{
+						"name": "import1",
+						"schema": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"schema": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					}
+				]
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnCollectionsBeforeImportRequest": 1,
+				"OnCollectionsAfterImportRequest":  1,
+				"OnModelBeforeCreate":              2,
+				"OnModelAfterCreate":               2,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collections := []*models.Collection{}
+				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				if len(collections) != 7 {
+					t.Fatalf("Expected %d collections, got %d", 7, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as admin + successful collections save and old non-system collections deletion",
+			Method: http.MethodPut,
+			Url:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"deleteMissing": true,
+				"collections":[
+					{
+						"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+						"name":"profiles",
+						"system":true,
+						"listRule":"userId = @request.user.id",
+						"viewRule":"created > 'test_change'",
+						"createRule":"userId = @request.user.id",
+						"updateRule":"userId = @request.user.id",
+						"deleteRule":"userId = @request.user.id",
+						"schema":[
+							{
+								"id":"koih1lqx",
+								"name":"userId",
+								"type":"user",
+								"system":true,
+								"required":true,
+								"unique":true,
+								"options":{
+									"maxSelect":1,
+									"cascadeDelete":true
+								}
+							},
+							{
+								"id":"69ycbg3q",
+								"name":"rel",
+								"type":"relation",
+								"system":false,
+								"required":false,
+								"unique":false,
+								"options":{
+									"maxSelect":2,
+									"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+									"cascadeDelete":false
+								}
+							}
+						]
+					},
+					{
+						"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+						"name":"demo",
+						"schema":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"system":false,
+								"required":true,
+								"unique":false,
+								"options":{
+									"min":3,
+									"max":null,
+									"pattern":""
+								}
+							}
+						]
+					},
+					{
+						"name": "new_import",
+						"schema": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					}
+				]
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnCollectionsAfterImportRequest":  1,
+				"OnCollectionsBeforeImportRequest": 1,
+				"OnModelBeforeDelete":              3,
+				"OnModelAfterDelete":               3,
+				"OnModelBeforeUpdate":              2,
+				"OnModelAfterUpdate":               2,
+				"OnModelBeforeCreate":              1,
+				"OnModelAfterCreate":               1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				collections := []*models.Collection{}
+				if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				if len(collections) != 3 {
+					t.Fatalf("Expected %d collections, got %d", 3, len(collections))
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/file.go

@@ -78,7 +78,7 @@ func (api *fileApi) download(c echo.Context) error {
 			// - if exists - compare last modified dates to determine whether the thumb should be recreated
 			tAttrs, tAttrsErr := fs.Attributes(servedPath)
 			if tAttrsErr != nil || oAttrs.ModTime.After(tAttrs.ModTime) {
-				if err := fs.CreateThumb(originalPath, servedPath, thumbSize, false); err != nil {
+				if err := fs.CreateThumb(originalPath, servedPath, thumbSize); err != nil {
 					servedPath = originalPath // fallback to the original
 				}
 			}

apis/file_test.go

@@ -16,7 +16,12 @@ func TestFileDownload(t *testing.T) {
 	dataDirRelPath := "../tests/data/"
 	testFilePath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/848a1dea-5ddd-42d6-a00d-030547bffcfe/8fe61d65-6a2e-4f11-87b3-d8a3170bfd4f.txt")
 	testImgPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png")
-	testThumbPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/100x100_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbCropCenterPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/70x50_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbCropTopPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/70x50t_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbCropBottomPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/70x50b_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbFitPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/70x50f_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbZeroWidthPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/0x50_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+	testThumbZeroHeightPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/70x0_4881bdef-06b4-4dea-8d97-6125ad242677.png")
 
 	testFile, fileErr := os.ReadFile(testFilePath)
 	if fileErr != nil {
@@ -28,7 +33,32 @@ func TestFileDownload(t *testing.T) {
 		t.Fatal(imgErr)
 	}
 
-	testThumb, thumbErr := os.ReadFile(testThumbPath)
+	testThumbCropCenter, thumbErr := os.ReadFile(testThumbCropCenterPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropTop, thumbErr := os.ReadFile(testThumbCropTopPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropBottom, thumbErr := os.ReadFile(testThumbCropBottomPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbFit, thumbErr := os.ReadFile(testThumbFitPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroWidth, thumbErr := os.ReadFile(testThumbZeroWidthPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroHeight, thumbErr := os.ReadFile(testThumbZeroHeightPath)
 	if thumbErr != nil {
 		t.Fatal(thumbErr)
 	}
@@ -76,11 +106,61 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb",
+			Name:            "existing image - existing thumb (crop center)",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=100x100",
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=70x50",
 			ExpectedStatus:  200,
-			ExpectedContent: []string{string(testThumb)},
+			ExpectedContent: []string{string(testThumbCropCenter)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (crop top)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=70x50t",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropTop)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (crop bottom)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=70x50b",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropBottom)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (fit)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=70x50f",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbFit)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (zero width)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=0x50",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroWidth)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (zero height)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=70x0",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroHeight)},
 			ExpectedEvents: map[string]int{
 				"OnFileDownloadRequest": 1,
 			},

apis/logs.go

@@ -28,7 +28,7 @@ type logsApi struct {
 var requestFilterFields = []string{
 	"rowid", "id", "created", "updated",
 	"url", "method", "status", "auth",
-	"ip", "referer", "userAgent",
+	"remoteIp", "userIp", "referer", "userAgent",
 }
 
 func (api *logsApi) requestsList(c echo.Context) error {

apis/logs_test.go

@@ -34,7 +34,7 @@ func TestRequestsList(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}
@@ -56,7 +56,7 @@ func TestRequestsList(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}
@@ -103,7 +103,7 @@ func TestRequestView(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}
@@ -118,7 +118,7 @@ func TestRequestView(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}
@@ -161,7 +161,7 @@ func TestRequestsStats(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}
@@ -178,7 +178,7 @@ func TestRequestsStats(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if err := tests.MockRequestLogsData(app); err != nil {
 					t.Fatal(err)
 				}

apis/middlewares.go

@@ -3,6 +3,7 @@ package apis
 import (
 	"fmt"
 	"log"
+	"net"
 	"net/http"
 	"strings"
 	"time"
@@ -247,12 +248,15 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
 				requestAuth = models.RequestAuthAdmin
 			}
 
+			ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
+
 			model := &models.Request{
 				Url:       httpRequest.URL.RequestURI(),
 				Method:    strings.ToLower(httpRequest.Method),
 				Status:    status,
 				Auth:      requestAuth,
-				Ip:        httpRequest.RemoteAddr,
+				UserIp:    realUserIp(httpRequest, ip),
+				RemoteIp:  ip,
 				Referer:   httpRequest.Referer(),
 				UserAgent: httpRequest.UserAgent(),
 				Meta:      meta,
@@ -297,3 +301,29 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
 		}
 	}
 }
+
+// Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
+//
+// The returned IP value shouldn't be trusted if not behind a trusted reverse proxy!
+func realUserIp(r *http.Request, fallbackIp string) string {
+	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
+		return ip
+	}
+
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
+
+	if ipsList := r.Header.Get("X-Forwarded-For"); ipsList != "" {
+		ips := strings.Split(ipsList, ",")
+		// extract the rightmost ip
+		for i := len(ips) - 1; i >= 0; i-- {
+			ip := strings.TrimSpace(ips[i])
+			if ip != "" {
+				return ip
+			}
+		}
+	}
+
+	return fallbackIp
+}

apis/middlewares_test.go

@@ -18,7 +18,7 @@ func TestRequireGuestOnly(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -40,7 +40,7 @@ func TestRequireGuestOnly(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -62,7 +62,7 @@ func TestRequireGuestOnly(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -81,7 +81,7 @@ func TestRequireGuestOnly(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -109,7 +109,7 @@ func TestRequireUserAuth(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -131,7 +131,7 @@ func TestRequireUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -153,7 +153,7 @@ func TestRequireUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -175,7 +175,7 @@ func TestRequireUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -203,7 +203,7 @@ func TestRequireAdminAuth(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -225,7 +225,7 @@ func TestRequireAdminAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -247,7 +247,7 @@ func TestRequireAdminAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -269,7 +269,7 @@ func TestRequireAdminAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -297,7 +297,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			Name:   "guest (while having at least 1 existing admin)",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -316,7 +316,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			Name:   "guest (while having 0 existing admins)",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins
 				_, err := app.Dao().DB().NewQuery("DELETE FROM {{_admins}}").Execute()
 				if err != nil {
@@ -344,7 +344,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -366,7 +366,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -388,7 +388,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -416,7 +416,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -438,7 +438,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -460,7 +460,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -482,7 +482,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -510,7 +510,7 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -532,7 +532,7 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -555,7 +555,7 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 				// test3@example.com
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImVtYWlsIjoidGVzdDNAZXhhbXBsZS5jb20iLCJpZCI6Ijk3Y2MzZDNkLTZiYTItMzgzZi1iNDJhLTdiYzg0ZDI3NDEwYyIsImV4cCI6MTg5MzUxNTU3Nn0.Q965uvlTxxOsZbACXSgJQNXykYK0TKZ87nyPzemvN4E",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -577,7 +577,7 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -599,7 +599,7 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			RequestHeaders: map[string]string{
 				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:custom",

apis/realtime.go

@@ -48,6 +48,9 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	c.Response().Header().Set("Content-Type", "text/event-stream; charset=UTF-8")
 	c.Response().Header().Set("Cache-Control", "no-store")
 	c.Response().Header().Set("Connection", "keep-alive")
+	// https://github.com/pocketbase/pocketbase/discussions/480#discussioncomment-3657640
+	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
+	c.Response().Header().Set("X-Accel-Buffering", "no")
 
 	event := &core.RealtimeConnectEvent{
 		HttpContext: c,
@@ -210,13 +213,17 @@ func (api *realtimeApi) bindEvents() {
 		return nil
 	})
 
-	api.app.OnRecordAfterCreateRequest().Add(func(e *core.RecordCreateEvent) error {
-		api.broadcastRecord("create", e.Record)
+	api.app.OnModelAfterCreate().Add(func(e *core.ModelEvent) error {
+		if record, ok := e.Model.(*models.Record); ok {
+			api.broadcastRecord("create", record)
+		}
 		return nil
 	})
 
-	api.app.OnRecordAfterUpdateRequest().Add(func(e *core.RecordUpdateEvent) error {
-		api.broadcastRecord("update", e.Record)
+	api.app.OnModelAfterUpdate().Add(func(e *core.ModelEvent) error {
+		if record, ok := e.Model.(*models.Record); ok {
+			api.broadcastRecord("update", record)
+		}
 		return nil
 	})
 

apis/realtime_test.go

@@ -27,7 +27,7 @@ func TestRealtimeConnect(t *testing.T) {
 			ExpectedEvents: map[string]int{
 				"OnRealtimeConnectRequest": 1,
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if len(app.SubscriptionsBroker().Clients()) != 0 {
 					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
 				}
@@ -68,11 +68,11 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				client.Subscribe("test0")
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if len(client.Subscriptions()) != 0 {
 					t.Errorf("Expected no subscriptions, got %v", client.Subscriptions())
 				}
@@ -89,11 +89,11 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				client.Subscribe("test0")
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				expectedSubs := []string{"test1", "test2"}
 				if len(expectedSubs) != len(client.Subscriptions()) {
 					t.Errorf("Expected subscriptions %v, got %v", expectedSubs, client.Subscriptions())
@@ -120,10 +120,10 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				admin, _ := client.Get(apis.ContextAdminKey).(*models.Admin)
 				if admin == nil {
 					t.Errorf("Expected admin auth model, got nil")
@@ -144,10 +144,10 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				user, _ := client.Get(apis.ContextUserKey).(*models.User)
 				if user == nil {
 					t.Errorf("Expected user auth model, got nil")
@@ -165,14 +165,14 @@ func TestRealtimeSubscribe(t *testing.T) {
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				initialAuth := &models.User{}
 				initialAuth.RefreshId()
 				client.Set(apis.ContextUserKey, initialAuth)
 
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				user, _ := client.Get(apis.ContextUserKey).(*models.User)
 				if user == nil {
 					t.Errorf("Expected user auth model, got nil")

apis/record_test.go

@@ -459,7 +459,7 @@ func TestRecordDelete(t *testing.T) {
 				"OnModelBeforeDelete":         3, // +2 cascade delete related records
 				"OnModelAfterDelete":          3, // +2 cascade delete related records
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				ensureDeletedFiles(app, "3f2888f8-075d-49fe-9d09-ea7e951000dc", "577bd676-aacb-4072-b7da-99d00ee210a4")
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "94568ca2-0bee-49d7-b749-06cb97956fd9")
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "63c2ab80-84ab-4057-a592-4604a731f78f")
@@ -481,7 +481,7 @@ func TestRecordDelete(t *testing.T) {
 				"OnModelBeforeDelete":         3, // +2 cascade delete related records
 				"OnModelAfterDelete":          3, // +2 cascade delete related records
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				ensureDeletedFiles(app, "3f2888f8-075d-49fe-9d09-ea7e951000dc", "577bd676-aacb-4072-b7da-99d00ee210a4")
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "94568ca2-0bee-49d7-b749-06cb97956fd9")
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "63c2ab80-84ab-4057-a592-4604a731f78f")
@@ -501,7 +501,7 @@ func TestRecordDelete(t *testing.T) {
 				"OnModelBeforeDelete":         1,
 				"OnModelAfterDelete":          1,
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "94568ca2-0bee-49d7-b749-06cb97956fd9")
 			},
 		},
@@ -529,7 +529,7 @@ func TestRecordDelete(t *testing.T) {
 				"OnModelBeforeDelete":         1,
 				"OnModelAfterDelete":          1,
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				ensureDeletedFiles(app, "2c1010aa-b8fe-41d9-a980-99534ca8a167", "63c2ab80-84ab-4057-a592-4604a731f78f")
 			},
 		},
@@ -562,7 +562,7 @@ func TestRecordDelete(t *testing.T) {
 				"OnModelBeforeDelete":         3,
 				"OnModelAfterDelete":          3,
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				recId := "63c2ab80-84ab-4057-a592-4604a731f78f"
 				col, _ := app.Dao().FindCollectionByNameOrId("demo2")
 				rec, _ := app.Dao().FindRecordById(col, recId, nil)
@@ -750,6 +750,62 @@ func TestRecordCreate(t *testing.T) {
 				"OnModelAfterCreate":          1,
 			},
 		},
+		{
+			Name:   "invalid custom insertion id (less than 15 chars)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "12345678901234",
+				"title": "test"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"id":{"code":"validation_length_invalid"`,
+			},
+		},
+		{
+			Name:   "invalid custom insertion id (more than 15 chars)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "1234567890123456",
+				"title": "test"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"id":{"code":"validation_length_invalid"`,
+			},
+		},
+		{
+			Name:   "valid custom insertion id (exactly 15 chars)",
+			Method: http.MethodPost,
+			Url:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "123456789012345",
+				"title": "test"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"123456789012345"`,
+				`"title":"test"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeCreateRequest": 1,
+				"OnRecordAfterCreateRequest":  1,
+				"OnModelBeforeCreate":         1,
+				"OnModelAfterCreate":          1,
+			},
+		},
+
 		{
 			Name:   "submit via multipart form data",
 			Method: http.MethodPost,

apis/settings.go

@@ -3,10 +3,12 @@ package apis
 import (
 	"net/http"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/security"
 )
 
 // BindSettingsApi registers the settings api endpoints.
@@ -16,6 +18,8 @@ func BindSettingsApi(app core.App, rg *echo.Group) {
 	subGroup := rg.Group("/settings", ActivityLogger(app), RequireAdminAuth())
 	subGroup.GET("", api.list)
 	subGroup.PATCH("", api.set)
+	subGroup.POST("/test/s3", api.testS3)
+	subGroup.POST("/test/email", api.testEmail)
 }
 
 type settingsApi struct {
@@ -43,7 +47,7 @@ func (api *settingsApi) set(c echo.Context) error {
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	event := &core.SettingsUpdateEvent{
@@ -76,3 +80,49 @@ func (api *settingsApi) set(c echo.Context) error {
 
 	return submitErr
 }
+
+func (api *settingsApi) testS3(c echo.Context) error {
+	if !api.app.Settings().S3.Enabled {
+		return rest.NewBadRequestError("S3 storage is not enabled.", nil)
+	}
+
+	fs, err := api.app.NewFilesystem()
+	if err != nil {
+		return rest.NewBadRequestError("Failed to initialize the S3 storage. Raw error: \n"+err.Error(), nil)
+	}
+	defer fs.Close()
+
+	testFileKey := "pb_test_" + security.RandomString(5) + "/test.txt"
+
+	if err := fs.Upload([]byte("test"), testFileKey); err != nil {
+		return rest.NewBadRequestError("Failed to upload a test file. Raw error: \n"+err.Error(), nil)
+	}
+
+	if err := fs.Delete(testFileKey); err != nil {
+		return rest.NewBadRequestError("Failed to delete a test file. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (api *settingsApi) testEmail(c echo.Context) error {
+	form := forms.NewTestEmailSend(api.app)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// send
+	if err := form.Submit(); err != nil {
+		if fErr, ok := err.(validation.Errors); ok {
+			// form error
+			return rest.NewBadRequestError("Failed to send the test email.", fErr)
+		}
+
+		// mailer error
+		return rest.NewBadRequestError("Failed to send the test email. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}

apis/settings_test.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -51,6 +52,7 @@ func TestSettingsList(t *testing.T) {
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"discordAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 			},
@@ -113,6 +115,7 @@ func TestSettingsSet(t *testing.T) {
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"discordAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"Acme"`,
@@ -165,6 +168,7 @@ func TestSettingsSet(t *testing.T) {
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"discordAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"update_test"`,
@@ -183,3 +187,192 @@ func TestSettingsSet(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestSettingsTestS3(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			Url:             "/api/settings/test/s3",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (no s3)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		// @todo consider creating a test S3 filesystem
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsTestEmail(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (invalid body)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (empty json)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"email":{"code":"validation_required"`,
+				`"template":{"code":"validation_required"`,
+			},
+		},
+		{
+			Name:   "authorized as admin (verifiation template)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if app.TestMailer.LastToAddress.Address != "test@example.com" {
+					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastHtmlBody, "Verify") {
+					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeUserVerificationSend": 1,
+				"OnMailerAfterUserVerificationSend":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin (password reset template)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "password-reset",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if app.TestMailer.LastToAddress.Address != "test@example.com" {
+					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastHtmlBody, "Reset password") {
+					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeUserResetPasswordSend": 1,
+				"OnMailerAfterUserResetPasswordSend":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin (email change)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "email-change",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if app.TestMailer.LastToAddress.Address != "test@example.com" {
+					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastHtmlBody, "Confirm new email") {
+					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeUserChangeEmailSend": 1,
+				"OnMailerAfterUserChangeEmailSend":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/user.go

@@ -38,6 +38,8 @@ func BindUserApi(app core.App, rg *echo.Group) {
 	subGroup.GET("/:id", api.view, RequireAdminOrOwnerAuth("id"))
 	subGroup.PATCH("/:id", api.update, RequireAdminAuth())
 	subGroup.DELETE("/:id", api.delete, RequireAdminOrOwnerAuth("id"))
+	subGroup.GET("/:id/external-auths", api.listExternalAuths, RequireAdminOrOwnerAuth("id"))
+	subGroup.DELETE("/:id/external-auths/:provider", api.unlinkExternalAuth, RequireAdminOrOwnerAuth("id"))
 }
 
 type userApi struct {
@@ -129,7 +131,7 @@ func (api *userApi) authMethods(c echo.Context) error {
 		}
 
 		state := security.RandomString(30)
-		codeVerifier := security.RandomString(30)
+		codeVerifier := security.RandomString(43)
 		codeChallenge := security.S256Challenge(codeVerifier)
 		codeChallengeMethod := "S256"
 		result.AuthProviders = append(result.AuthProviders, providerInfo{
@@ -152,7 +154,7 @@ func (api *userApi) authMethods(c echo.Context) error {
 func (api *userApi) oauth2Auth(c echo.Context) error {
 	form := forms.NewUserOauth2Login(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	user, authData, submitErr := form.Submit()
@@ -170,7 +172,7 @@ func (api *userApi) emailAuth(c echo.Context) error {
 
 	form := forms.NewUserEmailLogin(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	user, submitErr := form.Submit()
@@ -184,7 +186,7 @@ func (api *userApi) emailAuth(c echo.Context) error {
 func (api *userApi) requestPasswordReset(c echo.Context) error {
 	form := forms.NewUserPasswordResetRequest(api.app)
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	if err := form.Validate(); err != nil {
@@ -205,7 +207,7 @@ func (api *userApi) requestPasswordReset(c echo.Context) error {
 func (api *userApi) confirmPasswordReset(c echo.Context) error {
 	form := forms.NewUserPasswordResetConfirm(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	user, submitErr := form.Submit()
@@ -224,7 +226,7 @@ func (api *userApi) requestEmailChange(c echo.Context) error {
 
 	form := forms.NewUserEmailChangeRequest(api.app, loggedUser)
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	if err := form.Submit(); err != nil {
@@ -237,7 +239,7 @@ func (api *userApi) requestEmailChange(c echo.Context) error {
 func (api *userApi) confirmEmailChange(c echo.Context) error {
 	form := forms.NewUserEmailChangeConfirm(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	user, submitErr := form.Submit()
@@ -251,7 +253,7 @@ func (api *userApi) confirmEmailChange(c echo.Context) error {
 func (api *userApi) requestVerification(c echo.Context) error {
 	form := forms.NewUserVerificationRequest(api.app)
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	if err := form.Validate(); err != nil {
@@ -272,7 +274,7 @@ func (api *userApi) requestVerification(c echo.Context) error {
 func (api *userApi) confirmVerification(c echo.Context) error {
 	form := forms.NewUserVerificationConfirm(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return rest.NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
 	user, submitErr := form.Submit()
@@ -450,3 +452,68 @@ func (api *userApi) delete(c echo.Context) error {
 
 	return handlerErr
 }
+
+func (api *userApi) listExternalAuths(c echo.Context) error {
+	id := c.PathParam("id")
+	if id == "" {
+		return rest.NewNotFoundError("", nil)
+	}
+
+	user, err := api.app.Dao().FindUserById(id)
+	if err != nil || user == nil {
+		return rest.NewNotFoundError("", err)
+	}
+
+	externalAuths, err := api.app.Dao().FindAllExternalAuthsByUserId(user.Id)
+	if err != nil {
+		return rest.NewBadRequestError("Failed to fetch the external auths for the specified user.", err)
+	}
+
+	event := &core.UserListExternalAuthsEvent{
+		HttpContext:   c,
+		User:          user,
+		ExternalAuths: externalAuths,
+	}
+
+	return api.app.OnUserListExternalAuths().Trigger(event, func(e *core.UserListExternalAuthsEvent) error {
+		return e.HttpContext.JSON(http.StatusOK, e.ExternalAuths)
+	})
+}
+
+func (api *userApi) unlinkExternalAuth(c echo.Context) error {
+	id := c.PathParam("id")
+	provider := c.PathParam("provider")
+	if id == "" || provider == "" {
+		return rest.NewNotFoundError("", nil)
+	}
+
+	user, err := api.app.Dao().FindUserById(id)
+	if err != nil || user == nil {
+		return rest.NewNotFoundError("", err)
+	}
+
+	externalAuth, err := api.app.Dao().FindExternalAuthByUserIdAndProvider(user.Id, provider)
+	if err != nil {
+		return rest.NewNotFoundError("Missing external auth provider relation.", err)
+	}
+
+	event := &core.UserUnlinkExternalAuthEvent{
+		HttpContext:  c,
+		User:         user,
+		ExternalAuth: externalAuth,
+	}
+
+	handlerErr := api.app.OnUserBeforeUnlinkExternalAuthRequest().Trigger(event, func(e *core.UserUnlinkExternalAuthEvent) error {
+		if err := api.app.Dao().DeleteExternalAuth(externalAuth); err != nil {
+			return rest.NewBadRequestError("Cannot unlink the external auth provider. Make sure that the user has other linked auth providers OR has an email address.", err)
+		}
+
+		return e.HttpContext.NoContent(http.StatusNoContent)
+	})
+
+	if handlerErr == nil {
+		api.app.OnUserAfterUnlinkExternalAuthRequest().Trigger(event)
+	}
+
+	return handlerErr
+}

apis/user_test.go

@@ -84,7 +84,7 @@ func TestUserEmailAuth(t *testing.T) {
 			Method: http.MethodPost,
 			Url:    "/api/users/auth-via-email",
 			Body:   strings.NewReader(`{"email":"test@example.com","password":"123456"}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.Settings().EmailAuth.Enabled = false
 			},
 			ExpectedStatus:  400,
@@ -159,7 +159,7 @@ func TestUserRequestPasswordReset(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// simulate recent password request
 				user, err := app.Dao().FindUserByEmail("test@example.com")
 				if err != nil {
@@ -285,7 +285,7 @@ func TestUserRequestVerification(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// simulate recent verification sent
 				user, err := app.Dao().FindUserByEmail("test2@example.com")
 				if err != nil {
@@ -584,11 +584,12 @@ func TestUsersList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
-				`"totalItems":3`,
+				`"totalItems":4`,
 				`"items":[{`,
 				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
 				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
 				`"id":"97cc3d3d-6ba2-383f-b42a-7bc84d27410c"`,
+				`"id":"cx9u0dh2udo8xol"`,
 			},
 			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
 		},
@@ -603,8 +604,9 @@ func TestUsersList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":2`,
 				`"perPage":2`,
-				`"totalItems":3`,
+				`"totalItems":4`,
 				`"items":[{`,
+				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
 				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
 			},
 			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
@@ -630,10 +632,11 @@ func TestUsersList(t *testing.T) {
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
-				`"totalItems":2`,
+				`"totalItems":3`,
 				`"items":[{`,
 				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
 				`"id":"97cc3d3d-6ba2-383f-b42a-7bc84d27410c"`,
+				`"id":"cx9u0dh2udo8xol"`,
 			},
 			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
 		},
@@ -804,7 +807,7 @@ func TestUserCreate(t *testing.T) {
 			Method: http.MethodPost,
 			Url:    "/api/users",
 			Body:   strings.NewReader(`{"email":"newuser@example.com","password":"123456789","passwordConfirm":"123456789"}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.Settings().EmailAuth.Enabled = false
 			},
 			ExpectedStatus:  400,
@@ -926,3 +929,185 @@ func TestUserUpdate(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestUserListExternalsAuths(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			Url:             "/api/users/cx9u0dh2udo8xol/external-auths",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + nonexisting user id",
+			Method: http.MethodGet,
+			Url:    "/api/users/000000000000000/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin + existing user id and no external auths",
+			Method: http.MethodGet,
+			Url:    "/api/users/97cc3d3d-6ba2-383f-b42a-7bc84d27410c/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[]`,
+			},
+			ExpectedEvents: map[string]int{"OnUserListExternalAuths": 1},
+		},
+		{
+			Name:   "authorized as admin + existing user id and 2 external auths",
+			Method: http.MethodGet,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"abcdefghijklmn1"`,
+				`"id":"abcdefghijklmn0"`,
+				`"userId":"cx9u0dh2udo8xol"`,
+			},
+			ExpectedEvents: map[string]int{"OnUserListExternalAuths": 1},
+		},
+		{
+			Name:   "authorized as user - trying to list another user external auths",
+			Method: http.MethodGet,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user - owner without external auths",
+			Method: http.MethodGet,
+			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[]`,
+			},
+			ExpectedEvents: map[string]int{"OnUserListExternalAuths": 1},
+		},
+		{
+			Name:   "authorized as user - owner with 2 external auths",
+			Method: http.MethodGet,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImN4OXUwZGgydWRvOHhvbCIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.NgFYG2D7PftFW1tcfe5E2oDi_AVakDR9J6WI6VUZQfw",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"abcdefghijklmn1"`,
+				`"id":"abcdefghijklmn0"`,
+				`"userId":"cx9u0dh2udo8xol"`,
+			},
+			ExpectedEvents: map[string]int{"OnUserListExternalAuths": 1},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestUserUnlinkExternalsAuth(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodDelete,
+			Url:             "/api/users/cx9u0dh2udo8xol/external-auths/google",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin - nonexisting user id",
+			Method: http.MethodDelete,
+			Url:    "/api/users/000000000000000/external-auths/google",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin - nonexisting provider",
+			Method: http.MethodDelete,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths/facebook",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin - existing provider",
+			Method: http.MethodDelete,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths/google",
+			RequestHeaders: map[string]string{
+				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnModelAfterDelete":                    1,
+				"OnModelBeforeDelete":                   1,
+				"OnUserAfterUnlinkExternalAuthRequest":  1,
+				"OnUserBeforeUnlinkExternalAuthRequest": 1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				auth, _ := app.Dao().FindExternalAuthByUserIdAndProvider("cx9u0dh2udo8xol", "google")
+				if auth != nil {
+					t.Fatalf("Expected the google ExternalAuth to be deleted, got got \n%v", auth)
+				}
+			},
+		},
+		{
+			Name:   "authorized as user - trying to unlink another user external auth",
+			Method: http.MethodDelete,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths/google",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as user - owner with existing external auth",
+			Method: http.MethodDelete,
+			Url:    "/api/users/cx9u0dh2udo8xol/external-auths/google",
+			RequestHeaders: map[string]string{
+				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImN4OXUwZGgydWRvOHhvbCIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.NgFYG2D7PftFW1tcfe5E2oDi_AVakDR9J6WI6VUZQfw",
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnModelAfterDelete":                    1,
+				"OnModelBeforeDelete":                   1,
+				"OnUserAfterUnlinkExternalAuthRequest":  1,
+				"OnUserBeforeUnlinkExternalAuthRequest": 1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				auth, _ := app.Dao().FindExternalAuthByUserIdAndProvider("cx9u0dh2udo8xol", "google")
+				if auth != nil {
+					t.Fatalf("Expected the google ExternalAuth to be deleted, got got \n%v", auth)
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

cmd/migrate.go

@@ -1,12 +1,21 @@
 package cmd
 
 import (
+	"encoding/json"
+	"fmt"
 	"log"
+	"os"
+	"path"
+	"time"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/migrations"
 	"github.com/pocketbase/pocketbase/migrations/logs"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/inflector"
 	"github.com/pocketbase/pocketbase/tools/migrate"
 	"github.com/spf13/cobra"
 )
@@ -15,18 +24,40 @@ import (
 func NewMigrateCommand(app core.App) *cobra.Command {
 	desc := `
 Supported arguments are:
-- up                 - runs all available migrations.
-- down [number]      - reverts the last [number] applied migrations.
-- create folder name - creates new migration template file.
+- up                   - runs all available migrations.
+- down [number]        - reverts the last [number] applied migrations.
+- create name [folder] - creates new migration template file.
+- collections [folder] - (Experimental) creates new migration file with the most recent local collections configuration.
 `
 	var databaseFlag string
 
 	command := &cobra.Command{
 		Use:       "migrate",
 		Short:     "Executes DB migration scripts",
-		ValidArgs: []string{"up", "down", "create"},
+		ValidArgs: []string{"up", "down", "create", "collections"},
 		Long:      desc,
 		Run: func(command *cobra.Command, args []string) {
+			cmd := ""
+			if len(args) > 0 {
+				cmd = args[0]
+			}
+
+			// additional commands
+			// ---
+			if cmd == "create" {
+				if err := migrateCreateHandler(defaultMigrateCreateTemplate, args[1:]); err != nil {
+					log.Fatal(err)
+				}
+				return
+			}
+			if cmd == "collections" {
+				if err := migrateCollectionsHandler(app, args[1:]); err != nil {
+					log.Fatal(err)
+				}
+				return
+			}
+			// ---
+
 			// normalize
 			if databaseFlag != "logs" {
 				databaseFlag = "db"
@@ -75,3 +106,136 @@ func migrationsConnectionsMap(app core.App) map[string]migrationsConnection {
 		},
 	}
 }
+
+// -------------------------------------------------------------------
+// migrate create
+// -------------------------------------------------------------------
+
+const defaultMigrateCreateTemplate = `package migrations
+
+import (
+	"github.com/pocketbase/dbx"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		// add up queries...
+
+		return nil
+	}, func(db dbx.Builder) error {
+		// add down queries...
+
+		return nil
+	})
+}
+`
+
+func migrateCreateHandler(template string, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Missing migration file name")
+	}
+
+	name := args[0]
+
+	var dir string
+	if len(args) == 2 {
+		dir = args[1]
+	}
+	if dir == "" {
+		// If not specified, auto point to the default migrations folder.
+		//
+		// NB!
+		// Since the create command makes sense only during development,
+		// it is expected the user to be in the app working directory
+		// and to be using `go run`
+		wd, err := os.Getwd()
+		if err != nil {
+			return err
+		}
+		dir = path.Join(wd, "migrations")
+	}
+
+	resultFilePath := path.Join(
+		dir,
+		fmt.Sprintf("%d_%s.go", time.Now().Unix(), inflector.Snakecase(name)),
+	)
+
+	confirm := false
+	prompt := &survey.Confirm{
+		Message: fmt.Sprintf("Do you really want to create migration %q?", resultFilePath),
+	}
+	survey.AskOne(prompt, &confirm)
+	if !confirm {
+		fmt.Println("The command has been cancelled")
+		return nil
+	}
+
+	// ensure that migrations dir exist
+	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		return err
+	}
+
+	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
+		return fmt.Errorf("Failed to save migration file %q\n", resultFilePath)
+	}
+
+	fmt.Printf("Successfully created file %q\n", resultFilePath)
+	return nil
+}
+
+// -------------------------------------------------------------------
+// migrate collections
+// -------------------------------------------------------------------
+
+const collectionsMigrateCreateTemplate = `package migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+// Auto generated migration with the most recent collections configuration.
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		jsonData := ` + "`" + `%s` + "`" + `
+
+		collections := []*models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collections); err != nil {
+			return err
+		}
+
+		return daos.New(db).ImportCollections(collections, true, nil)
+	}, func(db dbx.Builder) error {
+		// no revert since the configuration on the environment, on which
+		// the migration was executed, could have changed via the UI/API
+		return nil
+	})
+}
+`
+
+func migrateCollectionsHandler(app core.App, args []string) error {
+	createArgs := []string{"collections_snapshot"}
+	createArgs = append(createArgs, args...)
+
+	dao := daos.New(app.DB())
+
+	collections := []*models.Collection{}
+	if err := dao.CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
+		return fmt.Errorf("Failed to fetch migrations list: %v", err)
+	}
+
+	serialized, err := json.MarshalIndent(collections, "\t\t", "\t")
+	if err != nil {
+		return fmt.Errorf("Failed to serialize collections list: %v", err)
+	}
+
+	return migrateCreateHandler(
+		fmt.Sprintf(collectionsMigrateCreateTemplate, string(serialized)),
+		createArgs,
+	)
+}

cmd/serve.go

@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"crypto/tls"
-	"fmt"
 	"log"
 	"net"
 	"net/http"
@@ -28,7 +27,7 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 
 	command := &cobra.Command{
 		Use:   "serve",
-		Short: "Starts the web server (default to localhost:8090)",
+		Short: "Starts the web server (default to 127.0.0.1:8090)",
 		Run: func(command *cobra.Command, args []string) {
 			// ensure that the latest migrations are applied before starting the server
 			if err := runMigrations(app); err != nil {
@@ -87,10 +86,11 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 				if httpsAddr != "" {
 					schema = "https"
 				}
+				regular := color.New()
 				bold := color.New(color.Bold).Add(color.FgGreen)
 				bold.Printf("> Server started at: %s\n", color.CyanString("%s://%s", schema, serverConfig.Addr))
-				fmt.Printf("  - REST API: %s\n", color.CyanString("%s://%s/api/", schema, serverConfig.Addr))
-				fmt.Printf("  - Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, serverConfig.Addr))
+				regular.Printf("  - REST API: %s\n", color.CyanString("%s://%s/api/", schema, serverConfig.Addr))
+				regular.Printf("  - Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, serverConfig.Addr))
 			}
 
 			var serveErr error
@@ -123,7 +123,7 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 	command.PersistentFlags().StringVar(
 		&httpAddr,
 		"http",
-		"localhost:8090",
+		"127.0.0.1:8090",
 		"api HTTP server address",
 	)
 

core/app.go

@@ -119,7 +119,7 @@ type App interface {
 	// sending a password reset email to an admin.
 	//
 	// Could be used to send your own custom email template if
-	// hook.StopPropagation is returned in one of its listeners.
+	// [hook.StopPropagation] is returned in one of its listeners.
 	OnMailerBeforeAdminResetPasswordSend() *hook.Hook[*MailerAdminEvent]
 
 	// OnMailerAfterAdminResetPasswordSend hook is triggered after
@@ -130,7 +130,7 @@ type App interface {
 	// sending a password reset email to a user.
 	//
 	// Could be used to send your own custom email template if
-	// hook.StopPropagation is returned in one of its listeners.
+	// [hook.StopPropagation] is returned in one of its listeners.
 	OnMailerBeforeUserResetPasswordSend() *hook.Hook[*MailerUserEvent]
 
 	// OnMailerAfterUserResetPasswordSend hook is triggered after
@@ -141,7 +141,7 @@ type App interface {
 	// sending a verification email to a user.
 	//
 	// Could be used to send your own custom email template if
-	// hook.StopPropagation is returned in one of its listeners.
+	// [hook.StopPropagation] is returned in one of its listeners.
 	OnMailerBeforeUserVerificationSend() *hook.Hook[*MailerUserEvent]
 
 	// OnMailerAfterUserVerificationSend hook is triggered after a user
@@ -152,7 +152,7 @@ type App interface {
 	// sending a confirmation new address email to a a user.
 	//
 	// Could be used to send your own custom email template if
-	// hook.StopPropagation is returned in one of its listeners.
+	// [hook.StopPropagation] is returned in one of its listeners.
 	OnMailerBeforeUserChangeEmailSend() *hook.Hook[*MailerUserEvent]
 
 	// OnMailerAfterUserChangeEmailSend hook is triggered after a user
@@ -192,7 +192,7 @@ type App interface {
 	//
 	// Could be used to additionally validate the request data or
 	// implement completely different persistence behavior
-	// (returning hook.StopPropagation).
+	// (returning [hook.StopPropagation]).
 	OnSettingsBeforeUpdateRequest() *hook.Hook[*SettingsUpdateEvent]
 
 	// OnSettingsAfterUpdateRequest hook is triggered after each
@@ -227,7 +227,7 @@ type App interface {
 	// Admin create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnAdminBeforeCreateRequest() *hook.Hook[*AdminCreateEvent]
 
 	// OnAdminAfterCreateRequest hook is triggered after each
@@ -238,7 +238,7 @@ type App interface {
 	// Admin update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnAdminBeforeUpdateRequest() *hook.Hook[*AdminUpdateEvent]
 
 	// OnAdminAfterUpdateRequest hook is triggered after each
@@ -249,7 +249,7 @@ type App interface {
 	// Admin delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning hook.StopPropagation).
+	// completely different delete behavior (returning [hook.StopPropagation]).
 	OnAdminBeforeDeleteRequest() *hook.Hook[*AdminDeleteEvent]
 
 	// OnAdminAfterDeleteRequest hook is triggered after each
@@ -281,7 +281,7 @@ type App interface {
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnUserBeforeCreateRequest() *hook.Hook[*UserCreateEvent]
 
 	// OnUserAfterCreateRequest hook is triggered after each
@@ -292,7 +292,7 @@ type App interface {
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnUserBeforeUpdateRequest() *hook.Hook[*UserUpdateEvent]
 
 	// OnUserAfterUpdateRequest hook is triggered after each
@@ -303,7 +303,7 @@ type App interface {
 	// delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning hook.StopPropagation).
+	// completely different delete behavior (returning [hook.StopPropagation]).
 	OnUserBeforeDeleteRequest() *hook.Hook[*UserDeleteEvent]
 
 	// OnUserAfterDeleteRequest hook is triggered after each
@@ -317,16 +317,21 @@ type App interface {
 	// authenticated user data and token.
 	OnUserAuthRequest() *hook.Hook[*UserAuthEvent]
 
-	// OnUserBeforeOauth2Register hook is triggered before each User OAuth2
-	// authentication request (when the client config has enabled new users registration).
+	// OnUserListExternalAuths hook is triggered on each API user's external auths list request.
 	//
-	// Could be used to additionally validate or modify the new user
-	// before persisting in the DB.
-	OnUserBeforeOauth2Register() *hook.Hook[*UserOauth2RegisterEvent]
+	// Could be used to validate or modify the response before returning it to the client.
+	OnUserListExternalAuths() *hook.Hook[*UserListExternalAuthsEvent]
 
-	// OnUserAfterOauth2Register hook is triggered after each successful User
-	// OAuth2 authentication sign-up request (right after the new user persistence).
-	OnUserAfterOauth2Register() *hook.Hook[*UserOauth2RegisterEvent]
+	// OnUserBeforeUnlinkExternalAuthRequest hook is triggered before each API user's
+	// external auth unlink request (after models load and before the actual relation deletion).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different delete behavior (returning [hook.StopPropagation]).
+	OnUserBeforeUnlinkExternalAuthRequest() *hook.Hook[*UserUnlinkExternalAuthEvent]
+
+	// OnUserAfterUnlinkExternalAuthRequest hook is triggered after each
+	// successful API user's external auth unlink request.
+	OnUserAfterUnlinkExternalAuthRequest() *hook.Hook[*UserUnlinkExternalAuthEvent]
 
 	// ---------------------------------------------------------------
 	// Record API event hooks
@@ -346,7 +351,7 @@ type App interface {
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnRecordBeforeCreateRequest() *hook.Hook[*RecordCreateEvent]
 
 	// OnRecordAfterCreateRequest hook is triggered after each
@@ -357,7 +362,7 @@ type App interface {
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnRecordBeforeUpdateRequest() *hook.Hook[*RecordUpdateEvent]
 
 	// OnRecordAfterUpdateRequest hook is triggered after each
@@ -368,7 +373,7 @@ type App interface {
 	// delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning hook.StopPropagation).
+	// completely different delete behavior (returning [hook.StopPropagation]).
 	OnRecordBeforeDeleteRequest() *hook.Hook[*RecordDeleteEvent]
 
 	// OnRecordAfterDeleteRequest hook is triggered after each
@@ -393,7 +398,7 @@ type App interface {
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnCollectionBeforeCreateRequest() *hook.Hook[*CollectionCreateEvent]
 
 	// OnCollectionAfterCreateRequest hook is triggered after each
@@ -404,7 +409,7 @@ type App interface {
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning hook.StopPropagation).
+	// completely different persistence behavior (returning [hook.StopPropagation]).
 	OnCollectionBeforeUpdateRequest() *hook.Hook[*CollectionUpdateEvent]
 
 	// OnCollectionAfterUpdateRequest hook is triggered after each
@@ -415,10 +420,21 @@ type App interface {
 	// Collection delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning hook.StopPropagation).
+	// completely different delete behavior (returning [hook.StopPropagation]).
 	OnCollectionBeforeDeleteRequest() *hook.Hook[*CollectionDeleteEvent]
 
 	// OnCollectionAfterDeleteRequest hook is triggered after each
 	// successful API Collection delete request.
 	OnCollectionAfterDeleteRequest() *hook.Hook[*CollectionDeleteEvent]
+
+	// OnCollectionsBeforeImportRequest hook is triggered before each API
+	// collections import request (after request data load and before the actual import).
+	//
+	// Could be used to additionally validate the imported collections or
+	// to implement completely different import behavior (returning [hook.StopPropagation]).
+	OnCollectionsBeforeImportRequest() *hook.Hook[*CollectionsImportEvent]
+
+	// OnCollectionsAfterImportRequest hook is triggered after each
+	// successful API collections import request.
+	OnCollectionsAfterImportRequest() *hook.Hook[*CollectionsImportEvent]
 }

core/base.go

@@ -85,18 +85,19 @@ type BaseApp struct {
 	onAdminAfterDeleteRequest  *hook.Hook[*AdminDeleteEvent]
 	onAdminAuthRequest         *hook.Hook[*AdminAuthEvent]
 
-	// user api event hooks
-	onUsersListRequest         *hook.Hook[*UsersListEvent]
-	onUserViewRequest          *hook.Hook[*UserViewEvent]
-	onUserBeforeCreateRequest  *hook.Hook[*UserCreateEvent]
-	onUserAfterCreateRequest   *hook.Hook[*UserCreateEvent]
-	onUserBeforeUpdateRequest  *hook.Hook[*UserUpdateEvent]
-	onUserAfterUpdateRequest   *hook.Hook[*UserUpdateEvent]
-	onUserBeforeDeleteRequest  *hook.Hook[*UserDeleteEvent]
-	onUserAfterDeleteRequest   *hook.Hook[*UserDeleteEvent]
-	onUserAuthRequest          *hook.Hook[*UserAuthEvent]
-	onUserBeforeOauth2Register *hook.Hook[*UserOauth2RegisterEvent]
-	onUserAfterOauth2Register  *hook.Hook[*UserOauth2RegisterEvent]
+	//                                    user api event hooks
+	onUsersListRequest                    *hook.Hook[*UsersListEvent]
+	onUserViewRequest                     *hook.Hook[*UserViewEvent]
+	onUserBeforeCreateRequest             *hook.Hook[*UserCreateEvent]
+	onUserAfterCreateRequest              *hook.Hook[*UserCreateEvent]
+	onUserBeforeUpdateRequest             *hook.Hook[*UserUpdateEvent]
+	onUserAfterUpdateRequest              *hook.Hook[*UserUpdateEvent]
+	onUserBeforeDeleteRequest             *hook.Hook[*UserDeleteEvent]
+	onUserAfterDeleteRequest              *hook.Hook[*UserDeleteEvent]
+	onUserAuthRequest                     *hook.Hook[*UserAuthEvent]
+	onUserListExternalAuths               *hook.Hook[*UserListExternalAuthsEvent]
+	onUserBeforeUnlinkExternalAuthRequest *hook.Hook[*UserUnlinkExternalAuthEvent]
+	onUserAfterUnlinkExternalAuthRequest  *hook.Hook[*UserUnlinkExternalAuthEvent]
 
 	// record api event hooks
 	onRecordsListRequest        *hook.Hook[*RecordsListEvent]
@@ -109,14 +110,16 @@ type BaseApp struct {
 	onRecordAfterDeleteRequest  *hook.Hook[*RecordDeleteEvent]
 
 	// collection api event hooks
-	onCollectionsListRequest        *hook.Hook[*CollectionsListEvent]
-	onCollectionViewRequest         *hook.Hook[*CollectionViewEvent]
-	onCollectionBeforeCreateRequest *hook.Hook[*CollectionCreateEvent]
-	onCollectionAfterCreateRequest  *hook.Hook[*CollectionCreateEvent]
-	onCollectionBeforeUpdateRequest *hook.Hook[*CollectionUpdateEvent]
-	onCollectionAfterUpdateRequest  *hook.Hook[*CollectionUpdateEvent]
-	onCollectionBeforeDeleteRequest *hook.Hook[*CollectionDeleteEvent]
-	onCollectionAfterDeleteRequest  *hook.Hook[*CollectionDeleteEvent]
+	onCollectionsListRequest         *hook.Hook[*CollectionsListEvent]
+	onCollectionViewRequest          *hook.Hook[*CollectionViewEvent]
+	onCollectionBeforeCreateRequest  *hook.Hook[*CollectionCreateEvent]
+	onCollectionAfterCreateRequest   *hook.Hook[*CollectionCreateEvent]
+	onCollectionBeforeUpdateRequest  *hook.Hook[*CollectionUpdateEvent]
+	onCollectionAfterUpdateRequest   *hook.Hook[*CollectionUpdateEvent]
+	onCollectionBeforeDeleteRequest  *hook.Hook[*CollectionDeleteEvent]
+	onCollectionAfterDeleteRequest   *hook.Hook[*CollectionDeleteEvent]
+	onCollectionsBeforeImportRequest *hook.Hook[*CollectionsImportEvent]
+	onCollectionsAfterImportRequest  *hook.Hook[*CollectionsImportEvent]
 }
 
 // NewBaseApp creates and returns a new BaseApp instance
@@ -178,17 +181,18 @@ func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
 		onAdminAuthRequest:         &hook.Hook[*AdminAuthEvent]{},
 
 		// user API event hooks
-		onUsersListRequest:         &hook.Hook[*UsersListEvent]{},
-		onUserViewRequest:          &hook.Hook[*UserViewEvent]{},
-		onUserBeforeCreateRequest:  &hook.Hook[*UserCreateEvent]{},
-		onUserAfterCreateRequest:   &hook.Hook[*UserCreateEvent]{},
-		onUserBeforeUpdateRequest:  &hook.Hook[*UserUpdateEvent]{},
-		onUserAfterUpdateRequest:   &hook.Hook[*UserUpdateEvent]{},
-		onUserBeforeDeleteRequest:  &hook.Hook[*UserDeleteEvent]{},
-		onUserAfterDeleteRequest:   &hook.Hook[*UserDeleteEvent]{},
-		onUserAuthRequest:          &hook.Hook[*UserAuthEvent]{},
-		onUserBeforeOauth2Register: &hook.Hook[*UserOauth2RegisterEvent]{},
-		onUserAfterOauth2Register:  &hook.Hook[*UserOauth2RegisterEvent]{},
+		onUsersListRequest:                    &hook.Hook[*UsersListEvent]{},
+		onUserViewRequest:                     &hook.Hook[*UserViewEvent]{},
+		onUserBeforeCreateRequest:             &hook.Hook[*UserCreateEvent]{},
+		onUserAfterCreateRequest:              &hook.Hook[*UserCreateEvent]{},
+		onUserBeforeUpdateRequest:             &hook.Hook[*UserUpdateEvent]{},
+		onUserAfterUpdateRequest:              &hook.Hook[*UserUpdateEvent]{},
+		onUserBeforeDeleteRequest:             &hook.Hook[*UserDeleteEvent]{},
+		onUserAfterDeleteRequest:              &hook.Hook[*UserDeleteEvent]{},
+		onUserAuthRequest:                     &hook.Hook[*UserAuthEvent]{},
+		onUserListExternalAuths:               &hook.Hook[*UserListExternalAuthsEvent]{},
+		onUserBeforeUnlinkExternalAuthRequest: &hook.Hook[*UserUnlinkExternalAuthEvent]{},
+		onUserAfterUnlinkExternalAuthRequest:  &hook.Hook[*UserUnlinkExternalAuthEvent]{},
 
 		// record API event hooks
 		onRecordsListRequest:        &hook.Hook[*RecordsListEvent]{},
@@ -201,14 +205,16 @@ func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
 		onRecordAfterDeleteRequest:  &hook.Hook[*RecordDeleteEvent]{},
 
 		// collection API event hooks
-		onCollectionsListRequest:        &hook.Hook[*CollectionsListEvent]{},
-		onCollectionViewRequest:         &hook.Hook[*CollectionViewEvent]{},
-		onCollectionBeforeCreateRequest: &hook.Hook[*CollectionCreateEvent]{},
-		onCollectionAfterCreateRequest:  &hook.Hook[*CollectionCreateEvent]{},
-		onCollectionBeforeUpdateRequest: &hook.Hook[*CollectionUpdateEvent]{},
-		onCollectionAfterUpdateRequest:  &hook.Hook[*CollectionUpdateEvent]{},
-		onCollectionBeforeDeleteRequest: &hook.Hook[*CollectionDeleteEvent]{},
-		onCollectionAfterDeleteRequest:  &hook.Hook[*CollectionDeleteEvent]{},
+		onCollectionsListRequest:         &hook.Hook[*CollectionsListEvent]{},
+		onCollectionViewRequest:          &hook.Hook[*CollectionViewEvent]{},
+		onCollectionBeforeCreateRequest:  &hook.Hook[*CollectionCreateEvent]{},
+		onCollectionAfterCreateRequest:   &hook.Hook[*CollectionCreateEvent]{},
+		onCollectionBeforeUpdateRequest:  &hook.Hook[*CollectionUpdateEvent]{},
+		onCollectionAfterUpdateRequest:   &hook.Hook[*CollectionUpdateEvent]{},
+		onCollectionBeforeDeleteRequest:  &hook.Hook[*CollectionDeleteEvent]{},
+		onCollectionAfterDeleteRequest:   &hook.Hook[*CollectionDeleteEvent]{},
+		onCollectionsBeforeImportRequest: &hook.Hook[*CollectionsImportEvent]{},
+		onCollectionsAfterImportRequest:  &hook.Hook[*CollectionsImportEvent]{},
 	}
 
 	app.registerDefaultHooks()
@@ -607,12 +613,16 @@ func (app *BaseApp) OnUserAuthRequest() *hook.Hook[*UserAuthEvent] {
 	return app.onUserAuthRequest
 }
 
-func (app *BaseApp) OnUserBeforeOauth2Register() *hook.Hook[*UserOauth2RegisterEvent] {
-	return app.onUserBeforeOauth2Register
+func (app *BaseApp) OnUserListExternalAuths() *hook.Hook[*UserListExternalAuthsEvent] {
+	return app.onUserListExternalAuths
 }
 
-func (app *BaseApp) OnUserAfterOauth2Register() *hook.Hook[*UserOauth2RegisterEvent] {
-	return app.onUserAfterOauth2Register
+func (app *BaseApp) OnUserBeforeUnlinkExternalAuthRequest() *hook.Hook[*UserUnlinkExternalAuthEvent] {
+	return app.onUserBeforeUnlinkExternalAuthRequest
+}
+
+func (app *BaseApp) OnUserAfterUnlinkExternalAuthRequest() *hook.Hook[*UserUnlinkExternalAuthEvent] {
+	return app.onUserAfterUnlinkExternalAuthRequest
 }
 
 // -------------------------------------------------------------------
@@ -687,6 +697,14 @@ func (app *BaseApp) OnCollectionAfterDeleteRequest() *hook.Hook[*CollectionDelet
 	return app.onCollectionAfterDeleteRequest
 }
 
+func (app *BaseApp) OnCollectionsBeforeImportRequest() *hook.Hook[*CollectionsImportEvent] {
+	return app.onCollectionsBeforeImportRequest
+}
+
+func (app *BaseApp) OnCollectionsAfterImportRequest() *hook.Hook[*CollectionsImportEvent] {
+	return app.onCollectionsAfterImportRequest
+}
+
 // -------------------------------------------------------------------
 // Helpers
 // -------------------------------------------------------------------

core/base_test.go

@@ -319,12 +319,16 @@ func TestBaseAppGetters(t *testing.T) {
 		t.Fatalf("Getter app.OnUserAuthRequest does not match or nil (%v vs %v)", app.OnUserAuthRequest(), app.onUserAuthRequest)
 	}
 
-	if app.onUserBeforeOauth2Register != app.OnUserBeforeOauth2Register() || app.OnUserBeforeOauth2Register() == nil {
-		t.Fatalf("Getter app.OnUserBeforeOauth2Register does not match or nil (%v vs %v)", app.OnUserBeforeOauth2Register(), app.onUserBeforeOauth2Register)
+	if app.onUserListExternalAuths != app.OnUserListExternalAuths() || app.OnUserListExternalAuths() == nil {
+		t.Fatalf("Getter app.OnUserListExternalAuths does not match or nil (%v vs %v)", app.OnUserListExternalAuths(), app.onUserListExternalAuths)
 	}
 
-	if app.onUserAfterOauth2Register != app.OnUserAfterOauth2Register() || app.OnUserAfterOauth2Register() == nil {
-		t.Fatalf("Getter app.OnUserAfterOauth2Register does not match or nil (%v vs %v)", app.OnUserAfterOauth2Register(), app.onUserAfterOauth2Register)
+	if app.onUserBeforeUnlinkExternalAuthRequest != app.OnUserBeforeUnlinkExternalAuthRequest() || app.OnUserBeforeUnlinkExternalAuthRequest() == nil {
+		t.Fatalf("Getter app.OnUserBeforeUnlinkExternalAuthRequest does not match or nil (%v vs %v)", app.OnUserBeforeUnlinkExternalAuthRequest(), app.onUserBeforeUnlinkExternalAuthRequest)
+	}
+
+	if app.onUserAfterUnlinkExternalAuthRequest != app.OnUserAfterUnlinkExternalAuthRequest() || app.OnUserAfterUnlinkExternalAuthRequest() == nil {
+		t.Fatalf("Getter app.OnUserAfterUnlinkExternalAuthRequest does not match or nil (%v vs %v)", app.OnUserAfterUnlinkExternalAuthRequest(), app.onUserAfterUnlinkExternalAuthRequest)
 	}
 
 	if app.onRecordsListRequest != app.OnRecordsListRequest() || app.OnRecordsListRequest() == nil {

core/events.go

@@ -4,7 +4,6 @@ import (
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
-	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
@@ -180,10 +179,16 @@ type UserAuthEvent struct {
 	Meta        any
 }
 
-type UserOauth2RegisterEvent struct {
-	HttpContext echo.Context
-	User        *models.User
-	AuthData    *auth.AuthUser
+type UserListExternalAuthsEvent struct {
+	HttpContext   echo.Context
+	User          *models.User
+	ExternalAuths []*models.ExternalAuth
+}
+
+type UserUnlinkExternalAuthEvent struct {
+	HttpContext  echo.Context
+	User         *models.User
+	ExternalAuth *models.ExternalAuth
 }
 
 // -------------------------------------------------------------------
@@ -216,6 +221,11 @@ type CollectionDeleteEvent struct {
 	Collection  *models.Collection
 }
 
+type CollectionsImportEvent struct {
+	HttpContext echo.Context
+	Collections []*models.Collection
+}
+
 // -------------------------------------------------------------------
 // File API events data
 // -------------------------------------------------------------------

core/settings.go

@@ -10,48 +10,49 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
-// Common settings placeholder tokens
-const (
-	EmailPlaceholderAppUrl string = "%APP_URL%"
-	EmailPlaceholderToken  string = "%TOKEN%"
-)
-
 // Settings defines common app configuration options.
 type Settings struct {
 	mux sync.RWMutex
 
-	Meta                    MetaConfig         `form:"meta" json:"meta"`
-	Logs                    LogsConfig         `form:"logs" json:"logs"`
-	Smtp                    SmtpConfig         `form:"smtp" json:"smtp"`
-	S3                      S3Config           `form:"s3" json:"s3"`
-	AdminAuthToken          TokenConfig        `form:"adminAuthToken" json:"adminAuthToken"`
-	AdminPasswordResetToken TokenConfig        `form:"adminPasswordResetToken" json:"adminPasswordResetToken"`
-	UserAuthToken           TokenConfig        `form:"userAuthToken" json:"userAuthToken"`
-	UserPasswordResetToken  TokenConfig        `form:"userPasswordResetToken" json:"userPasswordResetToken"`
-	UserEmailChangeToken    TokenConfig        `form:"userEmailChangeToken" json:"userEmailChangeToken"`
-	UserVerificationToken   TokenConfig        `form:"userVerificationToken" json:"userVerificationToken"`
-	EmailAuth               EmailAuthConfig    `form:"emailAuth" json:"emailAuth"`
-	GoogleAuth              AuthProviderConfig `form:"googleAuth" json:"googleAuth"`
-	FacebookAuth            AuthProviderConfig `form:"facebookAuth" json:"facebookAuth"`
-	GithubAuth              AuthProviderConfig `form:"githubAuth" json:"githubAuth"`
-	GitlabAuth              AuthProviderConfig `form:"gitlabAuth" json:"gitlabAuth"`
+	Meta MetaConfig `form:"meta" json:"meta"`
+	Logs LogsConfig `form:"logs" json:"logs"`
+	Smtp SmtpConfig `form:"smtp" json:"smtp"`
+	S3   S3Config   `form:"s3" json:"s3"`
+
+	AdminAuthToken          TokenConfig `form:"adminAuthToken" json:"adminAuthToken"`
+	AdminPasswordResetToken TokenConfig `form:"adminPasswordResetToken" json:"adminPasswordResetToken"`
+	UserAuthToken           TokenConfig `form:"userAuthToken" json:"userAuthToken"`
+	UserPasswordResetToken  TokenConfig `form:"userPasswordResetToken" json:"userPasswordResetToken"`
+	UserEmailChangeToken    TokenConfig `form:"userEmailChangeToken" json:"userEmailChangeToken"`
+	UserVerificationToken   TokenConfig `form:"userVerificationToken" json:"userVerificationToken"`
+
+	EmailAuth    EmailAuthConfig    `form:"emailAuth" json:"emailAuth"`
+	GoogleAuth   AuthProviderConfig `form:"googleAuth" json:"googleAuth"`
+	FacebookAuth AuthProviderConfig `form:"facebookAuth" json:"facebookAuth"`
+	GithubAuth   AuthProviderConfig `form:"githubAuth" json:"githubAuth"`
+	GitlabAuth   AuthProviderConfig `form:"gitlabAuth" json:"gitlabAuth"`
+	DiscordAuth  AuthProviderConfig `form:"discordAuth" json:"discordAuth"`
+	TwitterAuth  AuthProviderConfig `form:"twitterAuth" json:"twitterAuth"`
 }
 
 // NewSettings creates and returns a new default Settings instance.
 func NewSettings() *Settings {
 	return &Settings{
 		Meta: MetaConfig{
-			AppName:                   "Acme",
-			AppUrl:                    "http://localhost:8090",
-			SenderName:                "Support",
-			SenderAddress:             "support@example.com",
-			UserVerificationUrl:       EmailPlaceholderAppUrl + "/_/#/users/confirm-verification/" + EmailPlaceholderToken,
-			UserResetPasswordUrl:      EmailPlaceholderAppUrl + "/_/#/users/confirm-password-reset/" + EmailPlaceholderToken,
-			UserConfirmEmailChangeUrl: EmailPlaceholderAppUrl + "/_/#/users/confirm-email-change/" + EmailPlaceholderToken,
+			AppName:                    "Acme",
+			AppUrl:                     "http://localhost:8090",
+			HideControls:               false,
+			SenderName:                 "Support",
+			SenderAddress:              "support@example.com",
+			VerificationTemplate:       defaultVerificationTemplate,
+			ResetPasswordTemplate:      defaultResetPasswordTemplate,
+			ConfirmEmailChangeTemplate: defaultConfirmEmailChangeTemplate,
 		},
+
 		Logs: LogsConfig{
 			MaxDays: 7,
 		},
@@ -107,6 +108,14 @@ func NewSettings() *Settings {
 			Enabled:            false,
 			AllowRegistrations: true,
 		},
+		DiscordAuth: AuthProviderConfig{
+			Enabled:            false,
+			AllowRegistrations: true,
+		},
+		TwitterAuth: AuthProviderConfig{
+			Enabled:            false,
+			AllowRegistrations: true,
+		},
 	}
 }
 
@@ -131,6 +140,8 @@ func (s *Settings) Validate() error {
 		validation.Field(&s.FacebookAuth),
 		validation.Field(&s.GithubAuth),
 		validation.Field(&s.GitlabAuth),
+		validation.Field(&s.DiscordAuth),
+		validation.Field(&s.TwitterAuth),
 	)
 }
 
@@ -179,6 +190,8 @@ func (s *Settings) RedactClone() (*Settings, error) {
 		&clone.FacebookAuth.ClientSecret,
 		&clone.GithubAuth.ClientSecret,
 		&clone.GitlabAuth.ClientSecret,
+		&clone.DiscordAuth.ClientSecret,
+		&clone.TwitterAuth.ClientSecret,
 	}
 
 	// mask all sensitive fields
@@ -194,11 +207,16 @@ func (s *Settings) RedactClone() (*Settings, error) {
 // NamedAuthProviderConfigs returns a map with all registered OAuth2
 // provider configurations (indexed by their name identifier).
 func (s *Settings) NamedAuthProviderConfigs() map[string]AuthProviderConfig {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
 	return map[string]AuthProviderConfig{
 		auth.NameGoogle:   s.GoogleAuth,
 		auth.NameFacebook: s.FacebookAuth,
 		auth.NameGithub:   s.GithubAuth,
 		auth.NameGitlab:   s.GitlabAuth,
+		auth.NameDiscord:  s.DiscordAuth,
+		auth.NameTwitter:  s.TwitterAuth,
 	}
 }
 
@@ -213,7 +231,7 @@ type TokenConfig struct {
 func (c TokenConfig) Validate() error {
 	return validation.ValidateStruct(&c,
 		validation.Field(&c.Secret, validation.Required, validation.Length(30, 300)),
-		validation.Field(&c.Duration, validation.Required, validation.Min(5), validation.Max(31536000)),
+		validation.Field(&c.Duration, validation.Required, validation.Min(5), validation.Max(63072000)),
 	)
 }
 
@@ -267,13 +285,14 @@ func (c S3Config) Validate() error {
 // -------------------------------------------------------------------
 
 type MetaConfig struct {
-	AppName                   string `form:"appName" json:"appName"`
-	AppUrl                    string `form:"appUrl" json:"appUrl"`
-	SenderName                string `form:"senderName" json:"senderName"`
-	SenderAddress             string `form:"senderAddress" json:"senderAddress"`
-	UserVerificationUrl       string `form:"userVerificationUrl" json:"userVerificationUrl"`
-	UserResetPasswordUrl      string `form:"userResetPasswordUrl" json:"userResetPasswordUrl"`
-	UserConfirmEmailChangeUrl string `form:"userConfirmEmailChangeUrl" json:"userConfirmEmailChangeUrl"`
+	AppName                    string        `form:"appName" json:"appName"`
+	AppUrl                     string        `form:"appUrl" json:"appUrl"`
+	HideControls               bool          `form:"hideControls" json:"hideControls"`
+	SenderName                 string        `form:"senderName" json:"senderName"`
+	SenderAddress              string        `form:"senderAddress" json:"senderAddress"`
+	VerificationTemplate       EmailTemplate `form:"verificationTemplate" json:"verificationTemplate"`
+	ResetPasswordTemplate      EmailTemplate `form:"resetPasswordTemplate" json:"resetPasswordTemplate"`
+	ConfirmEmailChangeTemplate EmailTemplate `form:"confirmEmailChangeTemplate" json:"confirmEmailChangeTemplate"`
 }
 
 // Validate makes MetaConfig validatable by implementing [validation.Validatable] interface.
@@ -282,35 +301,46 @@ func (c MetaConfig) Validate() error {
 		validation.Field(&c.AppName, validation.Required, validation.Length(1, 255)),
 		validation.Field(&c.AppUrl, validation.Required, is.URL),
 		validation.Field(&c.SenderName, validation.Required, validation.Length(1, 255)),
-		validation.Field(&c.SenderAddress, is.Email, validation.Required),
+		validation.Field(&c.SenderAddress, is.EmailFormat, validation.Required),
+		validation.Field(&c.VerificationTemplate, validation.Required),
+		validation.Field(&c.ResetPasswordTemplate, validation.Required),
+		validation.Field(&c.ConfirmEmailChangeTemplate, validation.Required),
+	)
+}
+
+type EmailTemplate struct {
+	Body      string `form:"body" json:"body"`
+	Subject   string `form:"subject" json:"subject"`
+	ActionUrl string `form:"actionUrl" json:"actionUrl"`
+}
+
+// Validate makes EmailTemplate validatable by implementing [validation.Validatable] interface.
+func (t EmailTemplate) Validate() error {
+	return validation.ValidateStruct(&t,
+		validation.Field(&t.Subject, validation.Required),
 		validation.Field(
-			&c.UserVerificationUrl,
+			&t.Body,
 			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
+			validation.By(checkPlaceholderParams(EmailPlaceholderActionUrl)),
 		),
 		validation.Field(
-			&c.UserResetPasswordUrl,
+			&t.ActionUrl,
 			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
-		),
-		validation.Field(
-			&c.UserConfirmEmailChangeUrl,
-			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
+			validation.By(checkPlaceholderParams(EmailPlaceholderToken)),
 		),
 	)
 }
 
-func (c *MetaConfig) checkPlaceholders(params ...string) validation.RuleFunc {
+func checkPlaceholderParams(params ...string) validation.RuleFunc {
 	return func(value any) error {
 		v, _ := value.(string)
-		if v == "" {
-			return nil // nothing to check
-		}
 
 		for _, param := range params {
 			if !strings.Contains(v, param) {
-				return validation.NewError("validation_missing_required_param", fmt.Sprintf("Missing required parameter %q", param))
+				return validation.NewError(
+					"validation_missing_required_param",
+					fmt.Sprintf("Missing required parameter %q", param),
+				)
 			}
 		}
 
@@ -318,6 +348,50 @@ func (c *MetaConfig) checkPlaceholders(params ...string) validation.RuleFunc {
 	}
 }
 
+// Resolve replaces the placeholder parameters in the current email
+// template and returns its components as ready-to-use strings.
+func (t EmailTemplate) Resolve(
+	appName string,
+	appUrl,
+	token string,
+) (subject, body, actionUrl string) {
+	// replace action url placeholder params (if any)
+	actionUrlParams := map[string]string{
+		EmailPlaceholderAppName: appName,
+		EmailPlaceholderAppUrl:  appUrl,
+		EmailPlaceholderToken:   token,
+	}
+	actionUrl = t.ActionUrl
+	for k, v := range actionUrlParams {
+		actionUrl = strings.ReplaceAll(actionUrl, k, v)
+	}
+	actionUrl, _ = rest.NormalizeUrl(actionUrl)
+
+	// replace body placeholder params (if any)
+	bodyParams := map[string]string{
+		EmailPlaceholderAppName:   appName,
+		EmailPlaceholderAppUrl:    appUrl,
+		EmailPlaceholderToken:     token,
+		EmailPlaceholderActionUrl: actionUrl,
+	}
+	body = t.Body
+	for k, v := range bodyParams {
+		body = strings.ReplaceAll(body, k, v)
+	}
+
+	// replace subject placeholder params (if any)
+	subjectParams := map[string]string{
+		EmailPlaceholderAppName: appName,
+		EmailPlaceholderAppUrl:  appUrl,
+	}
+	subject = t.Subject
+	for k, v := range subjectParams {
+		subject = strings.ReplaceAll(subject, k, v)
+	}
+
+	return subject, body, actionUrl
+}
+
 // -------------------------------------------------------------------
 
 type LogsConfig struct {
@@ -333,6 +407,35 @@ func (c LogsConfig) Validate() error {
 
 // -------------------------------------------------------------------
 
+type EmailAuthConfig struct {
+	Enabled           bool     `form:"enabled" json:"enabled"`
+	ExceptDomains     []string `form:"exceptDomains" json:"exceptDomains"`
+	OnlyDomains       []string `form:"onlyDomains" json:"onlyDomains"`
+	MinPasswordLength int      `form:"minPasswordLength" json:"minPasswordLength"`
+}
+
+// Validate makes `EmailAuthConfig` validatable by implementing [validation.Validatable] interface.
+func (c EmailAuthConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(
+			&c.ExceptDomains,
+			validation.When(len(c.OnlyDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+		validation.Field(
+			&c.OnlyDomains,
+			validation.When(len(c.ExceptDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+		validation.Field(
+			&c.MinPasswordLength,
+			validation.When(c.Enabled, validation.Required),
+			validation.Min(5),
+			validation.Max(100),
+		),
+	)
+}
+
+// -------------------------------------------------------------------
+
 type AuthProviderConfig struct {
 	Enabled            bool   `form:"enabled" json:"enabled"`
 	AllowRegistrations bool   `form:"allowRegistrations" json:"allowRegistrations"`
@@ -382,32 +485,3 @@ func (c AuthProviderConfig) SetupProvider(provider auth.Provider) error {
 
 	return nil
 }
-
-// -------------------------------------------------------------------
-
-type EmailAuthConfig struct {
-	Enabled           bool     `form:"enabled" json:"enabled"`
-	ExceptDomains     []string `form:"exceptDomains" json:"exceptDomains"`
-	OnlyDomains       []string `form:"onlyDomains" json:"onlyDomains"`
-	MinPasswordLength int      `form:"minPasswordLength" json:"minPasswordLength"`
-}
-
-// Validate makes `EmailAuthConfig` validatable by implementing [validation.Validatable] interface.
-func (c EmailAuthConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(
-			&c.ExceptDomains,
-			validation.When(len(c.OnlyDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
-		),
-		validation.Field(
-			&c.OnlyDomains,
-			validation.When(len(c.ExceptDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
-		),
-		validation.Field(
-			&c.MinPasswordLength,
-			validation.When(c.Enabled, validation.Required),
-			validation.Min(5),
-			validation.Max(100),
-		),
-	)
-}

core/settings_templates.go

@@ -0,0 +1,54 @@
+package core
+
+// Common settings placeholder tokens
+const (
+	EmailPlaceholderAppName   string = "{APP_NAME}"
+	EmailPlaceholderAppUrl    string = "{APP_URL}"
+	EmailPlaceholderToken     string = "{TOKEN}"
+	EmailPlaceholderActionUrl string = "{ACTION_URL}"
+)
+
+var defaultVerificationTemplate = EmailTemplate{
+	Subject: "Verify your " + EmailPlaceholderAppName + " email",
+	Body: `<p>Hello,</p>
+<p>Thank you for joining us at ` + EmailPlaceholderAppName + `.</p>
+<p>Click on the button below to verify your email address.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderActionUrl + `" target="_blank" rel="noopener">Verify</a>
+</p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+	ActionUrl: EmailPlaceholderAppUrl + "/_/#/users/confirm-verification/" + EmailPlaceholderToken,
+}
+
+var defaultResetPasswordTemplate = EmailTemplate{
+	Subject: "Reset your " + EmailPlaceholderAppName + " password",
+	Body: `<p>Hello,</p>
+<p>Click on the button below to reset your password.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderActionUrl + `" target="_blank" rel="noopener">Reset password</a>
+</p>
+<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+	ActionUrl: EmailPlaceholderAppUrl + "/_/#/users/confirm-password-reset/" + EmailPlaceholderToken,
+}
+
+var defaultConfirmEmailChangeTemplate = EmailTemplate{
+	Subject: "Confirm your " + EmailPlaceholderAppName + " new email address",
+	Body: `<p>Hello,</p>
+<p>Click on the button below to confirm your new email address.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderActionUrl + `" target="_blank" rel="noopener">Confirm new email</a>
+</p>
+<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+	ActionUrl: EmailPlaceholderAppUrl + "/_/#/users/confirm-email-change/" + EmailPlaceholderToken,
+}

core/settings_test.go

@@ -2,9 +2,11 @@ package core_test
 
 import (
 	"encoding/json"
+	"fmt"
 	"strings"
 	"testing"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/auth"
 )
@@ -35,6 +37,10 @@ func TestSettingsValidate(t *testing.T) {
 	s.GithubAuth.ClientId = ""
 	s.GitlabAuth.Enabled = true
 	s.GitlabAuth.ClientId = ""
+	s.DiscordAuth.Enabled = true
+	s.DiscordAuth.ClientId = ""
+	s.TwitterAuth.Enabled = true
+	s.TwitterAuth.ClientId = ""
 
 	// check if Validate() is triggering the members validate methods.
 	err := s.Validate()
@@ -58,6 +64,7 @@ func TestSettingsValidate(t *testing.T) {
 		`"facebookAuth":{`,
 		`"githubAuth":{`,
 		`"gitlabAuth":{`,
+		`"discordAuth":{`,
 	}
 
 	errBytes, _ := json.Marshal(err)
@@ -96,6 +103,10 @@ func TestSettingsMerge(t *testing.T) {
 	s2.GithubAuth.ClientId = "github_test"
 	s2.GitlabAuth.Enabled = true
 	s2.GitlabAuth.ClientId = "gitlab_test"
+	s2.DiscordAuth.Enabled = true
+	s2.DiscordAuth.ClientId = "discord_test"
+	s2.TwitterAuth.Enabled = true
+	s2.TwitterAuth.ClientId = "twitter_test"
 
 	if err := s1.Merge(s2); err != nil {
 		t.Fatal(err)
@@ -161,6 +172,8 @@ func TestSettingsRedactClone(t *testing.T) {
 	s1.FacebookAuth.ClientSecret = "test123"
 	s1.GithubAuth.ClientSecret = "test123"
 	s1.GitlabAuth.ClientSecret = "test123"
+	s1.DiscordAuth.ClientSecret = "test123"
+	s1.TwitterAuth.ClientSecret = "test123"
 
 	s2, err := s1.RedactClone()
 	if err != nil {
@@ -172,7 +185,7 @@ func TestSettingsRedactClone(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","senderName":"Support","senderAddress":"support@example.com","userVerificationUrl":"%APP_URL%/_/#/users/confirm-verification/%TOKEN%","userResetPasswordUrl":"%APP_URL%/_/#/users/confirm-password-reset/%TOKEN%","userConfirmEmailChangeUrl":"%APP_URL%/_/#/users/confirm-email-change/%TOKEN%"},"logs":{"maxDays":7},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"userAuthToken":{"secret":"******","duration":1209600},"userPasswordResetToken":{"secret":"******","duration":1800},"userEmailChangeToken":{"secret":"******","duration":1800},"userVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":true,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":8},"googleAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"facebookAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"githubAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"}}`
+	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","hideControls":false,"senderName":"Support","senderAddress":"support@example.com","verificationTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Verify your {APP_NAME} email","actionUrl":"{APP_URL}/_/#/users/confirm-verification/{TOKEN}"},"resetPasswordTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Reset your {APP_NAME} password","actionUrl":"{APP_URL}/_/#/users/confirm-password-reset/{TOKEN}"},"confirmEmailChangeTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Confirm your {APP_NAME} new email address","actionUrl":"{APP_URL}/_/#/users/confirm-email-change/{TOKEN}"}},"logs":{"maxDays":7},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"userAuthToken":{"secret":"******","duration":1209600},"userPasswordResetToken":{"secret":"******","duration":1800},"userEmailChangeToken":{"secret":"******","duration":1800},"userVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":true,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":8},"googleAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"facebookAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"githubAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"discordAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"twitterAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"}}`
 
 	if encodedStr := string(encoded); encodedStr != expected {
 		t.Fatalf("Expected %v, got \n%v", expected, encodedStr)
@@ -187,6 +200,8 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 	s.GithubAuth.ClientId = "github_test"
 	s.GitlabAuth.ClientId = "gitlab_test"
 	s.GitlabAuth.Enabled = true
+	s.DiscordAuth.ClientId = "discord_test"
+	s.TwitterAuth.ClientId = "twitter_test"
 
 	result := s.NamedAuthProviderConfigs()
 
@@ -195,7 +210,7 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expected := `{"facebook":{"enabled":false,"allowRegistrations":true,"clientId":"facebook_test"},"github":{"enabled":false,"allowRegistrations":true,"clientId":"github_test"},"gitlab":{"enabled":true,"allowRegistrations":true,"clientId":"gitlab_test"},"google":{"enabled":false,"allowRegistrations":true,"clientId":"google_test"}}`
+	expected := `{"discord":{"enabled":false,"allowRegistrations":true,"clientId":"discord_test"},"facebook":{"enabled":false,"allowRegistrations":true,"clientId":"facebook_test"},"github":{"enabled":false,"allowRegistrations":true,"clientId":"github_test"},"gitlab":{"enabled":true,"allowRegistrations":true,"clientId":"gitlab_test"},"google":{"enabled":false,"allowRegistrations":true,"clientId":"google_test"},"twitter":{"enabled":false,"allowRegistrations":true,"clientId":"twitter_test"}}`
 
 	if encodedStr := string(encoded); encodedStr != expected {
 		t.Fatalf("Expected the same serialization, got %v", encodedStr)
@@ -215,15 +230,23 @@ func TestTokenConfigValidate(t *testing.T) {
 		// invalid data
 		{
 			core.TokenConfig{
-				Secret:   "test",
+				Secret:   strings.Repeat("a", 5),
 				Duration: 4,
 			},
 			true,
 		},
+		// valid secret but invalid duration
+		{
+			core.TokenConfig{
+				Secret:   strings.Repeat("a", 30),
+				Duration: 63072000 + 1,
+			},
+			true,
+		},
 		// valid data
 		{
 			core.TokenConfig{
-				Secret:   "testtesttesttesttesttesttestte",
+				Secret:   strings.Repeat("a", 30),
 				Duration: 100,
 			},
 			false,
@@ -355,6 +378,24 @@ func TestS3ConfigValidate(t *testing.T) {
 }
 
 func TestMetaConfigValidate(t *testing.T) {
+	invalidTemplate := core.EmailTemplate{
+		Subject:   "test",
+		ActionUrl: "test",
+		Body:      "test",
+	}
+
+	noPlaceholdersTemplate := core.EmailTemplate{
+		Subject:   "test",
+		ActionUrl: "http://example.com",
+		Body:      "test",
+	}
+
+	withPlaceholdersTemplate := core.EmailTemplate{
+		Subject:   "test",
+		ActionUrl: "http://example.com" + core.EmailPlaceholderToken,
+		Body:      "test" + core.EmailPlaceholderActionUrl,
+	}
+
 	scenarios := []struct {
 		config      core.MetaConfig
 		expectError bool
@@ -367,39 +408,39 @@ func TestMetaConfigValidate(t *testing.T) {
 		// invalid data
 		{
 			core.MetaConfig{
-				AppName:                   strings.Repeat("a", 300),
-				AppUrl:                    "test",
-				SenderName:                strings.Repeat("a", 300),
-				SenderAddress:             "invalid_email",
-				UserVerificationUrl:       "test",
-				UserResetPasswordUrl:      "test",
-				UserConfirmEmailChangeUrl: "test",
+				AppName:                    strings.Repeat("a", 300),
+				AppUrl:                     "test",
+				SenderName:                 strings.Repeat("a", 300),
+				SenderAddress:              "invalid_email",
+				VerificationTemplate:       invalidTemplate,
+				ResetPasswordTemplate:      invalidTemplate,
+				ConfirmEmailChangeTemplate: invalidTemplate,
 			},
 			true,
 		},
 		// invalid data (missing required placeholders)
 		{
 			core.MetaConfig{
-				AppName:                   "test",
-				AppUrl:                    "https://example.com",
-				SenderName:                "test",
-				SenderAddress:             "test@example.com",
-				UserVerificationUrl:       "https://example.com",
-				UserResetPasswordUrl:      "https://example.com",
-				UserConfirmEmailChangeUrl: "https://example.com",
+				AppName:                    "test",
+				AppUrl:                     "https://example.com",
+				SenderName:                 "test",
+				SenderAddress:              "test@example.com",
+				VerificationTemplate:       noPlaceholdersTemplate,
+				ResetPasswordTemplate:      noPlaceholdersTemplate,
+				ConfirmEmailChangeTemplate: noPlaceholdersTemplate,
 			},
 			true,
 		},
 		// valid data
 		{
 			core.MetaConfig{
-				AppName:                   "test",
-				AppUrl:                    "https://example.com",
-				SenderName:                "test",
-				SenderAddress:             "test@example.com",
-				UserVerificationUrl:       "https://example.com/" + core.EmailPlaceholderToken,
-				UserResetPasswordUrl:      "https://example.com/" + core.EmailPlaceholderToken,
-				UserConfirmEmailChangeUrl: "https://example.com/" + core.EmailPlaceholderToken,
+				AppName:                    "test",
+				AppUrl:                     "https://example.com",
+				SenderName:                 "test",
+				SenderAddress:              "test@example.com",
+				VerificationTemplate:       withPlaceholdersTemplate,
+				ResetPasswordTemplate:      withPlaceholdersTemplate,
+				ConfirmEmailChangeTemplate: withPlaceholdersTemplate,
 			},
 			false,
 		},
@@ -418,6 +459,130 @@ func TestMetaConfigValidate(t *testing.T) {
 	}
 }
 
+func TestEmailTemplateValidate(t *testing.T) {
+	scenarios := []struct {
+		emailTemplate  core.EmailTemplate
+		expectedErrors []string
+	}{
+		// require values
+		{
+			core.EmailTemplate{},
+			[]string{"subject", "actionUrl", "body"},
+		},
+		// missing placeholders
+		{
+			core.EmailTemplate{
+				Subject:   "test",
+				ActionUrl: "test",
+				Body:      "test",
+			},
+			[]string{"actionUrl", "body"},
+		},
+		// valid data
+		{
+			core.EmailTemplate{
+				Subject:   "test",
+				ActionUrl: "test" + core.EmailPlaceholderToken,
+				Body:      "test" + core.EmailPlaceholderActionUrl,
+			},
+			[]string{},
+		},
+	}
+
+	for i, s := range scenarios {
+		result := s.emailTemplate.Validate()
+
+		// parse errors
+		errs, ok := result.(validation.Errors)
+		if !ok && result != nil {
+			t.Errorf("(%d) Failed to parse errors %v", i, result)
+			continue
+		}
+
+		// check errors
+		if len(errs) > len(s.expectedErrors) {
+			t.Errorf("(%d) Expected error keys %v, got %v", i, s.expectedErrors, errs)
+		}
+		for _, k := range s.expectedErrors {
+			if _, ok := errs[k]; !ok {
+				t.Errorf("(%d) Missing expected error key %q in %v", i, k, errs)
+			}
+		}
+	}
+}
+
+func TestEmailTemplateResolve(t *testing.T) {
+	allPlaceholders := core.EmailPlaceholderActionUrl + core.EmailPlaceholderToken + core.EmailPlaceholderAppName + core.EmailPlaceholderAppUrl
+
+	scenarios := []struct {
+		emailTemplate     core.EmailTemplate
+		expectedSubject   string
+		expectedBody      string
+		expectedActionUrl string
+	}{
+		// no placeholders
+		{
+			emailTemplate: core.EmailTemplate{
+				Subject:   "subject:",
+				Body:      "body:",
+				ActionUrl: "/actionUrl////",
+			},
+			expectedSubject:   "subject:",
+			expectedActionUrl: "/actionUrl/",
+			expectedBody:      "body:",
+		},
+		// with placeholders
+		{
+			emailTemplate: core.EmailTemplate{
+				ActionUrl: "/actionUrl////" + allPlaceholders,
+				Subject:   "subject:" + allPlaceholders,
+				Body:      "body:" + allPlaceholders,
+			},
+			expectedActionUrl: fmt.Sprintf(
+				"/actionUrl/%%7BACTION_URL%%7D%s%s%s",
+				"token_test",
+				"name_test",
+				"url_test",
+			),
+			expectedSubject: fmt.Sprintf(
+				"subject:%s%s%s%s",
+				core.EmailPlaceholderActionUrl,
+				core.EmailPlaceholderToken,
+				"name_test",
+				"url_test",
+			),
+			expectedBody: fmt.Sprintf(
+				"body:%s%s%s%s",
+				fmt.Sprintf(
+					"/actionUrl/%%7BACTION_URL%%7D%s%s%s",
+					"token_test",
+					"name_test",
+					"url_test",
+				),
+				"token_test",
+				"name_test",
+				"url_test",
+			),
+		},
+	}
+
+	for i, s := range scenarios {
+		subject, body, actionUrl := s.emailTemplate.Resolve("name_test", "url_test", "token_test")
+
+		if s.expectedSubject != subject {
+			t.Errorf("(%d) Expected subject %q got %q", i, s.expectedSubject, subject)
+		}
+
+		if s.expectedBody != body {
+			t.Errorf("(%d) Expected body \n%v got \n%v", i, s.expectedBody, body)
+		}
+
+		if s.expectedActionUrl != actionUrl {
+			t.Errorf("(%d) Expected actionUrl \n%v got \n%v", i, s.expectedActionUrl, actionUrl)
+		}
+	}
+}
+
 func TestLogsConfigValidate(t *testing.T) {
 	scenarios := []struct {
 		config      core.LogsConfig

daos/base.go

@@ -49,6 +49,12 @@ func (dao *Dao) FindById(m models.Model, id string) error {
 	return dao.ModelQuery(m).Where(dbx.HashExp{"id": id}).Limit(1).One(m)
 }
 
+type afterCallGroup struct {
+	Action   string
+	EventDao *Dao
+	Model    models.Model
+}
+
 // RunInTransaction wraps fn into a transaction.
 //
 // It is safe to nest RunInTransaction calls.
@@ -59,45 +65,61 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 		// so execute the function within the current transaction
 		return fn(dao)
 	case *dbx.DB:
-		return txOrDB.Transactional(func(tx *dbx.Tx) error {
+		afterCalls := []afterCallGroup{}
+
+		txError := txOrDB.Transactional(func(tx *dbx.Tx) error {
 			txDao := New(tx)
 
-			txDao.BeforeCreateFunc = func(eventDao *Dao, m models.Model) error {
-				if dao.BeforeCreateFunc != nil {
+			if dao.BeforeCreateFunc != nil {
+				txDao.BeforeCreateFunc = func(eventDao *Dao, m models.Model) error {
 					return dao.BeforeCreateFunc(eventDao, m)
 				}
-				return nil
 			}
-			txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) {
-				if dao.AfterCreateFunc != nil {
-					dao.AfterCreateFunc(eventDao, m)
-				}
-			}
-			txDao.BeforeUpdateFunc = func(eventDao *Dao, m models.Model) error {
-				if dao.BeforeUpdateFunc != nil {
+			if dao.BeforeUpdateFunc != nil {
+				txDao.BeforeUpdateFunc = func(eventDao *Dao, m models.Model) error {
 					return dao.BeforeUpdateFunc(eventDao, m)
 				}
-				return nil
 			}
-			txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) {
-				if dao.AfterUpdateFunc != nil {
-					dao.AfterUpdateFunc(eventDao, m)
-				}
-			}
-			txDao.BeforeDeleteFunc = func(eventDao *Dao, m models.Model) error {
-				if dao.BeforeDeleteFunc != nil {
+			if dao.BeforeDeleteFunc != nil {
+				txDao.BeforeDeleteFunc = func(eventDao *Dao, m models.Model) error {
 					return dao.BeforeDeleteFunc(eventDao, m)
 				}
-				return nil
 			}
-			txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) {
-				if dao.AfterDeleteFunc != nil {
-					dao.AfterDeleteFunc(eventDao, m)
+
+			if dao.AfterCreateFunc != nil {
+				txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) {
+					afterCalls = append(afterCalls, afterCallGroup{"create", eventDao, m})
+				}
+			}
+			if dao.AfterUpdateFunc != nil {
+				txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) {
+					afterCalls = append(afterCalls, afterCallGroup{"update", eventDao, m})
+				}
+			}
+			if dao.AfterDeleteFunc != nil {
+				txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) {
+					afterCalls = append(afterCalls, afterCallGroup{"delete", eventDao, m})
 				}
 			}
 
 			return fn(txDao)
 		})
+
+		if txError == nil {
+			// execute after event calls on successful transaction
+			for _, call := range afterCalls {
+				switch call.Action {
+				case "create":
+					dao.AfterCreateFunc(call.EventDao, call.Model)
+				case "update":
+					dao.AfterUpdateFunc(call.EventDao, call.Model)
+				case "delete":
+					dao.AfterDeleteFunc(call.EventDao, call.Model)
+				}
+			}
+		}
+
+		return txError
 	}
 
 	return errors.New("Failed to start transaction (unknown dao.db)")
@@ -128,11 +150,11 @@ func (dao *Dao) Delete(m models.Model) error {
 
 // Save upserts (update or create if primary key is not set) the provided model.
 func (dao *Dao) Save(m models.Model) error {
-	if m.HasId() {
-		return dao.update(m)
+	if m.IsNew() {
+		return dao.create(m)
 	}
 
-	return dao.create(m)
+	return dao.update(m)
 }
 
 func (dao *Dao) update(m models.Model) error {
@@ -140,6 +162,10 @@ func (dao *Dao) update(m models.Model) error {
 		return errors.New("ID is not set")
 	}
 
+	if m.GetCreated().IsZero() {
+		m.RefreshCreated()
+	}
+
 	m.RefreshUpdated()
 
 	if dao.BeforeUpdateFunc != nil {
@@ -179,6 +205,9 @@ func (dao *Dao) create(m models.Model) error {
 		m.RefreshId()
 	}
 
+	// mark the model as "new" since the model now always has an ID
+	m.MarkAsNew()
+
 	if m.GetCreated().IsZero() {
 		m.RefreshCreated()
 	}
@@ -195,6 +224,9 @@ func (dao *Dao) create(m models.Model) error {
 
 	if v, ok := any(m).(models.ColumnValueMapper); ok {
 		dataMap := v.ColumnValueMap()
+		if _, ok := dataMap["id"]; !ok {
+			dataMap["id"] = m.GetId()
+		}
 
 		_, err := dao.db.Insert(m.TableName(), dataMap).Execute()
 		if err != nil {
@@ -206,6 +238,9 @@ func (dao *Dao) create(m models.Model) error {
 		}
 	}
 
+	// clears the "new" model flag
+	m.UnmarkAsNew()
+
 	if dao.AfterCreateFunc != nil {
 		dao.AfterCreateFunc(dao, m)
 	}

daos/base_test.go

@@ -158,6 +158,33 @@ func TestDaoSaveCreate(t *testing.T) {
 	}
 }
 
+func TestDaoSaveWithInsertId(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	model := &models.Admin{}
+	model.Id = "test"
+	model.Email = "test_new@example.com"
+	model.MarkAsNew()
+	if err := testApp.Dao().Save(model); err != nil {
+		t.Fatal(err)
+	}
+
+	// refresh
+	model, _ = testApp.Dao().FindAdminById("test")
+
+	if model == nil {
+		t.Fatal("Failed to find admin with id 'test'")
+	}
+
+	expectedHooks := []string{"OnModelBeforeCreate", "OnModelAfterCreate"}
+	for _, h := range expectedHooks {
+		if v, ok := testApp.EventCalls[h]; !ok || v != 1 {
+			t.Fatalf("Expected event %s to be called exactly one time, got %d", h, v)
+		}
+	}
+}
+
 func TestDaoSaveUpdate(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
@@ -184,6 +211,61 @@ func TestDaoSaveUpdate(t *testing.T) {
 	}
 }
 
+type dummyColumnValueMapper struct {
+	models.Admin
+}
+
+func (a *dummyColumnValueMapper) ColumnValueMap() map[string]any {
+	return map[string]any{
+		"email":        a.Email,
+		"passwordHash": a.PasswordHash,
+		"tokenKey":     "custom_token_key",
+	}
+}
+
+func TestDaoSaveWithColumnValueMapper(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	model := &dummyColumnValueMapper{}
+	model.Id = "test_mapped_id" // explicitly set an id
+	model.Email = "test_mapped_create@example.com"
+	model.TokenKey = "test_unmapped_token_key" // not used in the map
+	model.SetPassword("123456")
+	model.MarkAsNew()
+	if err := testApp.Dao().Save(model); err != nil {
+		t.Fatal(err)
+	}
+
+	createdModel, _ := testApp.Dao().FindAdminById("test_mapped_id")
+	if createdModel == nil {
+		t.Fatal("[create] Failed to find model with id 'test_mapped_id'")
+	}
+	if createdModel.Email != model.Email {
+		t.Fatalf("Expected model with email %q, got %q", model.Email, createdModel.Email)
+	}
+	if createdModel.TokenKey != "custom_token_key" {
+		t.Fatalf("Expected model with tokenKey %q, got %q", "custom_token_key", createdModel.TokenKey)
+	}
+
+	model.Email = "test_mapped_update@example.com"
+	model.Avatar = 9 // not mapped and expect to be ignored
+	if err := testApp.Dao().Save(model); err != nil {
+		t.Fatal(err)
+	}
+
+	updatedModel, _ := testApp.Dao().FindAdminById("test_mapped_id")
+	if updatedModel == nil {
+		t.Fatal("[update] Failed to find model with id 'test_mapped_id'")
+	}
+	if updatedModel.Email != model.Email {
+		t.Fatalf("Expected model with email %q, got %q", model.Email, createdModel.Email)
+	}
+	if updatedModel.Avatar != 0 {
+		t.Fatalf("Expected model avatar 0, got %v", updatedModel.Avatar)
+	}
+}
+
 func TestDaoDelete(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
@@ -211,35 +293,212 @@ func TestDaoBeforeHooksError(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
-	testApp.Dao().BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao := testApp.Dao()
+
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		return errors.New("before_create")
 	}
-	testApp.Dao().BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		return errors.New("before_update")
 	}
-	testApp.Dao().BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
 		return errors.New("before_delete")
 	}
 
 	existingModel, _ := testApp.Dao().FindAdminByEmail("test@example.com")
 
-	// try to create
+	// test create error
 	// ---
 	newModel := &models.Admin{}
-	newModel.Email = "test_new@example.com"
-	if err := testApp.Dao().Save(newModel); err.Error() != "before_create" {
+	if err := baseDao.Save(newModel); err.Error() != "before_create" {
 		t.Fatalf("Expected before_create error, got %v", err)
 	}
 
-	// try to update
+	// test update error
 	// ---
-	if err := testApp.Dao().Save(existingModel); err.Error() != "before_update" {
+	if err := baseDao.Save(existingModel); err.Error() != "before_update" {
 		t.Fatalf("Expected before_update error, got %v", err)
 	}
 
-	// try to delete
+	// test delete error
 	// ---
-	if err := testApp.Dao().Delete(existingModel); err.Error() != "before_delete" {
+	if err := baseDao.Delete(existingModel); err.Error() != "before_delete" {
 		t.Fatalf("Expected before_delete error, got %v", err)
 	}
 }
+
+func TestDaoTransactionHooksCallsOnFailure(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	beforeCreateFuncCalls := 0
+	beforeUpdateFuncCalls := 0
+	beforeDeleteFuncCalls := 0
+	afterCreateFuncCalls := 0
+	afterUpdateFuncCalls := 0
+	afterDeleteFuncCalls := 0
+
+	baseDao := testApp.Dao()
+
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeCreateFuncCalls++
+		return nil
+	}
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeUpdateFuncCalls++
+		return nil
+	}
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeDeleteFuncCalls++
+		return nil
+	}
+
+	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterCreateFuncCalls++
+	}
+	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterUpdateFuncCalls++
+	}
+	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterDeleteFuncCalls++
+	}
+
+	existingModel, _ := testApp.Dao().FindAdminByEmail("test@example.com")
+
+	baseDao.RunInTransaction(func(txDao1 *daos.Dao) error {
+		return txDao1.RunInTransaction(func(txDao2 *daos.Dao) error {
+			// test create
+			// ---
+			newModel := &models.Admin{}
+			newModel.Email = "test_new1@example.com"
+			newModel.SetPassword("123456")
+			if err := txDao2.Save(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test update (twice)
+			// ---
+			if err := txDao2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+			if err := txDao2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test delete
+			// ---
+			if err := txDao2.Delete(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			return errors.New("test_tx_error")
+		})
+	})
+
+	if beforeCreateFuncCalls != 1 {
+		t.Fatalf("Expected beforeCreateFuncCalls to be called 1 times, got %d", beforeCreateFuncCalls)
+	}
+	if beforeUpdateFuncCalls != 2 {
+		t.Fatalf("Expected beforeUpdateFuncCalls to be called 2 times, got %d", beforeUpdateFuncCalls)
+	}
+	if beforeDeleteFuncCalls != 1 {
+		t.Fatalf("Expected beforeDeleteFuncCalls to be called 1 times, got %d", beforeDeleteFuncCalls)
+	}
+	if afterCreateFuncCalls != 0 {
+		t.Fatalf("Expected afterCreateFuncCalls to be called 0 times, got %d", afterCreateFuncCalls)
+	}
+	if afterUpdateFuncCalls != 0 {
+		t.Fatalf("Expected afterUpdateFuncCalls to be called 0 times, got %d", afterUpdateFuncCalls)
+	}
+	if afterDeleteFuncCalls != 0 {
+		t.Fatalf("Expected afterDeleteFuncCalls to be called 0 times, got %d", afterDeleteFuncCalls)
+	}
+}
+
+func TestDaoTransactionHooksCallsOnSuccess(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	beforeCreateFuncCalls := 0
+	beforeUpdateFuncCalls := 0
+	beforeDeleteFuncCalls := 0
+	afterCreateFuncCalls := 0
+	afterUpdateFuncCalls := 0
+	afterDeleteFuncCalls := 0
+
+	baseDao := testApp.Dao()
+
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeCreateFuncCalls++
+		return nil
+	}
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeUpdateFuncCalls++
+		return nil
+	}
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		beforeDeleteFuncCalls++
+		return nil
+	}
+
+	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterCreateFuncCalls++
+	}
+	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterUpdateFuncCalls++
+	}
+	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
+		afterDeleteFuncCalls++
+	}
+
+	existingModel, _ := testApp.Dao().FindAdminByEmail("test@example.com")
+
+	baseDao.RunInTransaction(func(txDao1 *daos.Dao) error {
+		return txDao1.RunInTransaction(func(txDao2 *daos.Dao) error {
+			// test create
+			// ---
+			newModel := &models.Admin{}
+			newModel.Email = "test_new1@example.com"
+			newModel.SetPassword("123456")
+			if err := txDao2.Save(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test update (twice)
+			// ---
+			if err := txDao2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+			if err := txDao2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test delete
+			// ---
+			if err := txDao2.Delete(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			return nil
+		})
+	})
+
+	if beforeCreateFuncCalls != 1 {
+		t.Fatalf("Expected beforeCreateFuncCalls to be called 1 times, got %d", beforeCreateFuncCalls)
+	}
+	if beforeUpdateFuncCalls != 2 {
+		t.Fatalf("Expected beforeUpdateFuncCalls to be called 2 times, got %d", beforeUpdateFuncCalls)
+	}
+	if beforeDeleteFuncCalls != 1 {
+		t.Fatalf("Expected beforeDeleteFuncCalls to be called 1 times, got %d", beforeDeleteFuncCalls)
+	}
+	if afterCreateFuncCalls != 1 {
+		t.Fatalf("Expected afterCreateFuncCalls to be called 1 times, got %d", afterCreateFuncCalls)
+	}
+	if afterUpdateFuncCalls != 2 {
+		t.Fatalf("Expected afterUpdateFuncCalls to be called 2 times, got %d", afterUpdateFuncCalls)
+	}
+	if afterDeleteFuncCalls != 1 {
+		t.Fatalf("Expected afterDeleteFuncCalls to be called 1 times, got %d", afterDeleteFuncCalls)
+	}
+}

daos/collection.go

@@ -113,7 +113,7 @@ func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeI
 // - is referenced as part of a relation field in another collection
 func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 	if collection.System {
-		return errors.New("System collections cannot be deleted.")
+		return fmt.Errorf("System collection %q cannot be deleted.", collection.Name)
 	}
 
 	// ensure that there aren't any existing references.
@@ -123,7 +123,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 		return err
 	}
 	if total := len(result); total > 0 {
-		return fmt.Errorf("The collection has external relation field references (%d).", total)
+		return fmt.Errorf("The collection %q has external relation field references (%d).", collection.Name, total)
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
@@ -141,7 +141,7 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 func (dao *Dao) SaveCollection(collection *models.Collection) error {
 	var oldCollection *models.Collection
 
-	if collection.HasId() {
+	if !collection.IsNew() {
 		// get the existing collection state to compare with the new one
 		// note: the select is outside of the transaction to prevent SQLITE_LOCKED error when mixing read&write in a single transaction
 		var findErr error
@@ -161,3 +161,115 @@ func (dao *Dao) SaveCollection(collection *models.Collection) error {
 		return txDao.SyncRecordTableSchema(collection, oldCollection)
 	})
 }
+
+// ImportCollections imports the provided collections list within a single transaction.
+//
+// NB1! If deleteMissing is set, all local collections and schema fields, that are not present
+// in the imported configuration, WILL BE DELETED (including their related records data).
+//
+// NB2! This method doesn't perform validations on the imported collections data!
+// If you need validations, use [forms.CollectionsImport].
+func (dao *Dao) ImportCollections(
+	importedCollections []*models.Collection,
+	deleteMissing bool,
+	beforeRecordsSync func(txDao *Dao, mappedImported, mappedExisting map[string]*models.Collection) error,
+) error {
+	if len(importedCollections) == 0 {
+		return errors.New("No collections to import")
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		existingCollections := []*models.Collection{}
+		if err := txDao.CollectionQuery().OrderBy("created ASC").All(&existingCollections); err != nil {
+			return err
+		}
+		mappedExisting := make(map[string]*models.Collection, len(existingCollections))
+		for _, existing := range existingCollections {
+			mappedExisting[existing.GetId()] = existing
+		}
+
+		mappedImported := make(map[string]*models.Collection, len(importedCollections))
+		for _, imported := range importedCollections {
+			// generate id if not set
+			if !imported.HasId() {
+				imported.MarkAsNew()
+				imported.RefreshId()
+			}
+
+			if existing, ok := mappedExisting[imported.GetId()]; ok {
+				// preserve original created date
+				if !existing.Created.IsZero() {
+					imported.Created = existing.Created
+				}
+
+				// extend existing schema
+				if !deleteMissing {
+					schema, _ := existing.Schema.Clone()
+					for _, f := range imported.Schema.Fields() {
+						schema.AddField(f) // add or replace
+					}
+					imported.Schema = *schema
+				}
+			} else {
+				imported.MarkAsNew()
+			}
+
+			mappedImported[imported.GetId()] = imported
+		}
+
+		// delete old collections not available in the new configuration
+		// (before saving the imports in case a deleted collection name is being reused)
+		if deleteMissing {
+			for _, existing := range existingCollections {
+				if mappedImported[existing.GetId()] != nil {
+					continue // exist
+				}
+
+				if existing.System {
+					return fmt.Errorf("System collection %q cannot be deleted.", existing.Name)
+				}
+
+				// delete the collection
+				if err := txDao.Delete(existing); err != nil {
+					return err
+				}
+			}
+		}
+
+		// upsert imported collections
+		for _, imported := range importedCollections {
+			if err := txDao.Save(imported); err != nil {
+				return err
+			}
+		}
+
+		if beforeRecordsSync != nil {
+			if err := beforeRecordsSync(txDao, mappedImported, mappedExisting); err != nil {
+				return err
+			}
+		}
+
+		// delete the record tables of the deleted collections
+		if deleteMissing {
+			for _, existing := range existingCollections {
+				if mappedImported[existing.GetId()] != nil {
+					continue // exist
+				}
+
+				if err := txDao.DeleteTable(existing.Name); err != nil {
+					return err
+				}
+			}
+		}
+
+		// sync the upserted collections with the related records table
+		for _, imported := range importedCollections {
+			existing := mappedExisting[imported.GetId()]
+			if err := txDao.SyncRecordTableSchema(imported, existing); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}

daos/collection_test.go

@@ -1,8 +1,11 @@
 package daos_test
 
 import (
+	"encoding/json"
+	"errors"
 	"testing"
 
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
@@ -250,3 +253,314 @@ func TestSaveCollectionUpdate(t *testing.T) {
 		}
 	}
 }
+
+func TestImportCollections(t *testing.T) {
+	scenarios := []struct {
+		name                   string
+		jsonData               string
+		deleteMissing          bool
+		beforeRecordsSync      func(txDao *daos.Dao, mappedImported, mappedExisting map[string]*models.Collection) error
+		expectError            bool
+		expectCollectionsCount int
+		afterTestFunc          func(testApp *tests.TestApp, resultCollections []*models.Collection)
+	}{
+		{
+			name:                   "empty collections",
+			jsonData:               `[]`,
+			expectError:            true,
+			expectCollectionsCount: 5,
+		},
+		{
+			name: "check db constraints",
+			jsonData: `[
+				{"name": "import_test", "schema": []}
+			]`,
+			deleteMissing:          false,
+			expectError:            true,
+			expectCollectionsCount: 5,
+		},
+		{
+			name: "minimal collection import",
+			jsonData: `[
+				{"name": "import_test", "schema": [{"name":"test", "type": "text"}]}
+			]`,
+			deleteMissing:          false,
+			expectError:            false,
+			expectCollectionsCount: 6,
+		},
+		{
+			name: "minimal collection import + failed beforeRecordsSync",
+			jsonData: `[
+				{"name": "import_test", "schema": [{"name":"test", "type": "text"}]}
+			]`,
+			beforeRecordsSync: func(txDao *daos.Dao, mappedImported, mappedExisting map[string]*models.Collection) error {
+				return errors.New("test_error")
+			},
+			deleteMissing:          false,
+			expectError:            true,
+			expectCollectionsCount: 5,
+		},
+		{
+			name: "minimal collection import + successful beforeRecordsSync",
+			jsonData: `[
+				{"name": "import_test", "schema": [{"name":"test", "type": "text"}]}
+			]`,
+			beforeRecordsSync: func(txDao *daos.Dao, mappedImported, mappedExisting map[string]*models.Collection) error {
+				return nil
+			},
+			deleteMissing:          false,
+			expectError:            false,
+			expectCollectionsCount: 6,
+		},
+		{
+			name: "new + update + delete system collection",
+			jsonData: `[
+				{
+					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+					"name":"demo",
+					"schema":[
+						{
+							"id":"_2hlxbmp",
+							"name":"title",
+							"type":"text",
+							"system":false,
+							"required":true,
+							"unique":false,
+							"options":{
+								"min":3,
+								"max":null,
+								"pattern":""
+							}
+						}
+					]
+				},
+				{
+					"name": "import1",
+					"schema": [
+						{
+							"name":"active",
+							"type":"bool"
+						}
+					]
+				}
+			]`,
+			deleteMissing:          true,
+			expectError:            true,
+			expectCollectionsCount: 5,
+		},
+		{
+			name: "new + update + delete non-system collection",
+			jsonData: `[
+				{
+					"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+					"name":"profiles",
+					"system":true,
+					"listRule":"userId = @request.user.id",
+					"viewRule":"created > 'test_change'",
+					"createRule":"userId = @request.user.id",
+					"updateRule":"userId = @request.user.id",
+					"deleteRule":"userId = @request.user.id",
+					"schema":[
+						{
+							"id":"koih1lqx",
+							"name":"userId",
+							"type":"user",
+							"system":true,
+							"required":true,
+							"unique":true,
+							"options":{
+								"maxSelect":1,
+								"cascadeDelete":true
+							}
+						},
+						{
+							"id":"69ycbg3q",
+							"name":"rel",
+							"type":"relation",
+							"system":false,
+							"required":false,
+							"unique":false,
+							"options":{
+								"maxSelect":2,
+								"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+								"cascadeDelete":false
+							}
+						}
+					]
+				},
+				{
+					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+					"name":"demo",
+					"schema":[
+						{
+							"id":"_2hlxbmp",
+							"name":"title",
+							"type":"text",
+							"system":false,
+							"required":true,
+							"unique":false,
+							"options":{
+								"min":3,
+								"max":null,
+								"pattern":""
+							}
+						}
+					]
+				},
+				{
+					"id": "test_deleted_collection_name_reuse",
+					"name": "demo2",
+					"schema": [
+						{
+							"id":"fz6iql2m",
+							"name":"active",
+							"type":"bool"
+						}
+					]
+				}
+			]`,
+			deleteMissing:          true,
+			expectError:            false,
+			expectCollectionsCount: 3,
+		},
+		{
+			name: "test with deleteMissing: false",
+			jsonData: `[
+				{
+					"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+					"name":"profiles",
+					"system":true,
+					"listRule":"userId = @request.user.id",
+					"viewRule":"created > 'test_change'",
+					"createRule":"userId = @request.user.id",
+					"updateRule":"userId = @request.user.id",
+					"deleteRule":"userId = @request.user.id",
+					"schema":[
+						{
+							"id":"69ycbg3q",
+							"name":"rel",
+							"type":"relation",
+							"system":false,
+							"required":false,
+							"unique":false,
+							"options":{
+								"maxSelect":2,
+								"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+								"cascadeDelete":true
+							}
+						},
+						{
+							"id":"abcd_import",
+							"name":"new_field",
+							"type":"bool"
+						}
+					]
+				},
+				{
+					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+					"name":"demo",
+					"schema":[
+						{
+							"id":"_2hlxbmp",
+							"name":"title",
+							"type":"text",
+							"system":false,
+							"required":true,
+							"unique":false,
+							"options":{
+								"min":3,
+								"max":null,
+								"pattern":""
+							}
+						},
+						{
+							"id":"_2hlxbmp",
+							"name":"field_with_duplicate_id",
+							"type":"text",
+							"system":false,
+							"required":true,
+							"unique":false,
+							"options":{
+								"min":3,
+								"max":null,
+								"pattern":""
+							}
+						},
+						{
+							"id":"abcd_import",
+							"name":"new_field",
+							"type":"text"
+						}
+					]
+				},
+				{
+					"name": "new_import",
+					"schema": [
+						{
+							"id":"abcd_import",
+							"name":"active",
+							"type":"bool"
+						}
+					]
+				}
+			]`,
+			deleteMissing:          false,
+			expectError:            false,
+			expectCollectionsCount: 6,
+			afterTestFunc: func(testApp *tests.TestApp, resultCollections []*models.Collection) {
+				expectedCollectionFields := map[string]int{
+					"profiles":   6,
+					"demo":       3,
+					"demo2":      14,
+					"demo3":      1,
+					"demo4":      6,
+					"new_import": 1,
+				}
+				for name, expectedCount := range expectedCollectionFields {
+					collection, err := testApp.Dao().FindCollectionByNameOrId(name)
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if totalFields := len(collection.Schema.Fields()); totalFields != expectedCount {
+						t.Errorf("Expected %d %q fields, got %d", expectedCount, collection.Name, totalFields)
+					}
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		importedCollections := []*models.Collection{}
+
+		// load data
+		loadErr := json.Unmarshal([]byte(scenario.jsonData), &importedCollections)
+		if loadErr != nil {
+			t.Fatalf("[%s] Failed to load  data: %v", scenario.name, loadErr)
+			continue
+		}
+
+		err := testApp.Dao().ImportCollections(importedCollections, scenario.deleteMissing, scenario.beforeRecordsSync)
+
+		hasErr := err != nil
+		if hasErr != scenario.expectError {
+			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, err)
+		}
+
+		// check collections count
+		collections := []*models.Collection{}
+		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+			t.Fatal(err)
+		}
+		if len(collections) != scenario.expectCollectionsCount {
+			t.Errorf("[%s] Expected %d collections, got %d", scenario.name, scenario.expectCollectionsCount, len(collections))
+		}
+
+		if scenario.afterTestFunc != nil {
+			scenario.afterTestFunc(testApp, collections)
+		}
+	}
+}

daos/external_auth.go

@@ -0,0 +1,108 @@
+package daos
+
+import (
+	"errors"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+// ExternalAuthQuery returns a new ExternalAuth select query.
+func (dao *Dao) ExternalAuthQuery() *dbx.SelectQuery {
+	return dao.ModelQuery(&models.ExternalAuth{})
+}
+
+/// FindAllExternalAuthsByUserId returns all ExternalAuth models
+/// linked to the provided userId.
+func (dao *Dao) FindAllExternalAuthsByUserId(userId string) ([]*models.ExternalAuth, error) {
+	auths := []*models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.HashExp{"userId": userId}).
+		OrderBy("created ASC").
+		All(&auths)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return auths, nil
+}
+
+// FindExternalAuthByProvider returns the first available
+// ExternalAuth model for the specified provider and providerId.
+func (dao *Dao) FindExternalAuthByProvider(provider, providerId string) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
+		AndWhere(dbx.HashExp{
+			"provider":   provider,
+			"providerId": providerId,
+		}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+// FindExternalAuthByUserIdAndProvider returns the first available
+// ExternalAuth model for the specified userId and provider.
+func (dao *Dao) FindExternalAuthByUserIdAndProvider(userId, provider string) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.HashExp{
+			"userId":   userId,
+			"provider": provider,
+		}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+// SaveExternalAuth upserts the provided ExternalAuth model.
+func (dao *Dao) SaveExternalAuth(model *models.ExternalAuth) error {
+	// extra check the model data in case the provider's API response
+	// has changed and no longer returns the expected fields
+	if model.UserId == "" || model.Provider == "" || model.ProviderId == "" {
+		return errors.New("Missing required ExternalAuth fields.")
+	}
+
+	return dao.Save(model)
+}
+
+// DeleteExternalAuth deletes the provided ExternalAuth model.
+//
+// The delete may fail if the linked user doesn't have an email and
+// there are no other linked ExternalAuth models available.
+func (dao *Dao) DeleteExternalAuth(model *models.ExternalAuth) error {
+	user, err := dao.FindUserById(model.UserId)
+	if err != nil {
+		return err
+	}
+
+	// if the user doesn't have an email, make sure that there
+	// is at least one other external auth relation available
+	if user.Email == "" {
+		allExternalAuths, err := dao.FindAllExternalAuthsByUserId(user.Id)
+		if err != nil {
+			return err
+		}
+
+		if len(allExternalAuths) <= 1 {
+			return errors.New("You cannot delete the only available external auth relation because the user doesn't have an email address.")
+		}
+	}
+
+	return dao.Delete(model)
+}

daos/external_auth_test.go

@@ -0,0 +1,195 @@
+package daos_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestExternalAuthQuery(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	expected := "SELECT {{_externalAuths}}.* FROM `_externalAuths`"
+
+	sql := app.Dao().ExternalAuthQuery().Build().SQL()
+	if sql != expected {
+		t.Errorf("Expected sql %s, got %s", expected, sql)
+	}
+}
+
+func TestFindAllExternalAuthsByUserId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		userId        string
+		expectedCount int
+	}{
+		{"", 0},
+		{"missing", 0},
+		{"97cc3d3d-6ba2-383f-b42a-7bc84d27410c", 0},
+		{"cx9u0dh2udo8xol", 2},
+	}
+
+	for i, s := range scenarios {
+		auths, err := app.Dao().FindAllExternalAuthsByUserId(s.userId)
+		if err != nil {
+			t.Errorf("(%d) Unexpected error %v", i, err)
+			continue
+		}
+
+		if len(auths) != s.expectedCount {
+			t.Errorf("(%d) Expected %d auths, got %d", i, s.expectedCount, len(auths))
+		}
+
+		for _, auth := range auths {
+			if auth.UserId != s.userId {
+				t.Errorf("(%d) Expected all auths to be linked to userId %s, got %v", i, s.userId, auth)
+			}
+		}
+	}
+}
+
+func TestFindExternalAuthByProvider(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		provider   string
+		providerId string
+		expectedId string
+	}{
+		{"", "", ""},
+		{"github", "", ""},
+		{"github", "id1", ""},
+		{"github", "id2", ""},
+		{"google", "id1", "abcdefghijklmn0"},
+		{"gitlab", "id2", "abcdefghijklmn1"},
+	}
+
+	for i, s := range scenarios {
+		auth, err := app.Dao().FindExternalAuthByProvider(s.provider, s.providerId)
+
+		hasErr := err != nil
+		expectErr := s.expectedId == ""
+		if hasErr != expectErr {
+			t.Errorf("(%d) Expected hasErr %v, got %v", i, expectErr, err)
+			continue
+		}
+
+		if auth != nil && auth.Id != s.expectedId {
+			t.Errorf("(%d) Expected external auth with ID %s, got \n%v", i, s.expectedId, auth)
+		}
+	}
+}
+
+func TestFindExternalAuthByUserIdAndProvider(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		userId     string
+		provider   string
+		expectedId string
+	}{
+		{"", "", ""},
+		{"", "github", ""},
+		{"123456", "github", ""}, // missing user and provider record
+		{"123456", "google", ""}, // missing user but existing provider record
+		{"97cc3d3d-6ba2-383f-b42a-7bc84d27410c", "google", ""},
+		{"cx9u0dh2udo8xol", "google", "abcdefghijklmn0"},
+		{"cx9u0dh2udo8xol", "gitlab", "abcdefghijklmn1"},
+	}
+
+	for i, s := range scenarios {
+		auth, err := app.Dao().FindExternalAuthByUserIdAndProvider(s.userId, s.provider)
+
+		hasErr := err != nil
+		expectErr := s.expectedId == ""
+		if hasErr != expectErr {
+			t.Errorf("(%d) Expected hasErr %v, got %v", i, expectErr, err)
+			continue
+		}
+
+		if auth != nil && auth.Id != s.expectedId {
+			t.Errorf("(%d) Expected external auth with ID %s, got \n%v", i, s.expectedId, auth)
+		}
+	}
+}
+
+func TestSaveExternalAuth(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// save with empty provider data
+	emptyAuth := &models.ExternalAuth{}
+	if err := app.Dao().SaveExternalAuth(emptyAuth); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	auth := &models.ExternalAuth{
+		UserId:     "97cc3d3d-6ba2-383f-b42a-7bc84d27410c",
+		Provider:   "test",
+		ProviderId: "test_id",
+	}
+
+	if err := app.Dao().SaveExternalAuth(auth); err != nil {
+		t.Fatal(err)
+	}
+
+	// check if it was really saved
+	foundAuth, err := app.Dao().FindExternalAuthByProvider("test", "test_id")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if auth.Id != foundAuth.Id {
+		t.Fatalf("Expected ExternalAuth with id %s, got \n%v", auth.Id, foundAuth)
+	}
+}
+
+func TestDeleteExternalAuth(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.Dao().FindUserById("cx9u0dh2udo8xol")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	auths, err := app.Dao().FindAllExternalAuthsByUserId(user.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := app.Dao().DeleteExternalAuth(auths[0]); err != nil {
+		t.Fatalf("Failed to delete the first ExternalAuth relation, got \n%v", err)
+	}
+
+	if err := app.Dao().DeleteExternalAuth(auths[1]); err == nil {
+		t.Fatal("Expected delete to fail, got nil")
+	}
+
+	// update the user model and try again
+	user.Email = "test_new@example.com"
+	if err := app.Dao().SaveUser(user); err != nil {
+		t.Fatal(err)
+	}
+
+	// try to delete auths[1] again
+	if err := app.Dao().DeleteExternalAuth(auths[1]); err != nil {
+		t.Fatalf("Failed to delete the last ExternalAuth relation, got \n%v", err)
+	}
+
+	// check if the relations were really deleted
+	newAuths, err := app.Dao().FindAllExternalAuthsByUserId(user.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(newAuths) != 0 {
+		t.Fatalf("Expected all user %s ExternalAuth relations to be deleted, got \n%v", user.Id, newAuths)
+	}
+}

daos/record_test.go

@@ -298,7 +298,6 @@ func TestFindUserRelatedRecords(t *testing.T) {
 		}
 
 		if len(records) != len(scenario.expectedIds) {
-			fmt.Println(records[0])
 			t.Errorf("(%d) Expected %d records, got %d (%v)", i, len(scenario.expectedIds), len(records), records)
 			continue
 		}

daos/user.go

@@ -94,7 +94,7 @@ func (dao *Dao) FindUserById(id string) (*models.User, error) {
 	return model, nil
 }
 
-// FindUserByEmail finds a single User model by its email address.
+// FindUserByEmail finds a single User model by its non-empty email address.
 //
 // This method also auto loads the related user profile record
 // into the found model.
@@ -102,6 +102,7 @@ func (dao *Dao) FindUserByEmail(email string) (*models.User, error) {
 	model := &models.User{}
 
 	err := dao.UserQuery().
+		AndWhere(dbx.Not(dbx.HashExp{"email": ""})).
 		AndWhere(dbx.HashExp{"email": email}).
 		Limit(1).
 		One(model)

daos/user_test.go

@@ -110,6 +110,7 @@ func TestFindUserByEmail(t *testing.T) {
 		email       string
 		expectError bool
 	}{
+		{"", true},
 		{"invalid", true},
 		{"missing@example.com", true},
 		{"test@example.com", false},

examples/base/main.go

@@ -2,20 +2,40 @@ package main
 
 import (
 	"log"
+	"os"
+	"path/filepath"
+	"strings"
 
-	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 )
 
+func defaultPublicDir() string {
+	if strings.HasPrefix(os.Args[0], os.TempDir()) {
+		// most likely ran with go run
+		return "./pb_public"
+	}
+
+	return filepath.Join(os.Args[0], "../pb_public")
+}
+
 func main() {
 	app := pocketbase.New()
 
+	var publicDirFlag string
+
+	// add "--publicDir" option flag
+	app.RootCmd.PersistentFlags().StringVar(
+		&publicDirFlag,
+		"publicDir",
+		defaultPublicDir(),
+		"the directory to serve static files",
+	)
+
 	app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
 		// serves static files from the provided public dir (if exists)
-		subFs := echo.MustSubFS(e.Router.Filesystem, "pb_public")
-		e.Router.GET("/*", apis.StaticDirectoryHandler(subFs, false))
+		e.Router.GET("/*", apis.StaticDirectoryHandler(os.DirFS(publicDirFlag), false))
 
 		return nil
 	})

forms/admin_login.go

@@ -6,26 +6,57 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminLogin defines an admin email/pass login form.
+// AdminLogin specifies an admin email/pass login form.
 type AdminLogin struct {
-	app core.App
+	config AdminLoginConfig
 
 	Email    string `form:"email" json:"email"`
 	Password string `form:"password" json:"password"`
 }
 
-// NewAdminLogin creates new admin login form for the provided app.
+// AdminLoginConfig is the [AdminLogin] factory initializer config.
+//
+// NB! App is a required struct member.
+type AdminLoginConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewAdminLogin creates a new [AdminLogin] form with initializer
+// config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewAdminLoginWithConfig] with explicitly set Dao.
 func NewAdminLogin(app core.App) *AdminLogin {
-	return &AdminLogin{app: app}
+	return NewAdminLoginWithConfig(AdminLoginConfig{
+		App: app,
+	})
+}
+
+// NewAdminLoginWithConfig creates a new [AdminLogin] form
+// with the provided config or panics on invalid configuration.
+func NewAdminLoginWithConfig(config AdminLoginConfig) *AdminLogin {
+	form := &AdminLogin{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *AdminLogin) Validate() error {
 	return validation.ValidateStruct(form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.Email),
+		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
 		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
 	)
 }
@@ -37,7 +68,7 @@ func (form *AdminLogin) Submit() (*models.Admin, error) {
 		return nil, err
 	}
 
-	admin, err := form.app.Dao().FindAdminByEmail(form.Email)
+	admin, err := form.config.Dao.FindAdminByEmail(form.Email)
 	if err != nil {
 		return nil, err
 	}

forms/admin_login_test.go

@@ -7,6 +7,16 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestAdminLoginPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewAdminLogin(nil)
+}
+
 func TestAdminLoginValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/admin_password_reset_confirm.go

@@ -3,24 +3,53 @@ package forms
 import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminPasswordResetConfirm defines an admin password reset confirmation form.
+// AdminPasswordResetConfirm specifies an admin password reset confirmation form.
 type AdminPasswordResetConfirm struct {
-	app core.App
+	config AdminPasswordResetConfirmConfig
 
 	Token           string `form:"token" json:"token"`
 	Password        string `form:"password" json:"password"`
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// NewAdminPasswordResetConfirm creates new admin password reset confirmation form.
+// AdminPasswordResetConfirmConfig is the [AdminPasswordResetConfirm] factory initializer config.
+//
+// NB! App is required struct member.
+type AdminPasswordResetConfirmConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewAdminPasswordResetConfirm creates a new [AdminPasswordResetConfirm]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewAdminPasswordResetConfirmWithConfig] with explicitly set Dao.
 func NewAdminPasswordResetConfirm(app core.App) *AdminPasswordResetConfirm {
-	return &AdminPasswordResetConfirm{
-		app: app,
+	return NewAdminPasswordResetConfirmWithConfig(AdminPasswordResetConfirmConfig{
+		App: app,
+	})
+}
+
+// NewAdminPasswordResetConfirmWithConfig creates a new [AdminPasswordResetConfirm]
+// form with the provided config or panics on invalid configuration.
+func NewAdminPasswordResetConfirmWithConfig(config AdminPasswordResetConfirmConfig) *AdminPasswordResetConfirm {
+	form := &AdminPasswordResetConfirm{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -38,9 +67,9 @@ func (form *AdminPasswordResetConfirm) checkToken(value any) error {
 		return nil // nothing to check
 	}
 
-	admin, err := form.app.Dao().FindAdminByToken(
+	admin, err := form.config.Dao.FindAdminByToken(
 		v,
-		form.app.Settings().AdminPasswordResetToken.Secret,
+		form.config.App.Settings().AdminPasswordResetToken.Secret,
 	)
 	if err != nil || admin == nil {
 		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
@@ -56,9 +85,9 @@ func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
 		return nil, err
 	}
 
-	admin, err := form.app.Dao().FindAdminByToken(
+	admin, err := form.config.Dao.FindAdminByToken(
 		form.Token,
-		form.app.Settings().AdminPasswordResetToken.Secret,
+		form.config.App.Settings().AdminPasswordResetToken.Secret,
 	)
 	if err != nil {
 		return nil, err
@@ -68,7 +97,7 @@ func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
 		return nil, err
 	}
 
-	if err := form.app.Dao().SaveAdmin(admin); err != nil {
+	if err := form.config.Dao.SaveAdmin(admin); err != nil {
 		return nil, err
 	}
 

forms/admin_password_reset_confirm_test.go

@@ -8,6 +8,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+func TestAdminPasswordResetPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewAdminPasswordResetConfirm(nil)
+}
+
 func TestAdminPasswordResetConfirmValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/admin_password_reset_request.go

@@ -7,24 +7,53 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-// AdminPasswordResetRequest defines an admin password reset request form.
+// AdminPasswordResetRequest specifies an admin password reset request form.
 type AdminPasswordResetRequest struct {
-	app             core.App
-	resendThreshold float64
+	config AdminPasswordResetRequestConfig
 
 	Email string `form:"email" json:"email"`
 }
 
-// NewAdminPasswordResetRequest creates new admin password reset request form.
+// AdminPasswordResetRequestConfig is the [AdminPasswordResetRequest] factory initializer config.
+//
+// NB! App is required struct member.
+type AdminPasswordResetRequestConfig struct {
+	App             core.App
+	Dao             *daos.Dao
+	ResendThreshold float64 // in seconds
+}
+
+// NewAdminPasswordResetRequest creates a new [AdminPasswordResetRequest]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewAdminPasswordResetRequestWithConfig] with explicitly set Dao.
 func NewAdminPasswordResetRequest(app core.App) *AdminPasswordResetRequest {
-	return &AdminPasswordResetRequest{
-		app:             app,
-		resendThreshold: 120, // 2 min
+	return NewAdminPasswordResetRequestWithConfig(AdminPasswordResetRequestConfig{
+		App:             app,
+		ResendThreshold: 120, // 2min
+	})
+}
+
+// NewAdminPasswordResetRequestWithConfig creates a new [AdminPasswordResetRequest]
+// form with the provided config or panics on invalid configuration.
+func NewAdminPasswordResetRequestWithConfig(config AdminPasswordResetRequestConfig) *AdminPasswordResetRequest {
+	form := &AdminPasswordResetRequest{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -36,7 +65,7 @@ func (form *AdminPasswordResetRequest) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 		),
 	)
 }
@@ -48,23 +77,23 @@ func (form *AdminPasswordResetRequest) Submit() error {
 		return err
 	}
 
-	admin, err := form.app.Dao().FindAdminByEmail(form.Email)
+	admin, err := form.config.Dao.FindAdminByEmail(form.Email)
 	if err != nil {
 		return err
 	}
 
 	now := time.Now().UTC()
 	lastResetSentAt := admin.LastResetSentAt.Time()
-	if now.Sub(lastResetSentAt).Seconds() < form.resendThreshold {
+	if now.Sub(lastResetSentAt).Seconds() < form.config.ResendThreshold {
 		return errors.New("You have already requested a password reset.")
 	}
 
-	if err := mails.SendAdminPasswordReset(form.app, admin); err != nil {
+	if err := mails.SendAdminPasswordReset(form.config.App, admin); err != nil {
 		return err
 	}
 
 	// update last sent timestamp
 	admin.LastResetSentAt = types.NowDateTime()
 
-	return form.app.Dao().SaveAdmin(admin)
+	return form.config.Dao.SaveAdmin(admin)
 }

forms/admin_password_reset_request_test.go

@@ -7,6 +7,16 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestAdminPasswordResetRequestPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewAdminPasswordResetRequest(nil)
+}
+
 func TestAdminPasswordResetRequestValidate(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

forms/admin_upsert.go

@@ -4,32 +4,62 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminUpsert defines an admin upsert (create/update) form.
+// AdminUpsert specifies a [models.Admin] upsert (create/update) form.
 type AdminUpsert struct {
-	app      core.App
-	admin    *models.Admin
-	isCreate bool
+	config AdminUpsertConfig
+	admin  *models.Admin
 
+	Id              string `form:"id" json:"id"`
 	Avatar          int    `form:"avatar" json:"avatar"`
 	Email           string `form:"email" json:"email"`
 	Password        string `form:"password" json:"password"`
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// NewAdminUpsert creates new upsert form for the provided admin model
-// (pass an empty admin model instance (`&models.Admin{}`) for create).
+// AdminUpsertConfig is the [AdminUpsert] factory initializer config.
+//
+// NB! App is a required struct member.
+type AdminUpsertConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewAdminUpsert creates a new [AdminUpsert] form with initializer
+// config created from the provided [core.App] and [models.Admin] instances
+// (for create you could pass a pointer to an empty Admin - `&models.Admin{}`).
+//
+// If you want to submit the form as part of another transaction, use
+// [NewAdminUpsertWithConfig] with explicitly set Dao.
 func NewAdminUpsert(app core.App, admin *models.Admin) *AdminUpsert {
+	return NewAdminUpsertWithConfig(AdminUpsertConfig{
+		App: app,
+	}, admin)
+}
+
+// NewAdminUpsertWithConfig creates a new [AdminUpsert] form
+// with the provided config and [models.Admin] instance or panics on invalid configuration
+// (for create you could pass a pointer to an empty Admin - `&models.Admin{}`).
+func NewAdminUpsertWithConfig(config AdminUpsertConfig, admin *models.Admin) *AdminUpsert {
 	form := &AdminUpsert{
-		app:      app,
-		admin:    admin,
-		isCreate: !admin.HasId(),
+		config: config,
+		admin:  admin,
+	}
+
+	if form.config.App == nil || form.admin == nil {
+		panic("Invalid initializer config or nil upsert model.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
 	}
 
 	// load defaults
+	form.Id = admin.Id
 	form.Avatar = admin.Avatar
 	form.Email = admin.Email
 
@@ -39,6 +69,14 @@ func NewAdminUpsert(app core.App, admin *models.Admin) *AdminUpsert {
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *AdminUpsert) Validate() error {
 	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Id,
+			validation.When(
+				form.admin.IsNew(),
+				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
+				validation.Match(idRegex),
+			).Else(validation.In(form.admin.Id)),
+		),
 		validation.Field(
 			&form.Avatar,
 			validation.Min(0),
@@ -48,12 +86,12 @@ func (form *AdminUpsert) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 			validation.By(form.checkUniqueEmail),
 		),
 		validation.Field(
 			&form.Password,
-			validation.When(form.isCreate, validation.Required),
+			validation.When(form.admin.IsNew(), validation.Required),
 			validation.Length(10, 100),
 		),
 		validation.Field(
@@ -67,7 +105,7 @@ func (form *AdminUpsert) Validate() error {
 func (form *AdminUpsert) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
-	if form.app.Dao().IsAdminEmailUnique(v, form.admin.Id) {
+	if form.config.Dao.IsAdminEmailUnique(v, form.admin.Id) {
 		return nil
 	}
 
@@ -83,6 +121,12 @@ func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
 		return err
 	}
 
+	// custom insertion id can be set only on create
+	if form.admin.IsNew() && form.Id != "" {
+		form.admin.MarkAsNew()
+		form.admin.SetId(form.Id)
+	}
+
 	form.admin.Avatar = form.Avatar
 	form.admin.Email = form.Email
 
@@ -91,6 +135,6 @@ func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
 	}
 
 	return runInterceptors(func() error {
-		return form.app.Dao().SaveAdmin(form.admin)
+		return form.config.Dao.SaveAdmin(form.admin)
 	}, interceptors...)
 }

forms/admin_upsert_test.go

@@ -3,6 +3,7 @@ package forms_test
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -11,6 +12,29 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestAdminUpsertPanic1(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewAdminUpsert(nil, nil)
+}
+
+func TestAdminUpsertPanic2(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewAdminUpsert(app, nil)
+}
+
 func TestNewAdminUpsert(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -347,3 +371,105 @@ func TestAdminUpsertSubmitInterceptors(t *testing.T) {
 		t.Fatalf("Expected the form model to be filled before calling the interceptors")
 	}
 }
+
+func TestAdminUpsertWithCustomId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	existingAdmin, err := app.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		jsonData    string
+		collection  *models.Admin
+		expectError bool
+	}{
+		{
+			"empty data",
+			"{}",
+			&models.Admin{},
+			false,
+		},
+		{
+			"empty id",
+			`{"id":""}`,
+			&models.Admin{},
+			false,
+		},
+		{
+			"id < 15 chars",
+			`{"id":"a23"}`,
+			&models.Admin{},
+			true,
+		},
+		{
+			"id > 15 chars",
+			`{"id":"a234567890123456"}`,
+			&models.Admin{},
+			true,
+		},
+		{
+			"id = 15 chars (invalid chars)",
+			`{"id":"a@3456789012345"}`,
+			&models.Admin{},
+			true,
+		},
+		{
+			"id = 15 chars (valid chars)",
+			`{"id":"a23456789012345"}`,
+			&models.Admin{},
+			false,
+		},
+		{
+			"changing the id of an existing item",
+			`{"id":"b23456789012345"}`,
+			existingAdmin,
+			true,
+		},
+		{
+			"using the same existing item id",
+			`{"id":"` + existingAdmin.Id + `"}`,
+			existingAdmin,
+			false,
+		},
+		{
+			"skipping the id for existing item",
+			`{}`,
+			existingAdmin,
+			false,
+		},
+	}
+
+	for i, scenario := range scenarios {
+		form := forms.NewAdminUpsert(app, scenario.collection)
+		if form.Email == "" {
+			form.Email = fmt.Sprintf("test_id_%d@example.com", i)
+		}
+		form.Password = "1234567890"
+		form.PasswordConfirm = form.Password
+
+		// load data
+		loadErr := json.Unmarshal([]byte(scenario.jsonData), form)
+		if loadErr != nil {
+			t.Errorf("[%s] Failed to load form data: %v", scenario.name, loadErr)
+			continue
+		}
+
+		submitErr := form.Submit()
+		hasErr := submitErr != nil
+
+		if hasErr != scenario.expectError {
+			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, submitErr)
+		}
+
+		if !hasErr && form.Id != "" {
+			_, err := app.Dao().FindAdminById(form.Id)
+			if err != nil {
+				t.Errorf("[%s] Expected to find record with id %s, got %v", scenario.name, form.Id, err)
+			}
+		}
+	}
+}

forms/base.go

@@ -2,6 +2,11 @@
 // validation and applying changes to existing DB models through the app Dao.
 package forms
 
+import "regexp"
+
+// base ID value regex pattern
+var idRegex = regexp.MustCompile(`^[^\@\#\$\&\|\.\,\'\"\\\/\s]+$`)
+
 // InterceptorNextFunc is a interceptor handler function.
 // Usually used in combination with InterceptorFunc.
 type InterceptorNextFunc = func() error

forms/collection_upsert.go

@@ -1,11 +1,13 @@
 package forms
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/resolvers"
@@ -14,12 +16,12 @@ import (
 
 var collectionNameRegex = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_]*$`)
 
-// CollectionUpsert defines a collection upsert (create/update) form.
+// CollectionUpsert specifies a [models.Collection] upsert (create/update) form.
 type CollectionUpsert struct {
-	app        core.App
+	config     CollectionUpsertConfig
 	collection *models.Collection
-	isCreate   bool
 
+	Id         string        `form:"id" json:"id"`
 	Name       string        `form:"name" json:"name"`
 	System     bool          `form:"system" json:"system"`
 	Schema     schema.Schema `form:"schema" json:"schema"`
@@ -30,25 +32,54 @@ type CollectionUpsert struct {
 	DeleteRule *string       `form:"deleteRule" json:"deleteRule"`
 }
 
-// NewCollectionUpsert creates new collection upsert form for the provided Collection model
-// (pass an empty Collection model instance (`&models.Collection{}`) for create).
+// CollectionUpsertConfig is the [CollectionUpsert] factory initializer config.
+//
+// NB! App is a required struct member.
+type CollectionUpsertConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewCollectionUpsert creates a new [CollectionUpsert] form with initializer
+// config created from the provided [core.App] and [models.Collection] instances
+// (for create you could pass a pointer to an empty Collection - `&models.Collection{}`).
+//
+// If you want to submit the form as part of another transaction, use
+// [NewCollectionUpsertWithConfig] with explicitly set Dao.
 func NewCollectionUpsert(app core.App, collection *models.Collection) *CollectionUpsert {
+	return NewCollectionUpsertWithConfig(CollectionUpsertConfig{
+		App: app,
+	}, collection)
+}
+
+// NewCollectionUpsertWithConfig creates a new [CollectionUpsert] form
+// with the provided config and [models.Collection] instance or panics on invalid configuration
+// (for create you could pass a pointer to an empty Collection - `&models.Collection{}`).
+func NewCollectionUpsertWithConfig(config CollectionUpsertConfig, collection *models.Collection) *CollectionUpsert {
 	form := &CollectionUpsert{
-		app:        app,
+		config:     config,
 		collection: collection,
-		isCreate:   !collection.HasId(),
+	}
+
+	if form.config.App == nil || form.collection == nil {
+		panic("Invalid initializer config or nil upsert model.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
 	}
 
 	// load defaults
-	form.Name = collection.Name
-	form.System = collection.System
-	form.ListRule = collection.ListRule
-	form.ViewRule = collection.ViewRule
-	form.CreateRule = collection.CreateRule
-	form.UpdateRule = collection.UpdateRule
-	form.DeleteRule = collection.DeleteRule
+	form.Id = form.collection.Id
+	form.Name = form.collection.Name
+	form.System = form.collection.System
+	form.ListRule = form.collection.ListRule
+	form.ViewRule = form.collection.ViewRule
+	form.CreateRule = form.collection.CreateRule
+	form.UpdateRule = form.collection.UpdateRule
+	form.DeleteRule = form.collection.DeleteRule
 
-	clone, _ := collection.Schema.Clone()
+	clone, _ := form.collection.Schema.Clone()
 	if clone != nil {
 		form.Schema = *clone
 	} else {
@@ -61,6 +92,14 @@ func NewCollectionUpsert(app core.App, collection *models.Collection) *Collectio
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *CollectionUpsert) Validate() error {
 	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Id,
+			validation.When(
+				form.collection.IsNew(),
+				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
+				validation.Match(idRegex),
+			).Else(validation.In(form.collection.Id)),
+		),
 		validation.Field(
 			&form.System,
 			validation.By(form.ensureNoSystemFlagChange),
@@ -78,6 +117,7 @@ func (form *CollectionUpsert) Validate() error {
 			&form.Schema,
 			validation.By(form.ensureNoSystemFieldsChange),
 			validation.By(form.ensureNoFieldsTypeChange),
+			validation.By(form.ensureExistingRelationCollectionId),
 		),
 		validation.Field(&form.ListRule, validation.By(form.checkRule)),
 		validation.Field(&form.ViewRule, validation.By(form.checkRule)),
@@ -90,11 +130,11 @@ func (form *CollectionUpsert) Validate() error {
 func (form *CollectionUpsert) checkUniqueName(value any) error {
 	v, _ := value.(string)
 
-	if !form.app.Dao().IsCollectionNameUnique(v, form.collection.Id) {
+	if !form.config.Dao.IsCollectionNameUnique(v, form.collection.Id) {
 		return validation.NewError("validation_collection_name_exists", "Collection name must be unique (case insensitive).")
 	}
 
-	if (form.isCreate || !strings.EqualFold(v, form.collection.Name)) && form.app.Dao().HasTable(v) {
+	if (form.collection.IsNew() || !strings.EqualFold(v, form.collection.Name)) && form.config.Dao.HasTable(v) {
 		return validation.NewError("validation_collection_name_table_exists", "The collection name must be also unique table name.")
 	}
 
@@ -104,7 +144,7 @@ func (form *CollectionUpsert) checkUniqueName(value any) error {
 func (form *CollectionUpsert) ensureNoSystemNameChange(value any) error {
 	v, _ := value.(string)
 
-	if form.isCreate || !form.collection.System || v == form.collection.Name {
+	if form.collection.IsNew() || !form.collection.System || v == form.collection.Name {
 		return nil
 	}
 
@@ -114,7 +154,7 @@ func (form *CollectionUpsert) ensureNoSystemNameChange(value any) error {
 func (form *CollectionUpsert) ensureNoSystemFlagChange(value any) error {
 	v, _ := value.(bool)
 
-	if form.isCreate || v == form.collection.System {
+	if form.collection.IsNew() || v == form.collection.System {
 		return nil
 	}
 
@@ -124,11 +164,38 @@ func (form *CollectionUpsert) ensureNoSystemFlagChange(value any) error {
 func (form *CollectionUpsert) ensureNoFieldsTypeChange(value any) error {
 	v, _ := value.(schema.Schema)
 
-	for _, field := range v.Fields() {
+	for i, field := range v.Fields() {
 		oldField := form.collection.Schema.GetFieldById(field.Id)
 
 		if oldField != nil && oldField.Type != field.Type {
-			return validation.NewError("validation_field_type_change", "Field type cannot be changed.")
+			return validation.Errors{fmt.Sprint(i): validation.NewError(
+				"validation_field_type_change",
+				"Field type cannot be changed.",
+			)}
+		}
+	}
+
+	return nil
+}
+
+func (form *CollectionUpsert) ensureExistingRelationCollectionId(value any) error {
+	v, _ := value.(schema.Schema)
+
+	for i, field := range v.Fields() {
+		if field.Type != schema.FieldTypeRelation {
+			continue
+		}
+
+		options, _ := field.Options.(*schema.RelationOptions)
+		if options == nil {
+			continue
+		}
+
+		if _, err := form.config.Dao.FindCollectionByNameOrId(options.CollectionId); err != nil {
+			return validation.Errors{fmt.Sprint(i): validation.NewError(
+				"validation_field_invalid_relation",
+				"The relation collection doesn't exist.",
+			)}
 		}
 	}
 
@@ -161,7 +228,7 @@ func (form *CollectionUpsert) checkRule(value any) error {
 	}
 
 	dummy := &models.Collection{Schema: form.Schema}
-	r := resolvers.NewRecordFieldResolver(form.app.Dao(), dummy, nil)
+	r := resolvers.NewRecordFieldResolver(form.config.Dao, dummy, nil)
 
 	_, err := search.FilterData(*v).BuildExpr(r)
 	if err != nil {
@@ -182,13 +249,19 @@ func (form *CollectionUpsert) Submit(interceptors ...InterceptorFunc) error {
 		return err
 	}
 
-	// system flag can be set only for create
-	if form.isCreate {
+	if form.collection.IsNew() {
+		// system flag can be set only on create
 		form.collection.System = form.System
+
+		// custom insertion id can be set only on create
+		if form.Id != "" {
+			form.collection.MarkAsNew()
+			form.collection.SetId(form.Id)
+		}
 	}
 
 	// system collections cannot be renamed
-	if form.isCreate || !form.collection.System {
+	if form.collection.IsNew() || !form.collection.System {
 		form.collection.Name = form.Name
 	}
 
@@ -200,6 +273,6 @@ func (form *CollectionUpsert) Submit(interceptors ...InterceptorFunc) error {
 	form.collection.DeleteRule = form.DeleteRule
 
 	return runInterceptors(func() error {
-		return form.app.Dao().SaveCollection(form.collection)
+		return form.config.Dao.SaveCollection(form.collection)
 	}, interceptors...)
 }

forms/collection_upsert_test.go

@@ -10,9 +10,33 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
 )
 
+func TestCollectionUpsertPanic1(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewCollectionUpsert(nil, nil)
+}
+
+func TestCollectionUpsertPanic2(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewCollectionUpsert(app, nil)
+}
+
 func TestNewCollectionUpsert(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -518,3 +542,107 @@ func TestCollectionUpsertSubmitInterceptors(t *testing.T) {
 		t.Fatalf("Expected the form model to be filled before calling the interceptors")
 	}
 }
+
+func TestCollectionUpsertWithCustomId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	existingCollection, err := app.Dao().FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newCollection := func() *models.Collection {
+		return &models.Collection{
+			Name:   "c_" + security.RandomString(4),
+			Schema: existingCollection.Schema,
+		}
+	}
+
+	scenarios := []struct {
+		name        string
+		jsonData    string
+		collection  *models.Collection
+		expectError bool
+	}{
+		{
+			"empty data",
+			"{}",
+			newCollection(),
+			false,
+		},
+		{
+			"empty id",
+			`{"id":""}`,
+			newCollection(),
+			false,
+		},
+		{
+			"id < 15 chars",
+			`{"id":"a23"}`,
+			newCollection(),
+			true,
+		},
+		{
+			"id > 15 chars",
+			`{"id":"a234567890123456"}`,
+			newCollection(),
+			true,
+		},
+		{
+			"id = 15 chars (invalid chars)",
+			`{"id":"a@3456789012345"}`,
+			newCollection(),
+			true,
+		},
+		{
+			"id = 15 chars (valid chars)",
+			`{"id":"a23456789012345"}`,
+			newCollection(),
+			false,
+		},
+		{
+			"changing the id of an existing item",
+			`{"id":"b23456789012345"}`,
+			existingCollection,
+			true,
+		},
+		{
+			"using the same existing item id",
+			`{"id":"` + existingCollection.Id + `"}`,
+			existingCollection,
+			false,
+		},
+		{
+			"skipping the id for existing item",
+			`{}`,
+			existingCollection,
+			false,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		form := forms.NewCollectionUpsert(app, scenario.collection)
+
+		// load data
+		loadErr := json.Unmarshal([]byte(scenario.jsonData), form)
+		if loadErr != nil {
+			t.Errorf("[%s] Failed to load form data: %v", scenario.name, loadErr)
+			continue
+		}
+
+		submitErr := form.Submit()
+		hasErr := submitErr != nil
+
+		if hasErr != scenario.expectError {
+			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, submitErr)
+		}
+
+		if !hasErr && form.Id != "" {
+			_, err := app.Dao().FindCollectionByNameOrId(form.Id)
+			if err != nil {
+				t.Errorf("[%s] Expected to find record with id %s, got %v", scenario.name, form.Id, err)
+			}
+		}
+	}
+}

forms/collections_import.go

@@ -0,0 +1,152 @@
+package forms
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+// CollectionsImport specifies a form model to bulk import
+// (create, replace and delete) collections from a user provided list.
+type CollectionsImport struct {
+	config CollectionsImportConfig
+
+	Collections   []*models.Collection `form:"collections" json:"collections"`
+	DeleteMissing bool                 `form:"deleteMissing" json:"deleteMissing"`
+}
+
+// CollectionsImportConfig is the [CollectionsImport] factory initializer config.
+//
+// NB! App is a required struct member.
+type CollectionsImportConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewCollectionsImport creates a new [CollectionsImport] form with
+// initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewCollectionsImportWithConfig] with explicitly set Dao.
+func NewCollectionsImport(app core.App) *CollectionsImport {
+	return NewCollectionsImportWithConfig(CollectionsImportConfig{
+		App: app,
+	})
+}
+
+// NewCollectionsImportWithConfig creates a new [CollectionsImport]
+// form with the provided config or panics on invalid configuration.
+func NewCollectionsImportWithConfig(config CollectionsImportConfig) *CollectionsImport {
+	form := &CollectionsImport{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *CollectionsImport) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Collections, validation.Required),
+	)
+}
+
+// Submit applies the import, aka.:
+// - imports the form collections (create or replace)
+// - sync the collection changes with their related records table
+// - ensures the integrity of the imported structure (aka. run validations for each collection)
+// - if [form.DeleteMissing] is set, deletes all local collections that are not found in the imports list
+//
+// All operations are wrapped in a single transaction that are
+// rollbacked on the first encountered error.
+//
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *CollectionsImport) Submit(interceptors ...InterceptorFunc) error {
+	if err := form.Validate(); err != nil {
+		return err
+	}
+
+	return runInterceptors(func() error {
+		return form.config.Dao.RunInTransaction(func(txDao *daos.Dao) error {
+			importErr := txDao.ImportCollections(
+				form.Collections,
+				form.DeleteMissing,
+				form.beforeRecordsSync,
+			)
+			if importErr == nil {
+				return nil
+			}
+
+			// validation failure
+			if err, ok := importErr.(validation.Errors); ok {
+				return err
+			}
+
+			// generic/db failure
+			if form.config.App.IsDebug() {
+				log.Println("Internal import failure:", importErr)
+			}
+			return validation.Errors{"collections": validation.NewError(
+				"collections_import_failure",
+				"Failed to import the collections configuration.",
+			)}
+		})
+	}, interceptors...)
+}
+
+func (form *CollectionsImport) beforeRecordsSync(txDao *daos.Dao, mappedNew, mappedOld map[string]*models.Collection) error {
+	// refresh the actual persisted collections list
+	refreshedCollections := []*models.Collection{}
+	if err := txDao.CollectionQuery().OrderBy("created ASC").All(&refreshedCollections); err != nil {
+		return err
+	}
+
+	// trigger the validator for each existing collection to
+	// ensure that the app is not left in a broken state
+	for _, collection := range refreshedCollections {
+		upsertModel := mappedOld[collection.GetId()]
+		if upsertModel == nil {
+			upsertModel = collection
+		}
+
+		upsertForm := NewCollectionUpsertWithConfig(CollectionUpsertConfig{
+			App: form.config.App,
+			Dao: txDao,
+		}, upsertModel)
+
+		// load form fields with the refreshed collection state
+		upsertForm.Id = collection.Id
+		upsertForm.Name = collection.Name
+		upsertForm.System = collection.System
+		upsertForm.ListRule = collection.ListRule
+		upsertForm.ViewRule = collection.ViewRule
+		upsertForm.CreateRule = collection.CreateRule
+		upsertForm.UpdateRule = collection.UpdateRule
+		upsertForm.DeleteRule = collection.DeleteRule
+		upsertForm.Schema = collection.Schema
+
+		if err := upsertForm.Validate(); err != nil {
+			// serialize the validation error(s)
+			serializedErr, _ := json.MarshalIndent(err, "", "  ")
+
+			return validation.Errors{"collections": validation.NewError(
+				"collections_import_validate_failure",
+				fmt.Sprintf("Data validations failed for collection %q (%s):\n%s", collection.Name, collection.Id, serializedErr),
+			)}
+		}
+	}
+
+	return nil
+}

forms/collections_import_test.go

@@ -0,0 +1,419 @@
+package forms_test
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestCollectionsImportPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewCollectionsImport(nil)
+}
+
+func TestCollectionsImportValidate(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	form := forms.NewCollectionsImport(app)
+
+	scenarios := []struct {
+		collections []*models.Collection
+		expectError bool
+	}{
+		{nil, true},
+		{[]*models.Collection{}, true},
+		{[]*models.Collection{{}}, false},
+	}
+
+	for i, s := range scenarios {
+		form.Collections = s.collections
+
+		err := form.Validate()
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+		}
+	}
+}
+
+func TestCollectionsImportSubmit(t *testing.T) {
+	scenarios := []struct {
+		name                   string
+		jsonData               string
+		expectError            bool
+		expectCollectionsCount int
+		expectEvents           map[string]int
+	}{
+		{
+			name: "empty collections",
+			jsonData: `{
+				"deleteMissing": true,
+				"collections": []
+			}`,
+			expectError:            true,
+			expectCollectionsCount: 5,
+			expectEvents:           nil,
+		},
+		{
+			name: "one of the collections has invalid data",
+			jsonData: `{
+				"collections": [
+					{
+						"name": "import1",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					},
+					{
+						"name": "import 2",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            true,
+			expectCollectionsCount: 5,
+			expectEvents: map[string]int{
+				"OnModelBeforeCreate": 2,
+			},
+		},
+		{
+			name: "all imported collections has valid data",
+			jsonData: `{
+				"collections": [
+					{
+						"name": "import1",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            false,
+			expectCollectionsCount: 7,
+			expectEvents: map[string]int{
+				"OnModelBeforeCreate": 2,
+				"OnModelAfterCreate":  2,
+			},
+		},
+		{
+			name: "new collection with existing name",
+			jsonData: `{
+				"collections": [
+					{
+						"name": "demo2",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            true,
+			expectCollectionsCount: 5,
+			expectEvents: map[string]int{
+				"OnModelBeforeCreate": 1,
+			},
+		},
+		{
+			name: "delete system + modified + new collection",
+			jsonData: `{
+				"deleteMissing": true,
+				"collections": [
+					{
+						"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+						"name":"demo",
+						"schema":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"system":false,
+								"required":true,
+								"unique":false,
+								"options":{
+									"min":3,
+									"max":null,
+									"pattern":""
+								}
+							}
+						]
+					},
+					{
+						"name": "import1",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            true,
+			expectCollectionsCount: 5,
+		},
+		{
+			name: "modified + new collection",
+			jsonData: `{
+				"collections": [
+					{
+						"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+						"name":"demo",
+						"schema":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"system":false,
+								"required":true,
+								"unique":false,
+								"options":{
+									"min":3,
+									"max":null,
+									"pattern":""
+								}
+							}
+						]
+					},
+					{
+						"name": "import1",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            false,
+			expectCollectionsCount: 7,
+			expectEvents: map[string]int{
+				"OnModelBeforeUpdate": 1,
+				"OnModelAfterUpdate":  1,
+				"OnModelBeforeCreate": 2,
+				"OnModelAfterCreate":  2,
+			},
+		},
+		{
+			name: "delete non-system + modified + new collection",
+			jsonData: `{
+				"deleteMissing": true,
+				"collections": [
+					{
+						"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+						"name":"profiles",
+						"system":true,
+						"listRule":"userId = @request.user.id",
+						"viewRule":"created > 'test_change'",
+						"createRule":"userId = @request.user.id",
+						"updateRule":"userId = @request.user.id",
+						"deleteRule":"userId = @request.user.id",
+						"schema":[
+							{
+								"id":"koih1lqx",
+								"name":"userId",
+								"type":"user",
+								"system":true,
+								"required":true,
+								"unique":true,
+								"options":{
+									"maxSelect":1,
+									"cascadeDelete":true
+								}
+							},
+							{
+								"id":"69ycbg3q",
+								"name":"rel",
+								"type":"relation",
+								"system":false,
+								"required":false,
+								"unique":false,
+								"options":{
+									"maxSelect":2,
+									"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
+									"cascadeDelete":false
+								}
+							}
+						]
+					},
+					{
+						"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+						"name":"demo",
+						"schema":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"system":false,
+								"required":true,
+								"unique":false,
+								"options":{
+									"min":3,
+									"max":null,
+									"pattern":""
+								}
+							}
+						]
+					},
+					{
+						"id": "test_deleted_collection_name_reuse",
+						"name": "demo2",
+						"schema": [
+							{
+								"id":"fz6iql2m",
+								"name":"active",
+								"type":"bool"
+							}
+						]
+					}
+				]
+			}`,
+			expectError:            false,
+			expectCollectionsCount: 3,
+			expectEvents: map[string]int{
+				"OnModelBeforeUpdate": 2,
+				"OnModelAfterUpdate":  2,
+				"OnModelBeforeCreate": 1,
+				"OnModelAfterCreate":  1,
+				"OnModelBeforeDelete": 3,
+				"OnModelAfterDelete":  3,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		form := forms.NewCollectionsImport(testApp)
+
+		// load data
+		loadErr := json.Unmarshal([]byte(s.jsonData), form)
+		if loadErr != nil {
+			t.Errorf("[%s] Failed to load form data: %v", s.name, loadErr)
+			continue
+		}
+
+		err := form.Submit()
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		// check collections count
+		collections := []*models.Collection{}
+		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+			t.Fatal(err)
+		}
+		if len(collections) != s.expectCollectionsCount {
+			t.Errorf("[%s] Expected %d collections, got %d", s.name, s.expectCollectionsCount, len(collections))
+		}
+
+		// check events
+		if len(testApp.EventCalls) > len(s.expectEvents) {
+			t.Errorf("[%s] Expected events %v, got %v", s.name, s.expectEvents, testApp.EventCalls)
+		}
+		for event, expectedCalls := range s.expectEvents {
+			actualCalls := testApp.EventCalls[event]
+			if actualCalls != expectedCalls {
+				t.Errorf("[%s] Expected event %s to be called %d, got %d", s.name, event, expectedCalls, actualCalls)
+			}
+		}
+	}
+}
+
+func TestCollectionsImportSubmitInterceptors(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collections := []*models.Collection{}
+	if err := app.Dao().CollectionQuery().All(&collections); err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewCollectionsImport(app)
+	form.Collections = collections
+
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
+		return func() error {
+			interceptor1Called = true
+			return next()
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
+		return func() error {
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+}

forms/realtime_subscribe.go

@@ -4,7 +4,7 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 )
 
-// RealtimeSubscribe defines a RealtimeSubscribe request form.
+// RealtimeSubscribe is a realtime subscriptions request form.
 type RealtimeSubscribe struct {
 	ClientId      string   `form:"clientId" json:"clientId"`
 	Subscriptions []string `form:"subscriptions" json:"subscriptions"`

forms/record_upsert.go

@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"strconv"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
@@ -20,29 +21,59 @@ import (
 	"github.com/spf13/cast"
 )
 
-// RecordUpsert defines a Record upsert form.
+// RecordUpsert specifies a [models.Record] upsert (create/update) form.
 type RecordUpsert struct {
-	app    core.App
+	config RecordUpsertConfig
 	record *models.Record
 
-	isCreate      bool
 	filesToDelete []string // names list
 	filesToUpload []*rest.UploadedFile
 
+	Id   string         `form:"id" json:"id"`
 	Data map[string]any `json:"data"`
 }
 
-// NewRecordUpsert creates a new Record upsert form.
-// (pass a new Record model instance (`models.NewRecord(...)`) for create).
+// RecordUpsertConfig is the [RecordUpsert] factory initializer config.
+//
+// NB! App is required struct member.
+type RecordUpsertConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewRecordUpsert creates a new [RecordUpsert] form with initializer
+// config created from the provided [core.App] and [models.Record] instances
+// (for create you could pass a pointer to an empty Record - `models.NewRecord(collection)`).
+//
+// If you want to submit the form as part of another transaction, use
+// [NewRecordUpsertWithConfig] with explicitly set Dao.
 func NewRecordUpsert(app core.App, record *models.Record) *RecordUpsert {
+	return NewRecordUpsertWithConfig(RecordUpsertConfig{
+		App: app,
+	}, record)
+}
+
+// NewRecordUpsertWithConfig creates a new [RecordUpsert] form
+// with the provided config and [models.Record] instance or panics on invalid configuration
+// (for create you could pass a pointer to an empty Record - `models.NewRecord(collection)`).
+func NewRecordUpsertWithConfig(config RecordUpsertConfig, record *models.Record) *RecordUpsert {
 	form := &RecordUpsert{
-		app:           app,
+		config:        config,
 		record:        record,
-		isCreate:      !record.HasId(),
 		filesToDelete: []string{},
 		filesToUpload: []*rest.UploadedFile{},
 	}
 
+	if form.config.App == nil || form.record == nil {
+		panic("Invalid initializer config or nil upsert model.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	form.Id = record.Id
+
 	form.Data = map[string]any{}
 	for _, field := range record.Collection().Schema.Fields() {
 		form.Data[field.Name] = record.GetDataValue(field.Name)
@@ -136,6 +167,10 @@ func (form *RecordUpsert) LoadData(r *http.Request) error {
 		return err
 	}
 
+	if id, ok := requestData["id"]; ok {
+		form.Id = cast.ToString(id)
+	}
+
 	// extend base data with the extracted one
 	extendedData := form.record.Data()
 	rawData, err := json.Marshal(requestData)
@@ -159,21 +194,26 @@ func (form *RecordUpsert) LoadData(r *http.Request) error {
 		options, _ := field.Options.(*schema.FileOptions)
 		oldNames := list.ToUniqueStringSlice(form.Data[key])
 
-		// delete previously uploaded file(s)
-		if options.MaxSelect == 1 {
-			// search for unset zero indexed key as a fallback
-			indexedKeyValue, hasIndexedKey := extendedData[key+".0"]
+		// -----------------------------------------------------------
+		// Delete previously uploaded file(s)
+		// -----------------------------------------------------------
 
-			if cast.ToString(value) == "" || (hasIndexedKey && cast.ToString(indexedKeyValue) == "") {
-				if len(oldNames) > 0 {
-					form.filesToDelete = append(form.filesToDelete, oldNames...)
-				}
-				form.Data[key] = ""
-			}
-		} else if options.MaxSelect > 1 {
-			// search for individual file index to delete (eg. "file.0")
-			keyExp, _ := regexp.Compile(`^` + regexp.QuoteMeta(key) + `\.\d+$`)
+		// if empty value was set, mark all previously uploaded files for deletion
+		if len(list.ToUniqueStringSlice(value)) == 0 && len(oldNames) > 0 {
+			form.filesToDelete = append(form.filesToDelete, oldNames...)
+			form.Data[key] = []string{}
+		} else if len(oldNames) > 0 {
 			indexesToDelete := make([]int, 0, len(extendedData))
+
+			// search for individual file name to delete (eg. "file.test.png = null")
+			for i, name := range oldNames {
+				if v, ok := extendedData[key+"."+name]; ok && cast.ToString(v) == "" {
+					indexesToDelete = append(indexesToDelete, i)
+				}
+			}
+
+			// search for individual file index to delete (eg. "file.0 = null")
+			keyExp, _ := regexp.Compile(`^` + regexp.QuoteMeta(key) + `\.\d+$`)
 			for indexedKey := range extendedData {
 				if keyExp.MatchString(indexedKey) && cast.ToString(extendedData[indexedKey]) == "" {
 					index, indexErr := strconv.Atoi(indexedKey[len(key)+1:])
@@ -199,10 +239,17 @@ func (form *RecordUpsert) LoadData(r *http.Request) error {
 			form.Data[key] = nonDeleted
 		}
 
-		// check if there are any new uploaded form files
+		// -----------------------------------------------------------
+		// Check for new uploaded file
+		// -----------------------------------------------------------
+
+		if form.getContentType(r) != "multipart/form-data" {
+			continue // file upload is supported only via multipart/form-data
+		}
+
 		files, err := rest.FindUploadedFiles(r, key)
 		if err != nil {
-			if form.app.IsDebug() {
+			if form.config.App.IsDebug() {
 				log.Printf("%q uploaded file error: %v\n", key, err)
 			}
 
@@ -234,8 +281,24 @@ func (form *RecordUpsert) LoadData(r *http.Request) error {
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *RecordUpsert) Validate() error {
+	// base form fields validator
+	baseFieldsErrors := validation.ValidateStruct(form,
+		validation.Field(
+			&form.Id,
+			validation.When(
+				form.record.IsNew(),
+				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
+				validation.Match(idRegex),
+			).Else(validation.In(form.record.Id)),
+		),
+	)
+	if baseFieldsErrors != nil {
+		return baseFieldsErrors
+	}
+
+	// record data validator
 	dataValidator := validators.NewRecordDataValidator(
-		form.app.Dao(),
+		form.config.Dao,
 		form.record,
 		form.filesToUpload,
 	)
@@ -252,17 +315,26 @@ func (form *RecordUpsert) DrySubmit(callback func(txDao *daos.Dao) error) error
 		return err
 	}
 
+	isNew := form.record.IsNew()
+
+	// custom insertion id can be set only on create
+	if isNew && form.Id != "" {
+		form.record.MarkAsNew()
+		form.record.SetId(form.Id)
+	}
+
 	// bulk load form data
 	if err := form.record.Load(form.Data); err != nil {
 		return err
 	}
 
-	return form.app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+	return form.config.Dao.RunInTransaction(func(txDao *daos.Dao) error {
 		tx, ok := txDao.DB().(*dbx.Tx)
 		if !ok {
 			return errors.New("failed to get transaction db")
 		}
 		defer tx.Rollback()
+
 		txDao.BeforeCreateFunc = nil
 		txDao.AfterCreateFunc = nil
 		txDao.BeforeUpdateFunc = nil
@@ -272,7 +344,16 @@ func (form *RecordUpsert) DrySubmit(callback func(txDao *daos.Dao) error) error
 			return err
 		}
 
-		return callback(txDao)
+		// restore record isNew state
+		if isNew {
+			form.record.MarkAsNew()
+		}
+
+		if callback != nil {
+			return callback(txDao)
+		}
+
+		return nil
 	})
 }
 
@@ -285,13 +366,19 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc) error {
 		return err
 	}
 
+	// custom insertion id can be set only on create
+	if form.record.IsNew() && form.Id != "" {
+		form.record.MarkAsNew()
+		form.record.SetId(form.Id)
+	}
+
 	// bulk load form data
 	if err := form.record.Load(form.Data); err != nil {
 		return err
 	}
 
 	return runInterceptors(func() error {
-		return form.app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+		return form.config.Dao.RunInTransaction(func(txDao *daos.Dao) error {
 			// persist record model
 			if err := txDao.SaveRecord(form.record); err != nil {
 				return err
@@ -322,7 +409,7 @@ func (form *RecordUpsert) processFilesToUpload() error {
 		return errors.New("The record is not persisted yet.")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	fs, err := form.config.App.NewFilesystem()
 	if err != nil {
 		return err
 	}
@@ -358,7 +445,7 @@ func (form *RecordUpsert) processFilesToDelete() error {
 		return errors.New("The record is not persisted yet.")
 	}
 
-	fs, err := form.app.NewFilesystem()
+	fs, err := form.config.App.NewFilesystem()
 	if err != nil {
 		return err
 	}

forms/record_upsert_test.go

@@ -20,6 +20,29 @@ import (
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
+func TestRecordUpsertPanic1(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewRecordUpsert(nil, nil)
+}
+
+func TestRecordUpsertPanic2(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewRecordUpsert(app, nil)
+}
+
 func TestNewRecordUpsert(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -32,7 +55,7 @@ func TestNewRecordUpsert(t *testing.T) {
 
 	val := form.Data["title"]
 	if val != "test_value" {
-		t.Errorf("Expected record data to be load, got %v", form.Data)
+		t.Errorf("Expected record data to be loaded, got %v", form.Data)
 	}
 }
 
@@ -68,13 +91,14 @@ func TestRecordUpsertLoadDataJson(t *testing.T) {
 	}
 
 	testData := map[string]any{
+		"id":      "test_id",
 		"title":   "test123",
 		"unknown": "test456",
 		// file fields unset/delete
 		"onefile":     nil,
 		"manyfiles.0": "",
 		"manyfiles.1": "test.png", // should be ignored
-		"onlyimages":  nil,        // should be ignored
+		"onlyimages":  nil,
 	}
 
 	form := forms.NewRecordUpsert(app, record)
@@ -86,6 +110,10 @@ func TestRecordUpsertLoadDataJson(t *testing.T) {
 		t.Fatal(loadErr)
 	}
 
+	if form.Id != "test_id" {
+		t.Fatalf("Expect id field to be %q, got %q", "test_id", form.Id)
+	}
+
 	if v, ok := form.Data["title"]; !ok || v != "test123" {
 		t.Fatalf("Expect title field to be %q, got %q", "test123", v)
 	}
@@ -108,18 +136,12 @@ func TestRecordUpsertLoadDataJson(t *testing.T) {
 	}
 	manyfilesRemains := len(list.ToUniqueStringSlice(manyfiles))
 	if manyfilesRemains != 1 {
-		t.Fatalf("Expect only 1 manyfiles to remain, got %v", manyfiles)
+		t.Fatalf("Expect only 1 manyfiles to remain, got \n%v", manyfiles)
 	}
 
-	// cannot reset multiple file upload field with just using the field name
-	onlyimages, ok := form.Data["onlyimages"]
-	if !ok || onlyimages == nil {
-		t.Fatal("Expect onlyimages field to be set and not be altered")
-	}
-	onlyimagesRemains := len(list.ToUniqueStringSlice(onlyimages))
-	expectedRemains := 2 // 2 existing
-	if onlyimagesRemains != expectedRemains {
-		t.Fatalf("Expect onlyimages to be %d, got %d (%v)", expectedRemains, onlyimagesRemains, onlyimages)
+	onlyimages := form.Data["onlyimages"]
+	if len(list.ToUniqueStringSlice(onlyimages)) != 0 {
+		t.Fatalf("Expect onlyimages field to be deleted, got \n%v", onlyimages)
 	}
 }
 
@@ -134,13 +156,15 @@ func TestRecordUpsertLoadDataMultipart(t *testing.T) {
 	}
 
 	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"id":      "test_id",
 		"title":   "test123",
 		"unknown": "test456",
 		// file fields unset/delete
 		"onefile":     "",
-		"manyfiles.0": "",
+		"manyfiles.0": "", // delete by index
+		"manyfiles.b635c395-6837-49e5-8535-b0a6ebfbdbf3.png": "", // delete by name
 		"manyfiles.1": "test.png", // should be ignored
-		"onlyimages":  "",         // should be ignored
+		"onlyimages":  "",
 	}, "onlyimages")
 	if err != nil {
 		t.Fatal(err)
@@ -154,6 +178,10 @@ func TestRecordUpsertLoadDataMultipart(t *testing.T) {
 		t.Fatal(loadErr)
 	}
 
+	if form.Id != "test_id" {
+		t.Fatalf("Expect id field to be %q, got %q", "test_id", form.Id)
+	}
+
 	if v, ok := form.Data["title"]; !ok || v != "test123" {
 		t.Fatalf("Expect title field to be %q, got %q", "test123", v)
 	}
@@ -175,16 +203,16 @@ func TestRecordUpsertLoadDataMultipart(t *testing.T) {
 		t.Fatal("Expect manyfiles field to be set")
 	}
 	manyfilesRemains := len(list.ToUniqueStringSlice(manyfiles))
-	if manyfilesRemains != 1 {
-		t.Fatalf("Expect only 1 manyfiles to remain, got %v", manyfiles)
+	if manyfilesRemains != 0 {
+		t.Fatalf("Expect 0 manyfiles to remain, got %v", manyfiles)
 	}
 
 	onlyimages, ok := form.Data["onlyimages"]
 	if !ok || onlyimages == nil {
-		t.Fatal("Expect onlyimages field to be set and not be altered")
+		t.Fatal("Expect onlyimages field to be set")
 	}
 	onlyimagesRemains := len(list.ToUniqueStringSlice(onlyimages))
-	expectedRemains := 3 // 2 existing + 1 new upload
+	expectedRemains := 1 // -2 removed + 1 new upload
 	if onlyimagesRemains != expectedRemains {
 		t.Fatalf("Expect onlyimages to be %d, got %d (%v)", expectedRemains, onlyimagesRemains, onlyimages)
 	}
@@ -202,6 +230,7 @@ func TestRecordUpsertValidateFailure(t *testing.T) {
 
 	// try with invalid test data to check whether the RecordDataValidator is triggered
 	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"id":      "",
 		"unknown": "test456", // should be ignored
 		"title":   "a",
 		"onerel":  "00000000-84ab-4057-a592-4604a731f78f",
@@ -247,6 +276,7 @@ func TestRecordUpsertValidateSuccess(t *testing.T) {
 	}
 
 	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"id":      record.Id,
 		"unknown": "test456", // should be ignored
 		"title":   "abc",
 		"onerel":  "054f9f24-0a0a-4e09-87b1-bc7ff2b336a2",
@@ -454,8 +484,9 @@ func TestRecordUpsertSubmitSuccess(t *testing.T) {
 	}
 
 	formData, mp, err := tests.MockMultipartData(map[string]string{
-		"title":   "test_save",
-		"onefile": "",
+		"title":      "test_save",
+		"onefile":    "",
+		"onlyimages": "",
 	}, "manyfiles.1", "manyfiles") // replace + new file
 	if err != nil {
 		t.Fatal(err)
@@ -500,6 +531,11 @@ func TestRecordUpsertSubmitSuccess(t *testing.T) {
 		t.Fatal("Expected record.onefile to be deleted")
 	}
 
+	onlyimages := (recordAfter.GetStringSliceDataValue("onlyimages"))
+	if len(onlyimages) != 0 {
+		t.Fatalf("Expected all onlyimages files to be deleted, got %d (%v)", len(onlyimages), onlyimages)
+	}
+
 	manyfiles := (recordAfter.GetStringSliceDataValue("manyfiles"))
 	if len(manyfiles) != 3 {
 		t.Fatalf("Expected 3 manyfiles, got %d (%v)", len(manyfiles), manyfiles)
@@ -576,3 +612,109 @@ func hasRecordFile(app core.App, record *models.Record, filename string) bool {
 
 	return exists
 }
+
+func TestRecordUpsertWithCustomId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, _ := app.Dao().FindCollectionByNameOrId("demo3")
+	existingRecord, err := app.Dao().FindFirstRecordByData(collection, "id", "2c542824-9de1-42fe-8924-e57c86267760")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		data        map[string]string
+		record      *models.Record
+		expectError bool
+	}{
+		{
+			"empty data",
+			map[string]string{},
+			models.NewRecord(collection),
+			false,
+		},
+		{
+			"empty id",
+			map[string]string{"id": ""},
+			models.NewRecord(collection),
+			false,
+		},
+		{
+			"id < 15 chars",
+			map[string]string{"id": "a23"},
+			models.NewRecord(collection),
+			true,
+		},
+		{
+			"id > 15 chars",
+			map[string]string{"id": "a234567890123456"},
+			models.NewRecord(collection),
+			true,
+		},
+		{
+			"id = 15 chars (invalid chars)",
+			map[string]string{"id": "a@3456789012345"},
+			models.NewRecord(collection),
+			true,
+		},
+		{
+			"id = 15 chars (valid chars)",
+			map[string]string{"id": "a23456789012345"},
+			models.NewRecord(collection),
+			false,
+		},
+		{
+			"changing the id of an existing record",
+			map[string]string{"id": "b23456789012345"},
+			existingRecord,
+			true,
+		},
+		{
+			"using the same existing record id",
+			map[string]string{"id": existingRecord.Id},
+			existingRecord,
+			false,
+		},
+		{
+			"skipping the id for existing record",
+			map[string]string{},
+			existingRecord,
+			false,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		formData, mp, err := tests.MockMultipartData(scenario.data)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		form := forms.NewRecordUpsert(app, scenario.record)
+		req := httptest.NewRequest(http.MethodGet, "/", formData)
+		req.Header.Set(echo.HeaderContentType, mp.FormDataContentType())
+		form.LoadData(req)
+
+		dryErr := form.DrySubmit(nil)
+		hasDryErr := dryErr != nil
+
+		submitErr := form.Submit()
+		hasSubmitErr := submitErr != nil
+
+		if hasDryErr != hasSubmitErr {
+			t.Errorf("[%s] Expected hasDryErr and hasSubmitErr to have the same value, got %v vs %v", scenario.name, hasDryErr, hasSubmitErr)
+		}
+
+		if hasSubmitErr != scenario.expectError {
+			t.Errorf("[%s] Expected hasSubmitErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasSubmitErr, submitErr)
+		}
+
+		if id, ok := scenario.data["id"]; ok && id != "" && !hasSubmitErr {
+			_, err := app.Dao().FindRecordById(collection, id, nil)
+			if err != nil {
+				t.Errorf("[%s] Expected to find record with id %s, got %v", scenario.name, id, err)
+			}
+		}
+	}
+}

forms/settings_upsert.go

@@ -5,22 +5,56 @@ import (
 	"time"
 
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// SettingsUpsert defines app settings upsert form.
+// SettingsUpsert specifies a [core.Settings] upsert (create/update) form.
 type SettingsUpsert struct {
 	*core.Settings
 
-	app core.App
+	config SettingsUpsertConfig
 }
 
-// NewSettingsUpsert creates new settings upsert form from the provided app.
+// SettingsUpsertConfig is the [SettingsUpsert] factory initializer config.
+//
+// NB! App is required struct member.
+type SettingsUpsertConfig struct {
+	App     core.App
+	Dao     *daos.Dao
+	LogsDao *daos.Dao
+}
+
+// NewSettingsUpsert creates a new [SettingsUpsert] form with initializer
+// config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewSettingsUpsertWithConfig] with explicitly set Dao.
 func NewSettingsUpsert(app core.App) *SettingsUpsert {
-	form := &SettingsUpsert{app: app}
+	return NewSettingsUpsertWithConfig(SettingsUpsertConfig{
+		App: app,
+	})
+}
+
+// NewSettingsUpsertWithConfig creates a new [SettingsUpsert] form
+// with the provided config or panics on invalid configuration.
+func NewSettingsUpsertWithConfig(config SettingsUpsertConfig) *SettingsUpsert {
+	form := &SettingsUpsert{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	if form.config.LogsDao == nil {
+		form.config.LogsDao = form.config.App.LogsDao()
+	}
 
 	// load the application settings into the form
-	form.Settings, _ = app.Settings().Clone()
+	form.Settings, _ = config.App.Settings().Clone()
 
 	return form
 }
@@ -41,10 +75,10 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc) error {
 		return err
 	}
 
-	encryptionKey := os.Getenv(form.app.EncryptionEnv())
+	encryptionKey := os.Getenv(form.config.App.EncryptionEnv())
 
 	return runInterceptors(func() error {
-		saveErr := form.app.Dao().SaveParam(
+		saveErr := form.config.Dao.SaveParam(
 			models.ParamAppSettings,
 			form.Settings,
 			encryptionKey,
@@ -54,11 +88,11 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc) error {
 		}
 
 		// explicitly trigger old logs deletion
-		form.app.LogsDao().DeleteOldRequests(
+		form.config.LogsDao.DeleteOldRequests(
 			time.Now().AddDate(0, 0, -1*form.Settings.Logs.MaxDays),
 		)
 
 		// merge the application settings with the form ones
-		return form.app.Settings().Merge(form.Settings)
+		return form.config.App.Settings().Merge(form.Settings)
 	}, interceptors...)
 }

forms/settings_upsert_test.go

@@ -12,6 +12,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+func TestSettingsUpsertPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewSettingsUpsert(nil)
+}
+
 func TestNewSettingsUpsert(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/test_email_send.go

@@ -0,0 +1,69 @@
+package forms
+
+import (
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+const (
+	templateVerification  = "verification"
+	templatePasswordReset = "password-reset"
+	templateEmailChange   = "email-change"
+)
+
+// TestEmailSend is a email template test request form.
+type TestEmailSend struct {
+	app core.App
+
+	Template string `form:"template" json:"template"`
+	Email    string `form:"email" json:"email"`
+}
+
+// NewTestEmailSend creates and initializes new TestEmailSend form.
+func NewTestEmailSend(app core.App) *TestEmailSend {
+	return &TestEmailSend{app: app}
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *TestEmailSend) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Email,
+			validation.Required,
+			validation.Length(1, 255),
+			is.EmailFormat,
+		),
+		validation.Field(
+			&form.Template,
+			validation.Required,
+			validation.In(templateVerification, templateEmailChange, templatePasswordReset),
+		),
+	)
+}
+
+// Submit validates and sends a test email to the form.Email address.
+func (form *TestEmailSend) Submit() error {
+	if err := form.Validate(); err != nil {
+		return err
+	}
+
+	// create a test user
+	user := &models.User{}
+	user.Id = "__pb_test_id__"
+	user.Email = form.Email
+	user.RefreshTokenKey()
+
+	switch form.Template {
+	case templateVerification:
+		return mails.SendUserVerification(form.app, user)
+	case templatePasswordReset:
+		return mails.SendUserPasswordReset(form.app, user)
+	case templateEmailChange:
+		return mails.SendUserChangeEmail(form.app, user, form.Email)
+	}
+
+	return nil
+}

forms/test_email_send_test.go

@@ -0,0 +1,103 @@
+package forms_test
+
+import (
+	"strings"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestEmailSendValidate(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		template       string
+		email          string
+		expectedErrors []string
+	}{
+		{"", "", []string{"template", "email"}},
+		{"invalid", "test@example.com", []string{"template"}},
+		{"verification", "invalid", []string{"email"}},
+		{"verification", "test@example.com", nil},
+		{"password-reset", "test@example.com", nil},
+		{"email-change", "test@example.com", nil},
+	}
+
+	for i, s := range scenarios {
+		form := forms.NewTestEmailSend(app)
+		form.Email = s.email
+		form.Template = s.template
+
+		result := form.Validate()
+
+		// parse errors
+		errs, ok := result.(validation.Errors)
+		if !ok && result != nil {
+			t.Errorf("(%d) Failed to parse errors %v", i, result)
+			continue
+		}
+
+		// check errors
+		if len(errs) > len(s.expectedErrors) {
+			t.Errorf("(%d) Expected error keys %v, got %v", i, s.expectedErrors, errs)
+		}
+		for _, k := range s.expectedErrors {
+			if _, ok := errs[k]; !ok {
+				t.Errorf("(%d) Missing expected error key %q in %v", i, k, errs)
+			}
+		}
+	}
+}
+
+func TestEmailSendSubmit(t *testing.T) {
+	scenarios := []struct {
+		template    string
+		email       string
+		expectError bool
+	}{
+		{"", "", true},
+		{"invalid", "test@example.com", true},
+		{"verification", "invalid", true},
+		{"verification", "test@example.com", false},
+		{"password-reset", "test@example.com", false},
+		{"email-change", "test@example.com", false},
+	}
+
+	for i, s := range scenarios {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		form := forms.NewTestEmailSend(app)
+		form.Email = s.email
+		form.Template = s.template
+
+		err := form.Submit()
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		if app.TestMailer.TotalSend != 1 {
+			t.Errorf("(%d) Expected one email to be sent, got %d", i, app.TestMailer.TotalSend)
+		}
+
+		expectedContent := "Verify"
+		if s.template == "password-reset" {
+			expectedContent = "Reset password"
+		} else if s.template == "email-change" {
+			expectedContent = "Confirm new email"
+		}
+
+		if !strings.Contains(app.TestMailer.LastHtmlBody, expectedContent) {
+			t.Errorf("(%d) Expected the email to contains %s, got \n%v", i, expectedContent, app.TestMailer.LastHtmlBody)
+		}
+	}
+}

forms/user_email_change_confirm.go

@@ -3,23 +3,53 @@ package forms
 import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
-// UserEmailChangeConfirm defines a user email change confirmation form.
+// UserEmailChangeConfirm specifies a user email change confirmation form.
 type UserEmailChangeConfirm struct {
-	app core.App
+	config UserEmailChangeConfirmConfig
 
 	Token    string `form:"token" json:"token"`
 	Password string `form:"password" json:"password"`
 }
 
-// NewUserEmailChangeConfirm creates new user email change confirmation form.
+// UserEmailChangeConfirmConfig is the [UserEmailChangeConfirm] factory initializer config.
+//
+// NB! App is required struct member.
+type UserEmailChangeConfirmConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserEmailChangeConfirm creates a new [UserEmailChangeConfirm]
+// form with initializer config created from the provided [core.App] instance.
+//
+// This factory method is used primarily for convenience (and backward compatibility).
+// If you want to submit the form as part of another transaction, use
+// [NewUserEmailChangeConfirmWithConfig] with explicitly set Dao.
 func NewUserEmailChangeConfirm(app core.App) *UserEmailChangeConfirm {
-	return &UserEmailChangeConfirm{
-		app: app,
+	return NewUserEmailChangeConfirmWithConfig(UserEmailChangeConfirmConfig{
+		App: app,
+	})
+}
+
+// NewUserEmailChangeConfirmWithConfig creates a new [UserEmailChangeConfirm]
+// form with the provided config or panics on invalid configuration.
+func NewUserEmailChangeConfirmWithConfig(config UserEmailChangeConfirmConfig) *UserEmailChangeConfirm {
+	form := &UserEmailChangeConfirm{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -73,14 +103,14 @@ func (form *UserEmailChangeConfirm) parseToken(token string) (*models.User, stri
 	}
 
 	// ensure that there aren't other users with the new email
-	if !form.app.Dao().IsUserEmailUnique(newEmail, "") {
+	if !form.config.Dao.IsUserEmailUnique(newEmail, "") {
 		return nil, "", validation.NewError("validation_existing_token_email", "The new email address is already registered: "+newEmail)
 	}
 
-	// verify that the token is not expired and its signiture is valid
-	user, err := form.app.Dao().FindUserByToken(
+	// verify that the token is not expired and its signature is valid
+	user, err := form.config.Dao.FindUserByToken(
 		token,
-		form.app.Settings().UserEmailChangeToken.Secret,
+		form.config.App.Settings().UserEmailChangeToken.Secret,
 	)
 	if err != nil || user == nil {
 		return nil, "", validation.NewError("validation_invalid_token", "Invalid or expired token.")
@@ -105,7 +135,7 @@ func (form *UserEmailChangeConfirm) Submit() (*models.User, error) {
 	user.Verified = true
 	user.RefreshTokenKey() // invalidate old tokens
 
-	if err := form.app.Dao().SaveUser(user); err != nil {
+	if err := form.config.Dao.SaveUser(user); err != nil {
 		return nil, err
 	}
 

forms/user_email_change_confirm_test.go

@@ -10,6 +10,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+func TestUserEmailChangeConfirmPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserEmailChangeConfirm(nil)
+}
+
 func TestUserEmailChangeConfirmValidateAndSubmit(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/user_email_change_request.go

@@ -4,24 +4,55 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/models"
 )
 
 // UserEmailChangeRequest defines a user email change request form.
 type UserEmailChangeRequest struct {
-	app  core.App
-	user *models.User
+	config UserEmailChangeRequestConfig
+	user   *models.User
 
 	NewEmail string `form:"newEmail" json:"newEmail"`
 }
 
-// NewUserEmailChangeRequest creates a new user email change request form.
+// UserEmailChangeRequestConfig is the [UserEmailChangeRequest] factory initializer config.
+//
+// NB! App is required struct member.
+type UserEmailChangeRequestConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserEmailChangeRequest creates a new [UserEmailChangeRequest]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserEmailChangeConfirmWithConfig] with explicitly set Dao.
 func NewUserEmailChangeRequest(app core.App, user *models.User) *UserEmailChangeRequest {
-	return &UserEmailChangeRequest{
-		app:  app,
-		user: user,
+	return NewUserEmailChangeRequestWithConfig(UserEmailChangeRequestConfig{
+		App: app,
+	}, user)
+}
+
+// NewUserEmailChangeRequestWithConfig creates a new [UserEmailChangeRequest]
+// form with the provided config or panics on invalid configuration.
+func NewUserEmailChangeRequestWithConfig(config UserEmailChangeRequestConfig, user *models.User) *UserEmailChangeRequest {
+	form := &UserEmailChangeRequest{
+		config: config,
+		user:   user,
 	}
+
+	if form.config.App == nil || form.user == nil {
+		panic("Invalid initializer config or nil user model.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -31,7 +62,7 @@ func (form *UserEmailChangeRequest) Validate() error {
 			&form.NewEmail,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 			validation.By(form.checkUniqueEmail),
 		),
 	)
@@ -40,7 +71,7 @@ func (form *UserEmailChangeRequest) Validate() error {
 func (form *UserEmailChangeRequest) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
-	if !form.app.Dao().IsUserEmailUnique(v, "") {
+	if !form.config.Dao.IsUserEmailUnique(v, "") {
 		return validation.NewError("validation_user_email_exists", "User email already exists.")
 	}
 
@@ -53,5 +84,5 @@ func (form *UserEmailChangeRequest) Submit() error {
 		return err
 	}
 
-	return mails.SendUserChangeEmail(form.app, form.user, form.NewEmail)
+	return mails.SendUserChangeEmail(form.config.App, form.user, form.NewEmail)
 }

forms/user_email_change_request_test.go

@@ -9,6 +9,29 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestUserEmailChangeRequestPanic1(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserEmailChangeRequest(nil, nil)
+}
+
+func TestUserEmailChangeRequestPanic2(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserEmailChangeRequest(testApp, nil)
+}
+
 func TestUserEmailChangeRequestValidateAndSubmit(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

forms/user_email_login.go

@@ -4,21 +4,49 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// UserEmailLogin defines a user email/pass login form.
+// UserEmailLogin specifies a user email/pass login form.
 type UserEmailLogin struct {
-	app core.App
+	config UserEmailLoginConfig
 
 	Email    string `form:"email" json:"email"`
 	Password string `form:"password" json:"password"`
 }
 
-// NewUserEmailLogin creates a new user email/pass login form.
+// UserEmailLoginConfig is the [UserEmailLogin] factory initializer config.
+//
+// NB! App is required struct member.
+type UserEmailLoginConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserEmailLogin creates a new [UserEmailLogin] form with
+// initializer config created from the provided [core.App] instance.
+//
+// This factory method is used primarily for convenience (and backward compatibility).
+// If you want to submit the form as part of another transaction, use
+// [NewUserEmailLoginWithConfig] with explicitly set Dao.
 func NewUserEmailLogin(app core.App) *UserEmailLogin {
-	form := &UserEmailLogin{
-		app: app,
+	return NewUserEmailLoginWithConfig(UserEmailLoginConfig{
+		App: app,
+	})
+}
+
+// NewUserEmailLoginWithConfig creates a new [UserEmailLogin]
+// form with the provided config or panics on invalid configuration.
+func NewUserEmailLoginWithConfig(config UserEmailLoginConfig) *UserEmailLogin {
+	form := &UserEmailLogin{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
 	}
 
 	return form
@@ -27,7 +55,7 @@ func NewUserEmailLogin(app core.App) *UserEmailLogin {
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *UserEmailLogin) Validate() error {
 	return validation.ValidateStruct(form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.Email),
+		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
 		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
 	)
 }
@@ -39,7 +67,7 @@ func (form *UserEmailLogin) Submit() (*models.User, error) {
 		return nil, err
 	}
 
-	user, err := form.app.Dao().FindUserByEmail(form.Email)
+	user, err := form.config.Dao.FindUserByEmail(form.Email)
 	if err != nil {
 		return nil, err
 	}

forms/user_email_login_test.go

@@ -9,6 +9,16 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestUserEmailLoginPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserEmailLogin(nil)
+}
+
 func TestUserEmailLoginValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/user_oauth2_login.go

@@ -7,15 +7,16 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/auth"
 	"github.com/pocketbase/pocketbase/tools/security"
 	"golang.org/x/oauth2"
 )
 
-// UserOauth2Login defines a user Oauth2 login form.
+// UserOauth2Login specifies a user Oauth2 login form.
 type UserOauth2Login struct {
-	app core.App
+	config UserOauth2LoginConfig
 
 	// The name of the OAuth2 client provider (eg. "google")
 	Provider string `form:"provider" json:"provider"`
@@ -30,9 +31,39 @@ type UserOauth2Login struct {
 	RedirectUrl string `form:"redirectUrl" json:"redirectUrl"`
 }
 
-// NewUserOauth2Login creates a new user Oauth2 login form.
+// UserOauth2LoginConfig is the [UserOauth2Login] factory initializer config.
+//
+// NB! App is required struct member.
+type UserOauth2LoginConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserOauth2Login creates a new [UserOauth2Login] form with
+// initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserOauth2LoginWithConfig] with explicitly set Dao.
 func NewUserOauth2Login(app core.App) *UserOauth2Login {
-	return &UserOauth2Login{app: app}
+	return NewUserOauth2LoginWithConfig(UserOauth2LoginConfig{
+		App: app,
+	})
+}
+
+// NewUserOauth2LoginWithConfig creates a new [UserOauth2Login]
+// form with the provided config or panics on invalid configuration.
+func NewUserOauth2LoginWithConfig(config UserOauth2LoginConfig) *UserOauth2Login {
+	form := &UserOauth2Login{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -48,7 +79,7 @@ func (form *UserOauth2Login) Validate() error {
 func (form *UserOauth2Login) checkProviderName(value any) error {
 	name, _ := value.(string)
 
-	config, ok := form.app.Settings().NamedAuthProviderConfigs()[name]
+	config, ok := form.config.App.Settings().NamedAuthProviderConfigs()[name]
 	if !ok || !config.Enabled {
 		return validation.NewError("validation_invalid_provider", fmt.Sprintf("%q is missing or is not enabled.", name))
 	}
@@ -68,8 +99,11 @@ func (form *UserOauth2Login) Submit() (*models.User, *auth.AuthUser, error) {
 		return nil, nil, err
 	}
 
-	config := form.app.Settings().NamedAuthProviderConfigs()[form.Provider]
-	config.SetupProvider(provider)
+	// load provider configuration
+	config := form.config.App.Settings().NamedAuthProviderConfigs()[form.Provider]
+	if err := config.SetupProvider(provider); err != nil {
+		return nil, nil, err
+	}
 
 	provider.SetRedirectUrl(form.RedirectUrl)
 
@@ -82,52 +116,79 @@ func (form *UserOauth2Login) Submit() (*models.User, *auth.AuthUser, error) {
 		return nil, nil, err
 	}
 
-	// fetch auth user
+	// fetch external auth user
 	authData, err := provider.FetchAuthUser(token)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	// login/register the auth user
-	user, _ := form.app.Dao().FindUserByEmail(authData.Email)
-	if user != nil {
-		// update the existing user's verified state
-		if !user.Verified {
+	var user *models.User
+
+	// check for existing relation with the external auth user
+	rel, _ := form.config.Dao.FindExternalAuthByProvider(form.Provider, authData.Id)
+	if rel != nil {
+		user, err = form.config.Dao.FindUserById(rel.UserId)
+		if err != nil {
+			return nil, authData, err
+		}
+	} else if authData.Email != "" {
+		// look for an existing user by the external user's email
+		user, _ = form.config.Dao.FindUserByEmail(authData.Email)
+	}
+
+	if user == nil && !config.AllowRegistrations {
+		return nil, authData, errors.New("New users registration is not allowed for the authorized provider.")
+	}
+
+	saveErr := form.config.Dao.RunInTransaction(func(txDao *daos.Dao) error {
+		if user == nil {
+			user = &models.User{}
 			user.Verified = true
-			if err := form.app.Dao().SaveUser(user); err != nil {
-				return nil, authData, err
+			user.Email = authData.Email
+			user.SetPassword(security.RandomString(30))
+
+			// create the new user
+			if err := txDao.SaveUser(user); err != nil {
+				return err
+			}
+		} else {
+			// update the existing user empty email if the authData has one
+			// (this in case previously the user was created with
+			// an OAuth2 provider that didn't return an email address)
+			if user.Email == "" && authData.Email != "" {
+				user.Email = authData.Email
+				if err := txDao.SaveUser(user); err != nil {
+					return err
+				}
+			}
+
+			// update the existing user verified state
+			// (only if the user doesn't have an email or the user email match with the one in authData)
+			if !user.Verified && (user.Email == "" || user.Email == authData.Email) {
+				user.Verified = true
+				if err := txDao.SaveUser(user); err != nil {
+					return err
+				}
 			}
 		}
-		return user, authData, nil
-	}
 
-	if !config.AllowRegistrations {
-		// registration of new users is not allowed via the Oauth2 provider
-		return nil, authData, errors.New("Cannot find user with the authorized email.")
-	}
+		// create ExternalAuth relation if missing
+		if rel == nil {
+			rel = &models.ExternalAuth{
+				UserId:     user.Id,
+				Provider:   form.Provider,
+				ProviderId: authData.Id,
+			}
+			if err := txDao.SaveExternalAuth(rel); err != nil {
+				return err
+			}
+		}
 
-	// create new user
-	user = &models.User{Verified: true}
-	upsertForm := NewUserUpsert(form.app, user)
-	upsertForm.Email = authData.Email
-	upsertForm.Password = security.RandomString(30)
-	upsertForm.PasswordConfirm = upsertForm.Password
+		return nil
+	})
 
-	event := &core.UserOauth2RegisterEvent{
-		User:     user,
-		AuthData: authData,
-	}
-
-	if err := form.app.OnUserBeforeOauth2Register().Trigger(event); err != nil {
-		return nil, authData, err
-	}
-
-	if err := upsertForm.Submit(); err != nil {
-		return nil, authData, err
-	}
-
-	if err := form.app.OnUserAfterOauth2Register().Trigger(event); err != nil {
-		return nil, authData, err
+	if saveErr != nil {
+		return nil, authData, saveErr
 	}
 
 	return user, authData, nil

forms/user_oauth2_login_test.go

@@ -9,6 +9,16 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestUserOauth2LoginPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserOauth2Login(nil)
+}
+
 func TestUserOauth2LoginValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/user_password_reset_confirm.go

@@ -3,29 +3,59 @@ package forms
 import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// UserPasswordResetConfirm defines a user password reset confirmation form.
+// UserPasswordResetConfirm specifies a user password reset confirmation form.
 type UserPasswordResetConfirm struct {
-	app core.App
+	config UserPasswordResetConfirmConfig
 
 	Token           string `form:"token" json:"token"`
 	Password        string `form:"password" json:"password"`
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// NewUserPasswordResetConfirm creates new user password reset confirmation form.
+// UserPasswordResetConfirmConfig is the [UserPasswordResetConfirm]
+// factory initializer config.
+//
+// NB! App is required struct member.
+type UserPasswordResetConfirmConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserPasswordResetConfirm creates a new [UserPasswordResetConfirm]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserPasswordResetConfirmWithConfig] with explicitly set Dao.
 func NewUserPasswordResetConfirm(app core.App) *UserPasswordResetConfirm {
-	return &UserPasswordResetConfirm{
-		app: app,
+	return NewUserPasswordResetConfirmWithConfig(UserPasswordResetConfirmConfig{
+		App: app,
+	})
+}
+
+// NewUserPasswordResetConfirmWithConfig creates a new [UserPasswordResetConfirm]
+// form with the provided config or panics on invalid configuration.
+func NewUserPasswordResetConfirmWithConfig(config UserPasswordResetConfirmConfig) *UserPasswordResetConfirm {
+	form := &UserPasswordResetConfirm{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *UserPasswordResetConfirm) Validate() error {
-	minPasswordLength := form.app.Settings().EmailAuth.MinPasswordLength
+	minPasswordLength := form.config.App.Settings().EmailAuth.MinPasswordLength
 
 	return validation.ValidateStruct(form,
 		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
@@ -40,9 +70,9 @@ func (form *UserPasswordResetConfirm) checkToken(value any) error {
 		return nil // nothing to check
 	}
 
-	user, err := form.app.Dao().FindUserByToken(
+	user, err := form.config.Dao.FindUserByToken(
 		v,
-		form.app.Settings().UserPasswordResetToken.Secret,
+		form.config.App.Settings().UserPasswordResetToken.Secret,
 	)
 	if err != nil || user == nil {
 		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
@@ -58,9 +88,9 @@ func (form *UserPasswordResetConfirm) Submit() (*models.User, error) {
 		return nil, err
 	}
 
-	user, err := form.app.Dao().FindUserByToken(
+	user, err := form.config.Dao.FindUserByToken(
 		form.Token,
-		form.app.Settings().UserPasswordResetToken.Secret,
+		form.config.App.Settings().UserPasswordResetToken.Secret,
 	)
 	if err != nil {
 		return nil, err
@@ -70,7 +100,7 @@ func (form *UserPasswordResetConfirm) Submit() (*models.User, error) {
 		return nil, err
 	}
 
-	if err := form.app.Dao().SaveUser(user); err != nil {
+	if err := form.config.Dao.SaveUser(user); err != nil {
 		return nil, err
 	}
 

forms/user_password_reset_confirm_test.go

@@ -10,6 +10,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+func TestUserPasswordResetConfirmPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserPasswordResetConfirm(nil)
+}
+
 func TestUserPasswordResetConfirmValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/user_password_reset_request.go

@@ -7,24 +7,54 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-// UserPasswordResetRequest defines a user password reset request form.
+// UserPasswordResetRequest specifies a user password reset request form.
 type UserPasswordResetRequest struct {
-	app             core.App
-	resendThreshold float64
+	config UserPasswordResetRequestConfig
 
 	Email string `form:"email" json:"email"`
 }
 
-// NewUserPasswordResetRequest creates new user password reset request form.
+// UserPasswordResetRequestConfig is the [UserPasswordResetRequest]
+// factory initializer config.
+//
+// NB! App is required struct member.
+type UserPasswordResetRequestConfig struct {
+	App             core.App
+	Dao             *daos.Dao
+	ResendThreshold float64 // in seconds
+}
+
+// NewUserPasswordResetRequest creates a new [UserPasswordResetRequest]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserPasswordResetRequestWithConfig] with explicitly set Dao.
 func NewUserPasswordResetRequest(app core.App) *UserPasswordResetRequest {
-	return &UserPasswordResetRequest{
-		app:             app,
-		resendThreshold: 120, // 2 min
+	return NewUserPasswordResetRequestWithConfig(UserPasswordResetRequestConfig{
+		App:             app,
+		ResendThreshold: 120, // 2 min
+	})
+}
+
+// NewUserPasswordResetRequestWithConfig creates a new [UserPasswordResetRequest]
+// form with the provided config or panics on invalid configuration.
+func NewUserPasswordResetRequestWithConfig(config UserPasswordResetRequestConfig) *UserPasswordResetRequest {
+	form := &UserPasswordResetRequest{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -36,7 +66,7 @@ func (form *UserPasswordResetRequest) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 		),
 	)
 }
@@ -48,23 +78,23 @@ func (form *UserPasswordResetRequest) Submit() error {
 		return err
 	}
 
-	user, err := form.app.Dao().FindUserByEmail(form.Email)
+	user, err := form.config.Dao.FindUserByEmail(form.Email)
 	if err != nil {
 		return err
 	}
 
 	now := time.Now().UTC()
 	lastResetSentAt := user.LastResetSentAt.Time()
-	if now.Sub(lastResetSentAt).Seconds() < form.resendThreshold {
+	if now.Sub(lastResetSentAt).Seconds() < form.config.ResendThreshold {
 		return errors.New("You've already requested a password reset.")
 	}
 
-	if err := mails.SendUserPasswordReset(form.app, user); err != nil {
+	if err := mails.SendUserPasswordReset(form.config.App, user); err != nil {
 		return err
 	}
 
 	// update last sent timestamp
 	user.LastResetSentAt = types.NowDateTime()
 
-	return form.app.Dao().SaveUser(user)
+	return form.config.Dao.SaveUser(user)
 }

forms/user_password_reset_request_test.go

@@ -11,6 +11,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
+func TestUserPasswordResetRequestPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserPasswordResetRequest(nil)
+}
+
 func TestUserPasswordResetRequestValidate(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

forms/user_upsert.go

@@ -6,33 +6,63 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-// UserUpsert defines a user upsert (create/update) form.
+// UserUpsert specifies a [models.User] upsert (create/update) form.
 type UserUpsert struct {
-	app      core.App
-	user     *models.User
-	isCreate bool
+	config UserUpsertConfig
+	user   *models.User
 
+	Id              string `form:"id" json:"id"`
 	Email           string `form:"email" json:"email"`
 	Password        string `form:"password" json:"password"`
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// NewUserUpsert creates new upsert form for the provided user model
-// (pass an empty user model instance (`&models.User{}`) for create).
+// UserUpsertConfig is the [UserUpsert] factory initializer config.
+//
+// NB! App is required struct member.
+type UserUpsertConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserUpsert creates a new [UserUpsert] form with initializer
+// config created from the provided [core.App] instance
+// (for create you could pass a pointer to an empty User - `&models.User{}`).
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserEmailChangeConfirmWithConfig] with explicitly set Dao.
 func NewUserUpsert(app core.App, user *models.User) *UserUpsert {
+	return NewUserUpsertWithConfig(UserUpsertConfig{
+		App: app,
+	}, user)
+}
+
+// NewUserUpsertWithConfig creates a new [UserUpsert] form with the provided
+// config and [models.User] instance or panics on invalid configuration
+// (for create you could pass a pointer to an empty User - `&models.User{}`).
+func NewUserUpsertWithConfig(config UserUpsertConfig, user *models.User) *UserUpsert {
 	form := &UserUpsert{
-		app:      app,
-		user:     user,
-		isCreate: !user.HasId(),
+		config: config,
+		user:   user,
+	}
+
+	if form.config.App == nil || form.user == nil {
+		panic("Invalid initializer config or nil upsert model.")
+	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
 	}
 
 	// load defaults
+	form.Id = user.Id
 	form.Email = user.Email
 
 	return form
@@ -40,25 +70,31 @@ func NewUserUpsert(app core.App, user *models.User) *UserUpsert {
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *UserUpsert) Validate() error {
-	config := form.app.Settings()
-
 	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Id,
+			validation.When(
+				form.user.IsNew(),
+				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
+				validation.Match(idRegex),
+			).Else(validation.In(form.user.Id)),
+		),
 		validation.Field(
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 			validation.By(form.checkEmailDomain),
 			validation.By(form.checkUniqueEmail),
 		),
 		validation.Field(
 			&form.Password,
-			validation.When(form.isCreate, validation.Required),
-			validation.Length(config.EmailAuth.MinPasswordLength, 100),
+			validation.When(form.user.IsNew(), validation.Required),
+			validation.Length(form.config.App.Settings().EmailAuth.MinPasswordLength, 100),
 		),
 		validation.Field(
 			&form.PasswordConfirm,
-			validation.When(form.isCreate || form.Password != "", validation.Required),
+			validation.When(form.user.IsNew() || form.Password != "", validation.Required),
 			validation.By(validators.Compare(form.Password)),
 		),
 	)
@@ -67,7 +103,7 @@ func (form *UserUpsert) Validate() error {
 func (form *UserUpsert) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
-	if v == "" || form.app.Dao().IsUserEmailUnique(v, form.user.Id) {
+	if v == "" || form.config.Dao.IsUserEmailUnique(v, form.user.Id) {
 		return nil
 	}
 
@@ -81,8 +117,8 @@ func (form *UserUpsert) checkEmailDomain(value any) error {
 	}
 
 	domain := val[strings.LastIndex(val, "@")+1:]
-	only := form.app.Settings().EmailAuth.OnlyDomains
-	except := form.app.Settings().EmailAuth.ExceptDomains
+	only := form.config.App.Settings().EmailAuth.OnlyDomains
+	except := form.config.App.Settings().EmailAuth.ExceptDomains
 
 	// only domains check
 	if len(only) > 0 && !list.ExistInSlice(domain, only) {
@@ -110,7 +146,13 @@ func (form *UserUpsert) Submit(interceptors ...InterceptorFunc) error {
 		form.user.SetPassword(form.Password)
 	}
 
-	if !form.isCreate && form.Email != form.user.Email {
+	// custom insertion id can be set only on create
+	if form.user.IsNew() && form.Id != "" {
+		form.user.MarkAsNew()
+		form.user.SetId(form.Id)
+	}
+
+	if !form.user.IsNew() && form.Email != form.user.Email {
 		form.user.Verified = false
 		form.user.LastVerificationSentAt = types.DateTime{} // reset
 	}
@@ -118,6 +160,6 @@ func (form *UserUpsert) Submit(interceptors ...InterceptorFunc) error {
 	form.user.Email = form.Email
 
 	return runInterceptors(func() error {
-		return form.app.Dao().SaveUser(form.user)
+		return form.config.Dao.SaveUser(form.user)
 	}, interceptors...)
 }

forms/user_upsert_test.go

@@ -3,6 +3,7 @@ package forms_test
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -11,6 +12,29 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
+func TestUserUpsertPanic1(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserUpsert(nil, nil)
+}
+
+func TestUserUpsertPanic2(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserUpsert(app, nil)
+}
+
 func TestNewUserUpsert(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -304,3 +328,105 @@ func TestUserUpsertSubmitInterceptors(t *testing.T) {
 		t.Fatalf("Expected the form model to be filled before calling the interceptors")
 	}
 }
+
+func TestUserUpsertWithCustomId(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	existingUser, err := app.Dao().FindUserByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		jsonData    string
+		collection  *models.User
+		expectError bool
+	}{
+		{
+			"empty data",
+			"{}",
+			&models.User{},
+			false,
+		},
+		{
+			"empty id",
+			`{"id":""}`,
+			&models.User{},
+			false,
+		},
+		{
+			"id < 15 chars",
+			`{"id":"a23"}`,
+			&models.User{},
+			true,
+		},
+		{
+			"id > 15 chars",
+			`{"id":"a234567890123456"}`,
+			&models.User{},
+			true,
+		},
+		{
+			"id = 15 chars (invalid chars)",
+			`{"id":"a@3456789012345"}`,
+			&models.User{},
+			true,
+		},
+		{
+			"id = 15 chars (valid chars)",
+			`{"id":"a23456789012345"}`,
+			&models.User{},
+			false,
+		},
+		{
+			"changing the id of an existing item",
+			`{"id":"b23456789012345"}`,
+			existingUser,
+			true,
+		},
+		{
+			"using the same existing item id",
+			`{"id":"` + existingUser.Id + `"}`,
+			existingUser,
+			false,
+		},
+		{
+			"skipping the id for existing item",
+			`{}`,
+			existingUser,
+			false,
+		},
+	}
+
+	for i, scenario := range scenarios {
+		form := forms.NewUserUpsert(app, scenario.collection)
+		if form.Email == "" {
+			form.Email = fmt.Sprintf("test_id_%d@example.com", i)
+		}
+		form.Password = "1234567890"
+		form.PasswordConfirm = form.Password
+
+		// load data
+		loadErr := json.Unmarshal([]byte(scenario.jsonData), form)
+		if loadErr != nil {
+			t.Errorf("[%s] Failed to load form data: %v", scenario.name, loadErr)
+			continue
+		}
+
+		submitErr := form.Submit()
+		hasErr := submitErr != nil
+
+		if hasErr != scenario.expectError {
+			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, submitErr)
+		}
+
+		if !hasErr && form.Id != "" {
+			_, err := app.Dao().FindUserById(form.Id)
+			if err != nil {
+				t.Errorf("[%s] Expected to find record with id %s, got %v", scenario.name, form.Id, err)
+			}
+		}
+	}
+}

forms/user_verification_confirm.go

@@ -3,21 +3,51 @@ package forms
 import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// UserVerificationConfirm defines a user email confirmation form.
+// UserVerificationConfirm specifies a user email verification confirmation form.
 type UserVerificationConfirm struct {
-	app core.App
+	config UserVerificationConfirmConfig
 
 	Token string `form:"token" json:"token"`
 }
 
-// NewUserVerificationConfirm creates a new user email confirmation form.
+// UserVerificationConfirmConfig is the [UserVerificationConfirm]
+// factory initializer config.
+//
+// NB! App is required struct member.
+type UserVerificationConfirmConfig struct {
+	App core.App
+	Dao *daos.Dao
+}
+
+// NewUserVerificationConfirm creates a new [UserVerificationConfirm]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserVerificationConfirmWithConfig] with explicitly set Dao.
 func NewUserVerificationConfirm(app core.App) *UserVerificationConfirm {
-	return &UserVerificationConfirm{
-		app: app,
+	return NewUserVerificationConfirmWithConfig(UserVerificationConfirmConfig{
+		App: app,
+	})
+}
+
+// NewUserVerificationConfirmWithConfig creates a new [UserVerificationConfirmConfig]
+// form with the provided config or panics on invalid configuration.
+func NewUserVerificationConfirmWithConfig(config UserVerificationConfirmConfig) *UserVerificationConfirm {
+	form := &UserVerificationConfirm{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -33,9 +63,9 @@ func (form *UserVerificationConfirm) checkToken(value any) error {
 		return nil // nothing to check
 	}
 
-	user, err := form.app.Dao().FindUserByToken(
+	user, err := form.config.Dao.FindUserByToken(
 		v,
-		form.app.Settings().UserVerificationToken.Secret,
+		form.config.App.Settings().UserVerificationToken.Secret,
 	)
 	if err != nil || user == nil {
 		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
@@ -51,9 +81,9 @@ func (form *UserVerificationConfirm) Submit() (*models.User, error) {
 		return nil, err
 	}
 
-	user, err := form.app.Dao().FindUserByToken(
+	user, err := form.config.Dao.FindUserByToken(
 		form.Token,
-		form.app.Settings().UserVerificationToken.Secret,
+		form.config.App.Settings().UserVerificationToken.Secret,
 	)
 	if err != nil {
 		return nil, err
@@ -65,7 +95,7 @@ func (form *UserVerificationConfirm) Submit() (*models.User, error) {
 
 	user.Verified = true
 
-	if err := form.app.Dao().SaveUser(user); err != nil {
+	if err := form.config.Dao.SaveUser(user); err != nil {
 		return nil, err
 	}
 

forms/user_verification_confirm_test.go

@@ -10,6 +10,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
+func TestUserVerificationConfirmPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserVerificationConfirm(nil)
+}
+
 func TestUserVerificationConfirmValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()

forms/user_verification_request.go

@@ -7,24 +7,54 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 // UserVerificationRequest defines a user email verification request form.
 type UserVerificationRequest struct {
-	app             core.App
-	resendThreshold float64
+	config UserVerificationRequestConfig
 
 	Email string `form:"email" json:"email"`
 }
 
-// NewUserVerificationRequest creates a new user email verification request form.
+// UserVerificationRequestConfig is the [UserVerificationRequest]
+// factory initializer config.
+//
+// NB! App is required struct member.
+type UserVerificationRequestConfig struct {
+	App             core.App
+	Dao             *daos.Dao
+	ResendThreshold float64 // in seconds
+}
+
+// NewUserVerificationRequest creates a new [UserVerificationRequest]
+// form with initializer config created from the provided [core.App] instance.
+//
+// If you want to submit the form as part of another transaction, use
+// [NewUserVerificationRequestWithConfig] with explicitly set Dao.
 func NewUserVerificationRequest(app core.App) *UserVerificationRequest {
-	return &UserVerificationRequest{
-		app:             app,
-		resendThreshold: 120, // 2 min
+	return NewUserVerificationRequestWithConfig(UserVerificationRequestConfig{
+		App:             app,
+		ResendThreshold: 120, // 2 min
+	})
+}
+
+// NewUserVerificationRequestWithConfig creates a new [UserVerificationRequest]
+// form with the provided config or panics on invalid configuration.
+func NewUserVerificationRequestWithConfig(config UserVerificationRequestConfig) *UserVerificationRequest {
+	form := &UserVerificationRequest{config: config}
+
+	if form.config.App == nil {
+		panic("Missing required config.App instance.")
 	}
+
+	if form.config.Dao == nil {
+		form.config.Dao = form.config.App.Dao()
+	}
+
+	return form
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -36,7 +66,7 @@ func (form *UserVerificationRequest) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 		),
 	)
 }
@@ -48,7 +78,7 @@ func (form *UserVerificationRequest) Submit() error {
 		return err
 	}
 
-	user, err := form.app.Dao().FindUserByEmail(form.Email)
+	user, err := form.config.Dao.FindUserByEmail(form.Email)
 	if err != nil {
 		return err
 	}
@@ -59,16 +89,16 @@ func (form *UserVerificationRequest) Submit() error {
 
 	now := time.Now().UTC()
 	lastVerificationSentAt := user.LastVerificationSentAt.Time()
-	if (now.Sub(lastVerificationSentAt)).Seconds() < form.resendThreshold {
+	if (now.Sub(lastVerificationSentAt)).Seconds() < form.config.ResendThreshold {
 		return errors.New("A verification email was already sent.")
 	}
 
-	if err := mails.SendUserVerification(form.app, user); err != nil {
+	if err := mails.SendUserVerification(form.config.App, user); err != nil {
 		return err
 	}
 
 	// update last sent timestamp
 	user.LastVerificationSentAt = types.NowDateTime()
 
-	return form.app.Dao().SaveUser(user)
+	return form.config.Dao.SaveUser(user)
 }

forms/user_verification_request_test.go

@@ -11,6 +11,16 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
+func TestUserVerificationRequestPanic(t *testing.T) {
+	defer func() {
+		if recover() == nil {
+			t.Fatal("The form did not panic")
+		}
+	}()
+
+	forms.NewUserVerificationRequest(nil)
+}
+
 func TestUserVerificationRequestValidate(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

forms/validators/file.go

@@ -3,9 +3,9 @@ package validators
 import (
 	"encoding/binary"
 	"fmt"
-	"net/http"
 	"strings"
 
+	"github.com/gabriel-vasile/mimetype"
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/tools/rest"
 )
@@ -47,10 +47,10 @@ func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
 			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
 		}
 
-		filetype := http.DetectContentType(v.Bytes())
+		filetype := mimetype.Detect(v.Bytes())
 
 		for _, t := range validTypes {
-			if t == filetype {
+			if filetype.Is(t) {
 				return nil // valid
 			}
 		}

forms/validators/record_data.go

@@ -189,7 +189,7 @@ func (validator *RecordDataValidator) checkEmailValue(field *schema.SchemaField,
 		return nil // nothing to check
 	}
 
-	if is.Email.Validate(val) != nil {
+	if is.EmailFormat.Validate(val) != nil {
 		return validation.NewError("validation_invalid_email", "Must be a valid email")
 	}
 

go.mod

@@ -4,83 +4,81 @@ go 1.18
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.5
-	github.com/aws/aws-sdk-go v1.44.48
+	github.com/aws/aws-sdk-go v1.44.85
 	github.com/disintegration/imaging v1.6.2
-	github.com/domodwyer/mailyak/v3 v3.3.3
+	github.com/domodwyer/mailyak/v3 v3.3.4
 	github.com/fatih/color v1.13.0
+	github.com/gabriel-vasile/mimetype v1.4.1
 	github.com/ganigeorgiev/fexpr v0.1.1
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
 	github.com/golang-jwt/jwt/v4 v4.4.2
 	github.com/labstack/echo/v5 v5.0.0-20220201181537-ed2888cfa198
-	github.com/mattn/go-sqlite3 v1.14.14
-	github.com/microcosm-cc/bluemonday v1.0.19
+	github.com/mattn/go-sqlite3 v1.14.15
 	github.com/pocketbase/dbx v1.6.0
 	github.com/spf13/cast v1.5.0
 	github.com/spf13/cobra v1.5.0
-	gocloud.dev v0.25.0
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
-	golang.org/x/oauth2 v0.0.0-20220630143837-2104d58473e0
-	modernc.org/sqlite v1.17.3
+	gocloud.dev v0.26.0
+	golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503
+	golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c
+	golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094
+	modernc.org/sqlite v1.18.1
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.7 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.3 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.15.13 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.8 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.8 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.19 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.14 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.27.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.9 // indirect
-	github.com/aws/smithy-go v1.12.0 // indirect
-	github.com/aymerick/douceur v0.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.16.11 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.14 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.18 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.12 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.19 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.27.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.16.13 // indirect
+	github.com/aws/smithy-go v1.12.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/google/wire v0.5.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
-	github.com/gorilla/css v1.0.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.5.1 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.1 // indirect
 	go.opencensus.io v0.23.0 // indirect
-	golang.org/x/image v0.0.0-20220617043117-41969df76e82 // indirect
+	golang.org/x/image v0.0.0-20220722155232-062f8c9fd539 // indirect
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/net v0.0.0-20220706163947-c90051bbdb60 // indirect
-	golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e // indirect
-	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
+	golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
 	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
-	golang.org/x/tools v0.1.11 // indirect
+	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
+	golang.org/x/tools v0.1.12 // indirect
 	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.86.0 // indirect
+	google.golang.org/api v0.94.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220706132729-d86698d07c53 // indirect
-	google.golang.org/grpc v1.47.0 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/genproto v0.0.0-20220822174746-9e6da59bd2fc // indirect
+	google.golang.org/grpc v1.49.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	lukechampine.com/uint128 v1.2.0 // indirect
-	modernc.org/cc/v3 v3.36.0 // indirect
-	modernc.org/ccgo/v3 v3.16.6 // indirect
-	modernc.org/libc v1.16.14 // indirect
-	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.1.1 // indirect
+	modernc.org/cc/v3 v3.36.3 // indirect
+	modernc.org/ccgo/v3 v3.16.9 // indirect
+	modernc.org/libc v1.17.0 // indirect
+	modernc.org/mathutil v1.5.0 // indirect
+	modernc.org/memory v1.2.0 // indirect
 	modernc.org/opt v0.1.3 // indirect
 	modernc.org/strutil v1.1.2 // indirect
 	modernc.org/token v1.0.0 // indirect

go.sum

@@ -122,68 +122,66 @@ github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:W
 github.com/aws/aws-sdk-go v1.15.27/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
 github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.43.31/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.48 h1:jLDC9RsNoYMLFlKpB8LdqUnoDdC2yvkS4QbuyPQJ8+M=
-github.com/aws/aws-sdk-go v1.44.48/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.44.85 h1:JM2rkKY/GtTDCQXW0StkImbLn6n4Q/Dm2bj+u1rm7Kw=
+github.com/aws/aws-sdk-go v1.44.85/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v1.16.2/go.mod h1:ytwTPBG6fXTZLxxeeCCWj2/EMYp/xDUgX+OET6TLNNU=
-github.com/aws/aws-sdk-go-v2 v1.16.7 h1:zfBwXus3u14OszRxGcqCDS4MfMCv10e8SMJ2r8Xm0Ns=
-github.com/aws/aws-sdk-go-v2 v1.16.7/go.mod h1:6CpKuLXg2w7If3ABZCl/qZ6rEgwtjZTn4eAf4RcEyuw=
+github.com/aws/aws-sdk-go-v2 v1.16.11 h1:xM1ZPSvty3xVmdxiGr7ay/wlqv+MWhH0rMlyLdbC0YQ=
+github.com/aws/aws-sdk-go-v2 v1.16.11/go.mod h1:WTACcleLz6VZTp7fak4EO5b9Q4foxbn+8PIz3PmyKlo=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.1/go.mod h1:n8Bs1ElDD2wJ9kCRTczA83gYbBmjSwZp3umc6zF4EeM=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.3 h1:S/ZBwevQkr7gv5YxONYpGQxlMFFYSRfz3RMcjsC9Qhk=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.3/go.mod h1:gNsR5CaXKmQSSzrmGxmwmct/r+ZBfbxorAuXYsj/M5Y=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.4 h1:zfT11pa7ifu/VlLDpmc5OY2W4nYmnKkFDGeMVnmqAI0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.4/go.mod h1:ES0I1GBs+YYgcDS1ek47Erbn4TOL811JKqBXtgzqyZ8=
 github.com/aws/aws-sdk-go-v2/config v1.15.3/go.mod h1:9YL3v07Xc/ohTsxFXzan9ZpFpdTOFl4X65BAKYaz8jg=
-github.com/aws/aws-sdk-go-v2/config v1.15.13 h1:CJH9zn/Enst7lDiGpoguVt0lZr5HcpNVlRJWbJ6qreo=
-github.com/aws/aws-sdk-go-v2/config v1.15.13/go.mod h1:AcMu50uhV6wMBUlURnEXhr9b3fX6FLSTlEV89krTEGk=
+github.com/aws/aws-sdk-go-v2/config v1.17.1 h1:BWxTjokU/69BZ4DnLrZco6OvBDii6ToEdfBL/y5I1nA=
+github.com/aws/aws-sdk-go-v2/config v1.17.1/go.mod h1:uOxDHjBemNTF2Zos+fgG0NNfE86wn1OAHDTGxjMEYi0=
 github.com/aws/aws-sdk-go-v2/credentials v1.11.2/go.mod h1:j8YsY9TXTm31k4eFhspiQicfXPLZ0gYXA50i4gxPE8g=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.8 h1:niTa7zc7uyOP2ufri0jPESBt1h9yP3Zc0q+xzih3h8o=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.8/go.mod h1:P2Hd4Sy7mXRxPNcQMPBmqszSJoDXexX8XEDaT6lucO0=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.14 h1:AtVG/amkjbDBfnPr/tuW2IG18HGNznP6L12Dx0rLz+Q=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.14/go.mod h1:opAndTyq+YN7IpVG57z2CeNuXSQMqTYxGGlYH0m0RMY=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.3/go.mod h1:uk1vhHHERfSVCUnqSqz8O48LBYDSC+k6brng09jcMOk=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.8 h1:VfBdn2AxwMbFyJN/lF/xuT3SakomJ86PZu3rCxb5K0s=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.8/go.mod h1:oL1Q3KuCq1D4NykQnIvtRiBGLUXhcpY5pl6QZB2XEPU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.12 h1:wgJBHO58Pc1V1QAnzdVM3JK3WbE/6eUF0JxCZ+/izz0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.12/go.mod h1:aZ4vZnyUuxedC7eD4JyEHpGnCz+O2sHQEx3VvAwklSE=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.3/go.mod h1:0dHuD2HZZSiwfJSy1FO5bX1hQ1TxVV1QXXjpn3XUE44=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.19 h1:WfCYqsAADDRNCQQ5LGcrlqbR7SK3PYrP/UCh7qNGBQM=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.19/go.mod h1:koLPv2oF6ksE3zBKLDP0GFmKfaCmYwVHqGIbaPrHIRg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.27 h1:xFXIMBci0UXStoOHq/8w0XIZPB2hgb9CD7uATJhqt10=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.27/go.mod h1:+tj2cHQkChanggNZn1J2fJ1Cv6RO1TV0AA3472do31I=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.9/go.mod h1:AnVH5pvai0pAF4lXRq0bmhbes1u9R8wTE+g+183bZNM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.14 h1:2C0pYHcUBmdzPj+EKNC4qj97oK6yjrUhc1KoSodglvk=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.14/go.mod h1:kdjrMwHwrC3+FsKhNcCMJ7tUVj/8uSD5CZXeQ4wV6fM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.18 h1:OmiwoVyLKEqqD5GvB683dbSqxiOfvx4U2lDZhG2Esc4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.18/go.mod h1:348MLhzV1GSlZSMusdwQpXKbhD7X2gbI/TxwAPKkYZQ=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.3/go.mod h1:ssOhaLpRlh88H3UmEcsBoVKq309quMvm3Ds8e9d4eJM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.8 h1:2J+jdlBJWEmTyAwC82Ym68xCykIvnSnIN18b8xHGlcc=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.8/go.mod h1:ZIV8GYoC6WLBW5KGs+o4rsc65/ozd+eQ0L31XF5VDwk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.12 h1:5mvQDtNWtI6H56+E4LUnLWEmATMB7oEh+Z9RurtIuC0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.12/go.mod h1:ckaCVTEdGAxO6KwTGzgskxR1xM+iJW4lxMyDFVda2Fc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.10/go.mod h1:8DcYQcz0+ZJaSxANlHIsbbi6S+zMwjwdDqwW3r9AzaE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.15 h1:QquxR7NH3ULBsKC+NoTpilzbKKS+5AELfNREInbhvas=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.15/go.mod h1:Tkrthp/0sNBShQQsamR7j/zY4p19tVTAs+nnqhH6R3c=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.5 h1:tEEHn+PGAxRVqMPEhtU8oCSW/1Ge3zP5nUgPrGQNUPs=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.5/go.mod h1:aIwFF3dUk95ocCcA3zfk3nhz0oLkpzHFWuMp8l/4nNs=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.19 h1:g5qq9sgtEzt2szMaDqQO6fqKe026T6dHTFJp5NsPzkQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.19/go.mod h1:cVHo8KTuHjShb9V8/VjH3S/8+xPu16qx8fdGwmotJhE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.9 h1:agLpf3vtYX1rtKTrOGpevdP3iC2W0hKDmzmhhxJzL+A=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.9/go.mod h1:cv+n1mdyh+0B8tAtlEBzTYFA2Uv15SISEn6kabYhIgE=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.1/go.mod h1:GeUru+8VzrTXV/83XyMJ80KpH8xO89VPoUileyNQ+tc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.3 h1:4n4KCtv5SUoT5Er5XV41huuzrCqepxlW3SDI9qHQebc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.3/go.mod h1:gkb2qADY+OHaGLKNTYxMaQNacfeyQpZ4csDTQMeFmcw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.5 h1:g1ITJ9i9ixa+/WVggLNK20KyliAA8ltnuxfZEDfo2hM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.5/go.mod h1:oehQLbMQkppKLXvpx/1Eo0X47Fe+0971DXC9UjGnKcI=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.3/go.mod h1:Seb8KNmD6kVTjwRjVEgOT5hPin6sq+v4C2ycJQDwuH8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.9 h1:gVv2vXOMqJeR4ZHHV32K7LElIJIIzyw/RU1b0lSfWTQ=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.9/go.mod h1:EF5RLnD9l0xvEWwMRcktIS/dI6lF8lU5eV3B13k6sWo=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.13 h1:3GamN8jcdz/a3nvL/ZVtoH/6xxeshfsiXj5O+6GW4Rg=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.13/go.mod h1:89CSPn69UECDLVn0H6FwKNgbtirksl8C8i3aBeeeihw=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.3/go.mod h1:wlY6SVjuwvh3TVRpTqdy4I1JpBFLX4UGeKZdWntaocw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.8 h1:oKnAXxSF2FUvfgw8uzU/v9OTYorJJZ8eBmWhr9TWVVQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.8/go.mod h1:rDVhIMAX9N2r8nWxDUlbubvvaFMnfsm+3jAV7q+rpM4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.12 h1:7iPTTX4SAI2U2VOogD7/gmHlsgnYSgoNHt7MSQXtG2M=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.12/go.mod h1:1TODGhheLWjpQWSuhYuAUWYTCKwEjx2iblIFKDHjeTc=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.3/go.mod h1:Bm/v2IaN6rZ+Op7zX+bOUMdL4fsrYZiD0dsjLhNKwZc=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.8 h1:TlN1UC39A0LUNoD51ubO5h32haznA+oVe15jO9O4Lj0=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.8/go.mod h1:JlVwmWtT/1c5W+6oUsjXjAJ0iJZ+hlghdrDy/8JxGCU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.12 h1:QFjSOmHSb77qRTv7KI9UFon9X5wLWY5/M+6la3dTcZc=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.12/go.mod h1:MADjAN0GHFDuc5lRa5Y5ki+oIO/w7X4qczHy+OUx0IA=
 github.com/aws/aws-sdk-go-v2/service/kms v1.16.3/go.mod h1:QuiHPBqlOFCi4LqdSskYYAWpQlx3PKmohy+rE2F+o5g=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.26.3/go.mod h1:g1qvDuRsJY+XghsV6zg00Z4KJ7DtFFCx8fJD2a491Ak=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.27.1 h1:OKQIQ0QhEBmGr2LfT952meIZz3ujrPYnxH+dO/5ldnI=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.27.1/go.mod h1:NffjpNsMUFXp6Ok/PahrktAncoekWrywvmIK83Q2raE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.27.5 h1:h9qqTedYnA9JcWjKyLV6UYIMSdp91ExLCUbjbpDLH7A=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.27.5/go.mod h1:J8SS5Tp/zeLxaubB0xGfKnVrvssNBNLwTipreTKLhjQ=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.15.4/go.mod h1:PJc8s+lxyU8rrre0/4a0pn2wgwiDvOEzoOjcJUBr67o=
 github.com/aws/aws-sdk-go-v2/service/sns v1.17.4/go.mod h1:kElt+uCcXxcqFyc+bQqZPFD9DME/eC6oHBXvFzQ9Bcw=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.18.3/go.mod h1:skmQo0UPvsjsuYYSYMVmrPc1HWCbHUJyrCEp+ZaLzqM=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.24.1/go.mod h1:NR/xoKjdbRJ+qx0pMR4mI+N/H1I1ynHwXnO6FowXJc0=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.3/go.mod h1:7UQ/e69kU7LDPtY40OyoHYgRmgfGM4mgsLYtcObdveU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.11 h1:XOJWXNFXJyapJqQuCIPfftsOf0XZZioM0kK6OPRt9MY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.11/go.mod h1:MO4qguFjs3wPGcCSpQ7kOFTwRvb+eu+fn+1vKleGHUk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.11.17 h1:pXxu9u2z1UqSbjO9YA8kmFJBhFc1EVTDaf7A+S+Ivq8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.11.17/go.mod h1:mS5xqLZc/6kc06IpXn5vRxdLaED+jEuaSRv5BxtnsiY=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.3/go.mod h1:bfBj0iVmsUyUg4weDB4NxktD9rDGeKSVWnjTnwbx9b8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.16.9 h1:yOfILxyjmtr2ubRkRJldlHDFBhf5vw4CzhbwWIBmimQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.16.9/go.mod h1:O1IvkYxr+39hRf960Us6j0x1P8pDqhTX+oXM5kQNl/Y=
+github.com/aws/aws-sdk-go-v2/service/sts v1.16.13 h1:dl8T0PJlN92rvEGOEUiD0+YPYdPEaCZK0TqHukvSfII=
+github.com/aws/aws-sdk-go-v2/service/sts v1.16.13/go.mod h1:Ru3QVMLygVs/07UQ3YDur1AQZZp2tUNje8wfloFttC0=
 github.com/aws/smithy-go v1.11.2/go.mod h1:3xHYmszWVx2c0kIwQeEVf9uSm4fYZt67FBJnwub1bgM=
-github.com/aws/smithy-go v1.12.0 h1:gXpeZel/jPoWQ7OEmLIgCUnhkFftqNfwWUwAHSlp1v0=
-github.com/aws/smithy-go v1.12.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
-github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
+github.com/aws/smithy-go v1.12.1 h1:yQRC55aXN/y1W10HgwHle01DRuV9Dpf31iGkotjt3Ag=
+github.com/aws/smithy-go v1.12.1/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -220,8 +218,8 @@ github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/domodwyer/mailyak/v3 v3.3.3 h1:E9cjqDUiwY1QSE5G2CbWHM7EJV5FybKPHnGovc2iaA8=
-github.com/domodwyer/mailyak/v3 v3.3.3/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
+github.com/domodwyer/mailyak/v3 v3.3.4 h1:AG/pvcz2/ocFqZkPEG7lPAa0MhCq1warfUEKJt6Fagk=
+github.com/domodwyer/mailyak/v3 v3.3.4/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -240,6 +238,8 @@ github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoD
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
+github.com/gabriel-vasile/mimetype v1.4.1 h1:TRWk7se+TOjCYgRth7+1/OYLNiRNIotknkFtf/dnN7Q=
+github.com/gabriel-vasile/mimetype v1.4.1/go.mod h1:05Vi0w3Y9c/lNvJOdmIwvrrAhX3rYhfQQCaf9VJcv7M=
 github.com/ganigeorgiev/fexpr v0.1.1 h1:La9kYEgTcIutvOnqNZ8pOUD0O0Q/Gn15sTVEX+IeBE8=
 github.com/ganigeorgiev/fexpr v0.1.1/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -370,12 +370,11 @@ github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pf
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
 github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
-github.com/googleapis/gax-go/v2 v2.4.0 h1:dS9eYAjhrE2RjmzYw2XAPvcXfmcQLtFEQWn0CR82awk=
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
+github.com/googleapis/gax-go/v2 v2.5.1 h1:kBRZU0PSuI7PspsSb/ChWoVResUcwNVIdpB049pKTiw=
+github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqEF02fYlzkUCyo=
 github.com/googleapis/go-type-adapters v1.0.0 h1:9XdMn+d/G57qq1s8dNc5IesGCXHf6V2HZ2JwRxfA2tA=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
-github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
-github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hanwen/go-fuse v1.0.0/go.mod h1:unqXarDXqzAk0rt98O2tVndEPIpUgLD9+rwFisZH3Ok=
@@ -386,8 +385,9 @@ github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
+github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
@@ -462,25 +462,22 @@ github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcncea
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-ieproxy v0.0.1 h1:qiyop7gCflfhwCzGyeT0gro3sF9AIg9HU98JORTkqfI=
 github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
-github.com/mattn/go-ieproxy v0.0.3 h1:YkaHmK1CzE5C4O7A3hv3TCbfNDPSCf0RKZFX+VhBeYk=
-github.com/mattn/go-ieproxy v0.0.3/go.mod h1:6ZpRmhBaYuBX1U2za+9rC9iCGLsSp2tftelZne7CPko=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.14 h1:qZgc/Rwetq+MtyE18WhzjokPD93dNqLGNT3QJuLvBGw=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/microcosm-cc/bluemonday v1.0.19 h1:OI7hoF5FY4pFz2VA//RN8TfM0YJ2dJcl4P4APrCWy6c=
-github.com/microcosm-cc/bluemonday v1.0.19/go.mod h1:QNzV2UbLK2/53oIIwTOyLUSABMkjZ4tqiyC1g/DyqxE=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -565,8 +562,8 @@ go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
-gocloud.dev v0.25.0 h1:Y7vDq8xj7SyM848KXf32Krda2e6jQ4CLh/mTeCSqXtk=
-gocloud.dev v0.25.0/go.mod h1:7HegHVCYZrMiU3IE1qtnzf/vRrDwLYnRNR3EhWX8x9Y=
+gocloud.dev v0.26.0 h1:4rM/SVL0lLs+rhC0Gmc+gt/82DBpb7nbpIZKXXnfMXg=
+gocloud.dev v0.26.0/go.mod h1:mkUgejbnbLotorqDyvedJO20XcZNTynmSeVSQS9btVg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -582,8 +579,8 @@ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211115234514-b4de73f9ece8/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503 h1:vJ2V3lFLg+bBhgroYuRfyN583UzVveQmIXjc8T/y3to=
+golang.org/x/crypto v0.0.0-20220824171710-5757bc0c5503/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -597,8 +594,8 @@ golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMk
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20220617043117-41969df76e82 h1:KpZB5pUSBvrHltNEdK/tw0xlPeD13M6M6aGP32gKqiw=
-golang.org/x/image v0.0.0-20220617043117-41969df76e82/go.mod h1:doUCurBvlfPMKfmIpRIywoHmhN3VyhnoFDbvIEWF4hY=
+golang.org/x/image v0.0.0-20220722155232-062f8c9fd539 h1:/eM0PCrQI2xd471rI+snWuu251/+/jpBpZqir2mPdnU=
+golang.org/x/image v0.0.0-20220722155232-062f8c9fd539/go.mod h1:doUCurBvlfPMKfmIpRIywoHmhN3VyhnoFDbvIEWF4hY=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -665,7 +662,6 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220107192237-5cfca573fb4d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -674,8 +670,8 @@ golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220706163947-c90051bbdb60 h1:8NSylCMxLW4JvserAndSgFL7aPli6A68yf0bYFTcWCM=
-golang.org/x/net v0.0.0-20220706163947-c90051bbdb60/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c h1:JVAXQ10yGGVbSyoer5VILysz6YKjdNT2bsvlayjqhes=
+golang.org/x/net v0.0.0-20220822230855-b0a4917ee28c/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -698,9 +694,8 @@ golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j
 golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220630143837-2104d58473e0 h1:VnGaRqoLmqZH/3TMLJwYCEWkR4j1nuIU1U9TvbqsDUw=
-golang.org/x/oauth2 v0.0.0-20220630143837-2104d58473e0/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094 h1:2o1E+E8TpNLklK9nHiPiK1uzIYrIHt+cQx3ynCwq9V8=
+golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -770,13 +765,11 @@ golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220110181412-a018aaa089fe/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -791,14 +784,15 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220624220833-87e55d714810/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e h1:CsOuNlbOuf0mzxJIefr6Q4uAUetRUwZE4qt7VfzP+xo=
-golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64 h1:UiNENfZ8gDvpiWw7IpOMQ27spWmThO1RwwdQVbJahJM=
+golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 h1:CBpWXWQpIRjzmkkA+M7q9Fqnwd2mZr3AFqexg8YTfoM=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -814,8 +808,8 @@ golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220609170525-579cf78fd858 h1:Dpdu/EMxGMFgq0CeYMh4fazTD2vtlZRYE7wyynxJb9U=
-golang.org/x/time v0.0.0-20220609170525-579cf78fd858/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 h1:ftMN5LMiBFjbzleLqtoBZk7KdJwhuybIU+FckUHgoyQ=
+golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -874,8 +868,8 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.11 h1:loJ25fNOEhSXfHrpoGj91eCUThwdNX6u24rO1xnNteY=
-golang.org/x/tools v0.1.11/go.mod h1:SgwaegtQh8clINPpECJMqnxLv9I09HLqnW3RMqW0CA4=
+golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -932,8 +926,8 @@ google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69
 google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
 google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
 google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.86.0 h1:ZAnyOHQFIuWso1BodVfSaRyffD74T9ERGFa3k1fNk/U=
-google.golang.org/api v0.86.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
+google.golang.org/api v0.94.0 h1:KtKM9ru3nzQioV1HLlUf1cR7vMYJIpgls5VhAYQXIwA=
+google.golang.org/api v0.94.0/go.mod h1:eADj+UBuxkh5zlrSntJghuNeg8HwQ1w5lTKkuqaETEI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1036,8 +1030,8 @@ google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220706132729-d86698d07c53 h1:liFd7OL799HvMNYG5xozhUoWDj944y+zXPDOhu4PyaM=
-google.golang.org/genproto v0.0.0-20220706132729-d86698d07c53/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
+google.golang.org/genproto v0.0.0-20220822174746-9e6da59bd2fc h1:Nf+EdcTLHR8qDNN/KfkQL0u0ssxt9OhbaWCl5C0ucEI=
+google.golang.org/genproto v0.0.0-20220822174746-9e6da59bd2fc/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1068,8 +1062,9 @@ google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ5
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.47.0 h1:9n77onPX5F3qfFCqjy9dhn8PbNQsIKeVU04J9G7umt8=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.49.0 h1:WTLtQzmQori5FUH25Pq4WT22oCsv8USpQ+F6rqtsmxw=
+google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1084,8 +1079,9 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -1109,42 +1105,35 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0 h1:mBi/5l91vocEN8otkC5bDLhi2KdCticRiwbdB0O+rjI=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-modernc.org/cc/v3 v3.36.0 h1:0kmRkTmqNidmu3c7BNDSdVHCxXCkWLmWmCIVX4LUboo=
-modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/ccgo/v3 v3.0.0-20220428102840-41399a37e894/go.mod h1:eI31LL8EwEBKPpNpA4bU1/i+sKOwOrQy8D87zWUcRZc=
-modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
-modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.6 h1:3l18poV+iUemQ98O3X5OMr97LOqlzis+ytivU4NqGhA=
-modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
+modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
+modernc.org/cc/v3 v3.36.3 h1:uISP3F66UlixxWEcKuIWERa4TwrZENHSL8tWxZz8bHg=
+modernc.org/cc/v3 v3.36.3/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
+modernc.org/ccgo/v3 v3.16.9 h1:AXquSwg7GuMk11pIdw7fmO1Y/ybgazVkMhsZWCV0mHM=
+modernc.org/ccgo/v3 v3.16.9/go.mod h1:zNMzC9A9xeNUepy6KuZBbugn3c0Mc9TeiJO4lgvkJDo=
 modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
 modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
 modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
-modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.16.0/go.mod h1:N4LD6DBE9cf+Dzf9buBlzVJndKr/iJHG97vGLHYnb5A=
-modernc.org/libc v1.16.1/go.mod h1:JjJE0eu4yeK7tab2n4S1w8tlWd9MxXLRzheaRnAKymU=
-modernc.org/libc v1.16.7/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.14 h1:MUIjk9Xwlkrp0BqGhMfRkiq0EkZsqfNiP4eixL3YiPk=
-modernc.org/libc v1.16.14/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
+modernc.org/libc v1.17.0 h1:nbL2Lv0I323wLc1GmTh/AqVtI9JeBVc7Nhapdg9EONs=
+modernc.org/libc v1.17.0/go.mod h1:XsgLldpP4aWlPlsjqKRdHPqCxCjISdHfM/yeWC5GyW0=
 modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.4.1 h1:ij3fYGe8zBF4Vu+g0oT7mB06r8sqGWKuJu1yXeR4by8=
 modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/memory v1.1.1 h1:bDOL0DIDLQv7bWhP3gMvIrnoFw+Eo6F7a2QK9HPDiFU=
-modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
+modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=
+modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
+modernc.org/memory v1.2.0 h1:zXehBrt9n+Pjn+4RoRCZ0KqRA/0ePFqcecxZ/hXCIVw=
+modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.17.3 h1:iE+coC5g17LtByDYDWKpR6m2Z9022YrSh3bumwOnIrI=
-modernc.org/sqlite v1.17.3/go.mod h1:10hPVYar9C0kfXuTWGz8s0XtB8uAGymUy51ZzStYe3k=
+modernc.org/sqlite v1.18.1 h1:ko32eKt3jf7eqIkCgPAeHMBXw3riNSLhl2f3loEF7o8=
+modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.2 h1:iFBDH6j1Z0bN/Q9udJnnFoFpENA4252qe/7/5woE5MI=
 modernc.org/strutil v1.1.2/go.mod h1:OYajnUAcI/MX+XD/Wx7v1bbdvcQSvxgtb0gC+u3d3eg=
 modernc.org/tcl v1.13.1 h1:npxzTwFTZYM8ghWicVIX1cRWzj7Nd8i6AqqX2p+IYao=
-modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
 modernc.org/token v1.0.0 h1:a0jaWiNMDhDUtqOj09wvjWWAqd3q7WpBulmL9H2egsk=
 modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.5.1 h1:RTNHdsrOpeoSeOF4FbzTo8gBYByaJ5xT7NgZ9ZqRiJM=
-modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=

mails/admin.go

@@ -3,12 +3,12 @@ package mails
 import (
 	"fmt"
 	"net/mail"
-	"strings"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails/templates"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/rest"
 )
 
 // SendAdminPasswordReset sends a password reset request email to the specified admin.
@@ -18,9 +18,9 @@ func SendAdminPasswordReset(app core.App, admin *models.Admin) error {
 		return tokenErr
 	}
 
-	actionUrl, urlErr := normalizeUrl(fmt.Sprintf(
-		"%s/#/confirm-password-reset/%s",
-		strings.TrimSuffix(app.Settings().Meta.AppUrl, "/"),
+	actionUrl, urlErr := rest.NormalizeUrl(fmt.Sprintf(
+		"%s/_/#/confirm-password-reset/%s",
+		app.Settings().Meta.AppUrl,
 		token,
 	))
 	if urlErr != nil {

mails/admin_test.go

@@ -27,7 +27,7 @@ func TestSendAdminPasswordReset(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		"http://localhost:8090/#/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+		"http://localhost:8090/_/#/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
 		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {

mails/base.go

@@ -4,34 +4,9 @@ package mails
 
 import (
 	"bytes"
-	"net/url"
-	"path"
-	"strings"
 	"text/template"
 )
 
-// normalizeUrl removes duplicated slashes from a url path.
-func normalizeUrl(originalUrl string) (string, error) {
-	u, err := url.Parse(originalUrl)
-	if err != nil {
-		return "", err
-	}
-
-	hasSlash := strings.HasSuffix(u.Path, "/")
-
-	// clean up path by removing duplicated /
-	u.Path = path.Clean(u.Path)
-	u.RawPath = path.Clean(u.RawPath)
-
-	// restore original trailing slash
-	if hasSlash && !strings.HasSuffix(u.Path, "/") {
-		u.Path += "/"
-		u.RawPath += "/"
-	}
-
-	return u.String(), nil
-}
-
 // resolveTemplateContent resolves inline html template strings.
 func resolveTemplateContent(data any, content ...string) (string, error) {
 	if len(content) == 0 {

mails/templates/admin_password_reset.go

@@ -17,7 +17,6 @@ const AdminPasswordResetBody = `
 
 	<p>
 		<a class="btn" href="{{.ActionUrl}}" target="_blank" rel="noopener">Reset password</a>
-		<a class="fallback-link" href="{{.ActionUrl}}" target="_blank" rel="noopener">{{.ActionUrl}}</a>
 	</p>
 
 	<p><i>If you did not request to reset your password, please ignore this email and the link will expire on its own.</i></p>

mails/templates/layout.go

@@ -50,12 +50,6 @@ const Layout = `
         .hidden {
             display: none !important;
         }
-        .fallback-link {
-            display: none !important;
-            word-break: break-all;
-            font-size: 11px;
-            color:  #666f75;
-        }
         .btn {
             display: inline-block;
             vertical-align: top;

mails/templates/user_confirm_email_change.go

@@ -1,26 +0,0 @@
-package templates
-
-// Available variables:
-//
-// ```
-// User      *models.User
-// AppName   string
-// AppUrl    string
-// Token     string
-// ActionUrl string
-// ```
-const UserConfirmEmailChangeBody = `
-{{define "content"}}
-	<p>Hello,</p>
-	<p>Click on the button below to confirm your new email address.</p>
-	<p>
-		<a class="btn" href="{{.ActionUrl}}" target="_blank" rel="noopener">Confirm new email</a>
-		<a class="fallback-link" href="{{.ActionUrl}}" target="_blank" rel="noopener">{{.ActionUrl}}</a>
-	</p>
-	<p><i>If you didn’t ask to change your email address, you can ignore this email.</i></p>
-	<p>
-		Thanks,<br/>
-		{{.AppName}} team
-	</p>
-{{end}}
-`

mails/templates/user_password_reset.go

@@ -1,26 +0,0 @@
-package templates
-
-// Available variables:
-//
-// ```
-// User      *models.User
-// AppName   string
-// AppUrl    string
-// Token     string
-// ActionUrl string
-// ```
-const UserPasswordResetBody = `
-{{define "content"}}
-	<p>Hello,</p>
-	<p>Click on the button below to reset your password.</p>
-	<p>
-		<a class="btn" href="{{.ActionUrl}}" target="_blank" rel="noopener">Reset password</a>
-		<a class="fallback-link" href="{{.ActionUrl}}" target="_blank" rel="noopener">{{.ActionUrl}}</a>
-	</p>
-	<p><i>If you didn’t ask to reset your password, you can ignore this email.</i></p>
-	<p>
-		Thanks,<br/>
-		{{.AppName}} team
-	</p>
-{{end}}
-`

mails/templates/user_verification.go

@@ -1,26 +0,0 @@
-package templates
-
-// Available variables:
-//
-// ```
-// User      *models.User
-// AppName   string
-// AppUrl    string
-// Token     string
-// ActionUrl string
-// ```
-const UserVerificationBody = `
-{{define "content"}}
-	<p>Hello,</p>
-	<p>Thank you for joining us at {{.AppName}}.</p>
-	<p>Click on the button below to verify your email address.</p>
-	<p>
-		<a class="btn" href="{{.ActionUrl}}" target="_blank" rel="noopener">Verify</a>
-		<a class="fallback-link" href="{{.ActionUrl}}" target="_blank" rel="noopener">{{.ActionUrl}}</a>
-	</p>
-	<p>
-		Thanks,<br/>
-		{{.AppName}} team
-	</p>
-{{end}}
-`

mails/user.go

@@ -1,8 +1,8 @@
 package mails
 
 import (
+	"html/template"
 	"net/mail"
-	"strings"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails/templates"
@@ -10,46 +10,6 @@ import (
 	"github.com/pocketbase/pocketbase/tokens"
 )
 
-func prepareUserEmailBody(
-	app core.App,
-	user *models.User,
-	token string,
-	actionUrl string,
-	bodyTemplate string,
-) (string, error) {
-	settings := app.Settings()
-
-	// replace action url placeholder params (if any)
-	actionUrlParams := map[string]string{
-		core.EmailPlaceholderAppUrl: settings.Meta.AppUrl,
-		core.EmailPlaceholderToken:  token,
-	}
-	for k, v := range actionUrlParams {
-		actionUrl = strings.ReplaceAll(actionUrl, k, v)
-	}
-	var urlErr error
-	actionUrl, urlErr = normalizeUrl(actionUrl)
-	if urlErr != nil {
-		return "", urlErr
-	}
-
-	params := struct {
-		AppName   string
-		AppUrl    string
-		User      *models.User
-		Token     string
-		ActionUrl string
-	}{
-		AppName:   settings.Meta.AppName,
-		AppUrl:    settings.Meta.AppUrl,
-		User:      user,
-		Token:     token,
-		ActionUrl: actionUrl,
-	}
-
-	return resolveTemplateContent(params, templates.Layout, bodyTemplate)
-}
-
 // SendUserPasswordReset sends a password reset request email to the specified user.
 func SendUserPasswordReset(app core.App, user *models.User) error {
 	token, tokenErr := tokens.NewUserResetPasswordToken(app, user)
@@ -66,24 +26,20 @@ func SendUserPasswordReset(app core.App, user *models.User) error {
 	}
 
 	sendErr := app.OnMailerBeforeUserResetPasswordSend().Trigger(event, func(e *core.MailerUserEvent) error {
-		body, err := prepareUserEmailBody(
-			app,
-			user,
-			token,
-			app.Settings().Meta.UserResetPasswordUrl,
-			templates.UserPasswordResetBody,
-		)
+		settings := app.Settings()
+
+		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.ResetPasswordTemplate)
 		if err != nil {
 			return err
 		}
 
 		return e.MailClient.Send(
 			mail.Address{
-				Name:    app.Settings().Meta.SenderName,
-				Address: app.Settings().Meta.SenderAddress,
+				Name:    settings.Meta.SenderName,
+				Address: settings.Meta.SenderAddress,
 			},
 			mail.Address{Address: e.User.Email},
-			("Reset your " + app.Settings().Meta.AppName + " password"),
+			subject,
 			body,
 			nil,
 		)
@@ -112,24 +68,20 @@ func SendUserVerification(app core.App, user *models.User) error {
 	}
 
 	sendErr := app.OnMailerBeforeUserVerificationSend().Trigger(event, func(e *core.MailerUserEvent) error {
-		body, err := prepareUserEmailBody(
-			app,
-			user,
-			token,
-			app.Settings().Meta.UserVerificationUrl,
-			templates.UserVerificationBody,
-		)
+		settings := app.Settings()
+
+		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.VerificationTemplate)
 		if err != nil {
 			return err
 		}
 
 		return e.MailClient.Send(
 			mail.Address{
-				Name:    app.Settings().Meta.SenderName,
-				Address: app.Settings().Meta.SenderAddress,
+				Name:    settings.Meta.SenderName,
+				Address: settings.Meta.SenderAddress,
 			},
 			mail.Address{Address: e.User.Email},
-			("Verify your " + app.Settings().Meta.AppName + " email"),
+			subject,
 			body,
 			nil,
 		)
@@ -161,24 +113,20 @@ func SendUserChangeEmail(app core.App, user *models.User, newEmail string) error
 	}
 
 	sendErr := app.OnMailerBeforeUserChangeEmailSend().Trigger(event, func(e *core.MailerUserEvent) error {
-		body, err := prepareUserEmailBody(
-			app,
-			user,
-			token,
-			app.Settings().Meta.UserConfirmEmailChangeUrl,
-			templates.UserConfirmEmailChangeBody,
-		)
+		settings := app.Settings()
+
+		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.ConfirmEmailChangeTemplate)
 		if err != nil {
 			return err
 		}
 
 		return e.MailClient.Send(
 			mail.Address{
-				Name:    app.Settings().Meta.SenderName,
-				Address: app.Settings().Meta.SenderAddress,
+				Name:    settings.Meta.SenderName,
+				Address: settings.Meta.SenderAddress,
 			},
 			mail.Address{Address: newEmail},
-			("Confirm your " + app.Settings().Meta.AppName + " new email address"),
+			subject,
 			body,
 			nil,
 		)
@@ -190,3 +138,30 @@ func SendUserChangeEmail(app core.App, user *models.User, newEmail string) error
 
 	return sendErr
 }
+
+func resolveEmailTemplate(
+	app core.App,
+	token string,
+	emailTemplate core.EmailTemplate,
+) (subject string, body string, err error) {
+	settings := app.Settings()
+
+	subject, rawBody, _ := emailTemplate.Resolve(
+		settings.Meta.AppName,
+		settings.Meta.AppUrl,
+		token,
+	)
+
+	params := struct {
+		HtmlContent template.HTML
+	}{
+		HtmlContent: template.HTML(rawBody),
+	}
+
+	body, err = resolveTemplateContent(params, templates.Layout, templates.HtmlBody)
+	if err != nil {
+		return "", "", err
+	}
+
+	return subject, body, nil
+}

mails/user_test.go

@@ -27,7 +27,7 @@ func TestSendUserPasswordReset(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		"http://localhost:8090/#/users/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+		"http://localhost:8090/_/#/users/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
 		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
@@ -52,7 +52,7 @@ func TestSendUserVerification(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		"http://localhost:8090/#/users/confirm-verification/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+		"http://localhost:8090/_/#/users/confirm-verification/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
 		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
@@ -77,7 +77,7 @@ func TestSendUserChangeEmail(t *testing.T) {
 	}
 
 	expectedParts := []string{
-		"http://localhost:8090/#/users/confirm-email-change/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+		"http://localhost:8090/_/#/users/confirm-email-change/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
 		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {

migrations/1640988000_init.go

@@ -96,6 +96,7 @@ func init() {
 			UpdateRule: &profileOwnerRule,
 			Schema: schema.NewSchema(
 				&schema.SchemaField{
+					Id:       "pbfielduser",
 					Name:     models.ProfileCollectionUserFieldName,
 					Type:     schema.FieldTypeUser,
 					Unique:   true,
@@ -107,11 +108,13 @@ func init() {
 					},
 				},
 				&schema.SchemaField{
+					Id:      "pbfieldname",
 					Name:    "name",
 					Type:    schema.FieldTypeText,
 					Options: &schema.TextOptions{},
 				},
 				&schema.SchemaField{
+					Id:   "pbfieldavatar",
 					Name: "avatar",
 					Type: schema.FieldTypeFile,
 					Options: &schema.FileOptions{
@@ -128,6 +131,8 @@ func init() {
 				},
 			),
 		}
+		collection.Id = "systemprofiles0"
+		collection.MarkAsNew()
 
 		return daos.New(db).SaveCollection(collection)
 	}, func(db dbx.Builder) error {

migrations/1661586591_add_externalAuths_table.go

@@ -0,0 +1,76 @@
+package migrations
+
+import "github.com/pocketbase/dbx"
+
+func init() {
+	AppMigrations.Register(func(db dbx.Builder) error {
+		_, createErr := db.NewQuery(`
+			CREATE TABLE {{_externalAuths}} (
+				[[id]]         TEXT PRIMARY KEY,
+				[[userId]]     TEXT NOT NULL,
+				[[provider]]   TEXT NOT NULL,
+				[[providerId]] TEXT NOT NULL,
+				[[created]]    TEXT DEFAULT "" NOT NULL,
+				[[updated]]    TEXT DEFAULT "" NOT NULL,
+				---
+				FOREIGN KEY ([[userId]]) REFERENCES {{_users}} ([[id]]) ON UPDATE CASCADE ON DELETE CASCADE
+			);
+
+			CREATE UNIQUE INDEX _externalAuths_userId_provider_idx on {{_externalAuths}} ([[userId]], [[provider]]);
+			CREATE UNIQUE INDEX _externalAuths_provider_providerId_idx on {{_externalAuths}} ([[provider]], [[providerId]]);
+		`).Execute()
+		if createErr != nil {
+			return createErr
+		}
+
+		// remove the unique email index from the _users table and
+		// replace it with partial index
+		_, alterErr := db.NewQuery(`
+			-- crate new users table
+			CREATE TABLE {{_newUsers}} (
+				[[id]]                     TEXT PRIMARY KEY,
+				[[verified]]               BOOLEAN DEFAULT FALSE NOT NULL,
+				[[email]]                  TEXT DEFAULT "" NOT NULL,
+				[[tokenKey]]               TEXT NOT NULL,
+				[[passwordHash]]           TEXT NOT NULL,
+				[[lastResetSentAt]]        TEXT DEFAULT "" NOT NULL,
+				[[lastVerificationSentAt]] TEXT DEFAULT "" NOT NULL,
+				[[created]]                TEXT DEFAULT "" NOT NULL,
+				[[updated]]                TEXT DEFAULT "" NOT NULL
+			);
+
+			-- copy all data from the old users table to the new one
+			INSERT INTO {{_newUsers}} SELECT * FROM {{_users}};
+
+			-- drop old table
+			DROP TABLE {{_users}};
+
+			-- rename new table
+			ALTER TABLE {{_newUsers}} RENAME TO {{_users}};
+
+			-- create named indexes
+			CREATE UNIQUE INDEX _users_email_idx ON {{_users}} ([[email]]) WHERE [[email]] != "";
+			CREATE UNIQUE INDEX _users_tokenKey_idx ON {{_users}} ([[tokenKey]]);
+		`).Execute()
+		if alterErr != nil {
+			return alterErr
+		}
+
+		return nil
+	}, func(db dbx.Builder) error {
+		if _, err := db.DropTable("_externalAuths").Execute(); err != nil {
+			return err
+		}
+
+		// drop the partial email unique index and replace it with normal unique index
+		_, indexErr := db.NewQuery(`
+			DROP INDEX IF EXISTS _users_email_idx;
+			CREATE UNIQUE INDEX _users_email_idx on {{_users}} ([[email]]);
+		`).Execute()
+		if indexErr != nil {
+			return indexErr
+		}
+
+		return nil
+	})
+}

migrations/logs/1660821103_add_user_ip_column.go

@@ -0,0 +1,57 @@
+package logs
+
+import (
+	"github.com/pocketbase/dbx"
+)
+
+func init() {
+	LogsMigrations.Register(func(db dbx.Builder) error {
+		// delete old index (don't check for error because of backward compatibility with old installations)
+		db.DropIndex("_requests", "_request_ip_idx").Execute()
+
+		// rename ip -> remoteIp
+		if _, err := db.RenameColumn("_requests", "ip", "remoteIp").Execute(); err != nil {
+			return err
+		}
+
+		// add new userIp column
+		if _, err := db.AddColumn("_requests", "userIp", `TEXT DEFAULT "127.0.0.1" NOT NULL`).Execute(); err != nil {
+			return err
+		}
+
+		// add new indexes
+		if _, err := db.CreateIndex("_requests", "_request_remote_ip_idx", "remoteIp").Execute(); err != nil {
+			return err
+		}
+		if _, err := db.CreateIndex("_requests", "_request_user_ip_idx", "userIp").Execute(); err != nil {
+			return err
+		}
+
+		return nil
+	}, func(db dbx.Builder) error {
+		// delete new indexes
+		if _, err := db.DropIndex("_requests", "_request_remote_ip_idx").Execute(); err != nil {
+			return err
+		}
+		if _, err := db.DropIndex("_requests", "_request_user_ip_idx").Execute(); err != nil {
+			return err
+		}
+
+		// drop userIp column
+		if _, err := db.DropColumn("_requests", "userIp").Execute(); err != nil {
+			return err
+		}
+
+		// restore original remoteIp column name
+		if _, err := db.RenameColumn("_requests", "remoteIp", "ip").Execute(); err != nil {
+			return err
+		}
+
+		// restore original index
+		if _, err := db.CreateIndex("_requests", "_request_ip_idx", "ip").Execute(); err != nil {
+			return err
+		}
+
+		return nil
+	})
+}

models/base.go

@@ -9,6 +9,14 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
+const (
+	// DefaultIdLength is the default length of the generated model id.
+	DefaultIdLength = 15
+
+	// DefaultIdAlphabet is the default characters set used for generating the model id.
+	DefaultIdAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
+)
+
 // ColumnValueMapper defines an interface for custom db model data serialization.
 type ColumnValueMapper interface {
 	// ColumnValueMap returns the data to be used when persisting the model.
@@ -24,8 +32,12 @@ type FilesManager interface {
 // Model defines an interface with common methods that all db models should have.
 type Model interface {
 	TableName() string
+	IsNew() bool
+	MarkAsNew()
+	UnmarkAsNew()
 	HasId() bool
 	GetId() string
+	SetId(id string)
 	GetCreated() types.DateTime
 	GetUpdated() types.DateTime
 	RefreshId()
@@ -39,45 +51,67 @@ type Model interface {
 
 // BaseModel defines common fields and methods used by all other models.
 type BaseModel struct {
+	isNewFlag bool
+
 	Id      string         `db:"id" json:"id"`
 	Created types.DateTime `db:"created" json:"created"`
 	Updated types.DateTime `db:"updated" json:"updated"`
 }
 
-// HasId returns whether the model has a nonzero primary key (aka. id).
+// HasId returns whether the model has a nonzero id.
 func (m *BaseModel) HasId() bool {
 	return m.GetId() != ""
 }
 
-// GetId returns the model's id.
+// GetId returns the model id.
 func (m *BaseModel) GetId() string {
 	return m.Id
 }
 
-// GetCreated returns the model's Created datetime.
+// SetId sets the model id to the provided string value.
+func (m *BaseModel) SetId(id string) {
+	m.Id = id
+}
+
+// MarkAsNew sets the model isNewFlag enforcing [m.IsNew()] to be true.
+func (m *BaseModel) MarkAsNew() {
+	m.isNewFlag = true
+}
+
+// UnmarkAsNew resets the model isNewFlag.
+func (m *BaseModel) UnmarkAsNew() {
+	m.isNewFlag = false
+}
+
+// IsNew indicates what type of db query (insert or update)
+// should be used with the model instance.
+func (m *BaseModel) IsNew() bool {
+	return m.isNewFlag || !m.HasId()
+}
+
+// GetCreated returns the model Created datetime.
 func (m *BaseModel) GetCreated() types.DateTime {
 	return m.Created
 }
 
-// GetUpdated returns the model's Updated datetime.
+// GetUpdated returns the model Updated datetime.
 func (m *BaseModel) GetUpdated() types.DateTime {
 	return m.Updated
 }
 
 // RefreshId generates and sets a new model id.
 //
-// The generated id is a cryptographically random 15 characters length string
-// (could change in the future).
+// The generated id is a cryptographically random 15 characters length string.
 func (m *BaseModel) RefreshId() {
-	m.Id = security.RandomString(15)
+	m.Id = security.RandomStringWithAlphabet(DefaultIdLength, DefaultIdAlphabet)
 }
 
-// RefreshCreated updates the model's Created field with the current datetime.
+// RefreshCreated updates the model Created field with the current datetime.
 func (m *BaseModel) RefreshCreated() {
 	m.Created = types.NowDateTime()
 }
 
-// RefreshUpdated updates the model's Updated field with the current datetime.
+// RefreshUpdated updates the model Updated field with the current datetime.
 func (m *BaseModel) RefreshUpdated() {
 	m.Updated = types.NowDateTime()
 }

models/base_test.go

@@ -34,25 +34,55 @@ func TestBaseModelHasId(t *testing.T) {
 	}
 }
 
-func TestBaseModelGetId(t *testing.T) {
-	m0 := models.BaseModel{}
-	if m0.GetId() != "" {
-		t.Fatalf("Expected zero id value, got %v", m0.GetId())
+func TestBaseModelId(t *testing.T) {
+	m := models.BaseModel{}
+
+	if m.GetId() != "" {
+		t.Fatalf("Expected empty id value, got %v", m.GetId())
 	}
 
-	id := "abc"
-	m1 := models.BaseModel{Id: id}
-	if m1.GetId() != id {
-		t.Fatalf("Expected id %v, got %v", id, m1.GetId())
+	m.SetId("test")
+
+	if m.GetId() != "test" {
+		t.Fatalf("Expected %q id, got %v", "test", m.GetId())
+	}
+
+	m.RefreshId()
+
+	if len(m.GetId()) != 15 {
+		t.Fatalf("Expected 15 chars id, got %v", m.GetId())
 	}
 }
 
-func TestBaseModelRefreshId(t *testing.T) {
-	m := models.BaseModel{}
-	m.RefreshId()
+func TestBaseModelIsNew(t *testing.T) {
+	m0 := models.BaseModel{}
+	m1 := models.BaseModel{Id: ""}
+	m2 := models.BaseModel{Id: "test"}
+	m3 := models.BaseModel{}
+	m3.MarkAsNew()
+	m4 := models.BaseModel{Id: "test"}
+	m4.MarkAsNew()
+	m5 := models.BaseModel{Id: "test"}
+	m5.MarkAsNew()
+	m5.UnmarkAsNew()
 
-	if m.GetId() == "" {
-		t.Fatalf("Expected nonempty id value, got %v", m.GetId())
+	scenarios := []struct {
+		model    models.BaseModel
+		expected bool
+	}{
+		{m0, true},
+		{m1, true},
+		{m2, false},
+		{m3, true},
+		{m4, true},
+		{m5, false},
+	}
+
+	for i, s := range scenarios {
+		result := s.model.IsNew()
+		if result != s.expected {
+			t.Errorf("(%d) Expected IsNew %v, got %v", i, s.expected, result)
+		}
 	}
 }
 

models/external_auth.go

@@ -0,0 +1,15 @@
+package models
+
+var _ Model = (*ExternalAuth)(nil)
+
+type ExternalAuth struct {
+	BaseModel
+
+	UserId     string `db:"userId" json:"userId"`
+	Provider   string `db:"provider" json:"provider"`
+	ProviderId string `db:"providerId" json:"providerId"`
+}
+
+func (m *ExternalAuth) TableName() string {
+	return "_externalAuths"
+}

models/external_auth_test.go

@@ -0,0 +1,14 @@
+package models_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func TestExternalAuthTableName(t *testing.T) {
+	m := models.ExternalAuth{}
+	if m.TableName() != "_externalAuths" {
+		t.Fatalf("Unexpected table name, got %q", m.TableName())
+	}
+}