updated go deps

Co-authored-by: alxjsn <alxjsn@sameorigin.org>

.github/FUNDING.yaml

@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-custom: ['https://www.paypal.com/donate/?hosted_button_id=4DVXNL4B8WT98']

.github/SECURITY.md

@@ -0,0 +1,5 @@
+# Security
+
+If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
+
+All reports will be promptly addressed, and you'll be credited accordingly.

.github/workflows/release.yaml

@@ -9,19 +9,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: latest
+          node-version: 20.11.0
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: '>=1.19.0'
+          go-version: '>=1.22.1'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.
@@ -29,6 +29,13 @@ jobs:
       - name: Build Admin dashboard UI
         run: npm --prefix=./ui ci && npm --prefix=./ui run build
 
+      # Temporary disable as the types can have random generated identifiers making it non-deterministic.
+      #
+      # # Similar to the above, the jsvm types are pregenerated locally
+      # # but its here to ensure that it wasn't forgotten to be executed.
+      # - name: Generate jsvm types
+      #   run: go run ./plugins/jsvm/internal/types/types.go
+
       # The prebuilt golangci-lint doesn't support go 1.18+ yet
       # https://github.com/golangci/golangci-lint/issues/2649
       # - name: Run linter
@@ -42,6 +49,6 @@ jobs:
         with:
           distribution: goreleaser
           version: latest
-          args: release --rm-dist
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -6,12 +6,13 @@
 # goreleaser builds folder
 /.builds/
 
-# examples app directories
-pb_data
-pb_public
-
 # tests coverage
 coverage.out
 
 # plaintask todo files
 *.todo
+
+# generated markdown previews
+README.html
+CHANGELOG.html
+LICENSE.html

.goreleaser.yaml

@@ -7,7 +7,21 @@ before:
     - go mod tidy
 
 builds:
-  - main: ./examples/base
+  # used only for tests
+  - id: build_cgo
+    main: ./examples/base
+    binary: pocketbase
+    ldflags:
+      - -s -w -X github.com/pocketbase/pocketbase.Version={{ .Version }}
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+
+  - id: build_noncgo
+    main: ./examples/base
     binary: pocketbase
     ldflags:
       - -s -w -X github.com/pocketbase/pocketbase.Version={{ .Version }}
@@ -33,10 +47,12 @@ release:
   draft: true
 
 archives:
-  - format: zip
+  - id: archive_noncgo
+    builds: [build_noncgo]
+    format: zip
     files:
-      - LICENSE*
-      - CHANGELOG*
+      - LICENSE.md
+      - CHANGELOG.md
 
 checksum:
   name_template: 'checksums.txt'

CHANGELOG.md

@@ -0,0 +1,974 @@
+## v0.22.6
+
+- Admin UI accessibility improvements:
+  - Fixed the dropdowns tab/enter/space keyboard navigation ([#4607](https://github.com/pocketbase/pocketbase/issues/4607)).
+  - Added `role`, `aria-label`, `aria-hidden` attributes to some of the elements in attempt to better assist screen readers.
+
+
+## v0.22.5
+
+- Minor test helpers fixes ([#4600](https://github.com/pocketbase/pocketbase/issues/4600)):
+  - Call the `OnTerminate` hook on `TestApp.Cleanup()`.
+  - Automatically run the DB migrations on initializing the test app with `tests.NewTestApp()`.
+
+- Added more elaborate warning message when restoring a backup explaining how the operation works.
+
+- Skip irregular files (symbolic links, sockets, etc.) when restoring a backup zip from the Admin UI or calling `archive.Extract(src, dst)` because they come with too many edge cases and ambiguities.
+  <details>
+    <summary><b><i>More details</i></b></summary>
+
+    This was initially reported as security issue (_thanks Harvey Spec_) but in the PocketBase context it is not something that can be exploited without an admin intervention and since the general expectations are that the PocketBase admins can do anything and they are the one who manage their server, this should be treated with the same diligence when using `scp`/`rsync`/`rclone`/etc. with untrusted file sources.
+
+    It is not possible (_or at least I'm not aware how to do that easily_) to perform virus/malicious content scanning on the uploaded backup archive files and some caution is always required when using the Admin UI or running shell commands, hence the backup-restore warning text.
+
+    **Or in other words, if someone sends you a file and tell you to upload it to your server (either as backup zip or manually via scp) obviously you shouldn't do that unless you really trust them.**
+
+    PocketBase is like any other regular application that you run on your server and there is no builtin "sandbox" for what the PocketBase process can execute. This is left to the developers to restrict on application or OS level depending on their needs. If you are self-hosting PocketBase you usually don't have to do that, but if you are offering PocketBase as a service and allow strangers to run their own PocketBase instances on your server then you'll need to implement the isolation mechanisms on your own.
+  </details>
+
+
+## v0.22.4
+
+- Removed conflicting styles causing the detailed codeblock log data preview to not visualize properly ([#4505](https://github.com/pocketbase/pocketbase/pull/4505)).
+
+- Minor JSVM improvements:
+  - Added `$filesystem.fileFromUrl(url, optSecTimeout)` helper.
+  - Implemented the `FormData` interface and added support for sending `multipart/form-data` requests with `$http.send()` ([#4544](https://github.com/pocketbase/pocketbase/discussions/4544)).
+
+
+## v0.22.3
+
+- Fixed the z-index of the current admin dropdown on Safari ([#4492](https://github.com/pocketbase/pocketbase/issues/4492)).
+
+- Fixed `OnAfterApiError` debug log `nil` error reference ([#4498](https://github.com/pocketbase/pocketbase/issues/4498)).
+
+- Added the field name as part of the `@request.data.someRelField.*` join to handle the case when a collection has 2 or more relation fields pointing to the same place ([#4500](https://github.com/pocketbase/pocketbase/issues/4500)).
+
+- Updated Go deps and bumped the min Go version in the GitHub release action to Go 1.22.1 since it comes with [some security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.22.1).
+
+
+## v0.22.2
+
+- Fixed a small regression introduced with v0.22.0 that was causing some missing unknown fields to always return an error instead of applying the specific `nullifyMisingField` resolver option to the query.
+
+
+## v0.22.1
+
+- Fixed Admin UI record and collection panels not reinitializing properly on browser back/forward navigation ([#4462](https://github.com/pocketbase/pocketbase/issues/4462)).
+
+- Initialize `RecordAuthWithOAuth2Event.IsNewRecord` for the `OnRecordBeforeAuthWithOAuth2Request` hook ([#4437](https://github.com/pocketbase/pocketbase/discussions/4437)).
+
+- Added error checks to the autogenerated Go migrations ([#4448](https://github.com/pocketbase/pocketbase/issues/4448)).
+
+
+## v0.22.0
+
+- Added Planning Center OAuth2 provider ([#4393](https://github.com/pocketbase/pocketbase/pull/4393); thanks @alxjsn).
+
+- Admin UI improvements:
+  - Autosync collection changes across multiple open browser tabs.
+  - Fixed vertical image popup preview scrolling.
+  - Added options to export a subset of collections.
+  - Added option to import a subset of collections without deleting the others ([#3403](https://github.com/pocketbase/pocketbase/issues/3403)).
+
+- Added support for back/indirect relation `filter`/`sort` (single and multiple).
+  The syntax to reference back relation fields is `yourCollection_via_yourRelField.*`.
+  ⚠️ To avoid excessive joins, the nested relations resolver is now limited to max 6 level depth (the same as `expand`).
+  _Note that in the future there will be also more advanced and granular options to specify a subset of the fields that are filterable/sortable._
+
+- Added support for multiple back/indirect relation `expand` and updated the keys to use the `_via_` reference syntax (`yourCollection_via_yourRelField`).
+  _To minimize the breaking changes, the old parenthesis reference syntax (`yourCollection(yourRelField)`) will still continue to work but it is soft-deprecated and there will be a console log reminding you to change it to the new one._
+
+- ⚠️ Collections and fields are no longer allowed to have `_via_` in their name to avoid collisions with the back/indirect relation reference syntax.
+
+- Added `jsvm.Config.OnInit` optional config function to allow registering custom Go bindings to the JSVM.
+
+- Added `@request.context` rule field that can be used to apply a different set of constraints based on the API rule execution context.
+  For example, to disallow user creation by an OAuth2 auth, you could set for the users Create API rule `@request.context != "oauth2"`.
+  The currently supported `@request.context` values are:
+  ```
+  default
+  realtime
+  protectedFile
+  oauth2
+  ```
+
+- Adjusted the `cron.Start()` to start the ticker at the `00` second of the cron interval ([#4394](https://github.com/pocketbase/pocketbase/discussions/4394)).
+  _Note that the cron format has only minute granularity and there is still no guarantee that the scheduled job will be always executed at the `00` second._
+
+- Fixed auto backups cron not reloading properly after app settings change ([#4431](https://github.com/pocketbase/pocketbase/discussions/4431)).
+
+- Upgraded to `aws-sdk-go-v2` and added special handling for GCS to workaround the previous [GCS headers signature issue](https://github.com/pocketbase/pocketbase/issues/2231) that we had with v2.
+  _This should also fix the SVG/JSON zero response when using Cloudflare R2 ([#4287](https://github.com/pocketbase/pocketbase/issues/4287#issuecomment-1925168142), [#2068](https://github.com/pocketbase/pocketbase/discussions/2068), [#2952](https://github.com/pocketbase/pocketbase/discussions/2952))._
+  _⚠️ If you are using S3 for uploaded files or backups, please verify that you have a green check in the Admin UI for your S3 configuration (I've tested the new version with GCS, MinIO, Cloudflare R2 and Wasabi)._
+
+- Added `:each` modifier support for `file` and `relation` type fields (_previously it was supported only for `select` type fields_).
+
+- Other minor improvements (updated the `ghupdate` plugin to use the configured executable name when printing to the console, fixed the error reporting of `admin update/delete` commands, etc.).
+
+
+## v0.21.3
+
+- Ignore the JS required validations for disabled OIDC providers ([#4322](https://github.com/pocketbase/pocketbase/issues/4322)).
+
+- Allow `HEAD` requests to the `/api/health` endpoint ([#4310](https://github.com/pocketbase/pocketbase/issues/4310)).
+
+- Fixed the `editor` field value when visualized inside the View collection preview panel.
+
+- Manually clear all TinyMCE events on editor removal (_workaround for [tinymce#9377](https://github.com/tinymce/tinymce/issues/9377)_).
+
+
+## v0.21.2
+
+- Fixed `@request.auth.*` initialization side-effect which caused the current authenticated user email to not being returned in the user auth response ([#2173](https://github.com/pocketbase/pocketbase/issues/2173#issuecomment-1932332038)).
+  _The current authenticated user email should be accessible always no matter of the `emailVisibility` state._
+
+- Fixed `RecordUpsert.RemoveFiles` godoc example.
+
+- Bumped to `NumCPU()+2` the `thumbGenSem` limit as some users reported that it was too restrictive.
+
+
+## v0.21.1
+
+- Small fix for the Admin UI related to the _Settings > Sync_ menu not being visible even when the "Hide controls" toggle is off.
+
+
+## v0.21.0
+
+- Added Bitbucket OAuth2 provider ([#3948](https://github.com/pocketbase/pocketbase/pull/3948); thanks @aabajyan).
+
+- Mark user as verified on confirm password reset ([#4066](https://github.com/pocketbase/pocketbase/issues/4066)).
+  _If the user email has changed after issuing the reset token (eg. updated by an admin), then the `verified` user state remains unchanged._
+
+- Added support for loading a serialized json payload for `multipart/form-data` requests using the special `@jsonPayload` key.
+  _This is intended to be used primarily by the SDKs to resolve [js-sdk#274](https://github.com/pocketbase/js-sdk/issues/274)._
+
+- Added graceful OAuth2 redirect error handling ([#4177](https://github.com/pocketbase/pocketbase/issues/4177)).
+  _Previously on redirect error we were returning directly a standard json error response. Now on redirect error we'll redirect to a generic OAuth2 failure screen (similar to the success one) and will attempt to auto close the OAuth2 popup._
+  _The SDKs are also updated to handle the OAuth2 redirect error and it will be returned as Promise rejection of the `authWithOAuth2()` call._
+
+- Exposed `$apis.gzip()` and `$apis.bodyLimit(bytes)` middlewares to the JSVM.
+
+- Added `TestMailer.SentMessages` field that holds all sent test app emails until cleanup.
+
+- Optimized the cascade delete of records with multiple `relation` fields.
+
+- Updated the `serve` and `admin` commands error reporting.
+
+- Minor Admin UI improvements (reduced the min table row height, added option to duplicate fields, added new TinyMCE codesample plugin languages, hide the collection sync settings when the `Settings.Meta.HideControls` is enabled, etc.)
+
+
+## v0.20.7
+
+- Fixed the Admin UI auto indexes update when renaming fields with a common prefix ([#4160](https://github.com/pocketbase/pocketbase/issues/4160)).
+
+
+## v0.20.6
+
+- Fixed JSVM types generation for functions with omitted arg types ([#4145](https://github.com/pocketbase/pocketbase/issues/4145)).
+
+- Updated Go deps.
+
+
+## v0.20.5
+
+- Minor CSS fix for the Admin UI to prevent the searchbar within a popup from expanding too much and pushing the controls out of the visible area ([#4079](https://github.com/pocketbase/pocketbase/issues/4079#issuecomment-1876994116)).
+
+
+## v0.20.4
+
+- Small fix for a regression introduced with the recent `json` field changes that was causing View collection column expressions recognized as `json` to fail to resolve ([#4072](https://github.com/pocketbase/pocketbase/issues/4072)).
+
+
+## v0.20.3
+
+- Fixed the `json` field query comparisons to work correctly with plain JSON values like `null`, `bool` `number`, etc. ([#4068](https://github.com/pocketbase/pocketbase/issues/4068)).
+  Since there are plans in the future to allow custom SQLite builds and also in some situations it may be useful to be able to distinguish `NULL` from `''`,
+  for the `json` fields (and for any other future non-standard field) we no longer apply `COALESCE` by default, aka.:
+  ```
+  Dataset:
+  1) data: json(null)
+  2) data: json('')
+
+  For the filter "data = null" only 1) will resolve to TRUE.
+  For the filter "data = ''"   only 2) will resolve to TRUE.
+  ```
+
+- Minor Go tests improvements
+  - Sorted the record cascade delete references to ensure that the delete operation will preserve the order of the fired events when running the tests.
+  - Marked some of the tests as safe for parallel execution to speed up a little the GitHub action build times.
+
+
+## v0.20.2
+
+- Added `sleep(milliseconds)` JSVM binding.
+  _It works the same way as Go `time.Sleep()`, aka. it pauses the goroutine where the JSVM code is running._
+
+- Fixed multi-line text paste in the Admin UI search bar ([#4022](https://github.com/pocketbase/pocketbase/discussions/4022)).
+
+- Fixed the monospace font loading in the Admin UI.
+
+- Fixed various reported docs and code comment typos.
+
+
+## v0.20.1
+
+- Added `--dev` flag and its accompanying `app.IsDev()` method (_in place of the previously removed `--debug`_) to assist during development ([#3918](https://github.com/pocketbase/pocketbase/discussions/3918)).
+  The `--dev` flag prints in the console "everything" and more specifically:
+  - the data DB SQL statements
+  - all `app.Logger().*` logs (debug, info, warning, error, etc.), no matter of the logs persistence settings in the Admin UI
+
+- Minor Admin UI fixes:
+  - Fixed the log `error` label text wrapping.
+  - Added the log `referer` (_when it is from a different source_) and `details` labels in the logs listing.
+  - Removed the blank current time entry from the logs chart because it was causing confusion when used with custom time ranges.
+  - Updated the SQL syntax highlighter and keywords autocompletion in the Admin UI to recognize `CAST(x as bool)` expressions.
+
+- Replaced the default API tests timeout with a new `ApiScenario.Timeout` option ([#3930](https://github.com/pocketbase/pocketbase/issues/3930)).
+  A negative or zero value means no tests timeout.
+  If a single API test takes more than 3s to complete it will have a log message visible when the test fails or when `go test -v` flag is used.
+
+- Added timestamp at the beginning of the generated JSVM types file to avoid creating it everytime with the app startup.
+
+
+## v0.20.0
+
+- Added `expand`, `filter`, `fields`, custom query and headers parameters support for the realtime subscriptions.
+    _Requires JS SDK v0.20.0+ or Dart SDK v0.17.0+._
+
+    ```js
+    // JS SDK v0.20.0
+    pb.collection("example").subscribe("*", (e) => {
+      ...
+    }, {
+      expand: "someRelField",
+      filter: "status = 'active'",
+      fields: "id,expand.someRelField.*:excerpt(100)",
+    })
+    ```
+
+    ```dart
+    // Dart SDK v0.17.0
+    pb.collection("example").subscribe("*", (e) {
+        ...
+      },
+      expand: "someRelField",
+      filter: "status = 'active'",
+      fields: "id,expand.someRelField.*:excerpt(100)",
+    )
+    ```
+
+- Generalized the logs to allow any kind of application logs, not just requests.
+
+    The new `app.Logger()` implements the standard [`log/slog` interfaces](https://pkg.go.dev/log/slog) available with Go 1.21.
+    ```
+    // Go: https://pocketbase.io/docs/go-logging/
+    app.Logger().Info("Example message", "total", 123, "details", "lorem ipsum...")
+
+    // JS: https://pocketbase.io/docs/js-logging/
+    $app.logger().info("Example message", "total", 123, "details", "lorem ipsum...")
+    ```
+
+    For better performance and to minimize blocking on hot paths, logs are currently written with
+    debounce and on batches:
+    - 3 seconds after the last debounced log write
+    - when the batch threshold is reached (currently 200)
+    - right before app termination to attempt saving everything from the existing logs queue
+
+    Some notable log related changes:
+
+    - ⚠️ Bumped the minimum required Go version to 1.21.
+
+    - ⚠️ Removed `_requests` table in favor of the generalized `_logs`.
+      _Note that existing logs will be deleted!_
+
+    - ⚠️ Renamed the following `Dao` log methods:
+      ```go
+      Dao.RequestQuery(...)      -> Dao.LogQuery(...)
+      Dao.FindRequestById(...)   -> Dao.FindLogById(...)
+      Dao.RequestsStats(...)     -> Dao.LogsStats(...)
+      Dao.DeleteOldRequests(...) -> Dao.DeleteOldLogs(...)
+      Dao.SaveRequest(...)       -> Dao.SaveLog(...)
+      ```
+    - ⚠️ Removed `app.IsDebug()` and the `--debug` flag.
+      This was done to avoid the confusion with the new logger and its debug severity level.
+      If you want to store debug logs you can set `-4` as min log level from the Admin UI.
+
+    - Refactored Admin UI Logs:
+      - Added new logs table listing.
+      - Added log settings option to toggle the IP logging for the activity logger.
+      - Added log settings option to specify a minimum log level.
+      - Added controls to export individual or bulk selected logs as json.
+      - Other minor improvements and fixes.
+
+- Added new `filesystem/System.Copy(src, dest)` method to copy existing files from one location to another.
+  _This is usually useful when duplicating records with `file` field(s) programmatically._
+
+- Added `filesystem.NewFileFromUrl(ctx, url)` helper method to construct a `*filesystem.BytesReader` file from the specified url.
+
+- OAuth2 related additions:
+
+    - Added new `PKCE()` and `SetPKCE(enable)` OAuth2 methods to indicate whether the PKCE flow is supported or not.
+      _The PKCE value is currently configurable from the UI only for the OIDC providers._
+      _This was added to accommodate OIDC providers that may throw an error if unsupported PKCE params are submitted with the auth request (eg. LinkedIn; see [#3799](https://github.com/pocketbase/pocketbase/discussions/3799#discussioncomment-7640312))._
+
+    - Added new `displayName` field for each `listAuthMethods()` OAuth2 provider item.
+      _The value of the `displayName` property is currently configurable from the UI only for the OIDC providers._
+
+    - Added `expiry` field to the OAuth2 user response containing the _optional_ expiration time of the OAuth2 access token ([#3617](https://github.com/pocketbase/pocketbase/discussions/3617)).
+
+    - Allow a single OAuth2 user to be used for authentication in multiple auth collection.
+      _⚠️ Because now you can have more than one external provider with `collectionId-provider-providerId` pair, `Dao.FindExternalAuthByProvider(provider, providerId)` method was removed in favour of the more generic `Dao.FindFirstExternalAuthByExpr(expr)`._
+
+- Added `onlyVerified` auth collection option to globally disallow authentication requests for unverified users.
+
+- Added support for single line comments (ex. `// your comment`) in the API rules and filter expressions.
+
+- Added support for specifying a collection alias in `@collection.someCollection:alias.*`.
+
+- Soft-deprecated and renamed `app.Cache()` with `app.Store()`.
+
+- Minor JSVM updates and fixes:
+
+    - Updated `$security.parseUnverifiedJWT(token)` and `$security.parseJWT(token, key)` to return the token payload result as plain object.
+
+    - Added `$apis.requireGuestOnly()` middleware JSVM binding ([#3896](https://github.com/pocketbase/pocketbase/issues/3896)).
+
+- Use `IS NOT` instead of `!=` as not-equal SQL query operator to handle the cases when comparing with nullable columns or expressions (eg. `json_extract` over `json` field).
+  _Based on my local dataset I wasn't able to find a significant difference in the performance between the 2 operators, but if you stumble on a query that you think may be affected negatively by this, please report it and I'll test it further._
+
+- Added `MaxSize` `json` field option to prevent storing large json data in the db ([#3790](https://github.com/pocketbase/pocketbase/issues/3790)).
+  _Existing `json` fields are updated with a system migration to have a ~2MB size limit (it can be adjusted from the Admin UI)._
+
+- Fixed negative string number normalization support for the `json` field type.
+
+- Trigger the `app.OnTerminate()` hook on `app.Restart()` call.
+  _A new bool `IsRestart` field was also added to the `core.TerminateEvent` event._
+
+- Fixed graceful shutdown handling and speed up a little the app termination time.
+
+- Limit the concurrent thumbs generation to avoid high CPU and memory usage in spiky scenarios ([#3794](https://github.com/pocketbase/pocketbase/pull/3794); thanks @t-muehlberger).
+  _Currently the max concurrent thumbs generation processes are limited to "total of logical process CPUs + 1"._
+  _This is arbitrary chosen and may change in the future depending on the users feedback and usage patterns._
+  _If you are experiencing OOM errors during large image thumb generations, especially in container environment, you can try defining the `GOMEMLIMIT=500MiB` env variable before starting the executable._
+
+- Slightly speed up (~10%) the thumbs generation by changing from cubic (`CatmullRom`) to bilinear (`Linear`) resampling filter (_the quality difference is very little_).
+
+- Added a default red colored Stderr output in case of a console command error.
+  _You can now also silence individually custom commands errors using the `cobra.Command.SilenceErrors` field._
+
+- Fixed links formatting in the autogenerated html->text mail body.
+
+- Removed incorrectly imported empty `local('')` font-face declarations.
+
+
+## v0.19.4
+
+- Fixed TinyMCE source code viewer textarea styles ([#3715](https://github.com/pocketbase/pocketbase/issues/3715)).
+
+- Fixed `text` field min/max validators to properly count multi-byte characters ([#3735](https://github.com/pocketbase/pocketbase/issues/3735)).
+
+- Allowed hyphens in `username` ([#3697](https://github.com/pocketbase/pocketbase/issues/3697)).
+  _More control over the system fields settings will be available in the future._
+
+- Updated the JSVM generated types to use directly the value type instead of `* | undefined` union in functions/methods return declarations.
+
+
+## v0.19.3
+
+- Added the release notes to the console output of `./pocketbase update` ([#3685](https://github.com/pocketbase/pocketbase/discussions/3685)).
+
+- Added missing documentation for the JSVM `$mails.*` bindings.
+
+- Relaxed the OAuth2 redirect url validation to allow any string value ([#3689](https://github.com/pocketbase/pocketbase/pull/3689); thanks @sergeypdev).
+  _Note that the redirect url format is still bound to the accepted values by the specific OAuth2 provider._
+
+
+## v0.19.2
+
+- Updated the JSVM generated types ([#3627](https://github.com/pocketbase/pocketbase/issues/3627), [#3662](https://github.com/pocketbase/pocketbase/issues/3662)).
+
+
+## v0.19.1
+
+- Fixed `tokenizer.Scan()/ScanAll()` to ignore the separators from the default trim cutset.
+  An option to return also the empty found tokens was also added via `Tokenizer.KeepEmptyTokens(true)`.
+  _This should fix the parsing of whitespace characters around view query column names when no quotes are used ([#3616](https://github.com/pocketbase/pocketbase/discussions/3616#discussioncomment-7398564))._
+
+- Fixed the `:excerpt(max, withEllipsis?)` `fields` query param modifier to properly add space to the generated text fragment after block tags.
+
+
+## v0.19.0
+
+- Added Patreon OAuth2 provider ([#3323](https://github.com/pocketbase/pocketbase/pull/3323); thanks @ghostdevv).
+
+- Added mailcow OAuth2 provider ([#3364](https://github.com/pocketbase/pocketbase/pull/3364); thanks @thisni1s).
+
+- Added support for `:excerpt(max, withEllipsis?)` `fields` modifier that will return a short plain text version of any string value (html tags are stripped).
+    This could be used to minimize the downloaded json data when listing records with large `editor` html values.
+    ```js
+    await pb.collection("example").getList(1, 20, {
+      "fields": "*,description:excerpt(100)"
+    })
+    ```
+
+- Several Admin UI improvements:
+  - Count the total records separately to speed up the query execution for large datasets ([#3344](https://github.com/pocketbase/pocketbase/issues/3344)).
+  - Enclosed the listing scrolling area within the table so that the horizontal scrollbar and table header are always reachable ([#2505](https://github.com/pocketbase/pocketbase/issues/2505)).
+  - Allowed opening the record preview/update form via direct URL ([#2682](https://github.com/pocketbase/pocketbase/discussions/2682)).
+  - Reintroduced the local `date` field tooltip on hover.
+  - Speed up the listing loading times for records with large `editor` field values by initially fetching only a partial of the records data (the complete record data is loaded on record preview/update).
+  - Added "Media library" (collection images picker) support for the TinyMCE `editor` field.
+  - Added support to "pin" collections in the sidebar.
+  - Added support to manually resize the collections sidebar.
+  - More clear "Nonempty" field label style.
+  - Removed the legacy `.woff` and `.ttf` fonts and keep only `.woff2`.
+
+- Removed the explicit `Content-Type` charset from the realtime response due to compatibility issues with IIS ([#3461](https://github.com/pocketbase/pocketbase/issues/3461)).
+  _The `Connection:keep-alive` realtime response header was also removed as it is not really used with HTTP2 anyway._
+
+- Added new JSVM bindings:
+  - `new Cookie({ ... })` constructor for creating `*http.Cookie` equivalent value.
+  - `new SubscriptionMessage({ ... })` constructor for creating a custom realtime subscription payload.
+  - Soft-deprecated `$os.exec()` in favour of `$os.cmd()` to make it more clear that the call only prepares the command and doesn't execute it.
+
+- ⚠️ Bumped the min required Go version to 1.19.
+
+
+## v0.18.10
+
+- Added global `raw` template function to allow outputting raw/verbatim HTML content in the JSVM templates ([#3476](https://github.com/pocketbase/pocketbase/discussions/3476)).
+  ```
+  {{.description|raw}}
+  ```
+
+- Trimmed view query semicolon and allowed single quotes for column aliases ([#3450](https://github.com/pocketbase/pocketbase/issues/3450#issuecomment-1748044641)).
+  _Single quotes are usually [not a valid identifier quote characters](https://www.sqlite.org/lang_keywords.html), but for resilience and compatibility reasons SQLite allows them in some contexts where only an identifier is expected._
+
+- Bumped the GitHub action to use [min Go 1.21.2](https://github.com/golang/go/issues?q=milestone%3AGo1.21.2) (_the fixed issues are not critical as they are mostly related to the compiler/build tools_).
+
+
+## v0.18.9
+
+- Fixed empty thumbs directories not getting deleted on Windows after deleting a record img file ([#3382](https://github.com/pocketbase/pocketbase/issues/3382)).
+
+- Updated the generated JSVM typings to silent the TS warnings when trying to access a field/method in a Go->TS interface.
+
+
+## v0.18.8
+
+- Minor fix for the View collections API Preview and Admin UI listings incorrectly showing the `created` and `updated` fields as `N/A` when the view query doesn't have them.
+
+
+## v0.18.7
+
+- Fixed JS error in the Admin UI when listing records with invalid `relation` field value ([#3372](https://github.com/pocketbase/pocketbase/issues/3372)).
+  _This could happen usually only during custom SQL import scripts or when directly modifying the record field value without data validations._
+
+- Updated Go deps and the generated JSVM types.
+
+
+## v0.18.6
+
+- Return the response headers and cookies in the `$http.send()` result ([#3310](https://github.com/pocketbase/pocketbase/discussions/3310)).
+
+- Added more descriptive internal error message for missing user/admin email on password reset requests.
+
+- Updated Go deps.
+
+
+## v0.18.5
+
+- Fixed minor Admin UI JS error in the auth collection options panel introduced with the change from v0.18.4.
+
+
+## v0.18.4
+
+- Added escape character (`\`) support in the Admin UI to allow using `select` field values with comma ([#2197](https://github.com/pocketbase/pocketbase/discussions/2197)).
+
+
+## v0.18.3
+
+- Exposed a global JSVM `readerToString(reader)` helper function to allow reading Go `io.Reader` values ([#3273](https://github.com/pocketbase/pocketbase/discussions/3273)).
+
+- Bumped the GitHub action to use [min Go 1.21.1](https://github.com/golang/go/issues?q=milestone%3AGo1.21.1+label%3ACherryPickApproved) for the prebuilt executable since it contains some minor `html/template` and `net/http` security fixes.
+
+
+## v0.18.2
+
+- Prevent breaking the record form in the Admin UI in case the browser's localStorage quota has been exceeded when uploading or storing large `editor` values ([#3265](https://github.com/pocketbase/pocketbase/issues/3265)).
+
+- Updated docs and missing JSVM typings.
+
+- Exposed additional crypto primitives under the `$security.*` JSVM namespace ([#3273](https://github.com/pocketbase/pocketbase/discussions/3273)):
+  ```js
+  // HMAC with SHA256
+  $security.hs256("hello", "secret")
+
+  // HMAC with SHA512
+  $security.hs512("hello", "secret")
+
+  // compare 2 strings with a constant time
+  $security.equal(hash1, hash2)
+  ```
+
+
+## v0.18.1
+
+- Excluded the local temp dir from the backups ([#3261](https://github.com/pocketbase/pocketbase/issues/3261)).
+
+
+## v0.18.0
+
+- Simplified the `serve` command to accept domain name(s) as argument to reduce any additional manual hosts setup that sometimes previously was needed when deploying on production ([#3190](https://github.com/pocketbase/pocketbase/discussions/3190)).
+  ```sh
+  ./pocketbase serve yourdomain.com
+  ```
+
+- Added `fields` wildcard (`*`) support.
+
+- Added option to upload a backup file from the Admin UI ([#2599](https://github.com/pocketbase/pocketbase/issues/2599)).
+
+- Registered a custom Deflate compressor to speedup (_nearly 2-3x_) the backups generation for the sake of a small zip size increase.
+  _Based on several local tests, `pb_data` of ~500MB (from which ~350MB+ are several hundred small files) results in a ~280MB zip generated for ~11s (previously it resulted in ~250MB zip but for ~35s)._
+
+- Added the application name as part of the autogenerated backup name for easier identification ([#3066](https://github.com/pocketbase/pocketbase/issues/3066)).
+
+- Added new `SmtpConfig.LocalName` option to specify a custom domain name (or IP address) for the initial EHLO/HELO exchange ([#3097](https://github.com/pocketbase/pocketbase/discussions/3097)).
+  _This is usually required for verification purposes only by some SMTP providers, such as on-premise [Gmail SMTP-relay](https://support.google.com/a/answer/2956491)._
+
+- Added `NoDecimal` `number` field option.
+
+- `editor` field improvements:
+    - Added new "Strip urls domain" option to allow controlling the default TinyMCE urls behavior (_default to `false` for new content_).
+    - Normalized pasted text while still preserving links, lists, tables, etc. formatting ([#3257](https://github.com/pocketbase/pocketbase/issues/3257)).
+
+- Added option to auto generate admin and auth record passwords from the Admin UI.
+
+- Added JSON validation and syntax highlight for the `json` field in the Admin UI ([#3191](https://github.com/pocketbase/pocketbase/issues/3191)).
+
+- Added datetime filter macros:
+  ```
+  // all macros are UTC based
+  @second     - @now second number (0-59)
+  @minute     - @now minute number (0-59)
+  @hour       - @now hour number (0-23)
+  @weekday    - @now weekday number (0-6)
+  @day        - @now day number
+  @month      - @now month number
+  @year       - @now year number
+  @todayStart - beginning of the current day as datetime string
+  @todayEnd   - end of the current day as datetime string
+  @monthStart - beginning of the current month as datetime string
+  @monthEnd   - end of the current month as datetime string
+  @yearStart  - beginning of the current year as datetime string
+  @yearEnd    - end of the current year as datetime string
+  ```
+
+- Added cron expression macros ([#3132](https://github.com/pocketbase/pocketbase/issues/3132)):
+  ```
+  @yearly   - "0 0 1 1 *"
+  @annually - "0 0 1 1 *"
+  @monthly  - "0 0 1 * *"
+  @weekly   - "0 0 * * 0"
+  @daily    - "0 0 * * *"
+  @midnight - "0 0 * * *"
+  @hourly   - "0 * * * *"
+  ```
+
+- ⚠️ Added offset argument `Dao.FindRecordsByFilter(collection, filter, sort, limit, offset, [params...])`.
+  _If you don't need an offset, you can set it to `0`._
+
+- To minimize the footguns with `Dao.FindFirstRecordByFilter()` and `Dao.FindRecordsByFilter()`, the functions now supports an optional placeholder params argument that is safe to be populated with untrusted user input.
+  The placeholders are in the same format as when binding regular SQL parameters.
+  ```go
+  // unsanitized and untrusted filter variables
+  status := "..."
+  author := "..."
+
+  app.Dao().FindFirstRecordByFilter("articles", "status={:status} && author={:author}", dbx.Params{
+    "status": status,
+    "author": author,
+  })
+
+  app.Dao().FindRecordsByFilter("articles", "status={:status} && author={:author}", "-created", 10, 0, dbx.Params{
+    "status": status,
+    "author": author,
+  })
+  ```
+
+- Added JSVM `$mails.*` binds for the corresponding Go [mails package](https://pkg.go.dev/github.com/pocketbase/pocketbase/mails) functions.
+
+- Added JSVM helper crypto primitives under the `$security.*` namespace:
+  ```js
+  $security.md5(text)
+  $security.sha256(text)
+  $security.sha512(text)
+  ```
+
+- ⚠️ Deprecated `RelationOptions.DisplayFields` in favor of the new `SchemaField.Presentable` option to avoid the duplication when a single collection is referenced more than once and/or by multiple other collections.
+
+- ⚠️ Fill the `LastVerificationSentAt` and `LastResetSentAt` fields only after a successfull email send ([#3121](https://github.com/pocketbase/pocketbase/issues/3121)).
+
+- ⚠️ Skip API `fields` json transformations for non 20x responses ([#3176](https://github.com/pocketbase/pocketbase/issues/3176)).
+
+- ⚠️ Changes to `tests.ApiScenario` struct:
+
+    - The `ApiScenario.AfterTestFunc` now receive as 3rd argument `*http.Response` pointer instead of `*echo.Echo` as the latter is not really useful in this context.
+      ```go
+      // old
+      AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo)
+
+      // new
+      AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response)
+      ```
+
+    - The `ApiScenario.TestAppFactory` now accept the test instance as argument and no longer expect an error as return result ([#3025](https://github.com/pocketbase/pocketbase/discussions/3025#discussioncomment-6592272)).
+      ```go
+      // old
+      TestAppFactory: func() (*tests.TestApp, error)
+
+      // new
+      TestAppFactory: func(t *testing.T) *tests.TestApp
+      ```
+      _Returning a `nil` app instance from the factory results in test failure. You can enforce a custom test failure by calling `t.Fatal(err)` inside the factory._
+
+- Bumped the min required TLS version to 1.2 in order to improve the cert reputation score.
+
+- Reduced the default JSVM prewarmed pool size to 25 to reduce the initial memory consumptions (_you can manually adjust the pool size with `--hooksPool=50` if you need to, but the default should suffice for most cases_).
+
+- Update `gocloud.dev` dependency to v0.34 and explicitly set the new `NoTempDir` fileblob option to prevent the cross-device link error introduced with v0.33.
+
+- Other minor Admin UI and docs improvements.
+
+
+## v0.17.7
+
+- Fixed the autogenerated `down` migrations to properly revert the old collection rules in case a change was made in `up` ([#3192](https://github.com/pocketbase/pocketbase/pull/3192); thanks @impact-merlinmarek).
+  _Existing `down` migrations can't be fixed but that should be ok as usually the `down` migrations are rarely used against prod environments since they can cause data loss and, while not ideal, the previous old behavior of always setting the rules to `null/nil` is safer than not updating the rules at all._
+
+- Updated some Go deps.
+
+
+## v0.17.6
+
+- Fixed JSVM `require()` file path error when using Windows-style path delimiters ([#3163](https://github.com/pocketbase/pocketbase/issues/3163#issuecomment-1685034438)).
+
+
+## v0.17.5
+
+- Added quotes around the wrapped view query columns introduced with v0.17.4.
+
+
+## v0.17.4
+
+- Fixed Views record retrieval when numeric id is used ([#3110](https://github.com/pocketbase/pocketbase/issues/3110)).
+  _With this fix we also now properly recognize `CAST(... as TEXT)` and `CAST(... as BOOLEAN)` as `text` and `bool` fields._
+
+- Fixed `relation` "Cascade delete" tooltip message ([#3098](https://github.com/pocketbase/pocketbase/issues/3098)).
+
+- Fixed jsvm error message prefix on failed migrations ([#3103](https://github.com/pocketbase/pocketbase/pull/3103); thanks @nzhenev).
+
+- Disabled the initial Admin UI admins counter cache when there are no initial admins to allow detecting externally created accounts (eg. with the `admin` command) ([#3106](https://github.com/pocketbase/pocketbase/issues/3106)).
+
+- Downgraded `google/go-cloud` dependency to v0.32.0 until v0.34.0 is released to prevent the `os.TempDir` `cross-device link` errors as too many users complained about it.
+
+
+## v0.17.3
+
+- Fixed Docker `cross-device link` error when creating `pb_data` backups on a local mounted volume ([#3089](https://github.com/pocketbase/pocketbase/issues/3089)).
+
+- Fixed the error messages for relation to views ([#3090](https://github.com/pocketbase/pocketbase/issues/3090)).
+
+- Always reserve space for the scrollbar to reduce the layout shifts in the Admin UI records listing due to the deprecated `overflow: overlay`.
+
+- Enabled lazy loading for the Admin UI thumb images.
+
+
+## v0.17.2
+
+- Soft-deprecated `$http.send({ data: object, ... })` in favour of `$http.send({ body: rawString, ... })`
+  to allow sending non-JSON body with the request ([#3058](https://github.com/pocketbase/pocketbase/discussions/3058)).
+  The existing `data` prop will still work, but it is recommended to use `body` instead (_to send JSON you can use `JSON.stringify(...)` as body value_).
+
+- Added `core.RealtimeConnectEvent.IdleTimeout` field to allow specifying a different realtime idle timeout duration per client basis ([#3054](https://github.com/pocketbase/pocketbase/discussions/3054)).
+
+- Fixed `apis.RequestData` deprecation log note ([#3068](https://github.com/pocketbase/pocketbase/pull/3068); thanks @gungjodi).
+
+
+## v0.17.1
+
+- Use relative path when redirecting to the OAuth2 providers page in the Admin UI to support subpath deployments ([#3026](https://github.com/pocketbase/pocketbase/pull/3026); thanks @sonyarianto).
+
+- Manually trigger the `OnBeforeServe` hook for `tests.ApiScenario` ([#3025](https://github.com/pocketbase/pocketbase/discussions/3025)).
+
+- Trigger the JSVM `cronAdd()` handler only on app `serve` to prevent unexpected (and eventually duplicated) cron handler calls when custom console commands are used ([#3024](https://github.com/pocketbase/pocketbase/discussions/3024#discussioncomment-6592703)).
+
+- The `console.log()` messages are now written to the `stdout` instead of `stderr`.
+
+
+## v0.17.0
+
+- New more detailed guides for using PocketBase as framework (both Go and JS).
+  _If you find any typos or issues with the docs please report them in https://github.com/pocketbase/site._
+
+- Added new experimental JavaScript app hooks binding via [goja](https://github.com/dop251/goja).
+  They are available by default with the prebuilt executable if you create `*.pb.js` file(s) in the `pb_hooks` directory.
+  Lower your expectations because the integration comes with some limitations. For more details please check the [Extend with JavaScript](https://pocketbase.io/docs/js-overview/) guide.
+  Optionally, you can also enable the JS app hooks as part of a custom Go build for dynamic scripting but you need to register the `jsvm` plugin manually:
+  ```go
+  jsvm.MustRegister(app core.App, config jsvm.Config{})
+  ```
+
+- Added Instagram OAuth2 provider ([#2534](https://github.com/pocketbase/pocketbase/pull/2534); thanks @pnmcosta).
+
+- Added VK OAuth2 provider ([#2533](https://github.com/pocketbase/pocketbase/pull/2533); thanks @imperatrona).
+
+- Added Yandex OAuth2 provider ([#2762](https://github.com/pocketbase/pocketbase/pull/2762); thanks @imperatrona).
+
+- Added new fields to `core.ServeEvent`:
+  ```go
+  type ServeEvent struct {
+    App    App
+    Router *echo.Echo
+    // new fields
+    Server      *http.Server      // allows adjusting the HTTP server config (global timeouts, TLS options, etc.)
+    CertManager *autocert.Manager // allows adjusting the autocert options (cache dir, host policy, etc.)
+  }
+  ```
+
+- Added `record.ExpandedOne(rel)` and `record.ExpandedAll(rel)` helpers to retrieve casted single or multiple expand relations from the already loaded "expand" Record data.
+
+- Added rule and filter record `Dao` helpers:
+  ```go
+  app.Dao().FindRecordsByFilter("posts", "title ~ 'lorem ipsum' && visible = true", "-created", 10)
+  app.Dao().FindFirstRecordByFilter("posts", "slug='test' && active=true")
+  app.Dao().CanAccessRecord(record, requestInfo, rule)
+  ```
+
+- Added `Dao.WithoutHooks()` helper to create a new `Dao` from the current one but without the create/update/delete hooks.
+
+- Use a default fetch function that will return all relations in case the `fetchFunc` argument of `Dao.ExpandRecord(record, expands, fetchFunc)` and `Dao.ExpandRecords(records, expands, fetchFunc)` is `nil`.
+
+- For convenience it is now possible to call `Dao.RecordQuery(collectionModelOrIdentifier)` with just the collection id or name.
+  In case an invalid collection id/name string is passed the query will be resolved with cancelled context error.
+
+- Refactored `apis.ApiError` validation errors serialization to allow `map[string]error` and `map[string]any` when generating the public safe formatted `ApiError.Data`.
+
+- Added support for wrapped API errors (_in case Go 1.20+ is used with multiple wrapped errors, the first `apis.ApiError` takes precedence_).
+
+- Added `?download=1` file query parameter to the file serving endpoint to force the browser to always download the file and not show its preview.
+
+- Added new utility `github.com/pocketbase/pocketbase/tools/template` subpackage to assist with rendering HTML templates using the standard Go `html/template` and `text/template` syntax.
+
+- Added `types.JsonMap.Get(k)` and `types.JsonMap.Set(k, v)` helpers for the cases where the type aliased direct map access is not allowed (eg. in [goja](https://pkg.go.dev/github.com/dop251/goja#hdr-Maps_with_methods)).
+
+- Soft-deprecated `security.NewToken()` in favor of `security.NewJWT()`.
+
+- `Hook.Add()` and `Hook.PreAdd` now returns a unique string identifier that could be used to remove the registered hook handler via `Hook.Remove(handlerId)`.
+
+- Changed the after* hooks to be called right before writing the user response, allowing users to return response errors from the after hooks.
+  There is also no longer need for returning explicitly `hook.StopPropagtion` when writing custom response body in a hook because we will skip the finalizer response body write if a response was already "committed".
+
+- ⚠️ Renamed `*Options{}` to `Config{}` for consistency and replaced the unnecessary pointers with their value equivalent to keep the applied configuration defaults isolated within their function calls:
+  ```go
+  old: pocketbase.NewWithConfig(config *pocketbase.Config) *pocketbase.PocketBase
+  new: pocketbase.NewWithConfig(config pocketbase.Config) *pocketbase.PocketBase
+
+  old: core.NewBaseApp(config *core.BaseAppConfig) *core.BaseApp
+  new: core.NewBaseApp(config core.BaseAppConfig) *core.BaseApp
+
+  old: apis.Serve(app core.App, options *apis.ServeOptions) error
+  new: apis.Serve(app core.App, config apis.ServeConfig) (*http.Server, error)
+
+  old: jsvm.MustRegisterMigrations(app core.App, options *jsvm.MigrationsOptions)
+  new: jsvm.MustRegister(app core.App, config jsvm.Config)
+
+  old: ghupdate.MustRegister(app core.App, rootCmd *cobra.Command, options *ghupdate.Options)
+  new: ghupdate.MustRegister(app core.App, rootCmd *cobra.Command, config ghupdate.Config)
+
+  old: migratecmd.MustRegister(app core.App, rootCmd *cobra.Command, options *migratecmd.Options)
+  new: migratecmd.MustRegister(app core.App, rootCmd *cobra.Command, config migratecmd.Config)
+  ```
+
+- ⚠️ Changed the type of `subscriptions.Message.Data` from `string` to `[]byte` because `Data` usually is a json bytes slice anyway.
+
+- ⚠️ Renamed `models.RequestData` to `models.RequestInfo` and soft-deprecated `apis.RequestData(c)` in favor of `apis.RequestInfo(c)` to avoid the stuttering with the `Data` field.
+  _The old `apis.RequestData()` method still works to minimize the breaking changes but it is recommended to replace it with `apis.RequestInfo(c)`._
+
+- ⚠️ Changes to the List/Search APIs
+    - Added new query parameter `?skipTotal=1` to skip the `COUNT` query performed with the list/search actions ([#2965](https://github.com/pocketbase/pocketbase/discussions/2965)).
+      If `?skipTotal=1` is set, the response fields `totalItems` and `totalPages` will have `-1` value (this is to avoid having different JSON responses and to differentiate from the zero default).
+      With the latest JS SDK 0.16+ and Dart SDK v0.11+ versions `skipTotal=1` is set by default for the `getFirstListItem()` and `getFullList()` requests.
+
+    - The count and regular select statements also now executes concurrently, meaning that we no longer perform normalization over the `page` parameter and in case the user
+      request a page that doesn't exist (eg. `?page=99999999`) we'll return empty `items` array.
+
+    - Reverted the default `COUNT` column to `id` as there are some common situations where it can negatively impact the query performance.
+      Additionally, from this version we also set `PRAGMA temp_store = MEMORY` so that also helps with the temp B-TREE creation when `id` is used.
+      _There are still scenarios where `COUNT` queries with `rowid` executes faster, but the majority of the time when nested relations lookups are used it seems to have the opposite effect (at least based on the benchmarks dataset)._
+
+- ⚠️ Disallowed relations to views **from non-view** collections ([#3000](https://github.com/pocketbase/pocketbase/issues/3000)).
+  The change was necessary because I wasn't able to find an efficient way to track view changes and the previous behavior could have too many unexpected side-effects (eg. view with computed ids).
+  There is a system migration that will convert the existing view `relation` fields to `json` (multiple) and `text` (single) fields.
+  This could be a breaking change if you have `relation` to view and use `expand` or some of the `relation` view fields as part of a collection rule.
+
+- ⚠️ Added an extra `action` argument to the `Dao` hooks to allow skipping the default persist behavior.
+  In preparation for the logs generalization, the `Dao.After*Func` methods now also allow returning an error.
+
+- Allowed `0` as `RelationOptions.MinSelect` value to avoid the ambiguity between 0 and non-filled input value ([#2817](https://github.com/pocketbase/pocketbase/discussions/2817)).
+
+- Fixed zero-default value not being used if the field is not explicitly set when manually creating records ([#2992](https://github.com/pocketbase/pocketbase/issues/2992)).
+  Additionally, `record.Get(field)` will now always return normalized value (the same as in the json serialization) for consistency and to avoid ambiguities with what is stored in the related DB table.
+  The schema fields columns `DEFAULT` definition was also updated for new collections to ensure that `NULL` values can't be accidentally inserted.
+
+- Fixed `migrate down` not returning the correct `lastAppliedMigrations()` when the stored migration applied time is in seconds.
+
+- Fixed realtime delete event to be called after the record was deleted from the DB (_including transactions and cascade delete operations_).
+
+- Other minor fixes and improvements (typos and grammar fixes, updated dependencies, removed unnecessary 404 error check in the Admin UI, etc.).
+
+
+## v0.16.10
+
+- Added multiple valued fields (`relation`, `select`, `file`) normalizations to ensure that the zero-default value of a newly created multiple field is applied for already existing data ([#2930](https://github.com/pocketbase/pocketbase/issues/2930)).
+
+
+## v0.16.9
+
+- Register the `eagerRequestInfoCache` middleware only for the internal `api` group routes to avoid conflicts with custom route handlers ([#2914](https://github.com/pocketbase/pocketbase/issues/2914)).
+
+
+## v0.16.8
+
+- Fixed unique validator detailed error message not being returned when camelCase field name is used ([#2868](https://github.com/pocketbase/pocketbase/issues/2868)).
+
+- Updated the index parser to allow no space between the table name and the columns list ([#2864](https://github.com/pocketbase/pocketbase/discussions/2864#discussioncomment-6373736)).
+
+- Updated go deps.
+
+
+## v0.16.7
+
+- Minor optimization for the list/search queries to use `rowid` with the `COUNT` statement when available.
+  _This eliminates the temp B-TREE step when executing the query and for large datasets (eg. 150k) it could have 10x improvement (from ~580ms to ~60ms)._
+
+
+## v0.16.6
+
+- Fixed collection index column sort normalization in the Admin UI ([#2681](https://github.com/pocketbase/pocketbase/pull/2681); thanks @SimonLoir).
+
+- Removed unnecessary admins count in `apis.RequireAdminAuthOnlyIfAny()` middleware ([#2726](https://github.com/pocketbase/pocketbase/pull/2726); thanks @svekko).
+
+- Fixed `multipart/form-data` request bind not populating map array values ([#2763](https://github.com/pocketbase/pocketbase/discussions/2763#discussioncomment-6278902)).
+
+- Upgraded npm and Go dependencies.
+
+
+## v0.16.5
+
+- Fixed the Admin UI serialization of implicit relation display fields ([#2675](https://github.com/pocketbase/pocketbase/issues/2675)).
+
+- Reset the Admin UI sort in case the active sort collection field is renamed or deleted.
+
+
+## v0.16.4
+
+- Fixed the selfupdate command not working on Windows due to missing `.exe` in the extracted binary path ([#2589](https://github.com/pocketbase/pocketbase/discussions/2589)).
+  _Note that the command on Windows will work from v0.16.4+ onwards, meaning that you still will have to update manually one more time to v0.16.4._
+
+- Added `int64`, `int32`, `uint`, `uint64` and `uint32` support when scanning `types.DateTime` ([#2602](https://github.com/pocketbase/pocketbase/discussions/2602))
+
+- Updated dependencies.
+
+
+## v0.16.3
+
+- Fixed schema fields sort not working on Safari/Gnome Web ([#2567](https://github.com/pocketbase/pocketbase/issues/2567)).
+
+- Fixed default `PRAGMA`s not being applied for new connections ([#2570](https://github.com/pocketbase/pocketbase/discussions/2570)).
+
+
+## v0.16.2
+
+- Fixed backups archive not excluding the local `backups` directory on Windows ([#2548](https://github.com/pocketbase/pocketbase/discussions/2548#discussioncomment-5979712)).
+
+- Changed file field to not use `dataTransfer.effectAllowed` when dropping files since it is not reliable and consistent across different OS and browsers ([#2541](https://github.com/pocketbase/pocketbase/issues/2541)).
+
+- Auto register the initial generated snapshot migration to prevent incorrectly reapplying the snapshot on Docker restart ([#2551](https://github.com/pocketbase/pocketbase/discussions/2551)).
+
+- Fixed missing view id field error message typo.
+
+
+## v0.16.1
+
+- Fixed backup restore not working in a container environment when `pb_data` is mounted as volume ([#2519](https://github.com/pocketbase/pocketbase/issues/2519)).
+
+- Fixed Dart SDK realtime API preview example ([#2523](https://github.com/pocketbase/pocketbase/pull/2523); thanks @xFrann).
+
+- Fixed typo in the backups create panel ([#2526](https://github.com/pocketbase/pocketbase/pull/2526); thanks @dschissler).
+
+- Removed unnecessary slice length check in `list.ExistInSlice` ([#2527](https://github.com/pocketbase/pocketbase/pull/2527); thanks @KunalSin9h).
+
+- Avoid mutating the cached request data on OAuth2 user create ([#2535](https://github.com/pocketbase/pocketbase/discussions/2535)).
+
+- Fixed Export Collections "Download as JSON" ([#2540](https://github.com/pocketbase/pocketbase/issues/2540)).
+
+- Fixed file field drag and drop not working in Firefox and Safari ([#2541](https://github.com/pocketbase/pocketbase/issues/2541)).
+
+
+## v0.16.0
+
+- Added automated backups (_+ cron rotation_) APIs and UI for the `pb_data` directory.
+  The backups can be also initialized programmatically using `app.CreateBackup("backup.zip")`.
+  There is also experimental restore method - `app.RestoreBackup("backup.zip")` (_currently works only on UNIX systems as it relies on execve_).
+  The backups can be stored locally or in external S3 storage (_it has its own configuration, separate from the file uploads storage filesystem_).
+
+- Added option to limit the returned API fields using the `?fields` query parameter.
+  The "fields picker" is applied for `SearchResult.Items` and every other JSON response. For example:
+  ```js
+  // original: {"id": "RECORD_ID", "name": "abc", "description": "...something very big...", "items": ["id1", "id2"], "expand": {"items": [{"id": "id1", "name": "test1"}, {"id": "id2", "name": "test2"}]}}
+  // output:   {"name": "abc", "expand": {"items": [{"name": "test1"}, {"name": "test2"}]}}
+  const result = await pb.collection("example").getOne("RECORD_ID", {
+    expand: "items",
+    fields: "name,expand.items.name",
+  })
+  ```
+
+- Added new `./pocketbase update` command to selfupdate the prebuilt executable (with option to generate a backup of your `pb_data`).
+
+- Added new `./pocketbase admin` console command:
+  ```sh
+  // creates new admin account
+  ./pocketbase admin create test@example.com 123456890
+
+  // changes the password of an existing admin account
+  ./pocketbase admin update test@example.com 0987654321
+
+  // deletes single admin account (if exists)
+  ./pocketbase admin delete test@example.com
+  ```
+
+- Added `apis.Serve(app, options)` helper to allow starting the API server programmatically.
+
+- Updated the schema fields Admin UI for "tidier" fields visualization.
+
+- Updated the logs "real" user IP to check for `Fly-Client-IP` header and changed the `X-Forward-For` header to use the first non-empty leftmost-ish IP as it the closest to the "real IP".
+
+- Added new `tools/archive` helper subpackage for managing archives (_currently works only with zip_).
+
+- Added new `tools/cron` helper subpackage for scheduling task using cron-like syntax (_this eventually may get exported in the future in a separate repo_).
+
+- Added new `Filesystem.List(prefix)` helper to retrieve a flat list with all files under the provided prefix.
+
+- Added new `App.NewBackupsFilesystem()` helper to create a dedicated filesystem abstraction for managing app data backups.
+
+- Added new `App.OnTerminate()` hook (_executed right before app termination, eg. on `SIGTERM` signal_).
+
+- Added `accept` file field attribute with the field MIME types ([#2466](https://github.com/pocketbase/pocketbase/pull/2466); thanks @Nikhil1920).
+
+- Added support for multiple files sort in the Admin UI ([#2445](https://github.com/pocketbase/pocketbase/issues/2445)).
+
+- Added support for multiple relations sort in the Admin UI.
+
+- Added `meta.isNew` to the OAuth2 auth JSON response to indicate a newly OAuth2 created PocketBase user.

CONTRIBUTING.md

@@ -1,5 +1,4 @@
-Contributing to PocketBase
-======================================================================
+# Contributing to PocketBase
 
 Thanks for taking the time to improve PocketBase!
 
@@ -9,26 +8,26 @@ This document describes how to prepare a PR for a change in the main repository.
 - [Making changes in the Go code](#making-changes-in-the-go-code)
 - [Making changes in the Admin UI](#making-changes-in-the-admin-ui)
 
-
 ## Prerequisites
 
-- Go 1.18+ (for making changes in the Go code)
-- Node 16+ (for making changes in the Admin UI)
+- Go 1.21+ (for making changes in the Go code)
+- Node 18+ (for making changes in the Admin UI)
 
 If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
+
 ```
 git clone https://github.com/your_username/pocketbase.git
 ```
 
+> [!IMPORTANT]
 > It is recommended to create a new branch from master for each of your bugfixes and features.
 > This is required if you are planning to submit multiple PRs in order to keep the changes separate for review until they eventually get merged.
 
-
 ## Making changes in the Go code
 
-PocketBase is a Go package, which means that in order to run the project you'll have to create a Go `main` program that imports the package.
+PocketBase is distributed as a Go package, which means that in order to run the project you'll have to create a Go `main` program that imports the package.
 
-The repository already includes such program, located in `/examples/base`, that is also used for the prebuilt executables.
+The repository already includes such program, located in `examples/base`, that is also used for the prebuilt executables.
 
 So, let's assume that you already done some changes in the PocketBase Go code and you want now to run them:
 
@@ -41,20 +40,22 @@ This will start a web server on `http://localhost:8090` with the embedded prebui
 
 - Add unit/integration tests for your changes (we are using the standard `testing` go package).
   To run the tests, you could execute (while in the root project directory):
-    ```sh
-    go test ./...
 
-    # or using the Makefile
-    make test
-    ```
+  ```sh
+  go test ./...
+
+  # or using the Makefile
+  make test
+  ```
 
 - Run the linter - **golangci** ([see how to install](https://golangci-lint.run/usage/install/#local-installation)):
-    ```sh
-    golangci-lint run -c ./golangci.yml ./...
 
-    # or using the Makefile
-    make lint
-    ```
+  ```sh
+  golangci-lint run -c ./golangci.yml ./...
+
+  # or using the Makefile
+  make lint
+  ```
 
 ## Making changes in the Admin UI
 
@@ -65,14 +66,15 @@ To start the Admin UI:
 1. Navigate to the `ui` project directory
 2. Run `npm install` to install the node dependencies
 3. Start vite's dev server
-    ```sh
-    npm run dev
-    ```
+   ```sh
+   npm run dev
+   ```
 
 You could open the browser and access the running Admin UI at `http://localhost:3000`.
 
 Since the Admin UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
 
+> [!NOTE]
 > By default, the Admin UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
 
 Every change you make in the Admin UI should be automatically reflected in the browser at `http://localhost:3000` without reloading the page.

LICENSE.md

@@ -1,5 +1,5 @@
 The MIT License (MIT)
-Copyright (c) 2022, Gani Georgiev
+Copyright (c) 2022 - present, Gani Georgiev
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software
 and associated documentation files (the "Software"), to deal in the Software without restriction,

Makefile

@@ -2,8 +2,11 @@ lint:
 	golangci-lint run -c ./golangci.yml ./...
 
 test:
-	go test -v --cover ./...
+	go test ./... -v --cover
+
+jstypes:
+	go run ./plugins/jsvm/internal/types/types.go
 
 test-report:
-	go test -v --cover -coverprofile=coverage.out ./...
+	go test ./... -v --cover -coverprofile=coverage.out
 	go tool cover -html=coverage.out

README.md

@@ -1,13 +1,13 @@
 <p align="center">
     <a href="https://pocketbase.io" target="_blank" rel="noopener">
-        <img src="https://i.imgur.com/ZfD4BHO.png" alt="PocketBase - open source backend in 1 file" />
+        <img src="https://i.imgur.com/5qimnm5.png" alt="PocketBase - open source backend in 1 file" />
     </a>
 </p>
 
 <p align="center">
     <a href="https://github.com/pocketbase/pocketbase/actions/workflows/release.yaml" target="_blank" rel="noopener"><img src="https://github.com/pocketbase/pocketbase/actions/workflows/release.yaml/badge.svg" alt="build" /></a>
     <a href="https://github.com/pocketbase/pocketbase/releases" target="_blank" rel="noopener"><img src="https://img.shields.io/github/release/pocketbase/pocketbase.svg" alt="Latest releases" /></a>
-    <a href="https://pkg.go.dev/github.com/pocketbase/pocketbase" target="_blank" rel="noopener"><img src="https://godoc.org/github.com/ganigeorgiev/fexpr?status.svg" alt="Go package documentation" /></a>
+    <a href="https://pkg.go.dev/github.com/pocketbase/pocketbase" target="_blank" rel="noopener"><img src="https://godoc.org/github.com/pocketbase/pocketbase?status.svg" alt="Go package documentation" /></a>
 </p>
 
 [PocketBase](https://pocketbase.io) is an open source Go backend, consisting of:
@@ -19,11 +19,10 @@
 
 **For documentation and examples, please visit https://pocketbase.io/docs.**
 
-> ⚠️ Although the web API definitions are considered stable,
-> please keep in mind that PocketBase is still under active development
+> [!WARNING]
+> Please keep in mind that PocketBase is still under active development
 > and therefore full backward compatibility is not guaranteed before reaching v1.0.0.
 
-
 ## API SDK clients
 
 The easiest way to interact with the API is to use one of the official SDK clients:
@@ -31,76 +30,111 @@ The easiest way to interact with the API is to use one of the official SDK clien
 - **JavaScript - [pocketbase/js-sdk](https://github.com/pocketbase/js-sdk)** (_browser and node_)
 - **Dart - [pocketbase/dart-sdk](https://github.com/pocketbase/dart-sdk)** (_web, mobile, desktop_)
 
-
 ## Overview
 
-PocketBase could be used as a standalone app or as a Go framework/toolkit that enables you to build
+### Use as standalone app
+
+You could download the prebuilt executable for your platform from the [Releases page](https://github.com/pocketbase/pocketbase/releases).
+Once downloaded, extract the archive and run `./pocketbase serve` in the extracted directory.
+
+The prebuilt executables are based on the [`examples/base/main.go` file](https://github.com/pocketbase/pocketbase/blob/master/examples/base/main.go) and comes with the JS VM plugin enabled by default which allows to extend PocketBase with JavaScript (_for more details please refer to [Extend with JavaScript](https://pocketbase.io/docs/js-overview/)_).
+
+### Use as a Go framework/toolkit
+
+PocketBase is distributed as a regular Go library package which allows you to build
 your own custom app specific business logic and still have a single portable executable at the end.
 
-### Installation
+Here is a minimal example:
 
-```sh
-# go 1.18+
-go get github.com/pocketbase/pocketbase
-```
-> For Windows, you may have to use go 1.19+ due to an incorrect js mime type in the Windows Registry (see [issue#6](https://github.com/pocketbase/pocketbase/issues/6)).
+0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
 
-### Example
+1. Create a new project directory with the following `main.go` file inside it:
+    ```go
+    package main
 
-```go
-package main
+    import (
+        "log"
+        "net/http"
 
-import (
-    "log"
-    "net/http"
+        "github.com/labstack/echo/v5"
+        "github.com/pocketbase/pocketbase"
+        "github.com/pocketbase/pocketbase/apis"
+        "github.com/pocketbase/pocketbase/core"
+    )
 
-    "github.com/labstack/echo/v5"
-    "github.com/pocketbase/pocketbase"
-    "github.com/pocketbase/pocketbase/apis"
-    "github.com/pocketbase/pocketbase/core"
-)
+    func main() {
+        app := pocketbase.New()
 
-func main() {
-    app := pocketbase.New()
+        app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
+            // add new "GET /hello" route to the app router (echo)
+            e.Router.AddRoute(echo.Route{
+                Method: http.MethodGet,
+                Path:   "/hello",
+                Handler: func(c echo.Context) error {
+                    return c.String(200, "Hello world!")
+                },
+                Middlewares: []echo.MiddlewareFunc{
+                    apis.ActivityLogger(app),
+                },
+            })
 
-    app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
-        // add new "GET /api/hello" route to the app router (echo)
-        e.Router.AddRoute(echo.Route{
-            Method: http.MethodGet,
-            Path:   "/api/hello",
-            Handler: func(c echo.Context) error {
-                return c.String(200, "Hello world!")
-            },
-            Middlewares: []echo.MiddlewareFunc{
-                apis.RequireAdminOrUserAuth(),
-            },
+            return nil
         })
 
-        return nil
-    })
-
-    if err := app.Start(); err != nil {
-        log.Fatal(err)
+        if err := app.Start(); err != nil {
+            log.Fatal(err)
+        }
     }
-}
+    ```
+
+2. To init the dependencies, run `go mod init myapp && go mod tidy`.
+
+3. To start the application, run `go run main.go serve`.
+
+4. To build a statically linked executable, you can run `CGO_ENABLED=0 go build` and then start the created executable with `./myapp serve`.
+
+> [!NOTE]
+> PocketBase embeds SQLite, but doesn't require CGO.
+>
+> If CGO is enabled (aka. `CGO_ENABLED=1`), it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite).
+> Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
+
+_For more details please refer to [Extend with Go](https://pocketbase.io/docs/go-overview/)._
+
+### Building and running the repo main.go example
+
+To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory:
+
+0. [Install Go 1.21+](https://go.dev/doc/install) (_if you haven't already_)
+1. Clone/download the repo
+2. Navigate to `examples/base`
+3. Run `GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build`
+   (_https://go.dev/doc/install/source#environment_)
+4. Start the created executable by running `./base serve`.
+
+Note that the supported build targets by the pure Go SQLite driver at the moment are:
+
+```
+darwin  amd64
+darwin  arm64
+freebsd amd64
+freebsd arm64
+linux   386
+linux   amd64
+linux   arm
+linux   arm64
+linux   ppc64le
+linux   riscv64
+linux   s390x
+windows amd64
+windows arm64
 ```
-
-### Running and building
-
-Running/building the application is the same as for any other Go program, aka. just `go run` and `go build`.
-
-**PocketBase embeds SQLite, but doesn't require CGO.**
-
-If CGO is enabled, it will use [mattn/go-sqlite3](https://pkg.go.dev/github.com/mattn/go-sqlite3) driver, otherwise - [modernc.org/sqlite](https://pkg.go.dev/modernc.org/sqlite). You can enable and disable CGO by setting the `CGO_ENABLED` environment variable to `1` or `0` respectively.
-
-Enable CGO only if you really need to squeeze the read/write query performance at the expense of complicating cross compilation.
-
-To build the minimal standalone executable, like the prebuilt ones in the releases page, you can simply run `go build` inside the `examples/base` directory.
 
 ### Testing
 
 PocketBase comes with mixed bag of unit and integration tests.
-To run them, use the default `go test` command:
+To run them, use the standard `go test` command:
+
 ```sh
 go test ./...
 ```
@@ -111,18 +145,22 @@ Check also the [Testing guide](http://pocketbase.io/docs/testing) to learn how t
 
 If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
 
-All reports will be promptly addressed and you'll be credited accordingly.
-
+All reports will be promptly addressed, and you'll be credited accordingly.
 
 ## Contributing
 
 PocketBase is free and open source project licensed under the [MIT License](LICENSE.md).
+You are free to do whatever you want with it, even offering it as a paid service.
 
 You could help continuing its development by:
 
 - [Contribute to the source code](CONTRIBUTING.md)
 - [Suggest new features and report issues](https://github.com/pocketbase/pocketbase/issues)
-- [Donate a small amount](https://pocketbase.io/support-us)
 
-> Please note that PocketBase was initially created to serve as a new backend for my other open source project - [Presentator](https://presentator.io) (see [#183](https://github.com/presentator/presentator/issues/183)),
-so all feature requests will be first aligned with what we need for Presentator v3.
+PRs for new OAuth2 providers, bug fixes, code optimizations and documentation improvements are more than welcome.
+
+But please refrain creating PRs for _new features_ without previously discussing the implementation details.
+PocketBase has a [roadmap](https://github.com/orgs/pocketbase/projects/2) and I try to work on issues in specific order and such PRs often come in out of nowhere and skew all initial planning with tedious back-and-forth communication.
+
+Don't get upset if I close your PR, even if it is well executed and tested. This doesn't mean that it will never be merged.
+Later we can always refer to it and/or take pieces of your implementation when the time comes to work on the issue (don't worry you'll be credited in the release notes).

apis/admin.go

@@ -1,7 +1,6 @@
 package apis
 
 import (
-	"log"
 	"net/http"
 
 	"github.com/labstack/echo/v5"
@@ -9,20 +8,19 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tokens"
-	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
-// BindAdminApi registers the admin api endpoints and the corresponding handlers.
-func BindAdminApi(app core.App, rg *echo.Group) {
+// bindAdminApi registers the admin api endpoints and the corresponding handlers.
+func bindAdminApi(app core.App, rg *echo.Group) {
 	api := adminApi{app: app}
 
 	subGroup := rg.Group("/admins", ActivityLogger(app))
-	subGroup.POST("/auth-via-email", api.emailAuth, RequireGuestOnly())
+	subGroup.POST("/auth-with-password", api.authWithPassword)
 	subGroup.POST("/request-password-reset", api.requestPasswordReset)
 	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
-	subGroup.POST("/refresh", api.refresh, RequireAdminAuth())
+	subGroup.POST("/auth-refresh", api.authRefresh, RequireAdminAuth())
 	subGroup.GET("", api.list, RequireAdminAuth())
 	subGroup.POST("", api.create, RequireAdminAuthOnlyIfAny(app))
 	subGroup.GET("/:id", api.view, RequireAdminAuth())
@@ -34,19 +32,28 @@ type adminApi struct {
 	app core.App
 }
 
-func (api *adminApi) authResponse(c echo.Context, admin *models.Admin) error {
+func (api *adminApi) authResponse(c echo.Context, admin *models.Admin, finalizers ...func(token string) error) error {
 	token, tokenErr := tokens.NewAdminAuthToken(api.app, admin)
 	if tokenErr != nil {
-		return rest.NewBadRequestError("Failed to create auth token.", tokenErr)
+		return NewBadRequestError("Failed to create auth token.", tokenErr)
 	}
 
-	event := &core.AdminAuthEvent{
-		HttpContext: c,
-		Admin:       admin,
-		Token:       token,
+	for _, f := range finalizers {
+		if err := f(token); err != nil {
+			return err
+		}
 	}
 
+	event := new(core.AdminAuthEvent)
+	event.HttpContext = c
+	event.Admin = admin
+	event.Token = token
+
 	return api.app.OnAdminAuthRequest().Trigger(event, func(e *core.AdminAuthEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(200, map[string]any{
 			"token": e.Token,
 			"admin": e.Admin,
@@ -54,62 +61,128 @@ func (api *adminApi) authResponse(c echo.Context, admin *models.Admin) error {
 	})
 }
 
-func (api *adminApi) refresh(c echo.Context) error {
+func (api *adminApi) authRefresh(c echo.Context) error {
 	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
 	if admin == nil {
-		return rest.NewNotFoundError("Missing auth admin context.", nil)
+		return NewNotFoundError("Missing auth admin context.", nil)
 	}
 
-	return api.authResponse(c, admin)
+	event := new(core.AdminAuthRefreshEvent)
+	event.HttpContext = c
+	event.Admin = admin
+
+	return api.app.OnAdminBeforeAuthRefreshRequest().Trigger(event, func(e *core.AdminAuthRefreshEvent) error {
+		return api.app.OnAdminAfterAuthRefreshRequest().Trigger(event, func(e *core.AdminAuthRefreshEvent) error {
+			return api.authResponse(e.HttpContext, e.Admin)
+		})
+	})
 }
 
-func (api *adminApi) emailAuth(c echo.Context) error {
+func (api *adminApi) authWithPassword(c echo.Context) error {
 	form := forms.NewAdminLogin(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	admin, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to authenticate.", submitErr)
-	}
+	event := new(core.AdminAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Password = form.Password
+	event.Identity = form.Identity
 
-	return api.authResponse(c, admin)
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.AdminAuthWithPasswordEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				return api.app.OnAdminAfterAuthWithPasswordRequest().Trigger(event, func(e *core.AdminAuthWithPasswordEvent) error {
+					return api.authResponse(e.HttpContext, e.Admin)
+				})
+			})
+		}
+	})
+
+	return submitErr
 }
 
 func (api *adminApi) requestPasswordReset(c echo.Context) error {
 	form := forms.NewAdminPasswordResetRequest(api.app)
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
 	if err := form.Validate(); err != nil {
-		return rest.NewBadRequestError("An error occurred while validating the form.", err)
+		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	// run in background because we don't need to show the result
-	// (prevents admins enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
+	event := new(core.AdminRequestPasswordResetEvent)
+	event.HttpContext = c
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(Admin *models.Admin) error {
+			event.Admin = Admin
+
+			return api.app.OnAdminBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Admin); err != nil {
+						api.app.Logger().Error("Failed to send admin password reset request.", "error", err)
+					}
+				})
+
+				return api.app.OnAdminAfterRequestPasswordResetRequest().Trigger(event, func(e *core.AdminRequestPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
 		}
 	})
 
-	return c.NoContent(http.StatusNoContent)
+	// eagerly write 204 response and skip submit errors
+	// as a measure against admins enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
 }
 
 func (api *adminApi) confirmPasswordReset(c echo.Context) error {
 	form := forms.NewAdminPasswordResetConfirm(api.app)
 	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	admin, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to set new password.", submitErr)
-	}
+	event := new(core.AdminConfirmPasswordResetEvent)
+	event.HttpContext = c
 
-	return api.authResponse(c, admin)
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			event.Admin = admin
+
+			return api.app.OnAdminBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.AdminConfirmPasswordResetEvent) error {
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return api.app.OnAdminAfterConfirmPasswordResetRequest().Trigger(event, func(e *core.AdminConfirmPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
 }
 
 func (api *adminApi) list(c echo.Context) error {
@@ -121,19 +194,22 @@ func (api *adminApi) list(c echo.Context) error {
 
 	result, err := search.NewProvider(fieldResolver).
 		Query(api.app.Dao().AdminQuery()).
-		ParseAndExec(c.QueryString(), &admins)
+		ParseAndExec(c.QueryParams().Encode(), &admins)
 
 	if err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	event := &core.AdminsListEvent{
-		HttpContext: c,
-		Admins:      admins,
-		Result:      result,
-	}
+	event := new(core.AdminsListEvent)
+	event.HttpContext = c
+	event.Admins = admins
+	event.Result = result
 
 	return api.app.OnAdminsListRequest().Trigger(event, func(e *core.AdminsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
 	})
 }
@@ -141,20 +217,23 @@ func (api *adminApi) list(c echo.Context) error {
 func (api *adminApi) view(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
 	admin, err := api.app.Dao().FindAdminById(id)
 	if err != nil || admin == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	event := &core.AdminViewEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminViewEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	return api.app.OnAdminViewRequest().Trigger(event, func(e *core.AdminViewEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.Admin)
 	})
 }
@@ -166,104 +245,109 @@ func (api *adminApi) create(c echo.Context) error {
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.AdminCreateEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminCreateEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	// create the admin
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
 			return api.app.OnAdminBeforeCreateRequest().Trigger(event, func(e *core.AdminCreateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to create admin.", err)
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to create admin.", err)
 				}
 
-				return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				return api.app.OnAdminAfterCreateRequest().Trigger(event, func(e *core.AdminCreateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				})
 			})
 		}
 	})
 
-	if submitErr == nil {
-		api.app.OnAdminAfterCreateRequest().Trigger(event)
-	}
-
 	return submitErr
 }
 
 func (api *adminApi) update(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
 	admin, err := api.app.Dao().FindAdminById(id)
 	if err != nil || admin == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
 	form := forms.NewAdminUpsert(api.app, admin)
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.AdminUpdateEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminUpdateEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
 	// update the admin
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
+			event.Admin = m
+
 			return api.app.OnAdminBeforeUpdateRequest().Trigger(event, func(e *core.AdminUpdateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to update admin.", err)
+				if err := next(e.Admin); err != nil {
+					return NewBadRequestError("Failed to update admin.", err)
 				}
 
-				return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				return api.app.OnAdminAfterUpdateRequest().Trigger(event, func(e *core.AdminUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Admin)
+				})
 			})
 		}
 	})
 
-	if submitErr == nil {
-		api.app.OnAdminAfterUpdateRequest().Trigger(event)
-	}
-
 	return submitErr
 }
 
 func (api *adminApi) delete(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
 	admin, err := api.app.Dao().FindAdminById(id)
 	if err != nil || admin == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	event := &core.AdminDeleteEvent{
-		HttpContext: c,
-		Admin:       admin,
-	}
+	event := new(core.AdminDeleteEvent)
+	event.HttpContext = c
+	event.Admin = admin
 
-	handlerErr := api.app.OnAdminBeforeDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
+	return api.app.OnAdminBeforeDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
 		if err := api.app.Dao().DeleteAdmin(e.Admin); err != nil {
-			return rest.NewBadRequestError("Failed to delete admin.", err)
+			return NewBadRequestError("Failed to delete admin.", err)
 		}
 
-		return e.HttpContext.NoContent(http.StatusNoContent)
+		return api.app.OnAdminAfterDeleteRequest().Trigger(event, func(e *core.AdminDeleteEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
 	})
-
-	if handlerErr == nil {
-		api.app.OnAdminAfterDeleteRequest().Trigger(event)
-	}
-
-	return handlerErr
 }

apis/admin_test.go

@@ -1,6 +1,7 @@
 package apis_test
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 	"testing"
@@ -8,61 +9,108 @@ import (
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-func TestAdminAuth(t *testing.T) {
+func TestAdminAuthWithPassword(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
 			Method:          http.MethodPost,
-			Url:             "/api/admins/auth-via-email",
+			Url:             "/api/admins/auth-with-password",
 			Body:            strings.NewReader(``),
 			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."},"password":{"code":"validation_required","message":"Cannot be blank."}}`},
+			ExpectedContent: []string{`"data":{"identity":{"code":"validation_required","message":"Cannot be blank."},"password":{"code":"validation_required","message":"Cannot be blank."}}`},
 		},
 		{
 			Name:            "invalid data",
 			Method:          http.MethodPost,
-			Url:             "/api/admins/auth-via-email",
+			Url:             "/api/admins/auth-with-password",
 			Body:            strings.NewReader(`{`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:            "wrong email/password",
+			Name:            "wrong email",
 			Method:          http.MethodPost,
-			Url:             "/api/admins/auth-via-email",
-			Body:            strings.NewReader(`{"email":"missing@example.com","password":"wrong_pass"}`),
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"missing@example.com","password":"1234567890"}`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
-			Name:   "valid email/password (already authorized)",
-			Method: http.MethodPost,
-			Url:    "/api/admins/auth-via-email",
-			Body:   strings.NewReader(`{"email":"test@example.com","password":"1234567890"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
+			Name:            "wrong password",
+			Method:          http.MethodPost,
+			Url:             "/api/admins/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"test@example.com","password":"invalid"}`),
 			ExpectedStatus:  400,
-			ExpectedContent: []string{`"message":"The request can be accessed only by guests.","data":{}`},
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+			},
 		},
 		{
 			Name:           "valid email/password (guest)",
 			Method:         http.MethodPost,
-			Url:            "/api/admins/auth-via-email",
-			Body:           strings.NewReader(`{"email":"test@example.com","password":"1234567890"}`),
+			Url:            "/api/admins/auth-with-password",
+			Body:           strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`"admin":{"id":"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c"`,
+				`"admin":{"id":"sywbhecnh46rhm0"`,
 				`"token":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnAdminAuthRequest": 1,
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "valid email/password (already authorized)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-with-password",
+			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"admin":{"id":"sywbhecnh46rhm0"`,
+				`"token":`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
+				"OnAdminAuthRequest":                   1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterAuthWithPasswordRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-with-password",
+			Body:   strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4MTYwMH0.han3_sG65zLddpcX2ic78qgy7FKecuPfOpFa8Dvi5Bg",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterAuthWithPasswordRequest().Add(func(e *core.AdminAuthWithPasswordEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthWithPasswordRequest": 1,
+				"OnAdminAfterAuthWithPasswordRequest":  1,
 			},
 		},
 	}
@@ -73,6 +121,8 @@ func TestAdminAuth(t *testing.T) {
 }
 
 func TestAdminRequestPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -106,10 +156,12 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                  1,
-				"OnModelAfterUpdate":                   1,
-				"OnMailerBeforeAdminResetPasswordSend": 1,
-				"OnMailerAfterAdminResetPasswordSend":  1,
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnMailerBeforeAdminResetPasswordSend":     1,
+				"OnMailerAfterAdminResetPasswordSend":      1,
+				"OnAdminBeforeRequestPasswordResetRequest": 1,
+				"OnAdminAfterRequestPasswordResetRequest":  1,
 			},
 		},
 		{
@@ -119,7 +171,7 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// simulate recent password request
 				admin, err := app.Dao().FindAdminByEmail("test@example.com")
 				if err != nil {
@@ -140,6 +192,8 @@ func TestAdminRequestPasswordReset(t *testing.T) {
 }
 
 func TestAdminConfirmPasswordReset(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "empty data",
@@ -158,27 +212,67 @@ func TestAdminConfirmPasswordReset(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:            "expired token",
-			Method:          http.MethodPost,
-			Url:             "/api/admins/confirm-password-reset",
-			Body:            strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA","password":"1234567890","passwordConfirm":"1234567890"}`),
+			Name:   "expired token",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MTY0MDk5MTY2MX0.GLwCOsgWTTEKXTK-AyGW838de1OeZGIjfHH0FoRLqZg",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890"
+			}`),
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{"token":{"code":"validation_invalid_token","message":"Invalid or expired token."}}}`},
 		},
 		{
-			Name:           "valid token",
-			Method:         http.MethodPost,
-			Url:            "/api/admins/confirm-password-reset",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg5MzQ3NDAwMH0.72IhlL_5CpNGE0ZKM7sV9aAKa3wxQaMZdDiHBo0orpw","password":"1234567890","passwordConfirm":"1234567890"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"admin":{"id":"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c"`,
-				`"token":`,
-			},
+			Name:   "valid token + invalid password",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"123456",
+				"passwordConfirm":"123456"
+			}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"password":{"code":"validation_length_out_of_range"`},
+		},
+		{
+			Name:   "valid token + valid password",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891"
+			}`),
+			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate": 1,
-				"OnModelAfterUpdate":  1,
-				"OnAdminAuthRequest":  1,
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnAdminBeforeConfirmPasswordResetRequest": 1,
+				"OnAdminAfterConfirmPasswordResetRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterConfirmPasswordResetRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891"
+			}`),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterConfirmPasswordResetRequest().Add(func(e *core.AdminConfirmPasswordResetEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnAdminBeforeConfirmPasswordResetRequest": 1,
+				"OnAdminAfterConfirmPasswordResetRequest":  1,
 			},
 		},
 	}
@@ -189,38 +283,71 @@ func TestAdminConfirmPasswordReset(t *testing.T) {
 }
 
 func TestAdminRefresh(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPost,
-			Url:             "/api/admins/refresh",
+			Url:             "/api/admins/auth-refresh",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as user",
 			Method: http.MethodPost,
-			Url:    "/api/admins/refresh",
+			Url:    "/api/admins/auth-refresh",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as admin",
+			Name:   "authorized as admin (expired token)",
 			Method: http.MethodPost,
-			Url:    "/api/admins/refresh",
+			Url:    "/api/admins/auth-refresh",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MDk5MTY2MX0.I7w8iktkleQvC7_UIRpD7rNzcU4OnF7i7SFIUu6lD_4",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (valid token)",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`"admin":{"id":"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c"`,
+				`"admin":{"id":"sywbhecnh46rhm0"`,
 				`"token":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnAdminAuthRequest": 1,
+				"OnAdminAuthRequest":              1,
+				"OnAdminBeforeAuthRefreshRequest": 1,
+				"OnAdminAfterAuthRefreshRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterAuthRefreshRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins/auth-refresh",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterAuthRefreshRequest().Add(func(e *core.AdminAuthRefreshEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnAdminBeforeAuthRefreshRequest": 1,
+				"OnAdminAfterAuthRefreshRequest":  1,
 			},
 		},
 	}
@@ -231,6 +358,8 @@ func TestAdminRefresh(t *testing.T) {
 }
 
 func TestAdminsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -244,7 +373,7 @@ func TestAdminsList(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/api/admins",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -254,16 +383,17 @@ func TestAdminsList(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/api/admins",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"page":1`,
 				`"perPage":30`,
-				`"totalItems":2`,
+				`"totalItems":3`,
 				`"items":[{`,
-				`"id":"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c"`,
-				`"id":"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8"`,
+				`"id":"sywbhecnh46rhm0"`,
+				`"id":"sbmbsdb40jyxf7h"`,
+				`"id":"9q2trqumvlyr3bd"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnAdminsListRequest": 1,
@@ -274,15 +404,19 @@ func TestAdminsList(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/api/admins?page=2&perPage=1&sort=-created",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`"page":2`,
 				`"perPage":1`,
-				`"totalItems":2`,
+				`"totalItems":3`,
 				`"items":[{`,
-				`"id":"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c"`,
+				`"id":"sbmbsdb40jyxf7h"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnAdminsListRequest": 1,
@@ -293,7 +427,7 @@ func TestAdminsList(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/api/admins?filter=invalidfield~'test2'",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
@@ -301,9 +435,9 @@ func TestAdminsList(t *testing.T) {
 		{
 			Name:   "authorized as admin + valid filter",
 			Method: http.MethodGet,
-			Url:    "/api/admins?filter=email~'test2'",
+			Url:    "/api/admins?filter=email~'test3'",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -311,7 +445,11 @@ func TestAdminsList(t *testing.T) {
 				`"perPage":30`,
 				`"totalItems":1`,
 				`"items":[{`,
-				`"id":"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8"`,
+				`"id":"9q2trqumvlyr3bd"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnAdminsListRequest": 1,
@@ -325,40 +463,32 @@ func TestAdminsList(t *testing.T) {
 }
 
 func TestAdminView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as user",
 			Method: http.MethodGet,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
-		{
-			Name:   "authorized as admin + invalid admin id",
-			Method: http.MethodGet,
-			Url:    "/api/admins/invalid",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
 		{
 			Name:   "authorized as admin + nonexisting admin id",
 			Method: http.MethodGet,
-			Url:    "/api/admins/b97ccf83-34a2-4d01-a26b-3d77bc842d3c",
+			Url:    "/api/admins/nonexisting",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
@@ -366,13 +496,17 @@ func TestAdminView(t *testing.T) {
 		{
 			Name:   "authorized as admin + existing admin id",
 			Method: http.MethodGet,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`"id":"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8"`,
+				`"id":"sbmbsdb40jyxf7h"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"passwordHash"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnAdminViewRequest": 1,
@@ -386,40 +520,32 @@ func TestAdminView(t *testing.T) {
 }
 
 func TestAdminDelete(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodDelete,
-			Url:             "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as user",
 			Method: http.MethodDelete,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as admin + invalid admin id",
+			Name:   "authorized as admin + missing admin id",
 			Method: http.MethodDelete,
-			Url:    "/api/admins/invalid",
+			Url:    "/api/admins/missing",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + nonexisting admin id",
-			Method: http.MethodDelete,
-			Url:    "/api/admins/b97ccf83-34a2-4d01-a26b-3d77bc842d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
@@ -427,9 +553,9 @@ func TestAdminDelete(t *testing.T) {
 		{
 			Name:   "authorized as admin + existing admin id",
 			Method: http.MethodDelete,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
@@ -442,15 +568,15 @@ func TestAdminDelete(t *testing.T) {
 		{
 			Name:   "authorized as admin - try to delete the only remaining admin",
 			Method: http.MethodDelete,
-			Url:    "/api/admins/2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			Url:    "/api/admins/sywbhecnh46rhm0",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins except the authorized one
 				adminModel := &models.Admin{}
 				_, err := app.Dao().DB().Delete(adminModel.TableName(), dbx.Not(dbx.HashExp{
-					"id": "2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+					"id": "sywbhecnh46rhm0",
 				})).Execute()
 				if err != nil {
 					t.Fatal(err)
@@ -462,6 +588,27 @@ func TestAdminDelete(t *testing.T) {
 				"OnAdminBeforeDeleteRequest": 1,
 			},
 		},
+		{
+			Name:   "OnAdminAfterDeleteRequest error response",
+			Method: http.MethodDelete,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterDeleteRequest().Add(func(e *core.AdminDeleteEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeDelete":        1,
+				"OnModelAfterDelete":         1,
+				"OnAdminBeforeDeleteRequest": 1,
+				"OnAdminAfterDeleteRequest":  1,
+			},
+		},
 	}
 
 	for _, scenario := range scenarios {
@@ -470,6 +617,8 @@ func TestAdminDelete(t *testing.T) {
 }
 
 func TestAdminCreate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized (while having at least 1 existing admin)",
@@ -483,7 +632,7 @@ func TestAdminCreate(t *testing.T) {
 			Method: http.MethodPost,
 			Url:    "/api/admins",
 			Body:   strings.NewReader(`{"email":"testnew@example.com","password":"1234567890","passwordConfirm":"1234567890","avatar":3}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins
 				_, err := app.Dao().DB().NewQuery("DELETE FROM {{_admins}}").Execute()
 				if err != nil {
@@ -508,7 +657,7 @@ func TestAdminCreate(t *testing.T) {
 			Method: http.MethodPost,
 			Url:    "/api/admins",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -519,7 +668,7 @@ func TestAdminCreate(t *testing.T) {
 			Url:    "/api/admins",
 			Body:   strings.NewReader(``),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."},"password":{"code":"validation_required","message":"Cannot be blank."}}`},
@@ -530,7 +679,7 @@ func TestAdminCreate(t *testing.T) {
 			Url:    "/api/admins",
 			Body:   strings.NewReader(`{`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
@@ -539,20 +688,36 @@ func TestAdminCreate(t *testing.T) {
 			Name:   "authorized as admin + invalid data",
 			Method: http.MethodPost,
 			Url:    "/api/admins",
-			Body:   strings.NewReader(`{"email":"test@example.com","password":"1234","passwordConfirm":"4321","avatar":99}`),
+			Body: strings.NewReader(`{
+				"email":"test@example.com",
+				"password":"1234",
+				"passwordConfirm":"4321",
+				"avatar":99
+			}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"avatar":{"code":"validation_max_less_equal_than_required"`,
+				`"email":{"code":"validation_admin_email_exists"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
 			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"avatar":{"code":"validation_max_less_equal_than_required","message":"Must be no greater than 9."},"email":{"code":"validation_admin_email_exists","message":"Admin email already exists."},"password":{"code":"validation_length_out_of_range","message":"The length must be between 10 and 100."},"passwordConfirm":{"code":"validation_values_mismatch","message":"Values don't match."}}`},
 		},
 		{
 			Name:   "authorized as admin + valid data",
 			Method: http.MethodPost,
 			Url:    "/api/admins",
-			Body:   strings.NewReader(`{"email":"testnew@example.com","password":"1234567890","passwordConfirm":"1234567890","avatar":3}`),
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890",
+				"avatar":3
+			}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -560,6 +725,39 @@ func TestAdminCreate(t *testing.T) {
 				`"email":"testnew@example.com"`,
 				`"avatar":3`,
 			},
+			NotExpectedContent: []string{
+				`"password"`,
+				`"passwordConfirm"`,
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeCreate":        1,
+				"OnModelAfterCreate":         1,
+				"OnAdminBeforeCreateRequest": 1,
+				"OnAdminAfterCreateRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterCreateRequest error response",
+			Method: http.MethodPost,
+			Url:    "/api/admins",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890",
+				"avatar":3
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterCreateRequest().Add(func(e *core.AdminCreateEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeCreate":        1,
 				"OnModelAfterCreate":         1,
@@ -575,42 +773,33 @@ func TestAdminCreate(t *testing.T) {
 }
 
 func TestAdminUpdate(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodPatch,
-			Url:             "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:             "/api/admins/sbmbsdb40jyxf7h",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:   "authorized as user",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as admin + invalid admin id",
+			Name:   "authorized as admin + missing admin",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/invalid",
+			Url:    "/api/admins/missing",
 			Body:   strings.NewReader(``),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + nonexisting admin id",
-			Method: http.MethodPatch,
-			Url:    "/api/admins/b97ccf83-34a2-4d01-a26b-3d77bc842d3c",
-			Body:   strings.NewReader(``),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
@@ -618,14 +807,14 @@ func TestAdminUpdate(t *testing.T) {
 		{
 			Name:   "authorized as admin + empty data",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			Body:   strings.NewReader(``),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`"id":"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8"`,
+				`"id":"sbmbsdb40jyxf7h"`,
 				`"email":"test2@example.com"`,
 				`"avatar":2`,
 			},
@@ -639,10 +828,10 @@ func TestAdminUpdate(t *testing.T) {
 		{
 			Name:   "authorized as admin + invalid formatted data",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
 			Body:   strings.NewReader(`{`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus:  400,
 			ExpectedContent: []string{`"data":{}`},
@@ -650,27 +839,77 @@ func TestAdminUpdate(t *testing.T) {
 		{
 			Name:   "authorized as admin + invalid data",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
-			Body:   strings.NewReader(`{"email":"test@example.com","password":"1234","passwordConfirm":"4321","avatar":99}`),
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"test@example.com",
+				"password":"1234",
+				"passwordConfirm":"4321",
+				"avatar":99
+			}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"avatar":{"code":"validation_max_less_equal_than_required"`,
+				`"email":{"code":"validation_admin_email_exists"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
 			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"avatar":{"code":"validation_max_less_equal_than_required","message":"Must be no greater than 9."},"email":{"code":"validation_admin_email_exists","message":"Admin email already exists."},"password":{"code":"validation_length_out_of_range","message":"The length must be between 10 and 100."},"passwordConfirm":{"code":"validation_values_mismatch","message":"Values don't match."}}`},
 		},
 		{
+			Name:   "authorized as admin + valid data",
 			Method: http.MethodPatch,
-			Url:    "/api/admins/3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8",
-			Body:   strings.NewReader(`{"email":"testnew@example.com","password":"1234567890","passwordConfirm":"1234567890","avatar":5}`),
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891",
+				"avatar":5
+			}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`"id":"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8"`,
+				`"id":"sbmbsdb40jyxf7h"`,
 				`"email":"testnew@example.com"`,
 				`"avatar":5`,
 			},
+			NotExpectedContent: []string{
+				`"password"`,
+				`"passwordConfirm"`,
+				`"tokenKey"`,
+				`"passwordHash"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":        1,
+				"OnModelAfterUpdate":         1,
+				"OnAdminBeforeUpdateRequest": 1,
+				"OnAdminAfterUpdateRequest":  1,
+			},
+		},
+		{
+			Name:   "OnAdminAfterUpdateRequest error response",
+			Method: http.MethodPatch,
+			Url:    "/api/admins/sbmbsdb40jyxf7h",
+			Body: strings.NewReader(`{
+				"email":"testnew@example.com",
+				"password":"1234567891",
+				"passwordConfirm":"1234567891",
+				"avatar":5
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnAdminAfterUpdateRequest().Add(func(e *core.AdminUpdateEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeUpdate":        1,
 				"OnModelAfterUpdate":         1,

apis/api_error.go

@@ -1,4 +1,4 @@
-package rest
+package apis
 
 import (
 	"net/http"
@@ -8,7 +8,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/inflector"
 )
 
-// ApiError defines the properties for a basic api error response.
+// ApiError defines the struct for a basic api error response.
 type ApiError struct {
 	Code    int            `json:"code"`
 	Message string         `json:"message"`
@@ -23,6 +23,7 @@ func (e *ApiError) Error() string {
 	return e.Message
 }
 
+// RawData returns the unformatted error data (could be an internal error, text, etc.)
 func (e *ApiError) RawData() any {
 	return e.rawData
 }
@@ -65,43 +66,67 @@ func NewUnauthorizedError(message string, data any) *ApiError {
 
 // NewApiError creates and returns new normalized `ApiError` instance.
 func NewApiError(status int, message string, data any) *ApiError {
-	message = inflector.Sentenize(message)
-
-	formattedData := map[string]any{}
-
-	if v, ok := data.(validation.Errors); ok {
-		formattedData = resolveValidationErrors(v)
-	}
-
 	return &ApiError{
 		rawData: data,
-		Data:    formattedData,
+		Data:    safeErrorsData(data),
 		Code:    status,
-		Message: strings.TrimSpace(message),
+		Message: strings.TrimSpace(inflector.Sentenize(message)),
 	}
 }
 
-func resolveValidationErrors(validationErrors validation.Errors) map[string]any {
+func safeErrorsData(data any) map[string]any {
+	switch v := data.(type) {
+	case validation.Errors:
+		return resolveSafeErrorsData[error](v)
+	case map[string]validation.Error:
+		return resolveSafeErrorsData[validation.Error](v)
+	case map[string]error:
+		return resolveSafeErrorsData[error](v)
+	case map[string]any:
+		return resolveSafeErrorsData[any](v)
+	default:
+		return map[string]any{} // not nil to ensure that is json serialized as object
+	}
+}
+
+func resolveSafeErrorsData[T any](data map[string]T) map[string]any {
 	result := map[string]any{}
 
-	// extract from each validation error its error code and message.
-	for name, err := range validationErrors {
-		// check for nested errors
-		if nestedErrs, ok := err.(validation.Errors); ok {
-			result[name] = resolveValidationErrors(nestedErrs)
+	for name, err := range data {
+		if isNestedError(err) {
+			result[name] = safeErrorsData(err)
 			continue
 		}
-
-		errCode := "validation_invalid_value" // default
-		if errObj, ok := err.(validation.ErrorObject); ok {
-			errCode = errObj.Code()
-		}
-
-		result[name] = map[string]string{
-			"code":    errCode,
-			"message": inflector.Sentenize(err.Error()),
-		}
+		result[name] = resolveSafeErrorItem(err)
 	}
 
 	return result
 }
+
+func isNestedError(err any) bool {
+	switch err.(type) {
+	case validation.Errors, map[string]validation.Error, map[string]error, map[string]any:
+		return true
+	}
+
+	return false
+}
+
+// resolveSafeErrorItem extracts from each validation error its
+// public safe error code and message.
+func resolveSafeErrorItem(err any) map[string]string {
+	// default public safe error values
+	code := "validation_invalid_value"
+	msg := "Invalid value."
+
+	// only validation errors are public safe
+	if obj, ok := err.(validation.Error); ok {
+		code = obj.Code()
+		msg = inflector.Sentenize(obj.Error())
+	}
+
+	return map[string]string{
+		"code":    code,
+		"message": msg,
+	}
+}

apis/api_error_test.go

@@ -1,4 +1,4 @@
-package rest_test
+package apis_test
 
 import (
 	"encoding/json"
@@ -6,11 +6,13 @@ import (
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/apis"
 )
 
 func TestNewApiErrorWithRawData(t *testing.T) {
-	e := rest.NewApiError(
+	t.Parallel()
+
+	e := apis.NewApiError(
 		300,
 		"message_test",
 		"rawData_test",
@@ -33,14 +35,16 @@ func TestNewApiErrorWithRawData(t *testing.T) {
 }
 
 func TestNewApiErrorWithValidationData(t *testing.T) {
-	e := rest.NewApiError(
+	t.Parallel()
+
+	e := apis.NewApiError(
 		300,
 		"message_test",
 		validation.Errors{
-			"err1": errors.New("test error"),
+			"err1": errors.New("test error"), // should be normalized
 			"err2": validation.ErrRequired,
 			"err3": validation.Errors{
-				"sub1": errors.New("test error"),
+				"sub1": errors.New("test error"), // should be normalized
 				"sub2": validation.ErrRequired,
 				"sub3": validation.Errors{
 					"sub11": validation.ErrRequired,
@@ -50,10 +54,10 @@ func TestNewApiErrorWithValidationData(t *testing.T) {
 	)
 
 	result, _ := json.Marshal(e)
-	expected := `{"code":300,"message":"Message_test.","data":{"err1":{"code":"validation_invalid_value","message":"Test error."},"err2":{"code":"validation_required","message":"Cannot be blank."},"err3":{"sub1":{"code":"validation_invalid_value","message":"Test error."},"sub2":{"code":"validation_required","message":"Cannot be blank."},"sub3":{"sub11":{"code":"validation_required","message":"Cannot be blank."}}}}}`
+	expected := `{"code":300,"message":"Message_test.","data":{"err1":{"code":"validation_invalid_value","message":"Invalid value."},"err2":{"code":"validation_required","message":"Cannot be blank."},"err3":{"sub1":{"code":"validation_invalid_value","message":"Invalid value."},"sub2":{"code":"validation_required","message":"Cannot be blank."},"sub3":{"sub11":{"code":"validation_required","message":"Cannot be blank."}}}}}`
 
 	if string(result) != expected {
-		t.Errorf("Expected %v, got %v", expected, string(result))
+		t.Errorf("Expected \n%v, \ngot \n%v", expected, string(result))
 	}
 
 	if e.Error() != "Message_test." {
@@ -66,6 +70,8 @@ func TestNewApiErrorWithValidationData(t *testing.T) {
 }
 
 func TestNewNotFoundError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -73,20 +79,22 @@ func TestNewNotFoundError(t *testing.T) {
 	}{
 		{"", nil, `{"code":404,"message":"The requested resource wasn't found.","data":{}}`},
 		{"demo", "rawData_test", `{"code":404,"message":"Demo.","data":{}}`},
-		{"demo", validation.Errors{"err1": errors.New("test error")}, `{"code":404,"message":"Demo.","data":{"err1":{"code":"validation_invalid_value","message":"Test error."}}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":404,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
 	}
 
 	for i, scenario := range scenarios {
-		e := rest.NewNotFoundError(scenario.message, scenario.data)
+		e := apis.NewNotFoundError(scenario.message, scenario.data)
 		result, _ := json.Marshal(e)
 
 		if string(result) != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, string(result))
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
 		}
 	}
 }
 
 func TestNewBadRequestError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -94,20 +102,22 @@ func TestNewBadRequestError(t *testing.T) {
 	}{
 		{"", nil, `{"code":400,"message":"Something went wrong while processing your request.","data":{}}`},
 		{"demo", "rawData_test", `{"code":400,"message":"Demo.","data":{}}`},
-		{"demo", validation.Errors{"err1": errors.New("test error")}, `{"code":400,"message":"Demo.","data":{"err1":{"code":"validation_invalid_value","message":"Test error."}}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":400,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
 	}
 
 	for i, scenario := range scenarios {
-		e := rest.NewBadRequestError(scenario.message, scenario.data)
+		e := apis.NewBadRequestError(scenario.message, scenario.data)
 		result, _ := json.Marshal(e)
 
 		if string(result) != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, string(result))
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
 		}
 	}
 }
 
 func TestNewForbiddenError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -115,20 +125,22 @@ func TestNewForbiddenError(t *testing.T) {
 	}{
 		{"", nil, `{"code":403,"message":"You are not allowed to perform this request.","data":{}}`},
 		{"demo", "rawData_test", `{"code":403,"message":"Demo.","data":{}}`},
-		{"demo", validation.Errors{"err1": errors.New("test error")}, `{"code":403,"message":"Demo.","data":{"err1":{"code":"validation_invalid_value","message":"Test error."}}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":403,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
 	}
 
 	for i, scenario := range scenarios {
-		e := rest.NewForbiddenError(scenario.message, scenario.data)
+		e := apis.NewForbiddenError(scenario.message, scenario.data)
 		result, _ := json.Marshal(e)
 
 		if string(result) != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, string(result))
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
 		}
 	}
 }
 
 func TestNewUnauthorizedError(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []struct {
 		message  string
 		data     any
@@ -136,15 +148,15 @@ func TestNewUnauthorizedError(t *testing.T) {
 	}{
 		{"", nil, `{"code":401,"message":"Missing or invalid authentication token.","data":{}}`},
 		{"demo", "rawData_test", `{"code":401,"message":"Demo.","data":{}}`},
-		{"demo", validation.Errors{"err1": errors.New("test error")}, `{"code":401,"message":"Demo.","data":{"err1":{"code":"validation_invalid_value","message":"Test error."}}}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"code":401,"message":"Demo.","data":{"err1":{"code":"test_code","message":"Test_message."}}}`},
 	}
 
 	for i, scenario := range scenarios {
-		e := rest.NewUnauthorizedError(scenario.message, scenario.data)
+		e := apis.NewUnauthorizedError(scenario.message, scenario.data)
 		result, _ := json.Marshal(e)
 
 		if string(result) != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, string(result))
+			t.Errorf("(%d) Expected \n%v, \ngot \n%v", i, scenario.expected, string(result))
 		}
 	}
 }

apis/backup.go

@@ -0,0 +1,214 @@
+package apis
+
+import (
+	"context"
+	"net/http"
+	"path/filepath"
+	"time"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+// bindBackupApi registers the file api endpoints and the corresponding handlers.
+//
+// @todo add hooks once the app hooks api restructuring is finalized
+func bindBackupApi(app core.App, rg *echo.Group) {
+	api := backupApi{app: app}
+
+	subGroup := rg.Group("/backups", ActivityLogger(app))
+	subGroup.GET("", api.list, RequireAdminAuth())
+	subGroup.POST("", api.create, RequireAdminAuth())
+	subGroup.POST("/upload", api.upload, RequireAdminAuth())
+	subGroup.GET("/:key", api.download)
+	subGroup.DELETE("/:key", api.delete, RequireAdminAuth())
+	subGroup.POST("/:key/restore", api.restore, RequireAdminAuth())
+}
+
+type backupApi struct {
+	app core.App
+}
+
+func (api *backupApi) list(c echo.Context) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	backups, err := fsys.List("")
+	if err != nil {
+		return NewBadRequestError("Failed to retrieve backup items. Raw error: \n"+err.Error(), nil)
+	}
+
+	result := make([]models.BackupFileInfo, len(backups))
+
+	for i, obj := range backups {
+		modified, _ := types.ParseDateTime(obj.ModTime)
+
+		result[i] = models.BackupFileInfo{
+			Key:      obj.Key,
+			Size:     obj.Size,
+			Modified: modified,
+		}
+	}
+
+	return c.JSON(http.StatusOK, result)
+}
+
+func (api *backupApi) create(c echo.Context) error {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
+		return NewBadRequestError("Try again later - another backup/restore process has already been started", nil)
+	}
+
+	form := forms.NewBackupCreate(api.app)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	return form.Submit(func(next forms.InterceptorNextFunc[string]) forms.InterceptorNextFunc[string] {
+		return func(name string) error {
+			if err := next(name); err != nil {
+				return NewBadRequestError("Failed to create backup.", err)
+			}
+
+			// we don't retrieve the generated backup file because it may not be
+			// available yet due to the eventually consistent nature of some S3 providers
+			return c.NoContent(http.StatusNoContent)
+		}
+	})
+}
+
+func (api *backupApi) upload(c echo.Context) error {
+	files, err := rest.FindUploadedFiles(c.Request(), "file")
+	if err != nil {
+		return NewBadRequestError("Missing or invalid uploaded file.", err)
+	}
+
+	form := forms.NewBackupUpload(api.app)
+	form.File = files[0]
+
+	return form.Submit(func(next forms.InterceptorNextFunc[*filesystem.File]) forms.InterceptorNextFunc[*filesystem.File] {
+		return func(file *filesystem.File) error {
+			if err := next(file); err != nil {
+				return NewBadRequestError("Failed to upload backup.", err)
+			}
+
+			// we don't retrieve the generated backup file because it may not be
+			// available yet due to the eventually consistent nature of some S3 providers
+			return c.NoContent(http.StatusNoContent)
+		}
+	})
+}
+
+func (api *backupApi) download(c echo.Context) error {
+	fileToken := c.QueryParam("token")
+
+	_, err := api.app.Dao().FindAdminByToken(
+		fileToken,
+		api.app.Settings().AdminFileToken.Secret,
+	)
+	if err != nil {
+		return NewForbiddenError("Insufficient permissions to access the resource.", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	key := c.PathParam("key")
+
+	br, err := fsys.GetFile(key)
+	if err != nil {
+		return NewBadRequestError("Failed to retrieve backup item. Raw error: \n"+err.Error(), nil)
+	}
+	defer br.Close()
+
+	return fsys.Serve(
+		c.Response(),
+		c.Request(),
+		key,
+		filepath.Base(key), // without the path prefix (if any)
+	)
+}
+
+func (api *backupApi) restore(c echo.Context) error {
+	if api.app.Store().Has(core.StoreKeyActiveBackup) {
+		return NewBadRequestError("Try again later - another backup/restore process has already been started.", nil)
+	}
+
+	key := c.PathParam("key")
+
+	existsCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(existsCtx)
+
+	if exists, err := fsys.Exists(key); !exists {
+		return NewBadRequestError("Missing or invalid backup file.", err)
+	}
+
+	go func() {
+		// wait max 15 minutes to fetch the backup
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+		defer cancel()
+
+		// give some optimistic time to write the response
+		time.Sleep(1 * time.Second)
+
+		if err := api.app.RestoreBackup(ctx, key); err != nil {
+			api.app.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
+		}
+	}()
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (api *backupApi) delete(c echo.Context) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := api.app.NewBackupsFilesystem()
+	if err != nil {
+		return NewBadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	key := c.PathParam("key")
+
+	if key != "" && cast.ToString(api.app.Store().Get(core.StoreKeyActiveBackup)) == key {
+		return NewBadRequestError("The backup is currently being used and cannot be deleted.", nil)
+	}
+
+	if err := fsys.Delete(key); err != nil {
+		return NewBadRequestError("Invalid or already deleted backup file. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}

apis/backup_test.go

@@ -0,0 +1,770 @@
+package apis_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"gocloud.dev/blob"
+)
+
+func TestBackupsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodGet,
+			Url:    "/api/backups",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodGet,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (empty list)",
+			Method: http.MethodGet,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[]`,
+			},
+		},
+		{
+			Name:   "authorized as admin",
+			Method: http.MethodGet,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"test1.zip"`,
+				`"test2.zip"`,
+				`"test3.zip"`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupsCreate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (pending backup)",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.Store().Set(core.StoreKeyActiveBackup, "")
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (autogenerated name)",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected 1 backup file, got %d", total)
+				}
+
+				expected := "pb_backup_"
+				if !strings.HasPrefix(files[0].Key, expected) {
+					t.Fatalf("Expected backup file with prefix %q, got %q", expected, files[0].Key)
+				}
+			},
+			ExpectedStatus: 204,
+		},
+		{
+			Name:   "authorized as admin (invalid name)",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			Body:   strings.NewReader(`{"name":"!test.zip"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"name":{"code":"validation_match_invalid"`,
+			},
+		},
+		{
+			Name:   "authorized as admin (valid name)",
+			Method: http.MethodPost,
+			Url:    "/api/backups",
+			Body:   strings.NewReader(`{"name":"test.zip"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected 1 backup file, got %d", total)
+				}
+
+				expected := "test.zip"
+				if files[0].Key != expected {
+					t.Fatalf("Expected backup file %q, got %q", expected, files[0].Key)
+				}
+			},
+			ExpectedStatus: 204,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupsUpload(t *testing.T) {
+	t.Parallel()
+
+	// create dummy form data bodies
+	type body struct {
+		buffer      io.Reader
+		contentType string
+	}
+	bodies := make([]body, 10)
+	for i := 0; i < 10; i++ {
+		func() {
+			zb := new(bytes.Buffer)
+			zw := zip.NewWriter(zb)
+			if err := zw.Close(); err != nil {
+				t.Fatal(err)
+			}
+
+			b := new(bytes.Buffer)
+			mw := multipart.NewWriter(b)
+
+			mfw, err := mw.CreateFormFile("file", "test")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := io.Copy(mfw, zb); err != nil {
+				t.Fatal(err)
+			}
+
+			mw.Close()
+
+			bodies[i] = body{
+				buffer:      b,
+				contentType: mw.FormDataContentType(),
+			}
+		}()
+	}
+	// ---
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			Url:    "/api/backups/upload",
+			Body:   bodies[0].buffer,
+			RequestHeaders: map[string]string{
+				"Content-Type": bodies[0].contentType,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/backups/upload",
+			Body:   bodies[1].buffer,
+			RequestHeaders: map[string]string{
+				"Content-Type":  bodies[1].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (missing file)",
+			Method: http.MethodPost,
+			Url:    "/api/backups/upload",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{`},
+		},
+		{
+			Name:   "authorized as admin (existing backup name)",
+			Method: http.MethodPost,
+			Url:    "/api/backups/upload",
+			Body:   bodies[3].buffer,
+			RequestHeaders: map[string]string{
+				"Content-Type":  bodies[3].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				fsys, err := app.NewBackupsFilesystem()
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer fsys.Close()
+				// create a dummy backup file to simulate existing backups
+				if err := fsys.Upload([]byte("123"), "test"); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, _ := getBackupFiles(app)
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected %d backup file, got %d", 1, total)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"file":{`},
+		},
+		{
+			Name:   "authorized as admin (valid file)",
+			Method: http.MethodPost,
+			Url:    "/api/backups/upload",
+			Body:   bodies[4].buffer,
+			RequestHeaders: map[string]string{
+				"Content-Type":  bodies[4].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, _ := getBackupFiles(app)
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected %d backup file, got %d", 1, total)
+				}
+			},
+			ExpectedStatus: 204,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupsDownload(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with record auth header",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with admin auth header",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with empty or invalid token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with valid record auth token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with valid record file token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with valid admin auth token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with expired admin file token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImFkbWluIn0.g7Q_3UX6H--JWJ7yt1Hoe-1ugTX1KpbKzdt0zjGSe-E",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with valid admin file token but missing backup name",
+			Method: http.MethodGet,
+			Url:    "/api/backups/missing?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "with valid admin file token",
+			Method: http.MethodGet,
+			Url:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`storage/`,
+				`data.db`,
+				`logs.db`,
+			},
+		},
+		{
+			Name:   "with valid admin file token and backup name with escaped char",
+			Method: http.MethodGet,
+			Url:    "/api/backups/%40test4.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`storage/`,
+				`data.db`,
+				`logs.db`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupsDelete(t *testing.T) {
+	t.Parallel()
+
+	noTestBackupFilesChanges := func(t *testing.T, app *tests.TestApp) {
+		files, err := getBackupFiles(app)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expected := 4
+		if total := len(files); total != expected {
+			t.Fatalf("Expected %d backup(s), got %d", expected, total)
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (missing file)",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/missing.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (existing file with matching active backup)",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				// mock active backup with the same name to delete
+				app.Store().Set(core.StoreKeyActiveBackup, "test1.zip")
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (existing file and no matching active backup)",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/test1.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				// mock active backup with different name
+				app.Store().Set(core.StoreKeyActiveBackup, "new.zip")
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 3 {
+					t.Fatalf("Expected %d backup files, got %d", 3, total)
+				}
+
+				deletedFile := "test1.zip"
+
+				for _, f := range files {
+					if f.Key == deletedFile {
+						t.Fatalf("Expected backup %q to be deleted", deletedFile)
+					}
+				}
+			},
+			ExpectedStatus: 204,
+		},
+		{
+			Name:   "authorized as admin (backup with escaped character)",
+			Method: http.MethodDelete,
+			Url:    "/api/backups/%40test4.zip",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 3 {
+					t.Fatalf("Expected %d backup files, got %d", 3, total)
+				}
+
+				deletedFile := "@test4.zip"
+
+				for _, f := range files {
+					if f.Key == deletedFile {
+						t.Fatalf("Expected backup %q to be deleted", deletedFile)
+					}
+				}
+			},
+			ExpectedStatus: 204,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupsRestore(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			Url:    "/api/backups/test1.zip/restore",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/backups/test1.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (missing file)",
+			Method: http.MethodPost,
+			Url:    "/api/backups/missing.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (active backup process)",
+			Method: http.MethodPost,
+			Url:    "/api/backups/test1.zip/restore",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				app.Store().Set(core.StoreKeyActiveBackup, "")
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+// -------------------------------------------------------------------
+
+func createTestBackups(app core.App) error {
+	ctx := context.Background()
+
+	if err := app.CreateBackup(ctx, "test1.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "test2.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "test3.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "@test4.zip"); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func getBackupFiles(app core.App) ([]*blob.ListObject, error) {
+	fsys, err := app.NewBackupsFilesystem()
+	if err != nil {
+		return nil, err
+	}
+	defer fsys.Close()
+
+	return fsys.List("")
+}
+
+func ensureNoBackups(t *testing.T, app *tests.TestApp) {
+	files, err := getBackupFiles(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(files); total != 0 {
+		t.Fatalf("Expected 0 backup files, got %d", total)
+	}
+}

apis/base.go

@@ -2,13 +2,16 @@
 package apis
 
 import (
+	"database/sql"
+	"errors"
 	"fmt"
 	"io/fs"
-	"log"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/labstack/echo/v5/middleware"
@@ -24,58 +27,89 @@ const trailedAdminPath = "/_/"
 // system and app specific routes and middlewares.
 func InitApi(app core.App) (*echo.Echo, error) {
 	e := echo.New()
-	e.Debug = app.IsDebug()
+	e.Debug = false
+	e.Binder = &rest.MultiBinder{}
+	e.JSONSerializer = &rest.Serializer{
+		FieldsParam: fieldsQueryParam,
+	}
+
+	// configure a custom router
+	e.ResetRouterCreator(func(ec *echo.Echo) echo.Router {
+		return echo.NewRouter(echo.RouterConfig{
+			UnescapePathParamValues: true,
+			AllowOverwritingRoute:   true,
+		})
+	})
 
 	// default middlewares
 	e.Pre(middleware.RemoveTrailingSlashWithConfig(middleware.RemoveTrailingSlashConfig{
 		Skipper: func(c echo.Context) bool {
-			// ignore Admin UI route(s)
-			return strings.HasPrefix(c.Request().URL.Path, trailedAdminPath)
+			// enable by default only for the API routes
+			return !strings.HasPrefix(c.Request().URL.Path, "/api/")
 		},
 	}))
+	e.Pre(LoadAuthContext(app))
 	e.Use(middleware.Recover())
 	e.Use(middleware.Secure())
-	e.Use(LoadAuthContext(app))
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set(ContextExecStartKey, time.Now())
+
+			return next(c)
+		}
+	})
 
 	// custom error handler
 	e.HTTPErrorHandler = func(c echo.Context, err error) {
-		if c.Response().Committed {
-			return
+		if err == nil {
+			return // no error
 		}
 
-		var apiErr *rest.ApiError
+		var apiErr *ApiError
 
-		switch v := err.(type) {
-		case *echo.HTTPError:
-			if v.Internal != nil && app.IsDebug() {
-				log.Println(v.Internal)
-			}
+		if errors.As(err, &apiErr) {
+			// already an api error...
+		} else if v := new(echo.HTTPError); errors.As(err, &v) {
 			msg := fmt.Sprintf("%v", v.Message)
-			apiErr = rest.NewApiError(v.Code, msg, v)
-		case *rest.ApiError:
-			if app.IsDebug() && v.RawData() != nil {
-				log.Println(v.RawData())
-			}
-			apiErr = v
-		default:
-			if err != nil && app.IsDebug() {
-				log.Println(err)
-			}
-			apiErr = rest.NewBadRequestError("", err)
-		}
-
-		// Send response
-		var cErr error
-		if c.Request().Method == http.MethodHead {
-			// @see https://github.com/labstack/echo/issues/608
-			cErr = c.NoContent(apiErr.Code)
+			apiErr = NewApiError(v.Code, msg, v)
 		} else {
-			cErr = c.JSON(apiErr.Code, apiErr)
+			if errors.Is(err, sql.ErrNoRows) {
+				apiErr = NewNotFoundError("", err)
+			} else {
+				apiErr = NewBadRequestError("", err)
+			}
 		}
 
-		// truly rare case; eg. client already disconnected
-		if cErr != nil && app.IsDebug() {
-			log.Println(cErr)
+		logRequest(app, c, apiErr)
+
+		if c.Response().Committed {
+			return // already committed
+		}
+
+		event := new(core.ApiErrorEvent)
+		event.HttpContext = c
+		event.Error = apiErr
+
+		// send error response
+		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			// @see https://github.com/labstack/echo/issues/608
+			if e.HttpContext.Request().Method == http.MethodHead {
+				return e.HttpContext.NoContent(apiErr.Code)
+			}
+
+			return e.HttpContext.JSON(apiErr.Code, apiErr)
+		})
+
+		if hookErr == nil {
+			if err := app.OnAfterApiError().Trigger(event); err != nil {
+				app.Logger().Debug("OnAfterApiError failure", slog.String("error", err.Error()))
+			}
+		} else {
+			app.Logger().Debug("OnBeforeApiError error (truly rare case, eg. client already disconnected)", slog.String("error", hookErr.Error()))
 		}
 	}
 
@@ -83,25 +117,17 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	bindStaticAdminUI(app, e)
 
 	// default routes
-	api := e.Group("/api")
-	BindSettingsApi(app, api)
-	BindAdminApi(app, api)
-	BindUserApi(app, api)
-	BindCollectionApi(app, api)
-	BindRecordApi(app, api)
-	BindFileApi(app, api)
-	BindRealtimeApi(app, api)
-	BindLogsApi(app, api)
-
-	// trigger the custom BeforeServe hook for the created api router
-	// allowing users to further adjust its options or register new routes
-	serveEvent := &core.ServeEvent{
-		App:    app,
-		Router: e,
-	}
-	if err := app.OnBeforeServe().Trigger(serveEvent); err != nil {
-		return nil, err
-	}
+	api := e.Group("/api", eagerRequestInfoCache(app))
+	bindSettingsApi(app, api)
+	bindAdminApi(app, api)
+	bindCollectionApi(app, api)
+	bindRecordCrudApi(app, api)
+	bindRecordAuthApi(app, api)
+	bindFileApi(app, api)
+	bindRealtimeApi(app, api)
+	bindLogsApi(app, api)
+	bindHealthApi(app, api)
+	bindBackupApi(app, api)
 
 	// catch all any route
 	api.Any("/*", func(c echo.Context) error {
@@ -114,22 +140,31 @@ func InitApi(app core.App) (*echo.Echo, error) {
 // StaticDirectoryHandler is similar to `echo.StaticDirectoryHandler`
 // but without the directory redirect which conflicts with RemoveTrailingSlash middleware.
 //
+// If a file resource is missing and indexFallback is set, the request
+// will be forwarded to the base index.html (useful also for SPA).
+//
 // @see https://github.com/labstack/echo/issues/2211
-func StaticDirectoryHandler(fileSystem fs.FS, disablePathUnescaping bool) echo.HandlerFunc {
+func StaticDirectoryHandler(fileSystem fs.FS, indexFallback bool) echo.HandlerFunc {
 	return func(c echo.Context) error {
 		p := c.PathParam("*")
-		if !disablePathUnescaping { // when router is already unescaping we do not want to do is twice
-			tmpPath, err := url.PathUnescape(p)
-			if err != nil {
-				return fmt.Errorf("failed to unescape path variable: %w", err)
-			}
-			p = tmpPath
+
+		// escape url path
+		tmpPath, err := url.PathUnescape(p)
+		if err != nil {
+			return fmt.Errorf("failed to unescape path variable: %w", err)
 		}
+		p = tmpPath
 
 		// fs.FS.Open() already assumes that file names are relative to FS root path and considers name with prefix `/` as invalid
 		name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))
 
-		return c.FileFS(name, fileSystem)
+		fileErr := c.FileFS(name, fileSystem)
+
+		if fileErr != nil && indexFallback && errors.Is(fileErr, echo.ErrNotFound) {
+			return c.FileFS("index.html", fileSystem)
+		}
+
+		return fileErr
 	}
 }
 
@@ -139,7 +174,7 @@ func bindStaticAdminUI(app core.App, e *echo.Echo) error {
 	e.GET(
 		strings.TrimRight(trailedAdminPath, "/"),
 		func(c echo.Context) error {
-			return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath)
+			return c.Redirect(http.StatusTemporaryRedirect, strings.TrimLeft(trailedAdminPath, "/"))
 		},
 	)
 
@@ -149,21 +184,36 @@ func bindStaticAdminUI(app core.App, e *echo.Echo) error {
 		trailedAdminPath+"*",
 		echo.StaticDirectoryHandler(ui.DistDirFS, false),
 		installerRedirect(app),
+		uiCacheControl(),
 		middleware.Gzip(),
 	)
 
 	return nil
 }
 
-const totalAdminsCacheKey = "totalAdmins"
+func uiCacheControl() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			// add default Cache-Control header for all Admin UI resources
+			// (ignoring the root admin path)
+			if c.Request().URL.Path != trailedAdminPath {
+				c.Response().Header().Set("Cache-Control", "max-age=1209600, stale-while-revalidate=86400")
+			}
 
-func updateTotalAdminsCache(app core.App) error {
+			return next(c)
+		}
+	}
+}
+
+const hasAdminsCacheKey = "@hasAdmins"
+
+func updateHasAdminsCache(app core.App) error {
 	total, err := app.Dao().TotalAdmins()
 	if err != nil {
 		return err
 	}
 
-	app.Cache().Set(totalAdminsCacheKey, total)
+	app.Store().Set(hasAdminsCacheKey, total > 0)
 
 	return nil
 }
@@ -171,12 +221,13 @@ func updateTotalAdminsCache(app core.App) error {
 // installerRedirect redirects the user to the installer admin UI page
 // when the application needs some preliminary configurations to be done.
 func installerRedirect(app core.App) echo.MiddlewareFunc {
-	// keep totalAdminsCacheKey value up-to-date
+	// keep hasAdminsCacheKey value up-to-date
 	app.OnAdminAfterCreateRequest().Add(func(data *core.AdminCreateEvent) error {
-		return updateTotalAdminsCache(app)
+		return updateHasAdminsCache(app)
 	})
+
 	app.OnAdminAfterDeleteRequest().Add(func(data *core.AdminDeleteEvent) error {
-		return updateTotalAdminsCache(app)
+		return updateHasAdminsCache(app)
 	})
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
@@ -187,25 +238,26 @@ func installerRedirect(app core.App) echo.MiddlewareFunc {
 				return next(c)
 			}
 
-			// load into cache (if not already)
-			if !app.Cache().Has(totalAdminsCacheKey) {
-				if err := updateTotalAdminsCache(app); err != nil {
+			hasAdmins := cast.ToBool(app.Store().Get(hasAdminsCacheKey))
+
+			if !hasAdmins {
+				// update the cache to make sure that the admin wasn't created by another process
+				if err := updateHasAdminsCache(app); err != nil {
 					return err
 				}
+				hasAdmins = cast.ToBool(app.Store().Get(hasAdminsCacheKey))
 			}
 
-			totalAdmins := cast.ToInt(app.Cache().Get(totalAdminsCacheKey))
-
 			_, hasInstallerParam := c.Request().URL.Query()["installer"]
 
-			if totalAdmins == 0 && !hasInstallerParam {
+			if !hasAdmins && !hasInstallerParam {
 				// redirect to the installer page
-				return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath+"?installer#")
+				return c.Redirect(http.StatusTemporaryRedirect, "?installer#")
 			}
 
-			if totalAdmins != 0 && hasInstallerParam {
-				// redirect to the home page
-				return c.Redirect(http.StatusTemporaryRedirect, trailedAdminPath+"#/")
+			if hasAdmins && hasInstallerParam {
+				// clear the installer param
+				return c.Redirect(http.StatusTemporaryRedirect, "?")
 			}
 
 			return next(c)

apis/base_test.go

@@ -1,16 +1,23 @@
 package apis_test
 
 import (
+	"database/sql"
 	"errors"
+	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/spf13/cast"
 )
 
 func Test404(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Method:          http.MethodGet,
@@ -49,12 +56,14 @@ func Test404(t *testing.T) {
 }
 
 func TestCustomRoutesAndErrorsHandling(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "custom route",
 			Method: http.MethodGet,
 			Url:    "/custom",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/custom",
@@ -66,11 +75,27 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"test123"},
 		},
+		{
+			Name:   "custom route with url encoded parameter",
+			Method: http.MethodGet,
+			Url:    "/a%2Bb%2Bc",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/:param",
+					Handler: func(c echo.Context) error {
+						return c.String(200, c.PathParam("param"))
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"a+b+c"},
+		},
 		{
 			Name:   "route with HTTPError",
 			Method: http.MethodGet,
 			Url:    "/http-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/http-error",
@@ -86,12 +111,12 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "route with api error",
 			Method: http.MethodGet,
 			Url:    "/api-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/api-error",
 					Handler: func(c echo.Context) error {
-						return rest.NewApiError(500, "test message", errors.New("internal_test"))
+						return apis.NewApiError(500, "test message", errors.New("internal_test"))
 					},
 				})
 			},
@@ -102,7 +127,7 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 			Name:   "route with plain error",
 			Method: http.MethodGet,
 			Url:    "/plain-error",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/plain-error",
@@ -120,3 +145,278 @@ func TestCustomRoutesAndErrorsHandling(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestRemoveTrailingSlashMiddleware(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "non /api/* route (exact match)",
+			Method: http.MethodGet,
+			Url:    "/custom",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "non /api/* route (with trailing slash)",
+			Method: http.MethodGet,
+			Url:    "/custom/",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "/api/* route (exact match)",
+			Method: http.MethodGet,
+			Url:    "/api/custom",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/api/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "/api/* route (with trailing slash)",
+			Method: http.MethodGet,
+			Url:    "/api/custom/",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/api/custom",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestMultiBinder(t *testing.T) {
+	t.Parallel()
+
+	rawJson := `{"name":"test123"}`
+
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		rest.MultipartJsonKey: rawJson,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "non-api group route",
+			Method: "POST",
+			Url:    "/custom",
+			Body:   strings.NewReader(rawJson),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: "POST",
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+
+						if err := c.Bind(data); err != nil {
+							return err
+						}
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return c.NoContent(200)
+					},
+				})
+			},
+			ExpectedStatus: 200,
+		},
+		{
+			Name:   "api group route",
+			Method: "GET",
+			Url:    "/api/admins",
+			Body:   strings.NewReader(rawJson),
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+					return func(c echo.Context) error {
+						// it is not important whether the route handler return an error since
+						// we just need to ensure that the eagerRequestInfoCache was registered
+						next(c)
+
+						// ensure that the body was read at least once
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+						c.Bind(data)
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return nil
+					}
+				})
+			},
+			ExpectedStatus: 200,
+		},
+		{
+			Name:   "custom route with @jsonPayload as multipart body",
+			Method: "POST",
+			Url:    "/custom",
+			Body:   formData,
+			RequestHeaders: map[string]string{
+				"Content-Type": mp.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: "POST",
+					Path:   "/custom",
+					Handler: func(c echo.Context) error {
+						data := &struct {
+							Name string `json:"name"`
+						}{}
+
+						if err := c.Bind(data); err != nil {
+							return err
+						}
+
+						// try to read the body again
+						r := apis.RequestInfo(c)
+						if v := cast.ToString(r.Data["name"]); v != "test123" {
+							t.Fatalf("Expected request data with name %q, got, %q", "test123", v)
+						}
+
+						return c.NoContent(200)
+					},
+				})
+			},
+			ExpectedStatus: 200,
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestErrorHandler(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "apis.ApiError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return apis.NewApiError(418, "test", nil)
+				})
+			},
+			ExpectedStatus:  418,
+			ExpectedContent: []string{`"message":"Test."`},
+		},
+		{
+			Name:   "wrapped apis.ApiError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", apis.NewApiError(418, "test", nil))
+				})
+			},
+			ExpectedStatus:     418,
+			ExpectedContent:    []string{`"message":"Test."`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "echo.HTTPError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return echo.NewHTTPError(418, "test")
+				})
+			},
+			ExpectedStatus:  418,
+			ExpectedContent: []string{`"message":"Test."`},
+		},
+		{
+			Name:   "wrapped echo.HTTPError",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", echo.NewHTTPError(418, "test"))
+				})
+			},
+			ExpectedStatus:     418,
+			ExpectedContent:    []string{`"message":"Test."`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "wrapped sql.ErrNoRows",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123: %w", sql.ErrNoRows)
+				})
+			},
+			ExpectedStatus:     404,
+			ExpectedContent:    []string{`"data":{}`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+		{
+			Name:   "custom error",
+			Method: http.MethodGet,
+			Url:    "/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.GET("/test", func(c echo.Context) error {
+					return fmt.Errorf("example 123")
+				})
+			},
+			ExpectedStatus:     400,
+			ExpectedContent:    []string{`"data":{}`},
+			NotExpectedContent: []string{"example", "123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/collection.go

@@ -7,12 +7,11 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
-// BindCollectionApi registers the collection api endpoints and the corresponding handlers.
-func BindCollectionApi(app core.App, rg *echo.Group) {
+// bindCollectionApi registers the collection api endpoints and the corresponding handlers.
+func bindCollectionApi(app core.App, rg *echo.Group) {
 	api := collectionApi{app: app}
 
 	subGroup := rg.Group("/collections", ActivityLogger(app), RequireAdminAuth())
@@ -30,26 +29,29 @@ type collectionApi struct {
 
 func (api *collectionApi) list(c echo.Context) error {
 	fieldResolver := search.NewSimpleFieldResolver(
-		"id", "created", "updated", "name", "system",
+		"id", "created", "updated", "name", "system", "type",
 	)
 
 	collections := []*models.Collection{}
 
 	result, err := search.NewProvider(fieldResolver).
 		Query(api.app.Dao().CollectionQuery()).
-		ParseAndExec(c.QueryString(), &collections)
+		ParseAndExec(c.QueryParams().Encode(), &collections)
 
 	if err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	event := &core.CollectionsListEvent{
-		HttpContext: c,
-		Collections: collections,
-		Result:      result,
-	}
+	event := new(core.CollectionsListEvent)
+	event.HttpContext = c
+	event.Collections = collections
+	event.Result = result
 
 	return api.app.OnCollectionsListRequest().Trigger(event, func(e *core.CollectionsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.Result)
 	})
 }
@@ -57,15 +59,18 @@ func (api *collectionApi) list(c echo.Context) error {
 func (api *collectionApi) view(c echo.Context) error {
 	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
 	if err != nil || collection == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	event := &core.CollectionViewEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionViewEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	return api.app.OnCollectionViewRequest().Trigger(event, func(e *core.CollectionViewEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.Collection)
 	})
 }
@@ -77,96 +82,97 @@ func (api *collectionApi) create(c echo.Context) error {
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionCreateEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionCreateEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	// create the collection
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
+
 			return api.app.OnCollectionBeforeCreateRequest().Trigger(event, func(e *core.CollectionCreateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to create the collection.", err)
+				if err := next(e.Collection); err != nil {
+					return NewBadRequestError("Failed to create the collection.", err)
 				}
 
-				return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				return api.app.OnCollectionAfterCreateRequest().Trigger(event, func(e *core.CollectionCreateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				})
 			})
 		}
 	})
-
-	if submitErr == nil {
-		api.app.OnCollectionAfterCreateRequest().Trigger(event)
-	}
-
-	return submitErr
 }
 
 func (api *collectionApi) update(c echo.Context) error {
 	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
 	if err != nil || collection == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
 	form := forms.NewCollectionUpsert(api.app, collection)
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionUpdateEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionUpdateEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
 	// update the collection
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Collection]) forms.InterceptorNextFunc[*models.Collection] {
+		return func(m *models.Collection) error {
+			event.Collection = m
+
 			return api.app.OnCollectionBeforeUpdateRequest().Trigger(event, func(e *core.CollectionUpdateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to update the collection.", err)
+				if err := next(e.Collection); err != nil {
+					return NewBadRequestError("Failed to update the collection.", err)
 				}
 
-				return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				return api.app.OnCollectionAfterUpdateRequest().Trigger(event, func(e *core.CollectionUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Collection)
+				})
 			})
 		}
 	})
-
-	if submitErr == nil {
-		api.app.OnCollectionAfterUpdateRequest().Trigger(event)
-	}
-
-	return submitErr
 }
 
 func (api *collectionApi) delete(c echo.Context) error {
 	collection, err := api.app.Dao().FindCollectionByNameOrId(c.PathParam("collection"))
 	if err != nil || collection == nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
-	event := &core.CollectionDeleteEvent{
-		HttpContext: c,
-		Collection:  collection,
-	}
+	event := new(core.CollectionDeleteEvent)
+	event.HttpContext = c
+	event.Collection = collection
 
-	handlerErr := api.app.OnCollectionBeforeDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
+	return api.app.OnCollectionBeforeDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
 		if err := api.app.Dao().DeleteCollection(e.Collection); err != nil {
-			return rest.NewBadRequestError("Failed to delete collection. Make sure that the collection is not referenced by other collections.", err)
+			return NewBadRequestError("Failed to delete collection due to existing dependency.", err)
 		}
 
-		return e.HttpContext.NoContent(http.StatusNoContent)
+		return api.app.OnCollectionAfterDeleteRequest().Trigger(event, func(e *core.CollectionDeleteEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
 	})
-
-	if handlerErr == nil {
-		api.app.OnCollectionAfterDeleteRequest().Trigger(event)
-	}
-
-	return handlerErr
 }
 
 func (api *collectionApi) bulkImport(c echo.Context) error {
@@ -174,32 +180,31 @@ func (api *collectionApi) bulkImport(c echo.Context) error {
 
 	// load request data
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
 	}
 
-	event := &core.CollectionsImportEvent{
-		HttpContext: c,
-		Collections: form.Collections,
-	}
+	event := new(core.CollectionsImportEvent)
+	event.HttpContext = c
+	event.Collections = form.Collections
 
 	// import collections
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
-				form.Collections = e.Collections // ensures that the form always has the latest changes
+	return form.Submit(func(next forms.InterceptorNextFunc[[]*models.Collection]) forms.InterceptorNextFunc[[]*models.Collection] {
+		return func(imports []*models.Collection) error {
+			event.Collections = imports
 
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to import the submitted collections.", err)
+			return api.app.OnCollectionsBeforeImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+				if err := next(e.Collections); err != nil {
+					return NewBadRequestError("Failed to import the submitted collections.", err)
 				}
 
-				return e.HttpContext.NoContent(http.StatusNoContent)
+				return api.app.OnCollectionsAfterImportRequest().Trigger(event, func(e *core.CollectionsImportEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
 			})
 		}
 	})
-
-	if submitErr == nil {
-		api.app.OnCollectionsAfterImportRequest().Trigger(event)
-	}
-
-	return submitErr
 }

apis/file.go

@@ -1,60 +1,161 @@
 package apis
 
 import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"runtime"
+	"strings"
+	"time"
+
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
+	"golang.org/x/sync/singleflight"
 )
 
-var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg"}
+var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif"}
 var defaultThumbSizes = []string{"100x100"}
 
-// BindFileApi registers the file api endpoints and the corresponding handlers.
-func BindFileApi(app core.App, rg *echo.Group) {
-	api := fileApi{app: app}
+// bindFileApi registers the file api endpoints and the corresponding handlers.
+func bindFileApi(app core.App, rg *echo.Group) {
+	api := fileApi{
+		app:             app,
+		thumbGenSem:     semaphore.NewWeighted(int64(runtime.NumCPU() + 2)), // the value is arbitrary chosen and may change in the future
+		thumbGenPending: new(singleflight.Group),
+		thumbGenMaxWait: 60 * time.Second,
+	}
 
 	subGroup := rg.Group("/files", ActivityLogger(app))
+	subGroup.POST("/token", api.fileToken)
+	subGroup.HEAD("/:collection/:recordId/:filename", api.download, LoadCollectionContext(api.app))
 	subGroup.GET("/:collection/:recordId/:filename", api.download, LoadCollectionContext(api.app))
 }
 
 type fileApi struct {
 	app core.App
+
+	// thumbGenSem is a semaphore to prevent too much concurrent
+	// requests generating new thumbs at the same time.
+	thumbGenSem *semaphore.Weighted
+
+	// thumbGenPending represents a group of currently pending
+	// thumb generation processes.
+	thumbGenPending *singleflight.Group
+
+	// thumbGenMaxWait is the maximum waiting time for starting a new
+	// thumb generation process.
+	thumbGenMaxWait time.Duration
+}
+
+func (api *fileApi) fileToken(c echo.Context) error {
+	event := new(core.FileTokenEvent)
+	event.HttpContext = c
+
+	if admin, _ := c.Get(ContextAdminKey).(*models.Admin); admin != nil {
+		event.Model = admin
+		event.Token, _ = tokens.NewAdminFileToken(api.app, admin)
+	} else if record, _ := c.Get(ContextAuthRecordKey).(*models.Record); record != nil {
+		event.Model = record
+		event.Token, _ = tokens.NewRecordFileToken(api.app, record)
+	}
+
+	return api.app.OnFileBeforeTokenRequest().Trigger(event, func(e *core.FileTokenEvent) error {
+		if e.Model == nil || e.Token == "" {
+			return NewBadRequestError("Failed to generate file token.", nil)
+		}
+
+		return api.app.OnFileAfterTokenRequest().Trigger(event, func(e *core.FileTokenEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.JSON(http.StatusOK, map[string]string{
+				"token": e.Token,
+			})
+		})
+	})
 }
 
 func (api *fileApi) download(c echo.Context) error {
 	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
 	if collection == nil {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
 	recordId := c.PathParam("recordId")
 	if recordId == "" {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
-	record, err := api.app.Dao().FindRecordById(collection, recordId, nil)
+	record, err := api.app.Dao().FindRecordById(collection.Id, recordId)
 	if err != nil {
-		return rest.NewNotFoundError("", err)
+		return NewNotFoundError("", err)
 	}
 
 	filename := c.PathParam("filename")
 
 	fileField := record.FindFileFieldByFile(filename)
 	if fileField == nil {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
-	options, _ := fileField.Options.(*schema.FileOptions)
 
-	fs, err := api.app.NewFilesystem()
+	options, ok := fileField.Options.(*schema.FileOptions)
+	if !ok {
+		return NewBadRequestError("", errors.New("Failed to load file options."))
+	}
+
+	// check whether the request is authorized to view the protected file
+	if options.Protected {
+		token := c.QueryParam("token")
+
+		adminOrAuthRecord, _ := api.findAdminOrAuthRecordByFileToken(token)
+
+		// create a copy of the cached request data and adjust it for the current auth model
+		requestInfo := *RequestInfo(c)
+		requestInfo.Context = models.RequestInfoContextProtectedFile
+		requestInfo.Admin = nil
+		requestInfo.AuthRecord = nil
+		if adminOrAuthRecord != nil {
+			if admin, _ := adminOrAuthRecord.(*models.Admin); admin != nil {
+				requestInfo.Admin = admin
+			} else if record, _ := adminOrAuthRecord.(*models.Record); record != nil {
+				requestInfo.AuthRecord = record
+			}
+		}
+
+		if ok, _ := api.app.Dao().CanAccessRecord(record, &requestInfo, record.Collection().ViewRule); !ok {
+			return NewForbiddenError("Insufficient permissions to access the file resource.", nil)
+		}
+	}
+
+	baseFilesPath := record.BaseFilesPath()
+
+	// fetch the original view file field related record
+	if collection.IsView() {
+		fileRecord, err := api.app.Dao().FindRecordByViewFile(collection.Id, fileField.Name, filename)
+		if err != nil {
+			return NewNotFoundError("", fmt.Errorf("Failed to fetch view file field record: %w", err))
+		}
+		baseFilesPath = fileRecord.BaseFilesPath()
+	}
+
+	fsys, err := api.app.NewFilesystem()
 	if err != nil {
-		return rest.NewBadRequestError("Filesystem initialization failure.", err)
+		return NewBadRequestError("Filesystem initialization failure.", err)
 	}
-	defer fs.Close()
+	defer fsys.Close()
 
-	originalPath := record.BaseFilesPath() + "/" + filename
+	originalPath := baseFilesPath + "/" + filename
 	servedPath := originalPath
 	servedName := filename
 
@@ -62,43 +163,114 @@ func (api *fileApi) download(c echo.Context) error {
 	thumbSize := c.QueryParam("thumb")
 	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, options.Thumbs)) {
 		// extract the original file meta attributes and check it existence
-		oAttrs, oAttrsErr := fs.Attributes(originalPath)
+		oAttrs, oAttrsErr := fsys.Attributes(originalPath)
 		if oAttrsErr != nil {
-			return rest.NewNotFoundError("", err)
+			return NewNotFoundError("", err)
 		}
 
 		// check if it is an image
 		if list.ExistInSlice(oAttrs.ContentType, imageContentTypes) {
 			// add thumb size as file suffix
 			servedName = thumbSize + "_" + filename
-			servedPath = record.BaseFilesPath() + "/thumbs_" + filename + "/" + servedName
+			servedPath = baseFilesPath + "/thumbs_" + filename + "/" + servedName
 
-			// check if the thumb exists:
-			// - if doesn't exist - create a new thumb with the specified thumb size
-			// - if exists - compare last modified dates to determine whether the thumb should be recreated
-			tAttrs, tAttrsErr := fs.Attributes(servedPath)
-			if tAttrsErr != nil || oAttrs.ModTime.After(tAttrs.ModTime) {
-				if err := fs.CreateThumb(originalPath, servedPath, thumbSize, false); err != nil {
-					servedPath = originalPath // fallback to the original
+			// create a new thumb if it doesn't exist
+			if exists, _ := fsys.Exists(servedPath); !exists {
+				if err := api.createThumb(c, fsys, originalPath, servedPath, thumbSize); err != nil {
+					api.app.Logger().Warn(
+						"Fallback to original - failed to create thumb "+servedName,
+						slog.Any("error", err),
+						slog.String("original", originalPath),
+						slog.String("thumb", servedPath),
+					)
+
+					// fallback to the original
+					servedName = filename
+					servedPath = originalPath
 				}
 			}
 		}
 	}
 
-	event := &core.FileDownloadEvent{
-		HttpContext: c,
-		Record:      record,
-		Collection:  collection,
-		FileField:   fileField,
-		ServedPath:  servedPath,
-		ServedName:  servedName,
-	}
+	event := new(core.FileDownloadEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.FileField = fileField
+	event.ServedPath = servedPath
+	event.ServedName = servedName
+
+	// clickjacking shouldn't be a concern when serving uploaded files,
+	// so it safe to unset the global X-Frame-Options to allow files embedding
+	// (note: it is out of the hook to allow users to customize the behavior)
+	c.Response().Header().Del("X-Frame-Options")
 
 	return api.app.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadEvent) error {
-		if err := fs.Serve(e.HttpContext.Response(), e.ServedPath, e.ServedName); err != nil {
-			return rest.NewNotFoundError("", err)
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		if err := fsys.Serve(e.HttpContext.Response(), e.HttpContext.Request(), e.ServedPath, e.ServedName); err != nil {
+			return NewNotFoundError("", err)
 		}
 
 		return nil
 	})
 }
+
+func (api *fileApi) findAdminOrAuthRecordByFileToken(fileToken string) (models.Model, error) {
+	fileToken = strings.TrimSpace(fileToken)
+	if fileToken == "" {
+		return nil, errors.New("missing file token")
+	}
+
+	claims, _ := security.ParseUnverifiedJWT(strings.TrimSpace(fileToken))
+	tokenType := cast.ToString(claims["type"])
+
+	switch tokenType {
+	case tokens.TypeAdmin:
+		admin, err := api.app.Dao().FindAdminByToken(
+			fileToken,
+			api.app.Settings().AdminFileToken.Secret,
+		)
+		if err == nil && admin != nil {
+			return admin, nil
+		}
+	case tokens.TypeAuthRecord:
+		record, err := api.app.Dao().FindAuthRecordByToken(
+			fileToken,
+			api.app.Settings().RecordFileToken.Secret,
+		)
+		if err == nil && record != nil {
+			return record, nil
+		}
+	}
+
+	return nil, errors.New("missing or invalid file token")
+}
+
+func (api *fileApi) createThumb(
+	c echo.Context,
+	fsys *filesystem.System,
+	originalPath string,
+	thumbPath string,
+	thumbSize string,
+) error {
+	ch := api.thumbGenPending.DoChan(thumbPath, func() (any, error) {
+		ctx, cancel := context.WithTimeout(c.Request().Context(), api.thumbGenMaxWait)
+		defer cancel()
+
+		if err := api.thumbGenSem.Acquire(ctx, 1); err != nil {
+			return nil, err
+		}
+		defer api.thumbGenSem.Release(1)
+
+		return nil, fsys.CreateThumb(originalPath, thumbPath, thumbSize)
+	})
+
+	res := <-ch
+
+	api.thumbGenPending.Forget(thumbPath)
+
+	return res.Err
+}

apis/file_test.go

@@ -2,21 +2,111 @@ package apis_test
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path"
 	"path/filepath"
 	"runtime"
+	"sync"
 	"testing"
 
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
+func TestFileToken(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			Url:             "/api/files/token",
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+			},
+		},
+		{
+			Name:   "unauthorized with model and token via hook",
+			Method: http.MethodPost,
+			Url:    "/api/files/token",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnFileBeforeTokenRequest().Add(func(e *core.FileTokenEvent) error {
+					record, _ := app.Dao().FindAuthRecordByEmail("users", "test@example.com")
+					e.Model = record
+					e.Token = "test"
+					return nil
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"test"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
+			},
+		},
+		{
+			Name:   "auth record",
+			Method: http.MethodPost,
+			Url:    "/api/files/token",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
+			},
+		},
+		{
+			Name:   "admin",
+			Method: http.MethodPost,
+			Url:    "/api/files/token",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"OnFileBeforeTokenRequest": 1,
+				"OnFileAfterTokenRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
 func TestFileDownload(t *testing.T) {
+	t.Parallel()
+
 	_, currentFile, _, _ := runtime.Caller(0)
 	dataDirRelPath := "../tests/data/"
-	testFilePath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/848a1dea-5ddd-42d6-a00d-030547bffcfe/8fe61d65-6a2e-4f11-87b3-d8a3170bfd4f.txt")
-	testImgPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png")
-	testThumbPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/3f2888f8-075d-49fe-9d09-ea7e951000dc/577bd676-aacb-4072-b7da-99d00ee210a4/thumbs_4881bdef-06b4-4dea-8d97-6125ad242677.png/100x100_4881bdef-06b4-4dea-8d97-6125ad242677.png")
+
+	testFilePath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt")
+	testImgPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png")
+	testThumbCropCenterPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png")
+	testThumbCropTopPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png")
+	testThumbCropBottomPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png")
+	testThumbFitPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png")
+	testThumbZeroWidthPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png")
+	testThumbZeroHeightPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png")
 
 	testFile, fileErr := os.ReadFile(testFilePath)
 	if fileErr != nil {
@@ -28,7 +118,32 @@ func TestFileDownload(t *testing.T) {
 		t.Fatal(imgErr)
 	}
 
-	testThumb, thumbErr := os.ReadFile(testThumbPath)
+	testThumbCropCenter, thumbErr := os.ReadFile(testThumbCropCenterPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropTop, thumbErr := os.ReadFile(testThumbCropTopPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropBottom, thumbErr := os.ReadFile(testThumbCropBottomPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbFit, thumbErr := os.ReadFile(testThumbFitPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroWidth, thumbErr := os.ReadFile(testThumbZeroWidthPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroHeight, thumbErr := os.ReadFile(testThumbZeroHeightPath)
 	if thumbErr != nil {
 		t.Fatal(thumbErr)
 	}
@@ -37,28 +152,28 @@ func TestFileDownload(t *testing.T) {
 		{
 			Name:            "missing collection",
 			Method:          http.MethodGet,
-			Url:             "/api/files/missing/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png",
+			Url:             "/api/files/missing/4q1xlclmfloku33/300_1SEi6Q6U72.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:            "missing record",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/00000000-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png",
+			Url:             "/api/files/_pb_users_auth_/missing/300_1SEi6Q6U72.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:            "missing file",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/00000000-06b4-4dea-8d97-6125ad242677.png",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/missing.png",
 			ExpectedStatus:  404,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
 			Name:            "existing image",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testImg)},
 			ExpectedEvents: map[string]int{
@@ -68,7 +183,7 @@ func TestFileDownload(t *testing.T) {
 		{
 			Name:            "existing image - missing thumb (should fallback to the original)",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=999x999",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testImg)},
 			ExpectedEvents: map[string]int{
@@ -76,11 +191,61 @@ func TestFileDownload(t *testing.T) {
 			},
 		},
 		{
-			Name:            "existing image - existing thumb",
+			Name:            "existing image - existing thumb (crop center)",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/577bd676-aacb-4072-b7da-99d00ee210a4/4881bdef-06b4-4dea-8d97-6125ad242677.png?thumb=100x100",
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
 			ExpectedStatus:  200,
-			ExpectedContent: []string{string(testThumb)},
+			ExpectedContent: []string{string(testThumbCropCenter)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (crop top)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropTop)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (crop bottom)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropBottom)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (fit)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbFit)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (zero width)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroWidth)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "existing image - existing thumb (zero height)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroHeight)},
 			ExpectedEvents: map[string]int{
 				"OnFileDownloadRequest": 1,
 			},
@@ -88,16 +253,222 @@ func TestFileDownload(t *testing.T) {
 		{
 			Name:            "existing non image file - thumb parameter should be ignored",
 			Method:          http.MethodGet,
-			Url:             "/api/files/demo/848a1dea-5ddd-42d6-a00d-030547bffcfe/8fe61d65-6a2e-4f11-87b3-d8a3170bfd4f.txt?thumb=100x100",
+			Url:             "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
 			ExpectedStatus:  200,
 			ExpectedContent: []string{string(testFile)},
 			ExpectedEvents: map[string]int{
 				"OnFileDownloadRequest": 1,
 			},
 		},
+
+		// protected file access checks
+		{
+			Name:            "protected file - expired token",
+			Method:          http.MethodGet,
+			Url:             "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testFile)},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "protected file - admin with expired file token",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImFkbWluIn0.g7Q_3UX6H--JWJ7yt1Hoe-1ugTX1KpbKzdt0zjGSe-E",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:            "protected file - admin with valid file token",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTg5MzQ1MjQ2MSwidHlwZSI6ImFkbWluIn0.LyAMpSfaHVsuUqIlqqEbhDQSdFzoPz_EIDcb2VJMBsU",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "protected file - guest without view access",
+			Method:          http.MethodGet,
+			Url:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "protected file - guest with view access",
+			Method: http.MethodGet,
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
+				// mock public view access
+				c, err := dao.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("")
+				if err := dao.SaveCollection(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "protected file - auth record without view access",
+			Method: http.MethodGet,
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
+				// mock restricted user view access
+				c, err := dao.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("@request.auth.verified = true")
+				if err := dao.SaveCollection(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "protected file - auth record with view access",
+			Method: http.MethodGet,
+			Url:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				dao := daos.New(app.Dao().DB())
+
+				// mock user view access
+				c, err := dao.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("@request.auth.verified = false")
+				if err := dao.SaveCollection(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "protected file in view (view's View API rule failure)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/view1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:            "protected file in view (view's View API rule success)",
+			Method:          http.MethodGet,
+			Url:             "/api/files/view1/84nmscqy84lsi1t/test_d61b33QdDU.txt?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTg5MzQ1MjQ2MSwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwidHlwZSI6ImF1dGhSZWNvcmQifQ.0d_0EO6kfn9ijZIQWAqgRi8Bo1z7MKcg1LQpXhQsEPk",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test"},
+			ExpectedEvents: map[string]int{
+				"OnFileDownloadRequest": 1,
+			},
+		},
 	}
 
 	for _, scenario := range scenarios {
+		// clone for the HEAD test (the same as the original scenario but without body)
+		head := scenario
+		head.Method = http.MethodHead
+		head.Name = ("(HEAD) " + scenario.Name)
+		head.ExpectedContent = nil
+		head.Test(t)
+
+		// regular request test
 		scenario.Test(t)
 	}
 }
+
+func TestConcurrentThumbsGeneration(t *testing.T) {
+	t.Parallel()
+
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	// create a dummy file field collection
+	demo1, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fileField := demo1.Schema.GetFieldByName("file_one")
+	fileField.Options = &schema.FileOptions{
+		Protected: false,
+		MaxSelect: 1,
+		MaxSize:   999999,
+		// new thumbs
+		Thumbs: []string{"111x111", "111x222", "111x333"},
+	}
+	demo1.Schema.AddField(fileField)
+	if err := app.Dao().SaveCollection(demo1); err != nil {
+		t.Fatal(err)
+	}
+
+	fileKey := "wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png"
+
+	e, err := apis.InitApi(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	urls := []string{
+		"/api/files/" + fileKey + "?thumb=111x111",
+		"/api/files/" + fileKey + "?thumb=111x111", // should still result in single thumb
+		"/api/files/" + fileKey + "?thumb=111x222",
+		"/api/files/" + fileKey + "?thumb=111x333",
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(len(urls))
+
+	for _, url := range urls {
+		url := url
+		go func() {
+			defer wg.Done()
+
+			recorder := httptest.NewRecorder()
+
+			req := httptest.NewRequest("GET", url, nil)
+
+			e.ServeHTTP(recorder, req)
+		}()
+	}
+
+	wg.Wait()
+
+	// ensure that all new requested thumbs were created
+	thumbKeys := []string{
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x111_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x222_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x333_" + filepath.Base(fileKey),
+	}
+	for _, k := range thumbKeys {
+		if exists, _ := fsys.Exists(k); !exists {
+			t.Fatalf("Missing thumb %q: %v", k, err)
+		}
+	}
+}

apis/health.go

@@ -0,0 +1,43 @@
+package apis
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// bindHealthApi registers the health api endpoint.
+func bindHealthApi(app core.App, rg *echo.Group) {
+	api := healthApi{app: app}
+
+	subGroup := rg.Group("/health")
+	subGroup.HEAD("", api.healthCheck)
+	subGroup.GET("", api.healthCheck)
+}
+
+type healthApi struct {
+	app core.App
+}
+
+type healthCheckResponse struct {
+	Message string `json:"message"`
+	Code    int    `json:"code"`
+	Data    struct {
+		CanBackup bool `json:"canBackup"`
+	} `json:"data"`
+}
+
+// healthCheck returns a 200 OK response if the server is healthy.
+func (api *healthApi) healthCheck(c echo.Context) error {
+	if c.Request().Method == http.MethodHead {
+		return c.NoContent(http.StatusOK)
+	}
+
+	resp := new(healthCheckResponse)
+	resp.Code = http.StatusOK
+	resp.Message = "API is healthy."
+	resp.Data.CanBackup = !api.app.Store().Has(core.StoreKeyActiveBackup)
+
+	return c.JSON(http.StatusOK, resp)
+}

apis/health_test.go

@@ -0,0 +1,36 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestHealthAPI(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "HEAD health status",
+			Method:         http.MethodHead,
+			Url:            "/api/health",
+			ExpectedStatus: 200,
+		},
+		{
+			Name:           "GET health status",
+			Method:         http.MethodGet,
+			Url:            "/api/health",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"code":200`,
+				`"data":{`,
+				`"canBackup":true`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/logs.go

@@ -7,46 +7,45 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/search"
 )
 
-// BindLogsApi registers the request logs api endpoints.
-func BindLogsApi(app core.App, rg *echo.Group) {
+// bindLogsApi registers the request logs api endpoints.
+func bindLogsApi(app core.App, rg *echo.Group) {
 	api := logsApi{app: app}
 
 	subGroup := rg.Group("/logs", RequireAdminAuth())
-	subGroup.GET("/requests", api.requestsList)
-	subGroup.GET("/requests/stats", api.requestsStats)
-	subGroup.GET("/requests/:id", api.requestView)
+	subGroup.GET("", api.list)
+	subGroup.GET("/stats", api.stats)
+	subGroup.GET("/:id", api.view)
 }
 
 type logsApi struct {
 	app core.App
 }
 
-var requestFilterFields = []string{
+var logFilterFields = []string{
 	"rowid", "id", "created", "updated",
-	"url", "method", "status", "auth",
-	"ip", "referer", "userAgent",
+	"level", "message", "data",
+	`^data\.[\w\.\:]*\w+$`,
 }
 
-func (api *logsApi) requestsList(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) list(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	result, err := search.NewProvider(fieldResolver).
-		Query(api.app.LogsDao().RequestQuery()).
-		ParseAndExec(c.QueryString(), &[]*models.Request{})
+		Query(api.app.LogsDao().LogQuery()).
+		ParseAndExec(c.QueryParams().Encode(), &[]*models.Log{})
 
 	if err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
 	return c.JSON(http.StatusOK, result)
 }
 
-func (api *logsApi) requestsStats(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(requestFilterFields...)
+func (api *logsApi) stats(c echo.Context) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
 
 	filter := c.QueryParam(search.FilterQueryParam)
 
@@ -55,28 +54,28 @@ func (api *logsApi) requestsStats(c echo.Context) error {
 		var err error
 		expr, err = search.FilterData(filter).BuildExpr(fieldResolver)
 		if err != nil {
-			return rest.NewBadRequestError("Invalid filter format.", err)
+			return NewBadRequestError("Invalid filter format.", err)
 		}
 	}
 
-	stats, err := api.app.LogsDao().RequestsStats(expr)
+	stats, err := api.app.LogsDao().LogsStats(expr)
 	if err != nil {
-		return rest.NewBadRequestError("Failed to generate requests stats.", err)
+		return NewBadRequestError("Failed to generate logs stats.", err)
 	}
 
 	return c.JSON(http.StatusOK, stats)
 }
 
-func (api *logsApi) requestView(c echo.Context) error {
+func (api *logsApi) view(c echo.Context) error {
 	id := c.PathParam("id")
 	if id == "" {
-		return rest.NewNotFoundError("", nil)
+		return NewNotFoundError("", nil)
 	}
 
-	request, err := api.app.LogsDao().FindRequestById(id)
-	if err != nil || request == nil {
-		return rest.NewNotFoundError("", err)
+	log, err := api.app.LogsDao().FindLogById(id)
+	if err != nil || log == nil {
+		return NewNotFoundError("", err)
 	}
 
-	return c.JSON(http.StatusOK, request)
+	return c.JSON(http.StatusOK, log)
 }

apis/logs_test.go

@@ -8,21 +8,23 @@ import (
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestRequestsList(t *testing.T) {
+func TestLogsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests",
+			Url:             "/api/logs",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -30,12 +32,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests",
+			Url:    "/api/logs",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -52,12 +54,12 @@ func TestRequestsList(t *testing.T) {
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests?filter=status>200",
+			Url:    "/api/logs?filter=data.status>200",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -77,21 +79,23 @@ func TestRequestsList(t *testing.T) {
 	}
 }
 
-func TestRequestView(t *testing.T) {
+func TestLogView(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -99,12 +103,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (nonexisting request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/missing1-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -114,12 +118,12 @@ func TestRequestView(t *testing.T) {
 		{
 			Name:   "authorized as admin (existing request log)",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Url:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
@@ -135,21 +139,23 @@ func TestRequestView(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
 			Method:          http.MethodGet,
-			Url:             "/api/logs/requests/stats",
+			Url:             "/api/logs/stats",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -157,35 +163,35 @@ func TestRequestsStats(t *testing.T) {
 		{
 			Name:   "authorized as admin",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats",
+			Url:    "/api/logs/stats",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`[{"total":1,"date":"2022-05-01 10:00:00.000"},{"total":1,"date":"2022-05-02 10:00:00.000"}]`,
+				`[{"total":1,"date":"2022-05-01 10:00:00.000Z"},{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`,
 			},
 		},
 		{
 			Name:   "authorized as admin + filter",
 			Method: http.MethodGet,
-			Url:    "/api/logs/requests/stats?filter=status>200",
+			Url:    "/api/logs/stats?filter=data.status>200",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				if err := tests.MockRequestLogsData(app); err != nil {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if err := tests.MockLogsData(app); err != nil {
 					t.Fatal(err)
 				}
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
-				`[{"total":1,"date":"2022-05-02 10:00:00.000"}]`,
+				`[{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`,
 			},
 		},
 	}

apis/middlewares.go

@@ -2,38 +2,42 @@ package apis
 
 import (
 	"fmt"
-	"log"
+	"log/slog"
+	"net"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/routine"
-	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/spf13/cast"
 )
 
 // Common request context keys used by the middlewares and api handlers.
 const (
-	ContextUserKey       string = "user"
 	ContextAdminKey      string = "admin"
+	ContextAuthRecordKey string = "authRecord"
 	ContextCollectionKey string = "collection"
+	ContextExecStartKey  string = "execStart"
 )
 
 // RequireGuestOnly middleware requires a request to NOT have a valid
-// Authorization header set.
+// Authorization header.
 //
-// This middleware is the opposite of [apis.RequireAdminOrUserAuth()].
+// This middleware is the opposite of [apis.RequireAdminOrRecordAuth()].
 func RequireGuestOnly() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			err := rest.NewBadRequestError("The request can be accessed only by guests.", nil)
+			err := NewBadRequestError("The request can be accessed only by guests.", nil)
 
-			user, _ := c.Get(ContextUserKey).(*models.User)
-			if user != nil {
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record != nil {
 				return err
 			}
 
@@ -47,14 +51,57 @@ func RequireGuestOnly() echo.MiddlewareFunc {
 	}
 }
 
-// RequireUserAuth middleware requires a request to have
-// a valid user Authorization header set (aka. `Authorization: User ...`).
-func RequireUserAuth() echo.MiddlewareFunc {
+// RequireRecordAuth middleware requires a request to have
+// a valid record auth Authorization header.
+//
+// The auth record could be from any collection.
+//
+// You can further filter the allowed record auth collections by
+// specifying their names.
+//
+// Example:
+//
+//	apis.RequireRecordAuth()
+//
+// Or:
+//
+//	apis.RequireRecordAuth("users", "supervisors")
+//
+// To restrict the auth record only to the loaded context collection,
+// use [apis.RequireSameContextRecordAuth()] instead.
+func RequireRecordAuth(optCollectionNames ...string) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			user, _ := c.Get(ContextUserKey).(*models.User)
-			if user == nil {
-				return rest.NewUnauthorizedError("The request requires valid user authorization token to be set.", nil)
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires valid record authorization token to be set.", nil)
+			}
+
+			// check record collection name
+			if len(optCollectionNames) > 0 && !list.ExistInSlice(record.Collection().Name, optCollectionNames) {
+				return NewForbiddenError("The authorized record model is not allowed to perform this action.", nil)
+			}
+
+			return next(c)
+		}
+	}
+}
+
+// RequireSameContextRecordAuth middleware requires a request to have
+// a valid record Authorization header.
+//
+// The auth record must be from the same collection already loaded in the context.
+func RequireSameContextRecordAuth() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires valid record authorization token to be set.", nil)
+			}
+
+			collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+			if collection == nil || record.Collection().Id != collection.Id {
+				return NewForbiddenError(fmt.Sprintf("The request requires auth record from %s collection.", record.Collection().Name), nil)
 			}
 
 			return next(c)
@@ -63,13 +110,13 @@ func RequireUserAuth() echo.MiddlewareFunc {
 }
 
 // RequireAdminAuth middleware requires a request to have
-// a valid admin Authorization header set (aka. `Authorization: Admin ...`).
+// a valid admin Authorization header.
 func RequireAdminAuth() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
 			if admin == nil {
-				return rest.NewUnauthorizedError("The request requires admin authorization token to be set.", nil)
+				return NewUnauthorizedError("The request requires valid admin authorization token to be set.", nil)
 			}
 
 			return next(c)
@@ -78,40 +125,48 @@ func RequireAdminAuth() echo.MiddlewareFunc {
 }
 
 // RequireAdminAuthOnlyIfAny middleware requires a request to have
-// a valid admin Authorization header set (aka. `Authorization: Admin ...`)
-// ONLY if the application has at least 1 existing Admin model.
+// a valid admin Authorization header ONLY if the application has
+// at least 1 existing Admin model.
 func RequireAdminAuthOnlyIfAny(app core.App) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			totalAdmins, err := app.Dao().TotalAdmins()
-			if err != nil {
-				return rest.NewBadRequestError("Failed to fetch admins info.", err)
-			}
-
 			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-
-			if admin != nil || totalAdmins == 0 {
+			if admin != nil {
 				return next(c)
 			}
 
-			return rest.NewUnauthorizedError("The request requires admin authorization token to be set.", nil)
+			totalAdmins, err := app.Dao().TotalAdmins()
+			if err != nil {
+				return NewBadRequestError("Failed to fetch admins info.", err)
+			}
+
+			if totalAdmins == 0 {
+				return next(c)
+			}
+
+			return NewUnauthorizedError("The request requires valid admin authorization token to be set.", nil)
 		}
 	}
 }
 
-// RequireAdminOrUserAuth middleware requires a request to have
-// a valid admin or user Authorization header set
-// (aka. `Authorization: Admin ...` or `Authorization: User ...`).
+// RequireAdminOrRecordAuth middleware requires a request to have
+// a valid admin or record Authorization header set.
+//
+// You can further filter the allowed auth record collections by providing their names.
 //
 // This middleware is the opposite of [apis.RequireGuestOnly()].
-func RequireAdminOrUserAuth() echo.MiddlewareFunc {
+func RequireAdminOrRecordAuth(optCollectionNames ...string) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-			user, _ := c.Get(ContextUserKey).(*models.User)
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
 
-			if admin == nil && user == nil {
-				return rest.NewUnauthorizedError("The request requires admin or user authorization token to be set.", nil)
+			if admin == nil && record == nil {
+				return NewUnauthorizedError("The request requires admin or record authorization token to be set.", nil)
+			}
+
+			if record != nil && len(optCollectionNames) > 0 && !list.ExistInSlice(record.Collection().Name, optCollectionNames) {
+				return NewForbiddenError("The authorized record model is not allowed to perform this action.", nil)
 			}
 
 			return next(c)
@@ -120,29 +175,33 @@ func RequireAdminOrUserAuth() echo.MiddlewareFunc {
 }
 
 // RequireAdminOrOwnerAuth middleware requires a request to have
-// a valid admin or user owner Authorization header set
-// (aka. `Authorization: Admin ...` or `Authorization: User ...`).
+// a valid admin or auth record owner Authorization header set.
 //
-// This middleware is similar to [apis.RequireAdminOrUserAuth()] but
-// for the user token expects to have the same id as the path parameter
-// `ownerIdParam` (default to "id").
+// This middleware is similar to [apis.RequireAdminOrRecordAuth()] but
+// for the auth record token expects to have the same id as the path
+// parameter ownerIdParam (default to "id" if empty).
 func RequireAdminOrOwnerAuth(ownerIdParam string) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
+			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+			if admin != nil {
+				return next(c)
+			}
+
+			record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+			if record == nil {
+				return NewUnauthorizedError("The request requires admin or record authorization token to be set.", nil)
+			}
+
 			if ownerIdParam == "" {
 				ownerIdParam = "id"
 			}
-
 			ownerId := c.PathParam(ownerIdParam)
-			admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-			loggedUser, _ := c.Get(ContextUserKey).(*models.User)
 
-			if admin == nil && loggedUser == nil {
-				return rest.NewUnauthorizedError("The request requires admin or user authorization token to be set.", nil)
-			}
-
-			if admin == nil && loggedUser.Id != ownerId {
-				return rest.NewForbiddenError("You are not allowed to perform this request.", nil)
+			// note: it is "safe" to compare only the record id since the auth
+			// record ids are treated as unique across all auth collections
+			if record.Id != ownerId {
+				return NewForbiddenError("You are not allowed to perform this request.", nil)
 			}
 
 			return next(c)
@@ -151,32 +210,41 @@ func RequireAdminOrOwnerAuth(ownerIdParam string) echo.MiddlewareFunc {
 }
 
 // LoadAuthContext middleware reads the Authorization request header
-// and loads the token related user or admin instance into the
+// and loads the token related record or admin instance into the
 // request's context.
 //
-// This middleware is expected to be registered by default for all routes.
+// This middleware is expected to be already registered by default for all routes.
 func LoadAuthContext(app core.App) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			token := c.Request().Header.Get("Authorization")
+			if token == "" {
+				return next(c)
+			}
 
-			if token != "" {
-				if strings.HasPrefix(token, "User ") {
-					user, err := app.Dao().FindUserByToken(
-						token[5:],
-						app.Settings().UserAuthToken.Secret,
-					)
-					if err == nil && user != nil {
-						c.Set(ContextUserKey, user)
-					}
-				} else if strings.HasPrefix(token, "Admin ") {
-					admin, err := app.Dao().FindAdminByToken(
-						token[6:],
-						app.Settings().AdminAuthToken.Secret,
-					)
-					if err == nil && admin != nil {
-						c.Set(ContextAdminKey, admin)
-					}
+			// the schema is not required and it is only for
+			// compatibility with the defaults of some HTTP clients
+			token = strings.TrimPrefix(token, "Bearer ")
+
+			claims, _ := security.ParseUnverifiedJWT(token)
+			tokenType := cast.ToString(claims["type"])
+
+			switch tokenType {
+			case tokens.TypeAdmin:
+				admin, err := app.Dao().FindAdminByToken(
+					token,
+					app.Settings().AdminAuthToken.Secret,
+				)
+				if err == nil && admin != nil {
+					c.Set(ContextAdminKey, admin)
+				}
+			case tokens.TypeAuthRecord:
+				record, err := app.Dao().FindAuthRecordByToken(
+					token,
+					app.Settings().RecordAuthToken.Secret,
+				)
+				if err == nil && record != nil {
+					c.Set(ContextAuthRecordKey, record)
 				}
 			}
 
@@ -187,13 +255,19 @@ func LoadAuthContext(app core.App) echo.MiddlewareFunc {
 
 // LoadCollectionContext middleware finds the collection with related
 // path identifier and loads it into the request context.
-func LoadCollectionContext(app core.App) echo.MiddlewareFunc {
+//
+// Set optCollectionTypes to further filter the found collection by its type.
+func LoadCollectionContext(app core.App, optCollectionTypes ...string) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			if param := c.PathParam("collection"); param != "" {
 				collection, err := app.Dao().FindCollectionByNameOrId(param)
 				if err != nil || collection == nil {
-					return rest.NewNotFoundError("", err)
+					return NewNotFoundError("", err)
+				}
+
+				if len(optCollectionTypes) > 0 && !list.ExistInSlice(collection.Type, optCollectionTypes) {
+					return NewBadRequestError("Unsupported collection type.", nil)
 				}
 
 				c.Set(ContextCollectionKey, collection)
@@ -212,88 +286,136 @@ func LoadCollectionContext(app core.App) echo.MiddlewareFunc {
 func ActivityLogger(app core.App) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			err := next(c)
-
-			// no logs retention
-			if app.Settings().Logs.MaxDays == 0 {
+			if err := next(c); err != nil {
 				return err
 			}
 
-			httpRequest := c.Request()
-			httpResponse := c.Response()
-			status := httpResponse.Status
-			meta := types.JsonMap{}
+			logRequest(app, c, nil)
 
-			if err != nil {
-				switch v := err.(type) {
-				case *echo.HTTPError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.Internal)
-				case *rest.ApiError:
-					status = v.Code
-					meta["errorMessage"] = v.Message
-					meta["errorDetails"] = fmt.Sprint(v.RawData())
-				default:
-					status = http.StatusBadRequest
-					meta["errorMessage"] = v.Error()
-				}
+			return nil
+		}
+	}
+}
+
+func logRequest(app core.App, c echo.Context, err *ApiError) {
+	// no logs retention
+	if app.Settings().Logs.MaxDays == 0 {
+		return
+	}
+
+	attrs := make([]any, 0, 15)
+
+	attrs = append(attrs, slog.String("type", "request"))
+
+	started := cast.ToTime(c.Get(ContextExecStartKey))
+	if !started.IsZero() {
+		attrs = append(attrs, slog.Float64("execTime", float64(time.Since(started))/float64(time.Millisecond)))
+	}
+
+	httpRequest := c.Request()
+	httpResponse := c.Response()
+	method := strings.ToUpper(httpRequest.Method)
+	status := httpResponse.Status
+	requestUri := httpRequest.URL.RequestURI()
+
+	// parse the request error
+	if err != nil {
+		status = err.Code
+		attrs = append(
+			attrs,
+			slog.String("error", err.Message),
+			slog.Any("details", err.RawData()),
+		)
+	}
+
+	requestAuth := models.RequestAuthGuest
+	if c.Get(ContextAuthRecordKey) != nil {
+		requestAuth = models.RequestAuthRecord
+	} else if c.Get(ContextAdminKey) != nil {
+		requestAuth = models.RequestAuthAdmin
+	}
+
+	attrs = append(
+		attrs,
+		slog.String("url", requestUri),
+		slog.String("method", method),
+		slog.Int("status", status),
+		slog.String("auth", requestAuth),
+		slog.String("referer", httpRequest.Referer()),
+		slog.String("userAgent", httpRequest.UserAgent()),
+	)
+
+	if app.Settings().Logs.LogIp {
+		ip, _, _ := net.SplitHostPort(httpRequest.RemoteAddr)
+		attrs = append(
+			attrs,
+			slog.String("userIp", realUserIp(httpRequest, ip)),
+			slog.String("remoteIp", ip),
+		)
+	}
+
+	// don't block on logs write
+	routine.FireAndForget(func() {
+		message := method + " "
+
+		if escaped, err := url.PathUnescape(requestUri); err == nil {
+			message += escaped
+		} else {
+			message += requestUri
+		}
+
+		if err != nil {
+			app.Logger().Error(message, attrs...)
+		} else {
+			app.Logger().Info(message, attrs...)
+		}
+	})
+}
+
+// Returns the "real" user IP from common proxy headers (or fallbackIp if none is found).
+//
+// The returned IP value shouldn't be trusted if not behind a trusted reverse proxy!
+func realUserIp(r *http.Request, fallbackIp string) string {
+	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
+		return ip
+	}
+
+	if ip := r.Header.Get("Fly-Client-IP"); ip != "" {
+		return ip
+	}
+
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
+
+	if ipsList := r.Header.Get("X-Forwarded-For"); ipsList != "" {
+		// extract the first non-empty leftmost-ish ip
+		ips := strings.Split(ipsList, ",")
+		for _, ip := range ips {
+			ip = strings.TrimSpace(ip)
+			if ip != "" {
+				return ip
 			}
+		}
+	}
 
-			requestAuth := models.RequestAuthGuest
-			if c.Get(ContextUserKey) != nil {
-				requestAuth = models.RequestAuthUser
-			} else if c.Get(ContextAdminKey) != nil {
-				requestAuth = models.RequestAuthAdmin
+	return fallbackIp
+}
+
+// @todo consider removing as this may no longer be needed due to the custom rest.MultiBinder.
+//
+// eagerRequestInfoCache ensures that the request data is cached in the request
+// context to allow reading for example the json request body data more than once.
+func eagerRequestInfoCache(app core.App) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			switch c.Request().Method {
+			// currently we are eagerly caching only the requests with body
+			case "POST", "PUT", "PATCH", "DELETE":
+				RequestInfo(c)
 			}
 
-			model := &models.Request{
-				Url:       httpRequest.URL.RequestURI(),
-				Method:    strings.ToLower(httpRequest.Method),
-				Status:    status,
-				Auth:      requestAuth,
-				Ip:        httpRequest.RemoteAddr,
-				Referer:   httpRequest.Referer(),
-				UserAgent: httpRequest.UserAgent(),
-				Meta:      meta,
-			}
-			// set timestamp fields before firing a new go routine
-			model.RefreshCreated()
-			model.RefreshUpdated()
-
-			routine.FireAndForget(func() {
-				attempts := 1
-
-			BeginSave:
-				logErr := app.LogsDao().SaveRequest(model)
-				if logErr != nil {
-					// try one more time after 10s in case of SQLITE_BUSY or "database is locked" error
-					if attempts <= 2 {
-						attempts++
-						time.Sleep(10 * time.Second)
-						goto BeginSave
-					} else if app.IsDebug() {
-						log.Println("Log save failed:", logErr)
-					}
-				}
-
-				// Delete old request logs
-				// ---
-				now := time.Now()
-				lastLogsDeletedAt := cast.ToTime(app.Cache().Get("lastLogsDeletedAt"))
-				daysDiff := now.Sub(lastLogsDeletedAt).Hours() * 24
-
-				if daysDiff > float64(app.Settings().Logs.MaxDays) {
-					deleteErr := app.LogsDao().DeleteOldRequests(now.AddDate(0, 0, -1*app.Settings().Logs.MaxDays))
-					if deleteErr == nil {
-						app.Cache().Set("lastLogsDeletedAt", now)
-					} else if app.IsDebug() {
-						log.Println("Logs delete failed:", deleteErr)
-					}
-				}
-			})
-
-			return err
+			return next(c)
 		}
 	}
 }

apis/middlewares_test.go

@@ -10,15 +10,17 @@ import (
 )
 
 func TestRequireGuestOnly(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
-			Name:   "valid user token",
+			Name:   "valid record token",
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -38,9 +40,9 @@ func TestRequireGuestOnly(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -60,9 +62,9 @@ func TestRequireGuestOnly(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxfQ.HqvpCpM0RAk3Qu9PfCMuZsk_DKh9UYuzFLwXBMTZd1w",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -81,7 +83,7 @@ func TestRequireGuestOnly(t *testing.T) {
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -103,13 +105,15 @@ func TestRequireGuestOnly(t *testing.T) {
 	}
 }
 
-func TestRequireUserAuth(t *testing.T) {
+func TestRequireRecordAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -117,7 +121,7 @@ func TestRequireUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireUserAuth(),
+						apis.RequireRecordAuth(),
 					},
 				})
 			},
@@ -129,9 +133,9 @@ func TestRequireUserAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxfQ.HqvpCpM0RAk3Qu9PfCMuZsk_DKh9UYuzFLwXBMTZd1w",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -139,7 +143,7 @@ func TestRequireUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireUserAuth(),
+						apis.RequireRecordAuth(),
 					},
 				})
 			},
@@ -151,9 +155,9 @@ func TestRequireUserAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -161,7 +165,7 @@ func TestRequireUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireUserAuth(),
+						apis.RequireRecordAuth(),
 					},
 				})
 			},
@@ -169,13 +173,13 @@ func TestRequireUserAuth(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token",
+			Name:   "valid record token",
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -183,7 +187,169 @@ func TestRequireUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireUserAuth(),
+						apis.RequireRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record token with collection not in the restricted list",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireRecordAuth("demo1", "demo2"),
+					},
+				})
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid record token with collection in the restricted list",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireRecordAuth("demo1", "demo2", "users"),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireSameContextRecordAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			Url:    "/my/users/test",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireSameContextRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "expired/invalid token",
+			Method: http.MethodGet,
+			Url:    "/my/users/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxfQ.HqvpCpM0RAk3Qu9PfCMuZsk_DKh9UYuzFLwXBMTZd1w",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireSameContextRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid admin token",
+			Method: http.MethodGet,
+			Url:    "/my/users/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireSameContextRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid record token but from different collection",
+			Method: http.MethodGet,
+			Url:    "/my/users/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.q34IWXrRWsjLvbbVNRfAs_J4SoTHloNBfdGEiLmy-D8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireSameContextRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid record token",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireRecordAuth(),
 					},
 				})
 			},
@@ -198,12 +364,14 @@ func TestRequireUserAuth(t *testing.T) {
 }
 
 func TestRequireAdminAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -223,9 +391,9 @@ func TestRequireAdminAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -241,13 +409,13 @@ func TestRequireAdminAuth(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token",
+			Name:   "valid record token",
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -267,9 +435,9 @@ func TestRequireAdminAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -292,12 +460,14 @@ func TestRequireAdminAuth(t *testing.T) {
 }
 
 func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest (while having at least 1 existing admin)",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -316,7 +486,7 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			Name:   "guest (while having 0 existing admins)",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// delete all admins
 				_, err := app.Dao().DB().NewQuery("DELETE FROM {{_admins}}").Execute()
 				if err != nil {
@@ -342,9 +512,9 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -360,13 +530,13 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token",
+			Name:   "valid record token",
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -386,9 +556,9 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -410,13 +580,15 @@ func TestRequireAdminAuthOnlyIfAny(t *testing.T) {
 	}
 }
 
-func TestRequireAdminOrUserAuth(t *testing.T) {
+func TestRequireAdminOrRecordAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
 			Method: http.MethodGet,
 			Url:    "/my/test",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -424,7 +596,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireAdminOrUserAuth(),
+						apis.RequireAdminOrRecordAuth(),
 					},
 				})
 			},
@@ -436,9 +608,9 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -446,7 +618,7 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireAdminOrUserAuth(),
+						apis.RequireAdminOrRecordAuth(),
 					},
 				})
 			},
@@ -454,13 +626,13 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token",
+			Name:   "valid record token",
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -468,7 +640,51 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireAdminOrUserAuth(),
+						apis.RequireAdminOrRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record token with collection not in the restricted list",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireAdminOrRecordAuth("demo1", "demo2", "clients"),
+					},
+				})
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid record token with collection in the restricted list",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireAdminOrRecordAuth("demo1", "demo2", "users"),
 					},
 				})
 			},
@@ -480,9 +696,9 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/my/test",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test",
@@ -490,7 +706,29 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 						return c.String(200, "test123")
 					},
 					Middlewares: []echo.MiddlewareFunc{
-						apis.RequireAdminOrUserAuth(),
+						apis.RequireAdminOrRecordAuth(),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid admin token + restricted collections list (should be ignored)",
+			Method: http.MethodGet,
+			Url:    "/my/test",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireAdminOrRecordAuth("demo1", "demo2"),
 					},
 				})
 			},
@@ -505,12 +743,14 @@ func TestRequireAdminOrUserAuth(t *testing.T) {
 }
 
 func TestRequireAdminOrOwnerAuth(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:   "guest",
 			Method: http.MethodGet,
-			Url:    "/my/test/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			Url:    "/my/test/4q1xlclmfloku33",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -528,11 +768,11 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 		{
 			Name:   "expired/invalid token",
 			Method: http.MethodGet,
-			Url:    "/my/test/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
+			Url:    "/my/test/4q1xlclmfloku33",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.HkAldxpbn0EybkMfFGQKEJUIYKE5UJA0AjcsrV7Q6Io",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxfQ.HqvpCpM0RAk3Qu9PfCMuZsk_DKh9UYuzFLwXBMTZd1w",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -548,14 +788,13 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token (different user)",
+			Name:   "valid record token (different user)",
 			Method: http.MethodGet,
-			Url:    "/my/test/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
+			Url:    "/my/test/4q1xlclmfloku33",
 			RequestHeaders: map[string]string{
-				// test3@example.com
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImVtYWlsIjoidGVzdDNAZXhhbXBsZS5jb20iLCJpZCI6Ijk3Y2MzZDNkLTZiYTItMzgzZi1iNDJhLTdiYzg0ZDI3NDEwYyIsImV4cCI6MTg5MzUxNTU3Nn0.Q965uvlTxxOsZbACXSgJQNXykYK0TKZ87nyPzemvN4E",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImJnczgyMG4zNjF2ajFxZCIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.tW4NZWZ0mHBgvSZsQ0OOQhWajpUNFPCvNrOF9aCZLZs",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -571,13 +810,35 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "valid user token (owner)",
+			Name:   "valid record token (different collection)",
 			Method: http.MethodGet,
-			Url:    "/my/test/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
+			Url:    "/my/test/4q1xlclmfloku33",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyMjA4OTg1MjYxfQ.q34IWXrRWsjLvbbVNRfAs_J4SoTHloNBfdGEiLmy-D8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/test/:id",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.RequireAdminOrOwnerAuth(""),
+					},
+				})
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "valid record token (owner)",
+			Method: http.MethodGet,
+			Url:    "/my/test/4q1xlclmfloku33",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:id",
@@ -595,11 +856,11 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 		{
 			Name:   "valid admin token",
 			Method: http.MethodGet,
-			Url:    "/my/test/2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			Url:    "/my/test/4q1xlclmfloku33",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				e.AddRoute(echo.Route{
 					Method: http.MethodGet,
 					Path:   "/my/test/:custom",
@@ -620,3 +881,134 @@ func TestRequireAdminOrOwnerAuth(t *testing.T) {
 		scenario.Test(t)
 	}
 }
+
+func TestLoadCollectionContext(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "missing collection",
+			Method: http.MethodGet,
+			Url:    "/my/missing",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app),
+					},
+				})
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			Url:    "/my/demo1",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record token",
+			Method: http.MethodGet,
+			Url:    "/my/demo1",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid admin token",
+			Method: http.MethodGet,
+			Url:    "/my/demo1",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "mismatched type",
+			Method: http.MethodGet,
+			Url:    "/my/demo1",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app, "auth"),
+					},
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "matched type",
+			Method: http.MethodGet,
+			Url:    "/my/users",
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				e.AddRoute(echo.Route{
+					Method: http.MethodGet,
+					Path:   "/my/:collection",
+					Handler: func(c echo.Context) error {
+						return c.String(200, "test123")
+					},
+					Middlewares: []echo.MiddlewareFunc{
+						apis.LoadCollectionContext(app, "auth"),
+					},
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/realtime.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/labstack/echo/v5"
@@ -16,17 +16,19 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/resolvers"
 	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/spf13/cast"
 )
 
-// BindRealtimeApi registers the realtime api endpoints.
-func BindRealtimeApi(app core.App, rg *echo.Group) {
+// bindRealtimeApi registers the realtime api endpoints.
+func bindRealtimeApi(app core.App, rg *echo.Group) {
 	api := realtimeApi{app: app}
 
-	subGroup := rg.Group("/realtime", ActivityLogger(app))
+	subGroup := rg.Group("/realtime")
 	subGroup.GET("", api.connect)
-	subGroup.POST("", api.setSubscriptions)
+	subGroup.POST("", api.setSubscriptions, ActivityLogger(app))
 
 	api.bindEvents()
 }
@@ -43,34 +45,72 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	// register new subscription client
 	client := subscriptions.NewDefaultClient()
 	api.app.SubscriptionsBroker().Register(client)
-	defer api.app.SubscriptionsBroker().Unregister(client.Id())
+	defer func() {
+		disconnectEvent := &core.RealtimeDisconnectEvent{
+			HttpContext: c,
+			Client:      client,
+		}
 
-	c.Response().Header().Set("Content-Type", "text/event-stream; charset=UTF-8")
+		if err := api.app.OnRealtimeDisconnectRequest().Trigger(disconnectEvent); err != nil {
+			api.app.Logger().Debug(
+				"OnRealtimeDisconnectRequest error",
+				slog.String("clientId", client.Id()),
+				slog.String("error", err.Error()),
+			)
+		}
+
+		api.app.SubscriptionsBroker().Unregister(client.Id())
+	}()
+
+	c.Response().Header().Set("Content-Type", "text/event-stream")
 	c.Response().Header().Set("Cache-Control", "no-store")
-	c.Response().Header().Set("Connection", "keep-alive")
+	// https://github.com/pocketbase/pocketbase/discussions/480#discussioncomment-3657640
+	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
+	c.Response().Header().Set("X-Accel-Buffering", "no")
 
-	event := &core.RealtimeConnectEvent{
+	connectEvent := &core.RealtimeConnectEvent{
 		HttpContext: c,
 		Client:      client,
+		IdleTimeout: 5 * time.Minute,
 	}
 
-	if err := api.app.OnRealtimeConnectRequest().Trigger(event); err != nil {
+	if err := api.app.OnRealtimeConnectRequest().Trigger(connectEvent); err != nil {
 		return err
 	}
 
-	if api.app.IsDebug() {
-		log.Printf("Realtime connection establisehd: %s\n", client.Id())
-	}
+	api.app.Logger().Debug("Realtime connection established.", slog.String("clientId", client.Id()))
 
 	// signalize established connection (aka. fire "connect" message)
-	fmt.Fprint(c.Response(), "id:"+client.Id()+"\n")
-	fmt.Fprint(c.Response(), "event:PB_CONNECT\n")
-	fmt.Fprint(c.Response(), "data:{\"clientId\":\""+client.Id()+"\"}\n\n")
-	c.Response().Flush()
+	connectMsgEvent := &core.RealtimeMessageEvent{
+		HttpContext: c,
+		Client:      client,
+		Message: &subscriptions.Message{
+			Name: "PB_CONNECT",
+			Data: []byte(`{"clientId":"` + client.Id() + `"}`),
+		},
+	}
+	connectMsgErr := api.app.OnRealtimeBeforeMessageSend().Trigger(connectMsgEvent, func(e *core.RealtimeMessageEvent) error {
+		w := e.HttpContext.Response()
+		w.Write([]byte("id:" + client.Id() + "\n"))
+		w.Write([]byte("event:" + e.Message.Name + "\n"))
+		w.Write([]byte("data:"))
+		w.Write(e.Message.Data)
+		w.Write([]byte("\n\n"))
+		w.Flush()
+		return api.app.OnRealtimeAfterMessageSend().Trigger(e)
+	})
+	if connectMsgErr != nil {
+		api.app.Logger().Debug(
+			"Realtime connection closed (failed to deliver PB_CONNECT)",
+			slog.String("clientId", client.Id()),
+			slog.String("error", connectMsgErr.Error()),
+		)
+		return nil
+	}
 
 	// start an idle timer to keep track of inactive/forgotten connections
-	idleDuration := 5 * time.Minute
-	idleTimer := time.NewTimer(idleDuration)
+	idleTimeout := connectEvent.IdleTimeout
+	idleTimer := time.NewTimer(idleTimeout)
 	defer idleTimer.Stop()
 
 	for {
@@ -80,25 +120,45 @@ func (api *realtimeApi) connect(c echo.Context) error {
 		case msg, ok := <-client.Channel():
 			if !ok {
 				// channel is closed
-				if api.app.IsDebug() {
-					log.Println("Realtime connection closed (closed channel):", client.Id())
-				}
+				api.app.Logger().Debug(
+					"Realtime connection closed (closed channel)",
+					slog.String("clientId", client.Id()),
+				)
 				return nil
 			}
 
-			w := c.Response()
-			fmt.Fprint(w, "id:"+client.Id()+"\n")
-			fmt.Fprint(w, "event:"+msg.Name+"\n")
-			fmt.Fprint(w, "data:"+msg.Data+"\n\n")
-			w.Flush()
+			msgEvent := &core.RealtimeMessageEvent{
+				HttpContext: c,
+				Client:      client,
+				Message:     &msg,
+			}
+			msgErr := api.app.OnRealtimeBeforeMessageSend().Trigger(msgEvent, func(e *core.RealtimeMessageEvent) error {
+				w := e.HttpContext.Response()
+				w.Write([]byte("id:" + e.Client.Id() + "\n"))
+				w.Write([]byte("event:" + e.Message.Name + "\n"))
+				w.Write([]byte("data:"))
+				w.Write(e.Message.Data)
+				w.Write([]byte("\n\n"))
+				w.Flush()
+				return api.app.OnRealtimeAfterMessageSend().Trigger(msgEvent)
+			})
+			if msgErr != nil {
+				api.app.Logger().Debug(
+					"Realtime connection closed (failed to deliver message)",
+					slog.String("clientId", client.Id()),
+					slog.String("error", msgErr.Error()),
+				)
+				return nil
+			}
 
 			idleTimer.Stop()
-			idleTimer.Reset(idleDuration)
+			idleTimer.Reset(idleTimeout)
 		case <-c.Request().Context().Done():
 			// connection is closed
-			if api.app.IsDebug() {
-				log.Println("Realtime connection closed (cancelled request):", client.Id())
-			}
+			api.app.Logger().Debug(
+				"Realtime connection closed (cancelled request)",
+				slog.String("clientId", client.Id()),
+			)
 			return nil
 		}
 	}
@@ -110,25 +170,25 @@ func (api *realtimeApi) setSubscriptions(c echo.Context) error {
 
 	// read request data
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
 	// validate request data
 	if err := form.Validate(); err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
 	// find subscription client
 	client, err := api.app.SubscriptionsBroker().ClientById(form.ClientId)
 	if err != nil {
-		return rest.NewNotFoundError("Missing or invalid client id.", err)
+		return NewNotFoundError("Missing or invalid client id.", err)
 	}
 
 	// check if the previous request was authorized
 	oldAuthId := extractAuthIdFromGetter(client)
 	newAuthId := extractAuthIdFromGetter(c)
 	if oldAuthId != "" && oldAuthId != newAuthId {
-		return rest.NewForbiddenError("The current and the previous request authorization don't match.", nil)
+		return NewForbiddenError("The current and the previous request authorization don't match.", nil)
 	}
 
 	event := &core.RealtimeSubscribeEvent{
@@ -137,10 +197,10 @@ func (api *realtimeApi) setSubscriptions(c echo.Context) error {
 		Subscriptions: form.Subscriptions,
 	}
 
-	handlerErr := api.app.OnRealtimeBeforeSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeEvent) error {
+	return api.app.OnRealtimeBeforeSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeEvent) error {
 		// update auth state
 		e.Client.Set(ContextAdminKey, e.HttpContext.Get(ContextAdminKey))
-		e.Client.Set(ContextUserKey, e.HttpContext.Get(ContextUserKey))
+		e.Client.Set(ContextAuthRecordKey, e.HttpContext.Get(ContextAuthRecordKey))
 
 		// unsubscribe from any previous existing subscriptions
 		e.Client.Unsubscribe()
@@ -148,147 +208,170 @@ func (api *realtimeApi) setSubscriptions(c echo.Context) error {
 		// subscribe to the new subscriptions
 		e.Client.Subscribe(e.Subscriptions...)
 
-		return e.HttpContext.NoContent(http.StatusNoContent)
-	})
+		api.app.Logger().Debug(
+			"Realtime subscriptions updated.",
+			slog.String("clientId", e.Client.Id()),
+			slog.Any("subscriptions", e.Subscriptions),
+		)
 
-	if handlerErr == nil {
-		api.app.OnRealtimeAfterSubscribeRequest().Trigger(event)
+		return api.app.OnRealtimeAfterSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// updateClientsAuthModel updates the existing clients auth model with the new one (matched by ID).
+func (api *realtimeApi) updateClientsAuthModel(contextKey string, newModel models.Model) error {
+	for _, client := range api.app.SubscriptionsBroker().Clients() {
+		clientModel, _ := client.Get(contextKey).(models.Model)
+		if clientModel != nil &&
+			clientModel.TableName() == newModel.TableName() &&
+			clientModel.GetId() == newModel.GetId() {
+			client.Set(contextKey, newModel)
+		}
 	}
 
-	return handlerErr
+	return nil
+}
+
+// unregisterClientsByAuthModel unregister all clients that has the provided auth model.
+func (api *realtimeApi) unregisterClientsByAuthModel(contextKey string, model models.Model) error {
+	for _, client := range api.app.SubscriptionsBroker().Clients() {
+		clientModel, _ := client.Get(contextKey).(models.Model)
+		if clientModel != nil &&
+			clientModel.TableName() == model.TableName() &&
+			clientModel.GetId() == model.GetId() {
+			api.app.SubscriptionsBroker().Unregister(client.Id())
+		}
+	}
+
+	return nil
 }
 
 func (api *realtimeApi) bindEvents() {
-	userTable := (&models.User{}).TableName()
-	adminTable := (&models.Admin{}).TableName()
-
-	// update user/admin auth state
-	api.app.OnModelAfterUpdate().Add(func(e *core.ModelEvent) error {
-		modelTable := e.Model.TableName()
-
-		var contextKey string
-		switch modelTable {
-		case userTable:
-			contextKey = ContextUserKey
-		case adminTable:
-			contextKey = ContextAdminKey
-		default:
-			return nil
+	// update the clients that has admin or auth record association
+	api.app.OnModelAfterUpdate().PreAdd(func(e *core.ModelEvent) error {
+		if record := api.resolveRecord(e.Model); record != nil && record.Collection().IsAuth() {
+			return api.updateClientsAuthModel(ContextAuthRecordKey, record)
 		}
 
-		for _, client := range api.app.SubscriptionsBroker().Clients() {
-			model, _ := client.Get(contextKey).(models.Model)
-			if model != nil && model.GetId() == e.Model.GetId() {
-				client.Set(contextKey, e.Model)
+		if admin, ok := e.Model.(*models.Admin); ok && admin != nil {
+			return api.updateClientsAuthModel(ContextAdminKey, admin)
+		}
+
+		return nil
+	})
+
+	// remove the client(s) associated to the deleted admin or auth record
+	api.app.OnModelAfterDelete().PreAdd(func(e *core.ModelEvent) error {
+		if collection := api.resolveRecordCollection(e.Model); collection != nil && collection.IsAuth() {
+			return api.unregisterClientsByAuthModel(ContextAuthRecordKey, e.Model)
+		}
+
+		if admin, ok := e.Model.(*models.Admin); ok && admin != nil {
+			return api.unregisterClientsByAuthModel(ContextAdminKey, admin)
+		}
+
+		return nil
+	})
+
+	api.app.OnModelAfterCreate().PreAdd(func(e *core.ModelEvent) error {
+		if record := api.resolveRecord(e.Model); record != nil {
+			if err := api.broadcastRecord("create", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record create",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
-
 		return nil
 	})
 
-	// remove user/admin client(s)
-	api.app.OnModelAfterDelete().Add(func(e *core.ModelEvent) error {
-		modelTable := e.Model.TableName()
-
-		var contextKey string
-		switch modelTable {
-		case userTable:
-			contextKey = ContextUserKey
-		case adminTable:
-			contextKey = ContextAdminKey
-		default:
-			return nil
-		}
-
-		for _, client := range api.app.SubscriptionsBroker().Clients() {
-			model, _ := client.Get(contextKey).(models.Model)
-			if model != nil && model.GetId() == e.Model.GetId() {
-				api.app.SubscriptionsBroker().Unregister(client.Id())
+	api.app.OnModelAfterUpdate().PreAdd(func(e *core.ModelEvent) error {
+		if record := api.resolveRecord(e.Model); record != nil {
+			if err := api.broadcastRecord("update", record, false); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record update",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
 			}
 		}
-
-		return nil
-	})
-
-	api.app.OnModelAfterCreate().Add(func(e *core.ModelEvent) error {
-		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("create", record)
-		}
-		return nil
-	})
-
-	api.app.OnModelAfterUpdate().Add(func(e *core.ModelEvent) error {
-		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("update", record)
-		}
 		return nil
 	})
 
 	api.app.OnModelBeforeDelete().Add(func(e *core.ModelEvent) error {
-		if record, ok := e.Model.(*models.Record); ok {
-			api.broadcastRecord("delete", record)
+		if record := api.resolveRecord(e.Model); record != nil {
+			if err := api.broadcastRecord("delete", record, true); err != nil {
+				api.app.Logger().Debug(
+					"Failed to dry cache record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
+			}
+		}
+		return nil
+	})
+
+	api.app.OnModelAfterDelete().Add(func(e *core.ModelEvent) error {
+		if record := api.resolveRecord(e.Model); record != nil {
+			if err := api.broadcastDryCachedRecord("delete", record); err != nil {
+				api.app.Logger().Debug(
+					"Failed to broadcast record delete",
+					slog.String("id", record.Id),
+					slog.String("collectionName", record.Collection().Name),
+					slog.String("error", err.Error()),
+				)
+			}
 		}
 		return nil
 	})
 }
 
-func (api *realtimeApi) canAccessRecord(client subscriptions.Client, record *models.Record, accessRule *string) bool {
-	admin, _ := client.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		// admins can access everything
-		return true
+// resolveRecord converts *if possible* the provided model interface to a Record.
+// This is usually helpful if the provided model is a custom Record model struct.
+func (api *realtimeApi) resolveRecord(model models.Model) (record *models.Record) {
+	record, _ = model.(*models.Record)
+
+	// check if it is custom Record model struct (ignore "private" tables)
+	if record == nil && !strings.HasPrefix(model.TableName(), "_") {
+		record, _ = api.app.Dao().FindRecordById(model.TableName(), model.GetId())
 	}
 
-	if accessRule == nil {
-		// only admins can access this record
-		return false
-	}
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if *accessRule == "" {
-			return nil // empty public rule
-		}
-
-		// emulate request data
-		requestData := map[string]any{
-			"method": "get",
-			"query":  map[string]any{},
-			"data":   map[string]any{},
-			"user":   nil,
-		}
-		user, _ := client.Get(ContextUserKey).(*models.User)
-		if user != nil {
-			requestData["user"], _ = user.AsMap()
-		}
-
-		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestData)
-		expr, err := search.FilterData(*accessRule).BuildExpr(resolver)
-		if err != nil {
-			return err
-		}
-		resolver.UpdateQuery(q)
-		q.AndWhere(expr)
-
-		return nil
-	}
-
-	foundRecord, err := api.app.Dao().FindRecordById(record.Collection(), record.Id, ruleFunc)
-	if err == nil && foundRecord != nil {
-		return true
-	}
-
-	return false
+	return record
 }
 
+// resolveRecordCollection extracts *if possible* the Collection model from the provided model interface.
+// This is usually helpful if the provided model is a custom Record model struct.
+func (api *realtimeApi) resolveRecordCollection(model models.Model) (collection *models.Collection) {
+	if record, ok := model.(*models.Record); ok {
+		collection = record.Collection()
+	} else if !strings.HasPrefix(model.TableName(), "_") {
+		// check if it is custom Record model struct (ignore "private" tables)
+		collection, _ = api.app.Dao().FindCollectionByNameOrId(model.TableName())
+	}
+
+	return collection
+}
+
+// recordData represents the broadcasted record subscrition message data.
 type recordData struct {
-	Action string         `json:"action"`
-	Record *models.Record `json:"record"`
+	Record any    `json:"record"` /* map or models.Record */
+	Action string `json:"action"`
 }
 
-func (api *realtimeApi) broadcastRecord(action string, record *models.Record) error {
+func (api *realtimeApi) broadcastRecord(action string, record *models.Record, dryCache bool) error {
 	collection := record.Collection()
 	if collection == nil {
-		return errors.New("Record collection not set.")
+		return errors.New("[broadcastRecord] Record collection not set.")
 	}
 
 	clients := api.app.SubscriptionsBroker().Clients()
@@ -296,61 +379,167 @@ func (api *realtimeApi) broadcastRecord(action string, record *models.Record) er
 		return nil // no subscribers
 	}
 
-	// remove the expand from the broadcasted record because we don't
-	// know if the clients have access to view the expanded records
-	cleanRecord := *record
-	cleanRecord.SetExpand(nil)
-
 	subscriptionRuleMap := map[string]*string{
-		(collection.Name + "/" + cleanRecord.Id): collection.ViewRule,
-		(collection.Id + "/" + cleanRecord.Id):   collection.ViewRule,
-		collection.Name:                          collection.ListRule,
-		collection.Id:                            collection.ListRule,
+		(collection.Name + "/" + record.Id + "?"): collection.ViewRule,
+		(collection.Id + "/" + record.Id + "?"):   collection.ViewRule,
+		(collection.Name + "/*?"):                 collection.ListRule,
+		(collection.Id + "/*?"):                   collection.ListRule,
+		// @deprecated: the same      as the wildcard topic but kept for backward compatibility
+		(collection.Name + "?"): collection.ListRule,
+		(collection.Id + "?"):   collection.ListRule,
 	}
 
-	data := &recordData{
-		Action: action,
-		Record: &cleanRecord,
-	}
-
-	serializedData, err := json.Marshal(data)
-	if err != nil {
-		if api.app.IsDebug() {
-			log.Println(err)
-		}
-		return err
-	}
+	dryCacheKey := action + "/" + record.Id
 
 	for _, client := range clients {
-		for subscription, rule := range subscriptionRuleMap {
-			if !client.HasSubscription(subscription) {
+		client := client
+
+		// note: not executed concurrently to avoid races and to ensure
+		// that the access checks are applied for the current record db state
+		for prefix, rule := range subscriptionRuleMap {
+			subs := client.Subscriptions(prefix)
+			if len(subs) == 0 {
 				continue
 			}
 
-			if !api.canAccessRecord(client, data.Record, rule) {
-				continue
-			}
+			for sub, options := range subs {
+				// create a clean record copy without expand and unknown fields
+				// because we don't know yet which exact fields the client subscription has permissions to access
+				cleanRecord := record.CleanCopy()
 
-			msg := subscriptions.Message{
-				Name: subscription,
-				Data: string(serializedData),
-			}
+				// mock request data
+				requestInfo := &models.RequestInfo{
+					Context: models.RequestInfoContextRealtime,
+					Method:  "GET",
+					Query:   options.Query,
+					Headers: options.Headers,
+				}
+				requestInfo.Admin, _ = client.Get(ContextAdminKey).(*models.Admin)
+				requestInfo.AuthRecord, _ = client.Get(ContextAuthRecordKey).(*models.Record)
 
-			client.Channel() <- msg
+				if !api.canAccessRecord(cleanRecord, requestInfo, rule) {
+					continue
+				}
+
+				rawExpand := cast.ToString(options.Query[expandQueryParam])
+				if rawExpand != "" {
+					expandErrs := api.app.Dao().ExpandRecord(cleanRecord, strings.Split(rawExpand, ","), expandFetch(api.app.Dao(), requestInfo))
+					if len(expandErrs) > 0 {
+						api.app.Logger().Debug(
+							"[broadcastRecord] expand errors",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("expand", rawExpand),
+							slog.Any("errors", expandErrs),
+						)
+					}
+				}
+
+				// ignore the auth record email visibility checks
+				// for auth owner, admin or manager
+				if collection.IsAuth() {
+					authId := extractAuthIdFromGetter(client)
+					if authId == cleanRecord.Id {
+						if api.canAccessRecord(cleanRecord, requestInfo, collection.AuthOptions().ManageRule) {
+							cleanRecord.IgnoreEmailVisibility(true)
+						}
+					}
+				}
+
+				data := &recordData{
+					Action: action,
+					Record: cleanRecord,
+				}
+
+				// check fields
+				rawFields := cast.ToString(options.Query[fieldsQueryParam])
+				if rawFields != "" {
+					decoded, err := rest.PickFields(cleanRecord, rawFields)
+					if err == nil {
+						data.Record = decoded
+					} else {
+						api.app.Logger().Debug(
+							"[broadcastRecord] pick fields error",
+							slog.String("id", cleanRecord.Id),
+							slog.String("collectionName", cleanRecord.Collection().Name),
+							slog.String("sub", sub),
+							slog.String("fields", rawFields),
+							slog.String("error", err.Error()),
+						)
+					}
+				}
+
+				dataBytes, err := json.Marshal(data)
+				if err != nil {
+					api.app.Logger().Debug(
+						"[broadcastRecord] data marshal error",
+						slog.String("id", cleanRecord.Id),
+						slog.String("collectionName", cleanRecord.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+					continue
+				}
+
+				msg := subscriptions.Message{
+					Name: sub,
+					Data: dataBytes,
+				}
+
+				if dryCache {
+					messages, ok := client.Get(dryCacheKey).([]subscriptions.Message)
+					if !ok {
+						messages = []subscriptions.Message{msg}
+					} else {
+						messages = append(messages, msg)
+					}
+					client.Set(dryCacheKey, messages)
+				} else {
+					routine.FireAndForget(func() {
+						client.Send(msg)
+					})
+				}
+			}
 		}
 	}
 
 	return nil
 }
 
+// broadcastDryCachedRecord broadcasts all cached record related messages.
+func (api *realtimeApi) broadcastDryCachedRecord(action string, record *models.Record) error {
+	key := action + "/" + record.Id
+
+	clients := api.app.SubscriptionsBroker().Clients()
+
+	for _, client := range clients {
+		messages, ok := client.Get(key).([]subscriptions.Message)
+		if !ok {
+			continue
+		}
+
+		client.Unset(key)
+
+		client := client
+
+		routine.FireAndForget(func() {
+			for _, msg := range messages {
+				client.Send(msg)
+			}
+		})
+	}
+
+	return nil
+}
+
 type getter interface {
 	Get(string) any
 }
 
 func extractAuthIdFromGetter(val getter) string {
-	user, _ := val.Get(ContextUserKey).(*models.User)
-	if user != nil {
-		return user.Id
+	record, _ := val.Get(ContextAuthRecordKey).(*models.Record)
+	if record != nil {
+		return record.Id
 	}
 
 	admin, _ := val.Get(ContextAdminKey).(*models.Admin)
@@ -360,3 +549,45 @@ func extractAuthIdFromGetter(val getter) string {
 
 	return ""
 }
+
+// canAccessRecord checks if the subscription client has access to the specified record model.
+func (api *realtimeApi) canAccessRecord(
+	record *models.Record,
+	requestInfo *models.RequestInfo,
+	accessRule *string,
+) bool {
+	// check the access rule
+	// ---
+	if ok, _ := api.app.Dao().CanAccessRecord(record, requestInfo, accessRule); !ok {
+		return false
+	}
+
+	// check the subscription client-side filter (if any)
+	// ---
+	filter := cast.ToString(requestInfo.Query[search.FilterQueryParam])
+	if filter == "" {
+		return true // no further checks needed
+	}
+
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
+		return false
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), record.Collection(), requestInfo, false)
+
+		expr, err := search.FilterData(filter).BuildExpr(resolver)
+		if err != nil {
+			return err
+		}
+		q.AndWhere(expr)
+
+		resolver.UpdateQuery(q)
+
+		return nil
+	}
+
+	_, err := api.app.Dao().FindRecordById(record.Collection().Id, record.Id, ruleFunc)
+
+	return err == nil
+}

apis/realtime_test.go

@@ -1,15 +1,20 @@
 package apis_test
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )
 
@@ -18,6 +23,7 @@ func TestRealtimeConnect(t *testing.T) {
 		{
 			Method:         http.MethodGet,
 			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
 				`id:`,
@@ -25,9 +31,59 @@ func TestRealtimeConnect(t *testing.T) {
 				`data:{"clientId":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnRealtimeConnectRequest": 1,
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeAfterMessageSend":  1,
+				"OnRealtimeDisconnectRequest": 1,
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "PB_CONNECT interrupt",
+			Method:         http.MethodGet,
+			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeDisconnectRequest": 1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnRealtimeBeforeMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+					if e.Message.Name == "PB_CONNECT" {
+						return errors.New("PB_CONNECT error")
+					}
+					return nil
+				})
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "Skipping/ignoring messages",
+			Method:         http.MethodGet,
+			Url:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeDisconnectRequest": 1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnRealtimeBeforeMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+					return hook.StopPropagation
+				})
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				if len(app.SubscriptionsBroker().Clients()) != 0 {
 					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
 				}
@@ -46,7 +102,7 @@ func TestRealtimeSubscribe(t *testing.T) {
 	resetClient := func() {
 		client.Unsubscribe()
 		client.Set(apis.ContextAdminKey, nil)
-		client.Set(apis.ContextUserKey, nil)
+		client.Set(apis.ContextAuthRecordKey, nil)
 	}
 
 	scenarios := []tests.ApiScenario{
@@ -68,11 +124,11 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				client.Subscribe("test0")
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				if len(client.Subscriptions()) != 0 {
 					t.Errorf("Expected no subscriptions, got %v", client.Subscriptions())
 				}
@@ -89,11 +145,11 @@ func TestRealtimeSubscribe(t *testing.T) {
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				client.Subscribe("test0")
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				expectedSubs := []string{"test1", "test2"}
 				if len(expectedSubs) != len(client.Subscriptions()) {
 					t.Errorf("Expected subscriptions %v, got %v", expectedSubs, client.Subscriptions())
@@ -113,17 +169,17 @@ func TestRealtimeSubscribe(t *testing.T) {
 			Url:    "/api/realtime",
 			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
 				admin, _ := client.Get(apis.ContextAdminKey).(*models.Admin)
 				if admin == nil {
 					t.Errorf("Expected admin auth model, got nil")
@@ -132,25 +188,25 @@ func TestRealtimeSubscribe(t *testing.T) {
 			},
 		},
 		{
-			Name:   "existing client - authorized user",
+			Name:   "existing client - authorized record",
 			Method: http.MethodPost,
 			Url:    "/api/realtime",
 			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
 				"OnRealtimeBeforeSubscribeRequest": 1,
 				"OnRealtimeAfterSubscribeRequest":  1,
 			},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				user, _ := client.Get(apis.ContextUserKey).(*models.User)
-				if user == nil {
-					t.Errorf("Expected user auth model, got nil")
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.ContextAuthRecordKey).(*models.Record)
+				if authRecord == nil {
+					t.Errorf("Expected auth record model, got nil")
 				}
 				resetClient()
 			},
@@ -161,21 +217,21 @@ func TestRealtimeSubscribe(t *testing.T) {
 			Url:    "/api/realtime",
 			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  403,
 			ExpectedContent: []string{`"data":{}`},
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				initialAuth := &models.User{}
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				initialAuth := &models.Record{}
 				initialAuth.RefreshId()
-				client.Set(apis.ContextUserKey, initialAuth)
+				client.Set(apis.ContextAuthRecordKey, initialAuth)
 
 				app.SubscriptionsBroker().Register(client)
 			},
-			AfterFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				user, _ := client.Get(apis.ContextUserKey).(*models.User)
-				if user == nil {
-					t.Errorf("Expected user auth model, got nil")
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.ContextAuthRecordKey).(*models.Record)
+				if authRecord == nil {
+					t.Errorf("Expected auth record model, got nil")
 				}
 				resetClient()
 			},
@@ -187,55 +243,61 @@ func TestRealtimeSubscribe(t *testing.T) {
 	}
 }
 
-func TestRealtimeUserDeleteEvent(t *testing.T) {
+func TestRealtimeAuthRecordDeleteEvent(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
 	apis.InitApi(testApp)
 
-	user, err := testApp.Dao().FindUserByEmail("test@example.com")
+	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextUserKey, user)
+	client.Set(apis.ContextAuthRecordKey, authRecord)
 	testApp.SubscriptionsBroker().Register(client)
 
-	testApp.OnModelAfterDelete().Trigger(&core.ModelEvent{Dao: testApp.Dao(), Model: user})
+	e := new(core.ModelEvent)
+	e.Dao = testApp.Dao()
+	e.Model = authRecord
+	testApp.OnModelAfterDelete().Trigger(e)
 
 	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
 		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
 	}
 }
 
-func TestRealtimeUserUpdateEvent(t *testing.T) {
+func TestRealtimeAuthRecordUpdateEvent(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
 	apis.InitApi(testApp)
 
-	user1, err := testApp.Dao().FindUserByEmail("test@example.com")
+	authRecord1, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	client := subscriptions.NewDefaultClient()
-	client.Set(apis.ContextUserKey, user1)
+	client.Set(apis.ContextAuthRecordKey, authRecord1)
 	testApp.SubscriptionsBroker().Register(client)
 
-	// refetch the user and change its email
-	user2, err := testApp.Dao().FindUserByEmail("test@example.com")
+	// refetch the authRecord and change its email
+	authRecord2, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
-	user2.Email = "new@example.com"
+	authRecord2.SetEmail("new@example.com")
 
-	testApp.OnModelAfterUpdate().Trigger(&core.ModelEvent{Dao: testApp.Dao(), Model: user2})
+	e := new(core.ModelEvent)
+	e.Dao = testApp.Dao()
+	e.Model = authRecord2
+	testApp.OnModelAfterUpdate().Trigger(e)
 
-	clientUser, _ := client.Get(apis.ContextUserKey).(*models.User)
-	if clientUser.Email != user2.Email {
-		t.Fatalf("Expected user with email %q, got %q", user2.Email, clientUser.Email)
+	clientAuthRecord, _ := client.Get(apis.ContextAuthRecordKey).(*models.Record)
+	if clientAuthRecord.Email() != authRecord2.Email() {
+		t.Fatalf("Expected authRecord with email %q, got %q", authRecord2.Email(), clientAuthRecord.Email())
 	}
 }
 
@@ -254,7 +316,10 @@ func TestRealtimeAdminDeleteEvent(t *testing.T) {
 	client.Set(apis.ContextAdminKey, admin)
 	testApp.SubscriptionsBroker().Register(client)
 
-	testApp.OnModelAfterDelete().Trigger(&core.ModelEvent{Dao: testApp.Dao(), Model: admin})
+	e := new(core.ModelEvent)
+	e.Dao = testApp.Dao()
+	e.Model = admin
+	testApp.OnModelAfterDelete().Trigger(e)
 
 	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
 		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
@@ -276,17 +341,113 @@ func TestRealtimeAdminUpdateEvent(t *testing.T) {
 	client.Set(apis.ContextAdminKey, admin1)
 	testApp.SubscriptionsBroker().Register(client)
 
-	// refetch the user and change its email
+	// refetch the authRecord and change its email
 	admin2, err := testApp.Dao().FindAdminByEmail("test@example.com")
 	if err != nil {
 		t.Fatal(err)
 	}
 	admin2.Email = "new@example.com"
 
-	testApp.OnModelAfterUpdate().Trigger(&core.ModelEvent{Dao: testApp.Dao(), Model: admin2})
+	e := new(core.ModelEvent)
+	e.Dao = testApp.Dao()
+	e.Model = admin2
+	testApp.OnModelAfterUpdate().Trigger(e)
 
 	clientAdmin, _ := client.Get(apis.ContextAdminKey).(*models.Admin)
 	if clientAdmin.Email != admin2.Email {
-		t.Fatalf("Expected user with email %q, got %q", admin2.Email, clientAdmin.Email)
+		t.Fatalf("Expected authRecord with email %q, got %q", admin2.Email, clientAdmin.Email)
+	}
+}
+
+// Custom auth record model struct
+// -------------------------------------------------------------------
+var _ models.Model = (*CustomUser)(nil)
+
+type CustomUser struct {
+	models.BaseModel
+
+	Email string `db:"email" json:"email"`
+}
+
+func (m *CustomUser) TableName() string {
+	return "users" // the name of your collection
+}
+
+func findCustomUserByEmail(dao *daos.Dao, email string) (*CustomUser, error) {
+	model := &CustomUser{}
+
+	err := dao.ModelQuery(model).
+		AndWhere(dbx.HashExp{"email": email}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	apis.InitApi(testApp)
+
+	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client := subscriptions.NewDefaultClient()
+	client.Set(apis.ContextAuthRecordKey, authRecord)
+	testApp.SubscriptionsBroker().Register(client)
+
+	// refetch the authRecord as CustomUser
+	customUser, err := findCustomUserByEmail(testApp.Dao(), "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// delete the custom user (should unset the client auth record)
+	if err := testApp.Dao().Delete(customUser); err != nil {
+		t.Fatal(err)
+	}
+
+	if len(testApp.SubscriptionsBroker().Clients()) != 0 {
+		t.Fatalf("Expected no subscription clients, found %d", len(testApp.SubscriptionsBroker().Clients()))
+	}
+}
+
+func TestRealtimeCustomAuthModelUpdateEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	apis.InitApi(testApp)
+
+	authRecord, err := testApp.Dao().FindFirstRecordByData("users", "email", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client := subscriptions.NewDefaultClient()
+	client.Set(apis.ContextAuthRecordKey, authRecord)
+	testApp.SubscriptionsBroker().Register(client)
+
+	// refetch the authRecord as CustomUser
+	customUser, err := findCustomUserByEmail(testApp.Dao(), "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// change its email
+	customUser.Email = "new@example.com"
+	if err := testApp.Dao().Save(customUser); err != nil {
+		t.Fatal(err)
+	}
+
+	clientAuthRecord, _ := client.Get(apis.ContextAuthRecordKey).(*models.Record)
+	if clientAuthRecord.Email() != customUser.Email {
+		t.Fatalf("Expected authRecord with email %q, got %q", customUser.Email, clientAuthRecord.Email())
 	}
 }

apis/record.go

@@ -1,454 +0,0 @@
-package apis
-
-import (
-	"fmt"
-	"log"
-	"net/http"
-	"strings"
-
-	"github.com/labstack/echo/v5"
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/daos"
-	"github.com/pocketbase/pocketbase/forms"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/resolvers"
-	"github.com/pocketbase/pocketbase/tools/rest"
-	"github.com/pocketbase/pocketbase/tools/search"
-)
-
-const expandQueryParam = "expand"
-
-// BindRecordApi registers the record api endpoints and the corresponding handlers.
-func BindRecordApi(app core.App, rg *echo.Group) {
-	api := recordApi{app: app}
-
-	subGroup := rg.Group(
-		"/collections/:collection/records",
-		ActivityLogger(app),
-		LoadCollectionContext(app),
-	)
-
-	subGroup.GET("", api.list)
-	subGroup.POST("", api.create)
-	subGroup.GET("/:id", api.view)
-	subGroup.PATCH("/:id", api.update)
-	subGroup.DELETE("/:id", api.delete)
-}
-
-type recordApi struct {
-	app core.App
-}
-
-func (api *recordApi) list(c echo.Context) error {
-	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
-	if collection == nil {
-		return rest.NewNotFoundError("", "Missing collection context.")
-	}
-
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin == nil && collection.ListRule == nil {
-		// only admins can access if the rule is nil
-		return rest.NewForbiddenError("Only admins can perform this action.", nil)
-	}
-
-	// forbid users and guests to query special filter/sort fields
-	if err := api.checkForForbiddenQueryFields(c); err != nil {
-		return err
-	}
-
-	requestData := api.exportRequestData(c)
-
-	fieldsResolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData)
-
-	searchProvider := search.NewProvider(fieldsResolver).
-		Query(api.app.Dao().RecordQuery(collection)).
-		CountColumn(fmt.Sprintf("%s.id", api.app.Dao().DB().QuoteSimpleColumnName(collection.Name)))
-
-	if admin == nil && collection.ListRule != nil {
-		searchProvider.AddFilter(search.FilterData(*collection.ListRule))
-	}
-
-	var rawRecords = []dbx.NullStringMap{}
-	result, err := searchProvider.ParseAndExec(c.QueryString(), &rawRecords)
-	if err != nil {
-		return rest.NewBadRequestError("Invalid filter parameters.", err)
-	}
-
-	records := models.NewRecordsFromNullStringMaps(collection, rawRecords)
-
-	// expand records relations
-	expands := strings.Split(c.QueryParam(expandQueryParam), ",")
-	if len(expands) > 0 {
-		failed := api.app.Dao().ExpandRecords(
-			records,
-			expands,
-			api.expandFunc(c, requestData),
-		)
-		if len(failed) > 0 && api.app.IsDebug() {
-			log.Println("Failed to expand relations: ", failed)
-		}
-	}
-
-	result.Items = records
-
-	event := &core.RecordsListEvent{
-		HttpContext: c,
-		Collection:  collection,
-		Records:     records,
-		Result:      result,
-	}
-
-	return api.app.OnRecordsListRequest().Trigger(event, func(e *core.RecordsListEvent) error {
-		return e.HttpContext.JSON(http.StatusOK, e.Result)
-	})
-}
-
-func (api *recordApi) view(c echo.Context) error {
-	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
-	if collection == nil {
-		return rest.NewNotFoundError("", "Missing collection context.")
-	}
-
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin == nil && collection.ViewRule == nil {
-		// only admins can access if the rule is nil
-		return rest.NewForbiddenError("Only admins can perform this action.", nil)
-	}
-
-	recordId := c.PathParam("id")
-	if recordId == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	requestData := api.exportRequestData(c)
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if admin == nil && collection.ViewRule != nil && *collection.ViewRule != "" {
-			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData)
-			expr, err := search.FilterData(*collection.ViewRule).BuildExpr(resolver)
-			if err != nil {
-				return err
-			}
-			resolver.UpdateQuery(q)
-			q.AndWhere(expr)
-		}
-		return nil
-	}
-
-	record, fetchErr := api.app.Dao().FindRecordById(collection, recordId, ruleFunc)
-	if fetchErr != nil || record == nil {
-		return rest.NewNotFoundError("", fetchErr)
-	}
-
-	// expand record relations
-	failed := api.app.Dao().ExpandRecord(
-		record,
-		strings.Split(c.QueryParam(expandQueryParam), ","),
-		api.expandFunc(c, requestData),
-	)
-	if len(failed) > 0 && api.app.IsDebug() {
-		log.Println("Failed to expand relations: ", failed)
-	}
-
-	event := &core.RecordViewEvent{
-		HttpContext: c,
-		Record:      record,
-	}
-
-	return api.app.OnRecordViewRequest().Trigger(event, func(e *core.RecordViewEvent) error {
-		return e.HttpContext.JSON(http.StatusOK, e.Record)
-	})
-}
-
-func (api *recordApi) create(c echo.Context) error {
-	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
-	if collection == nil {
-		return rest.NewNotFoundError("", "Missing collection context.")
-	}
-
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin == nil && collection.CreateRule == nil {
-		// only admins can access if the rule is nil
-		return rest.NewForbiddenError("Only admins can perform this action.", nil)
-	}
-
-	requestData := api.exportRequestData(c)
-
-	// temporary save the record and check it against the create rule
-	if admin == nil && collection.CreateRule != nil && *collection.CreateRule != "" {
-		ruleFunc := func(q *dbx.SelectQuery) error {
-			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData)
-			expr, err := search.FilterData(*collection.CreateRule).BuildExpr(resolver)
-			if err != nil {
-				return err
-			}
-			resolver.UpdateQuery(q)
-			q.AndWhere(expr)
-			return nil
-		}
-
-		testRecord := models.NewRecord(collection)
-		testForm := forms.NewRecordUpsert(api.app, testRecord)
-		if err := testForm.LoadData(c.Request()); err != nil {
-			return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-		}
-
-		testErr := testForm.DrySubmit(func(txDao *daos.Dao) error {
-			_, fetchErr := txDao.FindRecordById(collection, testRecord.Id, ruleFunc)
-			return fetchErr
-		})
-		if testErr != nil {
-			return rest.NewBadRequestError("Failed to create record.", testErr)
-		}
-	}
-
-	record := models.NewRecord(collection)
-	form := forms.NewRecordUpsert(api.app, record)
-
-	// load request
-	if err := form.LoadData(c.Request()); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := &core.RecordCreateEvent{
-		HttpContext: c,
-		Record:      record,
-	}
-
-	// create the record
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnRecordBeforeCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to create record.", err)
-				}
-
-				// expand record relations
-				failed := api.app.Dao().ExpandRecord(
-					e.Record,
-					strings.Split(e.HttpContext.QueryParam(expandQueryParam), ","),
-					api.expandFunc(e.HttpContext, requestData),
-				)
-				if len(failed) > 0 && api.app.IsDebug() {
-					log.Println("Failed to expand relations: ", failed)
-				}
-
-				return e.HttpContext.JSON(http.StatusOK, e.Record)
-			})
-		}
-	})
-
-	if submitErr == nil {
-		api.app.OnRecordAfterCreateRequest().Trigger(event)
-	}
-
-	return submitErr
-}
-
-func (api *recordApi) update(c echo.Context) error {
-	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
-	if collection == nil {
-		return rest.NewNotFoundError("", "Missing collection context.")
-	}
-
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin == nil && collection.UpdateRule == nil {
-		// only admins can access if the rule is nil
-		return rest.NewForbiddenError("Only admins can perform this action.", nil)
-	}
-
-	recordId := c.PathParam("id")
-	if recordId == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	requestData := api.exportRequestData(c)
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if admin == nil && collection.UpdateRule != nil && *collection.UpdateRule != "" {
-			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData)
-			expr, err := search.FilterData(*collection.UpdateRule).BuildExpr(resolver)
-			if err != nil {
-				return err
-			}
-			resolver.UpdateQuery(q)
-			q.AndWhere(expr)
-		}
-		return nil
-	}
-
-	// fetch record
-	record, fetchErr := api.app.Dao().FindRecordById(collection, recordId, ruleFunc)
-	if fetchErr != nil || record == nil {
-		return rest.NewNotFoundError("", fetchErr)
-	}
-
-	form := forms.NewRecordUpsert(api.app, record)
-
-	// load request
-	if err := form.LoadData(c.Request()); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := &core.RecordUpdateEvent{
-		HttpContext: c,
-		Record:      record,
-	}
-
-	// update the record
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnRecordBeforeUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to update record.", err)
-				}
-
-				// expand record relations
-				failed := api.app.Dao().ExpandRecord(
-					e.Record,
-					strings.Split(e.HttpContext.QueryParam(expandQueryParam), ","),
-					api.expandFunc(e.HttpContext, requestData),
-				)
-				if len(failed) > 0 && api.app.IsDebug() {
-					log.Println("Failed to expand relations: ", failed)
-				}
-
-				return e.HttpContext.JSON(http.StatusOK, e.Record)
-			})
-		}
-	})
-
-	if submitErr == nil {
-		api.app.OnRecordAfterUpdateRequest().Trigger(event)
-	}
-
-	return submitErr
-}
-
-func (api *recordApi) delete(c echo.Context) error {
-	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
-	if collection == nil {
-		return rest.NewNotFoundError("", "Missing collection context.")
-	}
-
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin == nil && collection.DeleteRule == nil {
-		// only admins can access if the rule is nil
-		return rest.NewForbiddenError("Only admins can perform this action.", nil)
-	}
-
-	recordId := c.PathParam("id")
-	if recordId == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	requestData := api.exportRequestData(c)
-
-	ruleFunc := func(q *dbx.SelectQuery) error {
-		if admin == nil && collection.DeleteRule != nil && *collection.DeleteRule != "" {
-			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestData)
-			expr, err := search.FilterData(*collection.DeleteRule).BuildExpr(resolver)
-			if err != nil {
-				return err
-			}
-			resolver.UpdateQuery(q)
-			q.AndWhere(expr)
-		}
-		return nil
-	}
-
-	record, fetchErr := api.app.Dao().FindRecordById(collection, recordId, ruleFunc)
-	if fetchErr != nil || record == nil {
-		return rest.NewNotFoundError("", fetchErr)
-	}
-
-	event := &core.RecordDeleteEvent{
-		HttpContext: c,
-		Record:      record,
-	}
-
-	handlerErr := api.app.OnRecordBeforeDeleteRequest().Trigger(event, func(e *core.RecordDeleteEvent) error {
-		// delete the record
-		if err := api.app.Dao().DeleteRecord(e.Record); err != nil {
-			return rest.NewBadRequestError("Failed to delete record. Make sure that the record is not part of a required relation reference.", err)
-		}
-
-		return e.HttpContext.NoContent(http.StatusNoContent)
-	})
-
-	if handlerErr == nil {
-		api.app.OnRecordAfterDeleteRequest().Trigger(event)
-	}
-
-	return handlerErr
-}
-
-func (api *recordApi) exportRequestData(c echo.Context) map[string]any {
-	result := map[string]any{}
-	queryParams := map[string]any{}
-	bodyData := map[string]any{}
-	method := c.Request().Method
-
-	echo.BindQueryParams(c, &queryParams)
-
-	rest.BindBody(c, &bodyData)
-
-	result["method"] = method
-	result["query"] = queryParams
-	result["data"] = bodyData
-	result["user"] = nil
-
-	loggedUser, _ := c.Get(ContextUserKey).(*models.User)
-	if loggedUser != nil {
-		result["user"], _ = loggedUser.AsMap()
-	}
-
-	return result
-}
-
-func (api *recordApi) checkForForbiddenQueryFields(c echo.Context) error {
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-	if admin != nil {
-		return nil // admins are allowed to query everything
-	}
-
-	decodedQuery := c.QueryParam(search.FilterQueryParam) + c.QueryParam(search.SortQueryParam)
-	forbiddenFields := []string{"@collection.", "@request."}
-
-	for _, field := range forbiddenFields {
-		if strings.Contains(decodedQuery, field) {
-			return rest.NewForbiddenError("Only admins can filter by @collection and @request query params", nil)
-		}
-	}
-
-	return nil
-}
-
-func (api *recordApi) expandFunc(c echo.Context, requestData map[string]any) daos.ExpandFetchFunc {
-	admin, _ := c.Get(ContextAdminKey).(*models.Admin)
-
-	return func(relCollection *models.Collection, relIds []string) ([]*models.Record, error) {
-		return api.app.Dao().FindRecordsByIds(relCollection, relIds, func(q *dbx.SelectQuery) error {
-			if admin != nil {
-				return nil // admin can access everything
-			}
-
-			if relCollection.ViewRule == nil {
-				return fmt.Errorf("Only admins can view collection %q records", relCollection.Name)
-			}
-
-			if *relCollection.ViewRule != "" {
-				resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), relCollection, requestData)
-				expr, err := search.FilterData(*(relCollection.ViewRule)).BuildExpr(resolver)
-				if err != nil {
-					return err
-				}
-				resolver.UpdateQuery(q)
-				q.AndWhere(expr)
-			}
-
-			return nil
-		})
-	}
-}

apis/record_auth.go

@@ -0,0 +1,712 @@
+package apis
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"sort"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"golang.org/x/oauth2"
+)
+
+// bindRecordAuthApi registers the auth record api endpoints and
+// the corresponding handlers.
+func bindRecordAuthApi(app core.App, rg *echo.Group) {
+	api := recordAuthApi{app: app}
+
+	// global oauth2 subscription redirect handler
+	rg.GET("/oauth2-redirect", api.oauth2SubscriptionRedirect)
+
+	// common collection record related routes
+	subGroup := rg.Group(
+		"/collections/:collection",
+		ActivityLogger(app),
+		LoadCollectionContext(app, models.CollectionTypeAuth),
+	)
+	subGroup.GET("/auth-methods", api.authMethods)
+	subGroup.POST("/auth-refresh", api.authRefresh, RequireSameContextRecordAuth())
+	subGroup.POST("/auth-with-oauth2", api.authWithOAuth2)
+	subGroup.POST("/auth-with-password", api.authWithPassword)
+	subGroup.POST("/request-password-reset", api.requestPasswordReset)
+	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
+	subGroup.POST("/request-verification", api.requestVerification)
+	subGroup.POST("/confirm-verification", api.confirmVerification)
+	subGroup.POST("/request-email-change", api.requestEmailChange, RequireSameContextRecordAuth())
+	subGroup.POST("/confirm-email-change", api.confirmEmailChange)
+	subGroup.GET("/records/:id/external-auths", api.listExternalAuths, RequireAdminOrOwnerAuth("id"))
+	subGroup.DELETE("/records/:id/external-auths/:provider", api.unlinkExternalAuth, RequireAdminOrOwnerAuth("id"))
+}
+
+type recordAuthApi struct {
+	app core.App
+}
+
+func (api *recordAuthApi) authRefresh(c echo.Context) error {
+	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if record == nil {
+		return NewNotFoundError("Missing auth record context.", nil)
+	}
+
+	event := new(core.RecordAuthRefreshEvent)
+	event.HttpContext = c
+	event.Collection = record.Collection()
+	event.Record = record
+
+	return api.app.OnRecordBeforeAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshEvent) error {
+		return api.app.OnRecordAfterAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshEvent) error {
+			return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+		})
+	})
+}
+
+type providerInfo struct {
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+	State       string `json:"state"`
+	AuthUrl     string `json:"authUrl"`
+	// technically could be omitted if the provider doesn't support PKCE,
+	// but to avoid breaking existing typed clients we'll return them as empty string
+	CodeVerifier        string `json:"codeVerifier"`
+	CodeChallenge       string `json:"codeChallenge"`
+	CodeChallengeMethod string `json:"codeChallengeMethod"`
+}
+
+func (api *recordAuthApi) authMethods(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	authOptions := collection.AuthOptions()
+
+	result := struct {
+		AuthProviders    []providerInfo `json:"authProviders"`
+		UsernamePassword bool           `json:"usernamePassword"`
+		EmailPassword    bool           `json:"emailPassword"`
+		OnlyVerified     bool           `json:"onlyVerified"`
+	}{
+		UsernamePassword: authOptions.AllowUsernameAuth,
+		EmailPassword:    authOptions.AllowEmailAuth,
+		OnlyVerified:     authOptions.OnlyVerified,
+		AuthProviders:    []providerInfo{},
+	}
+
+	if !authOptions.AllowOAuth2Auth {
+		return c.JSON(http.StatusOK, result)
+	}
+
+	nameConfigMap := api.app.Settings().NamedAuthProviderConfigs()
+	for name, config := range nameConfigMap {
+		if !config.Enabled {
+			continue
+		}
+
+		provider, err := auth.NewProviderByName(name)
+		if err != nil {
+			api.app.Logger().Debug("Missing or invalid provider name", slog.String("name", name))
+			continue // skip provider
+		}
+
+		if err := config.SetupProvider(provider); err != nil {
+			api.app.Logger().Debug(
+				"Failed to setup provider",
+				slog.String("name", name),
+				slog.String("error", err.Error()),
+			)
+			continue // skip provider
+		}
+
+		info := providerInfo{
+			Name:        name,
+			DisplayName: provider.DisplayName(),
+			State:       security.RandomString(30),
+		}
+
+		if info.DisplayName == "" {
+			info.DisplayName = name
+		}
+
+		urlOpts := []oauth2.AuthCodeOption{}
+
+		// custom providers url options
+		switch name {
+		case auth.NameApple:
+			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
+			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "query"))
+		}
+
+		if provider.PKCE() {
+			info.CodeVerifier = security.RandomString(43)
+			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
+			info.CodeChallengeMethod = "S256"
+			urlOpts = append(urlOpts,
+				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
+				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
+			)
+		}
+
+		info.AuthUrl = provider.BuildAuthUrl(
+			info.State,
+			urlOpts...,
+		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
+
+		result.AuthProviders = append(result.AuthProviders, info)
+	}
+
+	// sort providers
+	sort.SliceStable(result.AuthProviders, func(i, j int) bool {
+		return result.AuthProviders[i].Name < result.AuthProviders[j].Name
+	})
+
+	return c.JSON(http.StatusOK, result)
+}
+
+func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	if !collection.AuthOptions().AllowOAuth2Auth {
+		return NewBadRequestError("The collection is not configured to allow OAuth2 authentication.", nil)
+	}
+
+	var fallbackAuthRecord *models.Record
+
+	loggedAuthRecord, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if loggedAuthRecord != nil && loggedAuthRecord.Collection().Id == collection.Id {
+		fallbackAuthRecord = loggedAuthRecord
+	}
+
+	form := forms.NewRecordOAuth2Login(api.app, collection, fallbackAuthRecord)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordAuthWithOAuth2Event)
+	event.HttpContext = c
+	event.Collection = collection
+	event.ProviderName = form.Provider
+
+	form.SetBeforeNewRecordCreateFunc(func(createForm *forms.RecordUpsert, authRecord *models.Record, authUser *auth.AuthUser) error {
+		return createForm.DrySubmit(func(txDao *daos.Dao) error {
+			event.IsNewRecord = true
+
+			// clone the current request data and assign the form create data as its body data
+			requestInfo := *RequestInfo(c)
+			requestInfo.Context = models.RequestInfoContextOAuth2
+			requestInfo.Data = form.CreateData
+
+			createRuleFunc := func(q *dbx.SelectQuery) error {
+				admin, _ := c.Get(ContextAdminKey).(*models.Admin)
+				if admin != nil {
+					return nil // either admin or the rule is empty
+				}
+
+				if collection.CreateRule == nil {
+					return errors.New("Only admins can create new accounts with OAuth2")
+				}
+
+				if *collection.CreateRule != "" {
+					resolver := resolvers.NewRecordFieldResolver(txDao, collection, &requestInfo, true)
+					expr, err := search.FilterData(*collection.CreateRule).BuildExpr(resolver)
+					if err != nil {
+						return err
+					}
+					resolver.UpdateQuery(q)
+					q.AndWhere(expr)
+				}
+
+				return nil
+			}
+
+			if _, err := txDao.FindRecordById(collection.Id, createForm.Id, createRuleFunc); err != nil {
+				return fmt.Errorf("Failed create rule constraint: %w", err)
+			}
+
+			return nil
+		})
+	})
+
+	_, _, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData]) forms.InterceptorNextFunc[*forms.RecordOAuth2LoginData] {
+		return func(data *forms.RecordOAuth2LoginData) error {
+			event.Record = data.Record
+			event.OAuth2User = data.OAuth2User
+			event.ProviderClient = data.ProviderClient
+			event.IsNewRecord = data.Record == nil
+
+			return api.app.OnRecordBeforeAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+				data.Record = e.Record
+				data.OAuth2User = e.OAuth2User
+
+				if err := next(data); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				e.Record = data.Record
+				e.OAuth2User = data.OAuth2User
+
+				meta := struct {
+					*auth.AuthUser
+					IsNew bool `json:"isNew"`
+				}{
+					AuthUser: e.OAuth2User,
+					IsNew:    event.IsNewRecord,
+				}
+
+				return api.app.OnRecordAfterAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2Event) error {
+					return RecordAuthResponse(api.app, e.HttpContext, e.Record, meta)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) authWithPassword(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordPasswordLogin(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordAuthWithPasswordEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Password = form.Password
+	event.Identity = form.Identity
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to authenticate.", err)
+				}
+
+				return api.app.OnRecordAfterAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordEvent) error {
+					return RecordAuthResponse(api.app, e.HttpContext, e.Record, nil)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	authOptions := collection.AuthOptions()
+	if !authOptions.AllowUsernameAuth && !authOptions.AllowEmailAuth {
+		return NewBadRequestError("The collection is not configured to allow password authentication.", nil)
+	}
+
+	form := forms.NewRecordPasswordResetRequest(api.app, collection)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	if err := form.Validate(); err != nil {
+		return NewBadRequestError("An error occurred while validating the form.", err)
+	}
+
+	event := new(core.RecordRequestPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send password reset email",
+							slog.String("error", err.Error()),
+						)
+					}
+				})
+
+				return api.app.OnRecordAfterRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	// eagerly write 204 response and skip submit errors
+	// as a measure against emails enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
+}
+
+func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordPasswordResetConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmPasswordResetEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestVerification(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordVerificationRequest(api.app, collection)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	if err := form.Validate(); err != nil {
+		return NewBadRequestError("An error occurred while validating the form.", err)
+	}
+
+	event := new(core.RecordRequestVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil {
+						api.app.Logger().Debug(
+							"Failed to send verification email",
+							slog.String("error", err.Error()),
+						)
+					}
+				})
+
+				return api.app.OnRecordAfterRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	// eagerly write 204 response and skip submit errors
+	// as a measure against users enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return submitErr
+}
+
+func (api *recordAuthApi) confirmVerification(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordVerificationConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmVerificationEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("An error occurred while submitting the form.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	record, _ := c.Get(ContextAuthRecordKey).(*models.Record)
+	if record == nil {
+		return NewUnauthorizedError("The request requires valid auth record.", nil)
+	}
+
+	form := forms.NewRecordEmailChangeRequest(api.app, record)
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	event := new(core.RecordRequestEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			return api.app.OnRecordBeforeRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to request email change.", err)
+				}
+
+				return api.app.OnRecordAfterRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+}
+
+func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	form := forms.NewRecordEmailChangeConfirm(api.app, collection)
+	if readErr := c.Bind(form); readErr != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
+	}
+
+	event := new(core.RecordConfirmEmailChangeEvent)
+	event.HttpContext = c
+	event.Collection = collection
+
+	_, submitErr := form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to confirm email change.", err)
+				}
+
+				return api.app.OnRecordAfterConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.NoContent(http.StatusNoContent)
+				})
+			})
+		}
+	})
+
+	return submitErr
+}
+
+func (api *recordAuthApi) listExternalAuths(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	id := c.PathParam("id")
+	if id == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	record, err := api.app.Dao().FindRecordById(collection.Id, id)
+	if err != nil || record == nil {
+		return NewNotFoundError("", err)
+	}
+
+	externalAuths, err := api.app.Dao().FindAllExternalAuthsByRecord(record)
+	if err != nil {
+		return NewBadRequestError("Failed to fetch the external auths for the specified auth record.", err)
+	}
+
+	event := new(core.RecordListExternalAuthsEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuths = externalAuths
+
+	return api.app.OnRecordListExternalAuthsRequest().Trigger(event, func(e *core.RecordListExternalAuthsEvent) error {
+		return e.HttpContext.JSON(http.StatusOK, e.ExternalAuths)
+	})
+}
+
+func (api *recordAuthApi) unlinkExternalAuth(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("Missing collection context.", nil)
+	}
+
+	id := c.PathParam("id")
+	provider := c.PathParam("provider")
+	if id == "" || provider == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	record, err := api.app.Dao().FindRecordById(collection.Id, id)
+	if err != nil || record == nil {
+		return NewNotFoundError("", err)
+	}
+
+	externalAuth, err := api.app.Dao().FindExternalAuthByRecordAndProvider(record, provider)
+	if err != nil {
+		return NewNotFoundError("Missing external auth provider relation.", err)
+	}
+
+	event := new(core.RecordUnlinkExternalAuthEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.ExternalAuth = externalAuth
+
+	return api.app.OnRecordBeforeUnlinkExternalAuthRequest().Trigger(event, func(e *core.RecordUnlinkExternalAuthEvent) error {
+		if err := api.app.Dao().DeleteExternalAuth(externalAuth); err != nil {
+			return NewBadRequestError("Cannot unlink the external auth provider.", err)
+		}
+
+		return api.app.OnRecordAfterUnlinkExternalAuthRequest().Trigger(event, func(e *core.RecordUnlinkExternalAuthEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+const (
+	oauth2SubscriptionTopic   string = "@oauth2"
+	oauth2RedirectFailurePath string = "../_/#/auth/oauth2-redirect-failure"
+	oauth2RedirectSuccessPath string = "../_/#/auth/oauth2-redirect-success"
+)
+
+type oauth2EventMessage struct {
+	State string `json:"state"`
+	Code  string `json:"code"`
+	Error string `json:"error,omitempty"`
+}
+
+func (api *recordAuthApi) oauth2SubscriptionRedirect(c echo.Context) error {
+	state := c.QueryParam("state")
+	if state == "" {
+		api.app.Logger().Debug("Missing OAuth2 state parameter")
+		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+	}
+
+	client, err := api.app.SubscriptionsBroker().ClientById(state)
+	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
+		api.app.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", state)
+		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+	}
+	defer client.Unsubscribe(oauth2SubscriptionTopic)
+
+	data := oauth2EventMessage{
+		State: state,
+		Code:  c.QueryParam("code"),
+		Error: c.QueryParam("error"),
+	}
+
+	encodedData, err := json.Marshal(data)
+	if err != nil {
+		api.app.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
+		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+	}
+
+	msg := subscriptions.Message{
+		Name: oauth2SubscriptionTopic,
+		Data: encodedData,
+	}
+
+	client.Send(msg)
+
+	if data.Error != "" || data.Code == "" {
+		api.app.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
+		return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectFailurePath)
+	}
+
+	return c.Redirect(http.StatusTemporaryRedirect, oauth2RedirectSuccessPath)
+}

apis/record_crud.go

@@ -0,0 +1,410 @@
+package apis
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+// bindRecordCrudApi registers the record crud api endpoints and
+// the corresponding handlers.
+func bindRecordCrudApi(app core.App, rg *echo.Group) {
+	api := recordApi{app: app}
+
+	subGroup := rg.Group(
+		"/collections/:collection",
+		ActivityLogger(app),
+	)
+
+	subGroup.GET("/records", api.list, LoadCollectionContext(app))
+	subGroup.GET("/records/:id", api.view, LoadCollectionContext(app))
+	subGroup.POST("/records", api.create, LoadCollectionContext(app, models.CollectionTypeBase, models.CollectionTypeAuth))
+	subGroup.PATCH("/records/:id", api.update, LoadCollectionContext(app, models.CollectionTypeBase, models.CollectionTypeAuth))
+	subGroup.DELETE("/records/:id", api.delete, LoadCollectionContext(app, models.CollectionTypeBase, models.CollectionTypeAuth))
+}
+
+type recordApi struct {
+	app core.App
+}
+
+func (api *recordApi) list(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", "Missing collection context.")
+	}
+
+	requestInfo := RequestInfo(c)
+
+	// forbid users and guests to query special filter/sort fields
+	if err := checkForAdminOnlyRuleFields(requestInfo); err != nil {
+		return err
+	}
+
+	if requestInfo.Admin == nil && collection.ListRule == nil {
+		// only admins can access if the rule is nil
+		return NewForbiddenError("Only admins can perform this action.", nil)
+	}
+
+	fieldsResolver := resolvers.NewRecordFieldResolver(
+		api.app.Dao(),
+		collection,
+		requestInfo,
+		// hidden fields are searchable only by admins
+		requestInfo.Admin != nil,
+	)
+
+	searchProvider := search.NewProvider(fieldsResolver).
+		Query(api.app.Dao().RecordQuery(collection))
+
+	if requestInfo.Admin == nil && collection.ListRule != nil {
+		searchProvider.AddFilter(search.FilterData(*collection.ListRule))
+	}
+
+	records := []*models.Record{}
+
+	result, err := searchProvider.ParseAndExec(c.QueryParams().Encode(), &records)
+	if err != nil {
+		return NewBadRequestError("", err)
+	}
+
+	event := new(core.RecordsListEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Records = records
+	event.Result = result
+
+	return api.app.OnRecordsListRequest().Trigger(event, func(e *core.RecordsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		if err := EnrichRecords(e.HttpContext, api.app.Dao(), e.Records); err != nil {
+			api.app.Logger().Debug("Failed to enrich list records", slog.String("error", err.Error()))
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, e.Result)
+	})
+}
+
+func (api *recordApi) view(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", "Missing collection context.")
+	}
+
+	recordId := c.PathParam("id")
+	if recordId == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	requestInfo := RequestInfo(c)
+
+	if requestInfo.Admin == nil && collection.ViewRule == nil {
+		// only admins can access if the rule is nil
+		return NewForbiddenError("Only admins can perform this action.", nil)
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		if requestInfo.Admin == nil && collection.ViewRule != nil && *collection.ViewRule != "" {
+			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestInfo, true)
+			expr, err := search.FilterData(*collection.ViewRule).BuildExpr(resolver)
+			if err != nil {
+				return err
+			}
+			resolver.UpdateQuery(q)
+			q.AndWhere(expr)
+		}
+		return nil
+	}
+
+	record, fetchErr := api.app.Dao().FindRecordById(collection.Id, recordId, ruleFunc)
+	if fetchErr != nil || record == nil {
+		return NewNotFoundError("", fetchErr)
+	}
+
+	event := new(core.RecordViewEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+
+	return api.app.OnRecordViewRequest().Trigger(event, func(e *core.RecordViewEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+			api.app.Logger().Debug(
+				"Failed to enrich view record",
+				slog.String("id", e.Record.Id),
+				slog.String("collectionName", e.Record.Collection().Name),
+				slog.String("error", err.Error()),
+			)
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, e.Record)
+	})
+}
+
+func (api *recordApi) create(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", "Missing collection context.")
+	}
+
+	requestInfo := RequestInfo(c)
+
+	if requestInfo.Admin == nil && collection.CreateRule == nil {
+		// only admins can access if the rule is nil
+		return NewForbiddenError("Only admins can perform this action.", nil)
+	}
+
+	hasFullManageAccess := requestInfo.Admin != nil
+
+	// temporary save the record and check it against the create rule
+	if requestInfo.Admin == nil && collection.CreateRule != nil {
+		testRecord := models.NewRecord(collection)
+
+		// replace modifiers fields so that the resolved value is always
+		// available when accessing requestInfo.Data using just the field name
+		if requestInfo.HasModifierDataKeys() {
+			requestInfo.Data = testRecord.ReplaceModifers(requestInfo.Data)
+		}
+
+		testForm := forms.NewRecordUpsert(api.app, testRecord)
+		testForm.SetFullManageAccess(true)
+		if err := testForm.LoadRequest(c.Request(), ""); err != nil {
+			return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+		}
+
+		createRuleFunc := func(q *dbx.SelectQuery) error {
+			if *collection.CreateRule == "" {
+				return nil // no create rule to resolve
+			}
+
+			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestInfo, true)
+			expr, err := search.FilterData(*collection.CreateRule).BuildExpr(resolver)
+			if err != nil {
+				return err
+			}
+			resolver.UpdateQuery(q)
+			q.AndWhere(expr)
+			return nil
+		}
+
+		testErr := testForm.DrySubmit(func(txDao *daos.Dao) error {
+			foundRecord, err := txDao.FindRecordById(collection.Id, testRecord.Id, createRuleFunc)
+			if err != nil {
+				return fmt.Errorf("DrySubmit create rule failure: %w", err)
+			}
+			hasFullManageAccess = hasAuthManageAccess(txDao, foundRecord, requestInfo)
+			return nil
+		})
+
+		if testErr != nil {
+			return NewBadRequestError("Failed to create record.", testErr)
+		}
+	}
+
+	record := models.NewRecord(collection)
+	form := forms.NewRecordUpsert(api.app, record)
+	form.SetFullManageAccess(hasFullManageAccess)
+
+	// load request
+	if err := form.LoadRequest(c.Request(), ""); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.RecordCreateEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.UploadedFiles = form.FilesToUpload()
+
+	// create the record
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(m *models.Record) error {
+			event.Record = m
+
+			return api.app.OnRecordBeforeCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to create record.", err)
+				}
+
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich create record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+
+				return api.app.OnRecordAfterCreateRequest().Trigger(event, func(e *core.RecordCreateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Record)
+				})
+			})
+		}
+	})
+}
+
+func (api *recordApi) update(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", "Missing collection context.")
+	}
+
+	recordId := c.PathParam("id")
+	if recordId == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	requestInfo := RequestInfo(c)
+
+	if requestInfo.Admin == nil && collection.UpdateRule == nil {
+		// only admins can access if the rule is nil
+		return NewForbiddenError("Only admins can perform this action.", nil)
+	}
+
+	// eager fetch the record so that the modifier field values are replaced
+	// and available when accessing requestInfo.Data using just the field name
+	if requestInfo.HasModifierDataKeys() {
+		record, err := api.app.Dao().FindRecordById(collection.Id, recordId)
+		if err != nil || record == nil {
+			return NewNotFoundError("", err)
+		}
+		requestInfo.Data = record.ReplaceModifers(requestInfo.Data)
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		if requestInfo.Admin == nil && collection.UpdateRule != nil && *collection.UpdateRule != "" {
+			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestInfo, true)
+			expr, err := search.FilterData(*collection.UpdateRule).BuildExpr(resolver)
+			if err != nil {
+				return err
+			}
+			resolver.UpdateQuery(q)
+			q.AndWhere(expr)
+		}
+		return nil
+	}
+
+	// fetch record
+	record, fetchErr := api.app.Dao().FindRecordById(collection.Id, recordId, ruleFunc)
+	if fetchErr != nil || record == nil {
+		return NewNotFoundError("", fetchErr)
+	}
+
+	form := forms.NewRecordUpsert(api.app, record)
+	form.SetFullManageAccess(requestInfo.Admin != nil || hasAuthManageAccess(api.app.Dao(), record, requestInfo))
+
+	// load request
+	if err := form.LoadRequest(c.Request(), ""); err != nil {
+		return NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.RecordUpdateEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+	event.UploadedFiles = form.FilesToUpload()
+
+	// update the record
+	return form.Submit(func(next forms.InterceptorNextFunc[*models.Record]) forms.InterceptorNextFunc[*models.Record] {
+		return func(m *models.Record) error {
+			event.Record = m
+
+			return api.app.OnRecordBeforeUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to update record.", err)
+				}
+
+				if err := EnrichRecord(e.HttpContext, api.app.Dao(), e.Record); err != nil {
+					api.app.Logger().Debug(
+						"Failed to enrich update record",
+						slog.String("id", e.Record.Id),
+						slog.String("collectionName", e.Record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+
+				return api.app.OnRecordAfterUpdateRequest().Trigger(event, func(e *core.RecordUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, e.Record)
+				})
+			})
+		}
+	})
+}
+
+func (api *recordApi) delete(c echo.Context) error {
+	collection, _ := c.Get(ContextCollectionKey).(*models.Collection)
+	if collection == nil {
+		return NewNotFoundError("", "Missing collection context.")
+	}
+
+	recordId := c.PathParam("id")
+	if recordId == "" {
+		return NewNotFoundError("", nil)
+	}
+
+	requestInfo := RequestInfo(c)
+
+	if requestInfo.Admin == nil && collection.DeleteRule == nil {
+		// only admins can access if the rule is nil
+		return NewForbiddenError("Only admins can perform this action.", nil)
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		if requestInfo.Admin == nil && collection.DeleteRule != nil && *collection.DeleteRule != "" {
+			resolver := resolvers.NewRecordFieldResolver(api.app.Dao(), collection, requestInfo, true)
+			expr, err := search.FilterData(*collection.DeleteRule).BuildExpr(resolver)
+			if err != nil {
+				return err
+			}
+			resolver.UpdateQuery(q)
+			q.AndWhere(expr)
+		}
+		return nil
+	}
+
+	record, fetchErr := api.app.Dao().FindRecordById(collection.Id, recordId, ruleFunc)
+	if fetchErr != nil || record == nil {
+		return NewNotFoundError("", fetchErr)
+	}
+
+	event := new(core.RecordDeleteEvent)
+	event.HttpContext = c
+	event.Collection = collection
+	event.Record = record
+
+	return api.app.OnRecordBeforeDeleteRequest().Trigger(event, func(e *core.RecordDeleteEvent) error {
+		// delete the record
+		if err := api.app.Dao().DeleteRecord(e.Record); err != nil {
+			return NewBadRequestError("Failed to delete record. Make sure that the record is not part of a required relation reference.", err)
+		}
+
+		return api.app.OnRecordAfterDeleteRequest().Trigger(event, func(e *core.RecordDeleteEvent) error {
+			if e.HttpContext.Response().Committed {
+				return nil
+			}
+
+			return e.HttpContext.NoContent(http.StatusNoContent)
+		})
+	})
+}

apis/record_helpers.go

@@ -0,0 +1,345 @@
+package apis
+
+import (
+	"fmt"
+	"log"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/resolvers"
+	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+const ContextRequestInfoKey = "requestInfo"
+
+const expandQueryParam = "expand"
+const fieldsQueryParam = "fields"
+
+// Deprecated: Use RequestInfo instead.
+func RequestData(c echo.Context) *models.RequestInfo {
+	log.Println("RequestData(c) is deprecated and will be removed in the future! You can replace it with RequestInfo(c).")
+	return RequestInfo(c)
+}
+
+// RequestInfo exports cached common request data fields
+// (query, body, logged auth state, etc.) from the provided context.
+func RequestInfo(c echo.Context) *models.RequestInfo {
+	// return cached to avoid copying the body multiple times
+	if v := c.Get(ContextRequestInfoKey); v != nil {
+		if data, ok := v.(*models.RequestInfo); ok {
+			// refresh auth state
+			data.AuthRecord, _ = c.Get(ContextAuthRecordKey).(*models.Record)
+			data.Admin, _ = c.Get(ContextAdminKey).(*models.Admin)
+			return data
+		}
+	}
+
+	result := &models.RequestInfo{
+		Context: models.RequestInfoContextDefault,
+		Method:  c.Request().Method,
+		Query:   map[string]any{},
+		Data:    map[string]any{},
+		Headers: map[string]any{},
+	}
+
+	// extract the first value of all headers and normalizes the keys
+	// ("X-Token" is converted to "x_token")
+	for k, v := range c.Request().Header {
+		if len(v) > 0 {
+			result.Headers[inflector.Snakecase(k)] = v[0]
+		}
+	}
+
+	result.AuthRecord, _ = c.Get(ContextAuthRecordKey).(*models.Record)
+	result.Admin, _ = c.Get(ContextAdminKey).(*models.Admin)
+	echo.BindQueryParams(c, &result.Query)
+	rest.BindBody(c, &result.Data)
+
+	c.Set(ContextRequestInfoKey, result)
+
+	return result
+}
+
+// RecordAuthResponse writes standardised json record auth response
+// into the specified request context.
+func RecordAuthResponse(
+	app core.App,
+	c echo.Context,
+	authRecord *models.Record,
+	meta any,
+	finalizers ...func(token string) error,
+) error {
+	if !authRecord.Verified() && authRecord.Collection().AuthOptions().OnlyVerified {
+		return NewForbiddenError("Please verify your email first.", nil)
+	}
+
+	token, tokenErr := tokens.NewRecordAuthToken(app, authRecord)
+	if tokenErr != nil {
+		return NewBadRequestError("Failed to create auth token.", tokenErr)
+	}
+
+	event := new(core.RecordAuthEvent)
+	event.HttpContext = c
+	event.Collection = authRecord.Collection()
+	event.Record = authRecord
+	event.Token = token
+	event.Meta = meta
+
+	return app.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
+		// allow always returning the email address of the authenticated account
+		e.Record.IgnoreEmailVisibility(true)
+
+		// expand record relations
+		expands := strings.Split(c.QueryParam(expandQueryParam), ",")
+		if len(expands) > 0 {
+			// create a copy of the cached request data and adjust it to the current auth record
+			requestInfo := *RequestInfo(e.HttpContext)
+			requestInfo.Admin = nil
+			requestInfo.AuthRecord = e.Record
+			failed := app.Dao().ExpandRecord(
+				e.Record,
+				expands,
+				expandFetch(app.Dao(), &requestInfo),
+			)
+			if len(failed) > 0 {
+				app.Logger().Debug("[RecordAuthResponse] Failed to expand relations", slog.Any("errors", failed))
+			}
+		}
+
+		result := map[string]any{
+			"token":  e.Token,
+			"record": e.Record,
+		}
+
+		if e.Meta != nil {
+			result["meta"] = e.Meta
+		}
+
+		for _, f := range finalizers {
+			if err := f(e.Token); err != nil {
+				return err
+			}
+		}
+
+		return e.HttpContext.JSON(http.StatusOK, result)
+	})
+}
+
+// EnrichRecord parses the request context and enrich the provided record:
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth record and its expanded auth relations
+//     are visible only for the current logged admin, record owner or record with manage access
+func EnrichRecord(c echo.Context, dao *daos.Dao, record *models.Record, defaultExpands ...string) error {
+	return EnrichRecords(c, dao, []*models.Record{record}, defaultExpands...)
+}
+
+// EnrichRecords parses the request context and enriches the provided records:
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth records and their expanded auth relations
+//     are visible only for the current logged admin, record owner or record with manage access
+func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defaultExpands ...string) error {
+	requestInfo := RequestInfo(c)
+
+	if err := autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo); err != nil {
+		return fmt.Errorf("Failed to resolve email visibility: %w", err)
+	}
+
+	expands := defaultExpands
+	if param := c.QueryParam(expandQueryParam); param != "" {
+		expands = append(expands, strings.Split(param, ",")...)
+	}
+	if len(expands) == 0 {
+		return nil // nothing to expand
+	}
+
+	errs := dao.ExpandRecords(records, expands, expandFetch(dao, requestInfo))
+	if len(errs) > 0 {
+		return fmt.Errorf("Failed to expand: %v", errs)
+	}
+
+	return nil
+}
+
+// expandFetch is the records fetch function that is used to expand related records.
+func expandFetch(
+	dao *daos.Dao,
+	requestInfo *models.RequestInfo,
+) daos.ExpandFetchFunc {
+	return func(relCollection *models.Collection, relIds []string) ([]*models.Record, error) {
+		records, err := dao.FindRecordsByIds(relCollection.Id, relIds, func(q *dbx.SelectQuery) error {
+			if requestInfo.Admin != nil {
+				return nil // admins can access everything
+			}
+
+			if relCollection.ViewRule == nil {
+				return fmt.Errorf("Only admins can view collection %q records", relCollection.Name)
+			}
+
+			if *relCollection.ViewRule != "" {
+				resolver := resolvers.NewRecordFieldResolver(dao, relCollection, requestInfo, true)
+				expr, err := search.FilterData(*(relCollection.ViewRule)).BuildExpr(resolver)
+				if err != nil {
+					return err
+				}
+				resolver.UpdateQuery(q)
+				q.AndWhere(expr)
+			}
+
+			return nil
+		})
+
+		if err == nil && len(records) > 0 {
+			autoIgnoreAuthRecordsEmailVisibility(dao, records, requestInfo)
+		}
+
+		return records, err
+	}
+}
+
+// autoIgnoreAuthRecordsEmailVisibility ignores the email visibility check for
+// the provided record if the current auth model is admin, owner or a "manager".
+//
+// Note: Expects all records to be from the same auth collection!
+func autoIgnoreAuthRecordsEmailVisibility(
+	dao *daos.Dao,
+	records []*models.Record,
+	requestInfo *models.RequestInfo,
+) error {
+	if len(records) == 0 || !records[0].Collection().IsAuth() {
+		return nil // nothing to check
+	}
+
+	if requestInfo.Admin != nil {
+		for _, rec := range records {
+			rec.IgnoreEmailVisibility(true)
+		}
+		return nil
+	}
+
+	collection := records[0].Collection()
+
+	mappedRecords := make(map[string]*models.Record, len(records))
+	recordIds := make([]any, len(records))
+	for i, rec := range records {
+		mappedRecords[rec.Id] = rec
+		recordIds[i] = rec.Id
+	}
+
+	if requestInfo != nil && requestInfo.AuthRecord != nil && mappedRecords[requestInfo.AuthRecord.Id] != nil {
+		mappedRecords[requestInfo.AuthRecord.Id].IgnoreEmailVisibility(true)
+	}
+
+	authOptions := collection.AuthOptions()
+	if authOptions.ManageRule == nil || *authOptions.ManageRule == "" {
+		return nil // no manage rule to check
+	}
+
+	// fetch the ids of the managed records
+	// ---
+	managedIds := []string{}
+
+	query := dao.RecordQuery(collection).
+		Select(dao.DB().QuoteSimpleColumnName(collection.Name) + ".id").
+		AndWhere(dbx.In(dao.DB().QuoteSimpleColumnName(collection.Name)+".id", recordIds...))
+
+	resolver := resolvers.NewRecordFieldResolver(dao, collection, requestInfo, true)
+	expr, err := search.FilterData(*authOptions.ManageRule).BuildExpr(resolver)
+	if err != nil {
+		return err
+	}
+	resolver.UpdateQuery(query)
+	query.AndWhere(expr)
+
+	if err := query.Column(&managedIds); err != nil {
+		return err
+	}
+	// ---
+
+	// ignore the email visibility check for the managed records
+	for _, id := range managedIds {
+		if rec, ok := mappedRecords[id]; ok {
+			rec.IgnoreEmailVisibility(true)
+		}
+	}
+
+	return nil
+}
+
+// hasAuthManageAccess checks whether the client is allowed to have full
+// [forms.RecordUpsert] auth management permissions
+// (aka. allowing to change system auth fields without oldPassword).
+func hasAuthManageAccess(
+	dao *daos.Dao,
+	record *models.Record,
+	requestInfo *models.RequestInfo,
+) bool {
+	if !record.Collection().IsAuth() {
+		return false
+	}
+
+	manageRule := record.Collection().AuthOptions().ManageRule
+
+	if manageRule == nil || *manageRule == "" {
+		return false // only for admins (manageRule can't be empty)
+	}
+
+	if requestInfo == nil || requestInfo.AuthRecord == nil {
+		return false // no auth record
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		resolver := resolvers.NewRecordFieldResolver(dao, record.Collection(), requestInfo, true)
+		expr, err := search.FilterData(*manageRule).BuildExpr(resolver)
+		if err != nil {
+			return err
+		}
+		resolver.UpdateQuery(q)
+		q.AndWhere(expr)
+		return nil
+	}
+
+	_, findErr := dao.FindRecordById(record.Collection().Id, record.Id, ruleFunc)
+
+	return findErr == nil
+}
+
+var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
+var adminOnlyRuleFields = []string{"@collection.", "@request."}
+
+// @todo consider moving the rules check to the RecordFieldResolver.
+//
+// checkForAdminOnlyRuleFields loosely checks and returns an error if
+// the provided RequestInfo contains rule fields that only the admin can use.
+func checkForAdminOnlyRuleFields(requestInfo *models.RequestInfo) error {
+	if requestInfo.Admin != nil || len(requestInfo.Query) == 0 {
+		return nil // admin or nothing to check
+	}
+
+	for _, param := range ruleQueryParams {
+		v, _ := requestInfo.Query[param].(string)
+		if v == "" {
+			continue
+		}
+
+		for _, field := range adminOnlyRuleFields {
+			if strings.Contains(v, field) {
+				return NewForbiddenError("Only admins can filter by "+field, nil)
+			}
+		}
+	}
+
+	return nil
+}

apis/record_helpers_test.go

@@ -0,0 +1,236 @@
+package apis_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRequestInfo(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/?test=123", strings.NewReader(`{"test":456}`))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	req.Header.Set("X-Token-Test", "123")
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	dummyRecord := &models.Record{}
+	dummyRecord.Id = "id1"
+	c.Set(apis.ContextAuthRecordKey, dummyRecord)
+
+	dummyAdmin := &models.Admin{}
+	dummyAdmin.Id = "id2"
+	c.Set(apis.ContextAdminKey, dummyAdmin)
+
+	result := apis.RequestInfo(c)
+
+	if result == nil {
+		t.Fatal("Expected *models.RequestInfo instance, got nil")
+	}
+
+	if result.Method != http.MethodPost {
+		t.Fatalf("Expected Method %v, got %v", http.MethodPost, result.Method)
+	}
+
+	rawHeaders, _ := json.Marshal(result.Headers)
+	expectedHeaders := `{"content_type":"application/json","x_token_test":"123"}`
+	if v := string(rawHeaders); v != expectedHeaders {
+		t.Fatalf("Expected Query %v, got %v", expectedHeaders, v)
+	}
+
+	rawQuery, _ := json.Marshal(result.Query)
+	expectedQuery := `{"test":"123"}`
+	if v := string(rawQuery); v != expectedQuery {
+		t.Fatalf("Expected Query %v, got %v", expectedQuery, v)
+	}
+
+	rawData, _ := json.Marshal(result.Data)
+	expectedData := `{"test":456}`
+	if v := string(rawData); v != expectedData {
+		t.Fatalf("Expected Data %v, got %v", expectedData, v)
+	}
+
+	if result.AuthRecord == nil || result.AuthRecord.Id != dummyRecord.Id {
+		t.Fatalf("Expected AuthRecord %v, got %v", dummyRecord, result.AuthRecord)
+	}
+
+	if result.Admin == nil || result.Admin.Id != dummyAdmin.Id {
+		t.Fatalf("Expected Admin %v, got %v", dummyAdmin, result.Admin)
+	}
+}
+
+func TestRecordAuthResponse(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	dummyAdmin := &models.Admin{}
+	dummyAdmin.Id = "id1"
+
+	nonAuthRecord, err := app.Dao().FindRecordById("demo1", "al1h9ijdeojtsjy")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := app.Dao().FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unverifiedAuthRecord, err := app.Dao().FindRecordById("clients", "o1y0dd0spd786md")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name               string
+		record             *models.Record
+		meta               any
+		expectError        bool
+		expectedContent    []string
+		notExpectedContent []string
+		expectedEvents     map[string]int
+	}{
+		{
+			name:        "non auth record",
+			record:      nonAuthRecord,
+			expectError: true,
+		},
+		{
+			name:        "valid auth record but with unverified email in onlyVerified collection",
+			record:      unverifiedAuthRecord,
+			expectError: true,
+		},
+		{
+			name:        "valid auth record - without meta",
+			record:      authRecord,
+			expectError: false,
+			expectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"id":"`,
+				`"expand":{"rel":{`,
+			},
+			notExpectedContent: []string{
+				`"meta":`,
+			},
+			expectedEvents: map[string]int{
+				"OnRecordAuthRequest": 1,
+			},
+		},
+		{
+			name:        "valid auth record - with meta",
+			record:      authRecord,
+			meta:        map[string]any{"meta_test": 123},
+			expectError: false,
+			expectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"id":"`,
+				`"expand":{"rel":{`,
+				`"meta":{"meta_test":123`,
+			},
+			expectedEvents: map[string]int{
+				"OnRecordAuthRequest": 1,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		app.ResetEventCalls()
+
+		e := echo.New()
+		req := httptest.NewRequest(http.MethodGet, "/?expand=rel", nil)
+		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+		c.Set(apis.ContextAdminKey, dummyAdmin)
+
+		responseErr := apis.RecordAuthResponse(app, c, s.record, s.meta)
+
+		hasErr := responseErr != nil
+		if hasErr != s.expectError {
+			t.Fatalf("[%s] Expected hasErr to be %v, got %v (%v)", s.name, s.expectError, hasErr, responseErr)
+		}
+
+		if len(app.EventCalls) != len(s.expectedEvents) {
+			t.Fatalf("[%s] Expected events \n%v, \ngot \n%v", s.name, s.expectedEvents, app.EventCalls)
+		}
+		for k, v := range s.expectedEvents {
+			if app.EventCalls[k] != v {
+				t.Fatalf("[%s] Expected event %s to be called %d times, got %d", s.name, k, v, app.EventCalls[k])
+			}
+		}
+
+		if hasErr {
+			continue
+		}
+
+		response := rec.Body.String()
+
+		for _, v := range s.expectedContent {
+			if !strings.Contains(response, v) {
+				t.Fatalf("[%s] Missing %v in response \n%v", s.name, v, response)
+			}
+		}
+
+		for _, v := range s.notExpectedContent {
+			if strings.Contains(response, v) {
+				t.Fatalf("[%s] Unexpected %v in response \n%v", s.name, v, response)
+			}
+		}
+	}
+}
+
+func TestEnrichRecords(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodGet, "/?expand=rel_many", nil)
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	dummyAdmin := &models.Admin{}
+	dummyAdmin.Id = "test_id"
+	c.Set(apis.ContextAdminKey, dummyAdmin)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	records, err := app.Dao().FindRecordsByIds("demo1", []string{"al1h9ijdeojtsjy", "84nmscqy84lsi1t"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	apis.EnrichRecords(c, app.Dao(), records, "rel_one")
+
+	for _, record := range records {
+		expand := record.Expand()
+		if len(expand) == 0 {
+			t.Fatalf("Expected non-empty expand, got nil for record %v", record)
+		}
+
+		if len(record.GetStringSlice("rel_one")) != 0 {
+			if _, ok := expand["rel_one"]; !ok {
+				t.Fatalf("Expected rel_one to be expanded for record %v, got \n%v", record, expand)
+			}
+		}
+
+		if len(record.GetStringSlice("rel_many")) != 0 {
+			if _, ok := expand["rel_many"]; !ok {
+				t.Fatalf("Expected rel_many to be expanded for record %v, got \n%v", record, expand)
+			}
+		}
+	}
+}

apis/serve.go

@@ -0,0 +1,277 @@
+package apis
+
+import (
+	"context"
+	"crypto/tls"
+	"log"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/labstack/echo/v5"
+	"github.com/labstack/echo/v5/middleware"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/migrate"
+	"golang.org/x/crypto/acme"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+// ServeConfig defines a configuration struct for apis.Serve().
+type ServeConfig struct {
+	// ShowStartBanner indicates whether to show or hide the server start console message.
+	ShowStartBanner bool
+
+	// HttpAddr is the TCP address to listen for the HTTP server (eg. `127.0.0.1:80`).
+	HttpAddr string
+
+	// HttpsAddr is the TCP address to listen for the HTTPS server (eg. `127.0.0.1:443`).
+	HttpsAddr string
+
+	// Optional domains list to use when issuing the TLS certificate.
+	//
+	// If not set, the host from the bound server address will be used.
+	//
+	// For convenience, for each "non-www" domain a "www" entry and
+	// redirect will be automatically added.
+	CertificateDomains []string
+
+	// AllowedOrigins is an optional list of CORS origins (default to "*").
+	AllowedOrigins []string
+}
+
+// Serve starts a new app web server.
+//
+// NB! The app should be bootstrapped before starting the web server.
+//
+// Example:
+//
+//	app.Bootstrap()
+//	apis.Serve(app, apis.ServeConfig{
+//		HttpAddr:        "127.0.0.1:8080",
+//		ShowStartBanner: false,
+//	})
+func Serve(app core.App, config ServeConfig) (*http.Server, error) {
+	if len(config.AllowedOrigins) == 0 {
+		config.AllowedOrigins = []string{"*"}
+	}
+
+	// ensure that the latest migrations are applied before starting the server
+	if err := runMigrations(app); err != nil {
+		return nil, err
+	}
+
+	// reload app settings in case a new default value was set with a migration
+	// (or if this is the first time the init migration was executed)
+	if err := app.RefreshSettings(); err != nil {
+		color.Yellow("=====================================")
+		color.Yellow("WARNING: Settings load error! \n%v", err)
+		color.Yellow("Fallback to the application defaults.")
+		color.Yellow("=====================================")
+	}
+
+	router, err := InitApi(app)
+	if err != nil {
+		return nil, err
+	}
+
+	// configure cors
+	router.Use(middleware.CORSWithConfig(middleware.CORSConfig{
+		Skipper:      middleware.DefaultSkipper,
+		AllowOrigins: config.AllowedOrigins,
+		AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
+	}))
+
+	// start http server
+	// ---
+	mainAddr := config.HttpAddr
+	if config.HttpsAddr != "" {
+		mainAddr = config.HttpsAddr
+	}
+
+	var wwwRedirects []string
+
+	// extract the host names for the certificate host policy
+	hostNames := config.CertificateDomains
+	if len(hostNames) == 0 {
+		host, _, _ := net.SplitHostPort(mainAddr)
+		hostNames = append(hostNames, host)
+	}
+	for _, host := range hostNames {
+		if strings.HasPrefix(host, "www.") {
+			continue // explicitly set www host
+		}
+
+		wwwHost := "www." + host
+		if !list.ExistInSlice(wwwHost, hostNames) {
+			hostNames = append(hostNames, wwwHost)
+			wwwRedirects = append(wwwRedirects, wwwHost)
+		}
+	}
+
+	// implicit www->non-www redirect(s)
+	if len(wwwRedirects) > 0 {
+		router.Pre(func(next echo.HandlerFunc) echo.HandlerFunc {
+			return func(c echo.Context) error {
+				host := c.Request().Host
+
+				if strings.HasPrefix(host, "www.") && list.ExistInSlice(host, wwwRedirects) {
+					return c.Redirect(
+						http.StatusTemporaryRedirect,
+						(c.Scheme() + "://" + host[4:] + c.Request().RequestURI),
+					)
+				}
+
+				return next(c)
+			}
+		})
+	}
+
+	certManager := &autocert.Manager{
+		Prompt:     autocert.AcceptTOS,
+		Cache:      autocert.DirCache(filepath.Join(app.DataDir(), ".autocert_cache")),
+		HostPolicy: autocert.HostWhitelist(hostNames...),
+	}
+
+	// base request context used for cancelling long running requests
+	// like the SSE connections
+	baseCtx, cancelBaseCtx := context.WithCancel(context.Background())
+	defer cancelBaseCtx()
+
+	server := &http.Server{
+		TLSConfig: &tls.Config{
+			MinVersion:     tls.VersionTLS12,
+			GetCertificate: certManager.GetCertificate,
+			NextProtos:     []string{acme.ALPNProto},
+		},
+		ReadTimeout:       10 * time.Minute,
+		ReadHeaderTimeout: 30 * time.Second,
+		// WriteTimeout: 60 * time.Second, // breaks sse!
+		Handler: router,
+		Addr:    mainAddr,
+		BaseContext: func(l net.Listener) context.Context {
+			return baseCtx
+		},
+	}
+
+	serveEvent := &core.ServeEvent{
+		App:         app,
+		Router:      router,
+		Server:      server,
+		CertManager: certManager,
+	}
+	if err := app.OnBeforeServe().Trigger(serveEvent); err != nil {
+		return nil, err
+	}
+
+	if config.ShowStartBanner {
+		schema := "http"
+		addr := server.Addr
+
+		if config.HttpsAddr != "" {
+			schema = "https"
+
+			if len(config.CertificateDomains) > 0 {
+				addr = config.CertificateDomains[0]
+			}
+		}
+
+		date := new(strings.Builder)
+		log.New(date, "", log.LstdFlags).Print()
+
+		bold := color.New(color.Bold).Add(color.FgGreen)
+		bold.Printf(
+			"%s Server started at %s\n",
+			strings.TrimSpace(date.String()),
+			color.CyanString("%s://%s", schema, addr),
+		)
+
+		regular := color.New()
+		regular.Printf("├─ REST API: %s\n", color.CyanString("%s://%s/api/", schema, addr))
+		regular.Printf("└─ Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, addr))
+	}
+
+	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
+	// Note that the WaitGroup would not do anything if the app.OnTerminate() hook isn't triggered.
+	var wg sync.WaitGroup
+
+	// try to gracefully shutdown the server on app termination
+	app.OnTerminate().Add(func(e *core.TerminateEvent) error {
+		cancelBaseCtx()
+
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+
+		wg.Add(1)
+		server.Shutdown(ctx)
+		if e.IsRestart {
+			// wait for execve and other handlers up to 5 seconds before exit
+			time.AfterFunc(5*time.Second, func() {
+				wg.Done()
+			})
+		} else {
+			wg.Done()
+		}
+
+		return nil
+	})
+
+	// wait for the graceful shutdown to complete before exit
+	defer wg.Wait()
+
+	// ---
+	// @todo consider removing the server return value because it is
+	// not really useful when combined with the blocking serve calls
+	// ---
+
+	// start HTTPS server
+	if config.HttpsAddr != "" {
+		// if httpAddr is set, start an HTTP server to redirect the traffic to the HTTPS version
+		if config.HttpAddr != "" {
+			go http.ListenAndServe(config.HttpAddr, certManager.HTTPHandler(nil))
+		}
+
+		return server, server.ListenAndServeTLS("", "")
+	}
+
+	// OR start HTTP server
+	return server, server.ListenAndServe()
+}
+
+type migrationsConnection struct {
+	DB             *dbx.DB
+	MigrationsList migrate.MigrationsList
+}
+
+func runMigrations(app core.App) error {
+	connections := []migrationsConnection{
+		{
+			DB:             app.DB(),
+			MigrationsList: migrations.AppMigrations,
+		},
+		{
+			DB:             app.LogsDB(),
+			MigrationsList: logs.LogsMigrations,
+		},
+	}
+
+	for _, c := range connections {
+		runner, err := migrate.NewRunner(c.DB, c.MigrationsList)
+		if err != nil {
+			return err
+		}
+
+		if _, err := runner.Up(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

apis/settings.go

@@ -3,19 +3,23 @@ package apis
 import (
 	"net/http"
 
+	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/forms"
-	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/models/settings"
 )
 
-// BindSettingsApi registers the settings api endpoints.
-func BindSettingsApi(app core.App, rg *echo.Group) {
+// bindSettingsApi registers the settings api endpoints.
+func bindSettingsApi(app core.App, rg *echo.Group) {
 	api := settingsApi{app: app}
 
 	subGroup := rg.Group("/settings", ActivityLogger(app), RequireAdminAuth())
 	subGroup.GET("", api.list)
 	subGroup.PATCH("", api.set)
+	subGroup.POST("/test/s3", api.testS3)
+	subGroup.POST("/test/email", api.testEmail)
+	subGroup.POST("/apple/generate-client-secret", api.generateAppleClientSecret)
 }
 
 type settingsApi struct {
@@ -25,15 +29,18 @@ type settingsApi struct {
 func (api *settingsApi) list(c echo.Context) error {
 	settings, err := api.app.Settings().RedactClone()
 	if err != nil {
-		return rest.NewBadRequestError("", err)
+		return NewBadRequestError("", err)
 	}
 
-	event := &core.SettingsListEvent{
-		HttpContext:      c,
-		RedactedSettings: settings,
-	}
+	event := new(core.SettingsListEvent)
+	event.HttpContext = c
+	event.RedactedSettings = settings
 
 	return api.app.OnSettingsListRequest().Trigger(event, func(e *core.SettingsListEvent) error {
+		if e.HttpContext.Response().Committed {
+			return nil
+		}
+
 		return e.HttpContext.JSON(http.StatusOK, e.RedactedSettings)
 	})
 }
@@ -43,36 +50,105 @@ func (api *settingsApi) set(c echo.Context) error {
 
 	// load request
 	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	event := &core.SettingsUpdateEvent{
-		HttpContext: c,
-		OldSettings: api.app.Settings(),
-		NewSettings: form.Settings,
-	}
+	event := new(core.SettingsUpdateEvent)
+	event.HttpContext = c
+	event.OldSettings = api.app.Settings()
 
 	// update the settings
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	return form.Submit(func(next forms.InterceptorNextFunc[*settings.Settings]) forms.InterceptorNextFunc[*settings.Settings] {
+		return func(s *settings.Settings) error {
+			event.NewSettings = s
+
 			return api.app.OnSettingsBeforeUpdateRequest().Trigger(event, func(e *core.SettingsUpdateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("An error occurred while submitting the form.", err)
+				if err := next(e.NewSettings); err != nil {
+					return NewBadRequestError("An error occurred while submitting the form.", err)
 				}
 
-				redactedSettings, err := api.app.Settings().RedactClone()
-				if err != nil {
-					return rest.NewBadRequestError("", err)
-				}
+				return api.app.OnSettingsAfterUpdateRequest().Trigger(event, func(e *core.SettingsUpdateEvent) error {
+					if e.HttpContext.Response().Committed {
+						return nil
+					}
 
-				return e.HttpContext.JSON(http.StatusOK, redactedSettings)
+					redactedSettings, err := api.app.Settings().RedactClone()
+					if err != nil {
+						return NewBadRequestError("", err)
+					}
+
+					return e.HttpContext.JSON(http.StatusOK, redactedSettings)
+				})
 			})
 		}
 	})
+}
 
-	if submitErr == nil {
-		api.app.OnSettingsAfterUpdateRequest().Trigger(event)
+func (api *settingsApi) testS3(c echo.Context) error {
+	form := forms.NewTestS3Filesystem(api.app)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	return submitErr
+	// send
+	if err := form.Submit(); err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return NewBadRequestError("Failed to test the S3 filesystem.", fErr)
+		}
+
+		// mailer error
+		return NewBadRequestError("Failed to test the S3 filesystem. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (api *settingsApi) testEmail(c echo.Context) error {
+	form := forms.NewTestEmailSend(api.app)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// send
+	if err := form.Submit(); err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return NewBadRequestError("Failed to send the test email.", fErr)
+		}
+
+		// mailer error
+		return NewBadRequestError("Failed to send the test email. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (api *settingsApi) generateAppleClientSecret(c echo.Context) error {
+	form := forms.NewAppleClientSecretCreate(api.app)
+
+	// load request
+	if err := c.Bind(form); err != nil {
+		return NewBadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// generate
+	secret, err := form.Submit()
+	if err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return NewBadRequestError("Invalid client secret data.", fErr)
+		}
+
+		// secret generation error
+		return NewBadRequestError("Failed to generate client secret. Raw error: \n"+err.Error(), nil)
+	}
+
+	return c.JSON(http.StatusOK, map[string]any{
+		"secret": secret,
+	})
 }

apis/settings_test.go

@@ -1,14 +1,25 @@
 package apis_test
 
 import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 	"testing"
 
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
 func TestSettingsList(t *testing.T) {
+	t.Parallel()
+
 	scenarios := []tests.ApiScenario{
 		{
 			Name:            "unauthorized",
@@ -18,11 +29,11 @@ func TestSettingsList(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as user",
+			Name:   "authorized as auth record",
 			Method: http.MethodGet,
 			Url:    "/api/settings",
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -32,7 +43,7 @@ func TestSettingsList(t *testing.T) {
 			Method: http.MethodGet,
 			Url:    "/api/settings",
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -40,17 +51,41 @@ func TestSettingsList(t *testing.T) {
 				`"logs":{`,
 				`"smtp":{`,
 				`"s3":{`,
+				`"backups":{`,
 				`"adminAuthToken":{`,
 				`"adminPasswordResetToken":{`,
-				`"userAuthToken":{`,
-				`"userPasswordResetToken":{`,
-				`"userEmailChangeToken":{`,
-				`"userVerificationToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
 				`"emailAuth":{`,
 				`"googleAuth":{`,
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"twitterAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 			},
@@ -66,7 +101,9 @@ func TestSettingsList(t *testing.T) {
 }
 
 func TestSettingsSet(t *testing.T) {
-	validData := `{"meta":{"appName":"update_test"},"emailAuth":{"minPasswordLength": 12}}`
+	t.Parallel()
+
+	validData := `{"meta":{"appName":"update_test"}}`
 
 	scenarios := []tests.ApiScenario{
 		{
@@ -78,12 +115,12 @@ func TestSettingsSet(t *testing.T) {
 			ExpectedContent: []string{`"data":{}`},
 		},
 		{
-			Name:   "authorized as user",
+			Name:   "authorized as auth record",
 			Method: http.MethodPatch,
 			Url:    "/api/settings",
 			Body:   strings.NewReader(validData),
 			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
 			},
 			ExpectedStatus:  401,
 			ExpectedContent: []string{`"data":{}`},
@@ -94,7 +131,7 @@ func TestSettingsSet(t *testing.T) {
 			Url:    "/api/settings",
 			Body:   strings.NewReader(``),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -102,21 +139,43 @@ func TestSettingsSet(t *testing.T) {
 				`"logs":{`,
 				`"smtp":{`,
 				`"s3":{`,
+				`"backups":{`,
 				`"adminAuthToken":{`,
 				`"adminPasswordResetToken":{`,
-				`"userAuthToken":{`,
-				`"userPasswordResetToken":{`,
-				`"userEmailChangeToken":{`,
-				`"userVerificationToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
 				`"emailAuth":{`,
 				`"googleAuth":{`,
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
-				`"appName":"Acme"`,
-				`"minPasswordLength":8`,
+				`"appName":"acme_test"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeUpdate":           1,
@@ -129,15 +188,14 @@ func TestSettingsSet(t *testing.T) {
 			Name:   "authorized as admin submitting invalid data",
 			Method: http.MethodPatch,
 			Url:    "/api/settings",
-			Body:   strings.NewReader(`{"meta":{"appName":""},"emailAuth":{"minPasswordLength": 3}}`),
+			Body:   strings.NewReader(`{"meta":{"appName":""}}`),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 400,
 			ExpectedContent: []string{
 				`"data":{`,
-				`"emailAuth":{"minPasswordLength":{"code":"validation_min_greater_equal_than_required","message":"Must be no less than 5."}}`,
-				`"meta":{"appName":{"code":"validation_required","message":"Cannot be blank."}}`,
+				`"meta":{"appName":{"code":"validation_required"`,
 			},
 		},
 		{
@@ -146,7 +204,7 @@ func TestSettingsSet(t *testing.T) {
 			Url:    "/api/settings",
 			Body:   strings.NewReader(validData),
 			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			},
 			ExpectedStatus: 200,
 			ExpectedContent: []string{
@@ -154,21 +212,44 @@ func TestSettingsSet(t *testing.T) {
 				`"logs":{`,
 				`"smtp":{`,
 				`"s3":{`,
+				`"backups":{`,
 				`"adminAuthToken":{`,
 				`"adminPasswordResetToken":{`,
-				`"userAuthToken":{`,
-				`"userPasswordResetToken":{`,
-				`"userEmailChangeToken":{`,
-				`"userVerificationToken":{`,
+				`"adminFileToken":{`,
+				`"recordAuthToken":{`,
+				`"recordPasswordResetToken":{`,
+				`"recordEmailChangeToken":{`,
+				`"recordVerificationToken":{`,
+				`"recordFileToken":{`,
 				`"emailAuth":{`,
 				`"googleAuth":{`,
 				`"facebookAuth":{`,
 				`"githubAuth":{`,
 				`"gitlabAuth":{`,
+				`"twitterAuth":{`,
+				`"discordAuth":{`,
+				`"microsoftAuth":{`,
+				`"spotifyAuth":{`,
+				`"kakaoAuth":{`,
+				`"twitchAuth":{`,
+				`"stravaAuth":{`,
+				`"giteeAuth":{`,
+				`"livechatAuth":{`,
+				`"giteaAuth":{`,
+				`"oidcAuth":{`,
+				`"oidc2Auth":{`,
+				`"oidc3Auth":{`,
+				`"appleAuth":{`,
+				`"instagramAuth":{`,
+				`"vkAuth":{`,
+				`"yandexAuth":{`,
+				`"patreonAuth":{`,
+				`"mailcowAuth":{`,
+				`"bitbucketAuth":{`,
+				`"planningcenterAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
 				`"appName":"update_test"`,
-				`"minPasswordLength":12`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeUpdate":           1,
@@ -177,6 +258,377 @@ func TestSettingsSet(t *testing.T) {
 				"OnSettingsAfterUpdateRequest":  1,
 			},
 		},
+		{
+			Name:   "OnSettingsAfterUpdateRequest error response",
+			Method: http.MethodPatch,
+			Url:    "/api/settings",
+			Body:   strings.NewReader(validData),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnSettingsAfterUpdateRequest().Add(func(e *core.SettingsUpdateEvent) error {
+					return errors.New("error")
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"OnModelBeforeUpdate":           1,
+				"OnModelAfterUpdate":            1,
+				"OnSettingsBeforeUpdateRequest": 1,
+				"OnSettingsAfterUpdateRequest":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsTestS3(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			Url:             "/api/settings/test/s3",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (missing body + no s3)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"filesystem":{`,
+			},
+		},
+		{
+			Name:   "authorized as admin (invalid filesystem)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			Body:   strings.NewReader(`{"filesystem":"invalid"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"filesystem":{`,
+			},
+		},
+		{
+			Name:   "authorized as admin (valid filesystem and no s3)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/s3",
+			Body:   strings.NewReader(`{"filesystem":"storage"}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsTestEmail(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (invalid body)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (empty json)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"email":{"code":"validation_required"`,
+				`"template":{"code":"validation_required"`,
+			},
+		},
+		{
+			Name:   "authorized as admin (verifiation template)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[verification] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
+				}
+
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Verify") {
+					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeRecordVerificationSend": 1,
+				"OnMailerAfterRecordVerificationSend":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin (password reset template)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "password-reset",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[password-reset] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
+				}
+
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Reset password") {
+					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeRecordResetPasswordSend": 1,
+				"OnMailerAfterRecordResetPasswordSend":  1,
+			},
+		},
+		{
+			Name:   "authorized as admin (email change)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "email-change",
+				"email": "test@example.com"
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend != 1 {
+					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
+				}
+
+				if len(app.TestMailer.LastMessage.To) != 1 {
+					t.Fatalf("[email-change] Expected 1 recipient, got %v", app.TestMailer.LastMessage.To)
+				}
+
+				if app.TestMailer.LastMessage.To[0].Address != "test@example.com" {
+					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Confirm new email") {
+					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"OnMailerBeforeRecordChangeEmailSend": 1,
+				"OnMailerAfterRecordChangeEmailSend":  1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestGenerateAppleClientSecret(t *testing.T) {
+	t.Parallel()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	encodedKey, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	privatePem := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "PRIVATE KEY",
+			Bytes: encodedKey,
+		},
+	)
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			Url:             "/api/settings/apple/generate-client-secret",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as auth record",
+			Method: http.MethodPost,
+			Url:    "/api/settings/apple/generate-client-secret",
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyMjA4OTg1MjYxfQ.UwD8JvkbQtXpymT09d7J6fdA0aP9g4FJ1GPh_ggEkzc",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (invalid body)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/apple/generate-client-secret",
+			Body:   strings.NewReader(`{`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+		},
+		{
+			Name:   "authorized as admin (empty json)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/apple/generate-client-secret",
+			Body:   strings.NewReader(`{}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"clientId":{"code":"validation_required"`,
+				`"teamId":{"code":"validation_required"`,
+				`"keyId":{"code":"validation_required"`,
+				`"privateKey":{"code":"validation_required"`,
+				`"duration":{"code":"validation_required"`,
+			},
+		},
+		{
+			Name:   "authorized as admin (invalid data)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/apple/generate-client-secret",
+			Body: strings.NewReader(`{
+				"clientId": "",
+				"teamId": "123456789",
+				"keyId": "123456789",
+				"privateKey": "invalid",
+				"duration": -1
+			}`),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"clientId":{"code":"validation_required"`,
+				`"teamId":{"code":"validation_length_invalid"`,
+				`"keyId":{"code":"validation_length_invalid"`,
+				`"privateKey":{"code":"validation_match_invalid"`,
+				`"duration":{"code":"validation_min_greater_equal_than_required"`,
+			},
+		},
+		{
+			Name:   "authorized as admin (valid data)",
+			Method: http.MethodPost,
+			Url:    "/api/settings/apple/generate-client-secret",
+			Body: strings.NewReader(fmt.Sprintf(`{
+				"clientId": "123",
+				"teamId": "1234567890",
+				"keyId": "1234567891",
+				"privateKey": %q,
+				"duration": 1
+			}`, privatePem)),
+			RequestHeaders: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"secret":"`,
+			},
+		},
 	}
 
 	for _, scenario := range scenarios {

apis/user.go

@@ -1,452 +0,0 @@
-package apis
-
-import (
-	"log"
-	"net/http"
-
-	"github.com/labstack/echo/v5"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/forms"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tokens"
-	"github.com/pocketbase/pocketbase/tools/auth"
-	"github.com/pocketbase/pocketbase/tools/rest"
-	"github.com/pocketbase/pocketbase/tools/routine"
-	"github.com/pocketbase/pocketbase/tools/search"
-	"github.com/pocketbase/pocketbase/tools/security"
-	"golang.org/x/oauth2"
-)
-
-// BindUserApi registers the user api endpoints and the corresponding handlers.
-func BindUserApi(app core.App, rg *echo.Group) {
-	api := userApi{app: app}
-
-	subGroup := rg.Group("/users", ActivityLogger(app))
-	subGroup.GET("/auth-methods", api.authMethods)
-	subGroup.POST("/auth-via-oauth2", api.oauth2Auth, RequireGuestOnly())
-	subGroup.POST("/auth-via-email", api.emailAuth, RequireGuestOnly())
-	subGroup.POST("/request-password-reset", api.requestPasswordReset)
-	subGroup.POST("/confirm-password-reset", api.confirmPasswordReset)
-	subGroup.POST("/request-verification", api.requestVerification)
-	subGroup.POST("/confirm-verification", api.confirmVerification)
-	subGroup.POST("/request-email-change", api.requestEmailChange, RequireUserAuth())
-	subGroup.POST("/confirm-email-change", api.confirmEmailChange)
-	subGroup.POST("/refresh", api.refresh, RequireUserAuth())
-	// crud
-	subGroup.GET("", api.list, RequireAdminAuth())
-	subGroup.POST("", api.create)
-	subGroup.GET("/:id", api.view, RequireAdminOrOwnerAuth("id"))
-	subGroup.PATCH("/:id", api.update, RequireAdminAuth())
-	subGroup.DELETE("/:id", api.delete, RequireAdminOrOwnerAuth("id"))
-}
-
-type userApi struct {
-	app core.App
-}
-
-func (api *userApi) authResponse(c echo.Context, user *models.User, meta any) error {
-	token, tokenErr := tokens.NewUserAuthToken(api.app, user)
-	if tokenErr != nil {
-		return rest.NewBadRequestError("Failed to create auth token.", tokenErr)
-	}
-
-	event := &core.UserAuthEvent{
-		HttpContext: c,
-		User:        user,
-		Token:       token,
-		Meta:        meta,
-	}
-
-	return api.app.OnUserAuthRequest().Trigger(event, func(e *core.UserAuthEvent) error {
-		result := map[string]any{
-			"token": e.Token,
-			"user":  e.User,
-		}
-
-		if e.Meta != nil {
-			result["meta"] = e.Meta
-		}
-
-		return e.HttpContext.JSON(http.StatusOK, result)
-	})
-}
-
-func (api *userApi) refresh(c echo.Context) error {
-	user, _ := c.Get(ContextUserKey).(*models.User)
-	if user == nil {
-		return rest.NewNotFoundError("Missing auth user context.", nil)
-	}
-
-	return api.authResponse(c, user, nil)
-}
-
-type providerInfo struct {
-	Name                string `json:"name"`
-	State               string `json:"state"`
-	CodeVerifier        string `json:"codeVerifier"`
-	CodeChallenge       string `json:"codeChallenge"`
-	CodeChallengeMethod string `json:"codeChallengeMethod"`
-	AuthUrl             string `json:"authUrl"`
-}
-
-func (api *userApi) authMethods(c echo.Context) error {
-	result := struct {
-		EmailPassword bool           `json:"emailPassword"`
-		AuthProviders []providerInfo `json:"authProviders"`
-	}{
-		EmailPassword: true,
-		AuthProviders: []providerInfo{},
-	}
-
-	settings := api.app.Settings()
-
-	result.EmailPassword = settings.EmailAuth.Enabled
-
-	nameConfigMap := settings.NamedAuthProviderConfigs()
-
-	for name, config := range nameConfigMap {
-		if !config.Enabled {
-			continue
-		}
-
-		provider, err := auth.NewProviderByName(name)
-		if err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
-
-			// skip provider
-			continue
-		}
-
-		if err := config.SetupProvider(provider); err != nil {
-			if api.app.IsDebug() {
-				log.Println(err)
-			}
-
-			// skip provider
-			continue
-		}
-
-		state := security.RandomString(30)
-		codeVerifier := security.RandomString(30)
-		codeChallenge := security.S256Challenge(codeVerifier)
-		codeChallengeMethod := "S256"
-		result.AuthProviders = append(result.AuthProviders, providerInfo{
-			Name:                name,
-			State:               state,
-			CodeVerifier:        codeVerifier,
-			CodeChallenge:       codeChallenge,
-			CodeChallengeMethod: codeChallengeMethod,
-			AuthUrl: provider.BuildAuthUrl(
-				state,
-				oauth2.SetAuthURLParam("code_challenge", codeChallenge),
-				oauth2.SetAuthURLParam("code_challenge_method", codeChallengeMethod),
-			) + "&redirect_uri=", // empty redirect_uri so that users can append their url
-		})
-	}
-
-	return c.JSON(http.StatusOK, result)
-}
-
-func (api *userApi) oauth2Auth(c echo.Context) error {
-	form := forms.NewUserOauth2Login(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
-	}
-
-	user, authData, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to authenticate.", submitErr)
-	}
-
-	return api.authResponse(c, user, authData)
-}
-
-func (api *userApi) emailAuth(c echo.Context) error {
-	if !api.app.Settings().EmailAuth.Enabled {
-		return rest.NewBadRequestError("Email/Password authentication is not enabled.", nil)
-	}
-
-	form := forms.NewUserEmailLogin(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
-	}
-
-	user, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to authenticate.", submitErr)
-	}
-
-	return api.authResponse(c, user, nil)
-}
-
-func (api *userApi) requestPasswordReset(c echo.Context) error {
-	form := forms.NewUserPasswordResetRequest(api.app)
-	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
-	}
-
-	if err := form.Validate(); err != nil {
-		return rest.NewBadRequestError("An error occurred while validating the form.", err)
-	}
-
-	// run in background because we don't need to show
-	// the result to the user (prevents users enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
-		}
-	})
-
-	return c.NoContent(http.StatusNoContent)
-}
-
-func (api *userApi) confirmPasswordReset(c echo.Context) error {
-	form := forms.NewUserPasswordResetConfirm(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
-	}
-
-	user, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to set new password.", submitErr)
-	}
-
-	return api.authResponse(c, user, nil)
-}
-
-func (api *userApi) requestEmailChange(c echo.Context) error {
-	loggedUser, _ := c.Get(ContextUserKey).(*models.User)
-	if loggedUser == nil {
-		return rest.NewUnauthorizedError("The request requires valid authorized user.", nil)
-	}
-
-	form := forms.NewUserEmailChangeRequest(api.app, loggedUser)
-	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
-	}
-
-	if err := form.Submit(); err != nil {
-		return rest.NewBadRequestError("Failed to request email change.", err)
-	}
-
-	return c.NoContent(http.StatusNoContent)
-}
-
-func (api *userApi) confirmEmailChange(c echo.Context) error {
-	form := forms.NewUserEmailChangeConfirm(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
-	}
-
-	user, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("Failed to confirm email change.", submitErr)
-	}
-
-	return api.authResponse(c, user, nil)
-}
-
-func (api *userApi) requestVerification(c echo.Context) error {
-	form := forms.NewUserVerificationRequest(api.app)
-	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", err)
-	}
-
-	if err := form.Validate(); err != nil {
-		return rest.NewBadRequestError("An error occurred while validating the form.", err)
-	}
-
-	// run in background because we don't need to show
-	// the result to the user (prevents users enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
-		}
-	})
-
-	return c.NoContent(http.StatusNoContent)
-}
-
-func (api *userApi) confirmVerification(c echo.Context) error {
-	form := forms.NewUserVerificationConfirm(api.app)
-	if readErr := c.Bind(form); readErr != nil {
-		return rest.NewBadRequestError("An error occurred while reading the submitted data.", readErr)
-	}
-
-	user, submitErr := form.Submit()
-	if submitErr != nil {
-		return rest.NewBadRequestError("An error occurred while submitting the form.", submitErr)
-	}
-
-	return api.authResponse(c, user, nil)
-}
-
-// -------------------------------------------------------------------
-// CRUD
-// -------------------------------------------------------------------
-
-func (api *userApi) list(c echo.Context) error {
-	fieldResolver := search.NewSimpleFieldResolver(
-		"id", "created", "updated", "email", "verified",
-	)
-
-	users := []*models.User{}
-
-	result, searchErr := search.NewProvider(fieldResolver).
-		Query(api.app.Dao().UserQuery()).
-		ParseAndExec(c.QueryString(), &users)
-	if searchErr != nil {
-		return rest.NewBadRequestError("", searchErr)
-	}
-
-	// eager load user profiles (if any)
-	if err := api.app.Dao().LoadProfiles(users); err != nil {
-		return rest.NewBadRequestError("", err)
-	}
-
-	event := &core.UsersListEvent{
-		HttpContext: c,
-		Users:       users,
-		Result:      result,
-	}
-
-	return api.app.OnUsersListRequest().Trigger(event, func(e *core.UsersListEvent) error {
-		return e.HttpContext.JSON(http.StatusOK, e.Result)
-	})
-}
-
-func (api *userApi) view(c echo.Context) error {
-	id := c.PathParam("id")
-	if id == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	user, err := api.app.Dao().FindUserById(id)
-	if err != nil || user == nil {
-		return rest.NewNotFoundError("", err)
-	}
-
-	event := &core.UserViewEvent{
-		HttpContext: c,
-		User:        user,
-	}
-
-	return api.app.OnUserViewRequest().Trigger(event, func(e *core.UserViewEvent) error {
-		return e.HttpContext.JSON(http.StatusOK, e.User)
-	})
-}
-
-func (api *userApi) create(c echo.Context) error {
-	if !api.app.Settings().EmailAuth.Enabled {
-		return rest.NewBadRequestError("Email/Password authentication is not enabled.", nil)
-	}
-
-	user := &models.User{}
-	form := forms.NewUserUpsert(api.app, user)
-
-	// load request
-	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := &core.UserCreateEvent{
-		HttpContext: c,
-		User:        user,
-	}
-
-	// create the user
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnUserBeforeCreateRequest().Trigger(event, func(e *core.UserCreateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to create user.", err)
-				}
-
-				return e.HttpContext.JSON(http.StatusOK, e.User)
-			})
-		}
-	})
-
-	if submitErr == nil {
-		api.app.OnUserAfterCreateRequest().Trigger(event)
-	}
-
-	return submitErr
-}
-
-func (api *userApi) update(c echo.Context) error {
-	id := c.PathParam("id")
-	if id == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	user, err := api.app.Dao().FindUserById(id)
-	if err != nil || user == nil {
-		return rest.NewNotFoundError("", err)
-	}
-
-	form := forms.NewUserUpsert(api.app, user)
-
-	// load request
-	if err := c.Bind(form); err != nil {
-		return rest.NewBadRequestError("Failed to load the submitted data due to invalid formatting.", err)
-	}
-
-	event := &core.UserUpdateEvent{
-		HttpContext: c,
-		User:        user,
-	}
-
-	// update the user
-	submitErr := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
-			return api.app.OnUserBeforeUpdateRequest().Trigger(event, func(e *core.UserUpdateEvent) error {
-				if err := next(); err != nil {
-					return rest.NewBadRequestError("Failed to update user.", err)
-				}
-
-				return e.HttpContext.JSON(http.StatusOK, e.User)
-			})
-		}
-	})
-
-	if submitErr == nil {
-		api.app.OnUserAfterUpdateRequest().Trigger(event)
-	}
-
-	return submitErr
-}
-
-func (api *userApi) delete(c echo.Context) error {
-	id := c.PathParam("id")
-	if id == "" {
-		return rest.NewNotFoundError("", nil)
-	}
-
-	user, err := api.app.Dao().FindUserById(id)
-	if err != nil || user == nil {
-		return rest.NewNotFoundError("", err)
-	}
-
-	event := &core.UserDeleteEvent{
-		HttpContext: c,
-		User:        user,
-	}
-
-	handlerErr := api.app.OnUserBeforeDeleteRequest().Trigger(event, func(e *core.UserDeleteEvent) error {
-		// delete the user model
-		if err := api.app.Dao().DeleteUser(e.User); err != nil {
-			return rest.NewBadRequestError("Failed to delete user. Make sure that the user is not part of a required relation reference.", err)
-		}
-
-		return e.HttpContext.NoContent(http.StatusNoContent)
-	})
-
-	if handlerErr == nil {
-		api.app.OnUserAfterDeleteRequest().Trigger(event)
-	}
-
-	return handlerErr
-}

apis/user_test.go

@@ -1,928 +0,0 @@
-package apis_test
-
-import (
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/labstack/echo/v5"
-	"github.com/pocketbase/pocketbase/daos"
-	"github.com/pocketbase/pocketbase/tests"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-func TestUsersAuthMethods(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Method:         http.MethodGet,
-			Url:            "/api/users/auth-methods",
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"emailPassword":true`,
-				`"authProviders":[{`,
-				`"authProviders":[{`,
-				`"name":"gitlab"`,
-				`"state":`,
-				`"codeVerifier":`,
-				`"codeChallenge":`,
-				`"codeChallengeMethod":`,
-				`"authUrl":`,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserEmailAuth(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:   "authorized as user",
-			Method: http.MethodPost,
-			Url:    "/api/users/auth-via-email",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin",
-			Method: http.MethodPost,
-			Url:    "/api/users/auth-via-email",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:            "invalid body format",
-			Method:          http.MethodPost,
-			Url:             "/api/users/auth-via-email",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "invalid data",
-			Method:         http.MethodPost,
-			Url:            "/api/users/auth-via-email",
-			Body:           strings.NewReader(`{"email":"","password":""}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"email":{`,
-				`"password":{`,
-			},
-		},
-		{
-			Name:   "disabled email/pass auth with valid data",
-			Method: http.MethodPost,
-			Url:    "/api/users/auth-via-email",
-			Body:   strings.NewReader(`{"email":"test@example.com","password":"123456"}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				app.Settings().EmailAuth.Enabled = false
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "valid data",
-			Method:         http.MethodPost,
-			Url:            "/api/users/auth-via-email",
-			Body:           strings.NewReader(`{"email":"test2@example.com","password":"123456"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token"`,
-				`"user"`,
-				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
-				`"email":"test2@example.com"`,
-				`"verified":false`, // unverified user should be able to authenticate
-			},
-			ExpectedEvents: map[string]int{"OnUserAuthRequest": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserRequestPasswordReset(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "empty data",
-			Method:          http.MethodPost,
-			Url:             "/api/users/request-password-reset",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
-		},
-		{
-			Name:            "invalid data",
-			Method:          http.MethodPost,
-			Url:             "/api/users/request-password-reset",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "missing user",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-		},
-		{
-			Name:           "existing user",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                 1,
-				"OnModelAfterUpdate":                  1,
-				"OnMailerBeforeUserResetPasswordSend": 1,
-				"OnMailerAfterUserResetPasswordSend":  1,
-			},
-		},
-		{
-			Name:           "existing user (after already sent)",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-password-reset",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				// simulate recent password request
-				user, err := app.Dao().FindUserByEmail("test@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				user.LastResetSentAt = types.NowDateTime()
-				dao := daos.New(app.Dao().DB()) // new dao to ignore hooks
-				if err := dao.Save(user); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserConfirmPasswordReset(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "empty data",
-			Method:          http.MethodPost,
-			Url:             "/api/users/confirm-password-reset",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"password":{"code":"validation_required","message":"Cannot be blank."},"passwordConfirm":{"code":"validation_required","message":"Cannot be blank."},"token":{"code":"validation_required","message":"Cannot be blank."}}`},
-		},
-		{
-			Name:            "invalid data format",
-			Method:          http.MethodPost,
-			Url:             "/api/users/confirm-password-reset",
-			Body:            strings.NewReader(`{"password`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "expired token",
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-password-reset",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImlkIjoiNGQwMTk3Y2MtMmI0YS0zZjgzLWEyNmItZDc3YmM4NDIzZDNjIiwiZW1haWwiOiJ0ZXN0QGV4YW1wbGUuY29tIiwiZXhwIjoxNjQxMDMxMjAwfQ.t2lVe0ny9XruQsSFQdXqBi0I85i6vIUAQjFXZY5HPxc","password":"123456789","passwordConfirm":"123456789"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{`,
-				`"code":"validation_invalid_token"`,
-			},
-		},
-		{
-			Name:           "valid token and data",
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-password-reset",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImlkIjoiNGQwMTk3Y2MtMmI0YS0zZjgzLWEyNmItZDc3YmM4NDIzZDNjIiwiZW1haWwiOiJ0ZXN0QGV4YW1wbGUuY29tIiwiZXhwIjoxODYxOTU2MDAwfQ.V1gEbY4caEIF6IhQAJ8KZD4RvOGvTCFuYg1fTRSvhe0","password":"123456789","passwordConfirm":"123456789"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"user":`,
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-				`"email":"test@example.com"`,
-			},
-			ExpectedEvents: map[string]int{"OnUserAuthRequest": 1, "OnModelAfterUpdate": 1, "OnModelBeforeUpdate": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserRequestVerification(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "empty data",
-			Method:          http.MethodPost,
-			Url:             "/api/users/request-verification",
-			Body:            strings.NewReader(``),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
-		},
-		{
-			Name:            "invalid data",
-			Method:          http.MethodPost,
-			Url:             "/api/users/request-verification",
-			Body:            strings.NewReader(`{"email`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "missing user",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-verification",
-			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-		},
-		{
-			Name:           "existing already verified user",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-		},
-		{
-			Name:           "existing unverified user",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                1,
-				"OnModelAfterUpdate":                 1,
-				"OnMailerBeforeUserVerificationSend": 1,
-				"OnMailerAfterUserVerificationSend":  1,
-			},
-		},
-		{
-			Name:           "existing unverified user (after already sent)",
-			Method:         http.MethodPost,
-			Url:            "/api/users/request-verification",
-			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
-			Delay:          100 * time.Millisecond,
-			ExpectedStatus: 204,
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				// simulate recent verification sent
-				user, err := app.Dao().FindUserByEmail("test2@example.com")
-				if err != nil {
-					t.Fatal(err)
-				}
-				user.LastVerificationSentAt = types.NowDateTime()
-				dao := daos.New(app.Dao().DB()) // new dao to ignore hooks
-				if err := dao.Save(user); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserConfirmVerification(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		// empty data
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-verification",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"token":{"code":"validation_required"`,
-			},
-		},
-		// invalid data
-		{
-			Method:          http.MethodPost,
-			Url:             "/api/users/confirm-verification",
-			Body:            strings.NewReader(`{"token`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// expired token
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-verification",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImlkIjoiN2JjODRkMjctNmJhMi1iNDJhLTM4M2YtNDE5N2NjM2QzZDBjIiwiZW1haWwiOiJ0ZXN0MkBleGFtcGxlLmNvbSIsImV4cCI6MTY0MTAzMTIwMH0.YCqyREksfqn7cWu-innNNTbWQCr9DgYr7dduM2wxrtQ"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{`,
-				`"code":"validation_invalid_token"`,
-			},
-		},
-		// valid token
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-verification",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoidXNlciIsImlkIjoiN2JjODRkMjctNmJhMi1iNDJhLTM4M2YtNDE5N2NjM2QzZDBjIiwiZW1haWwiOiJ0ZXN0MkBleGFtcGxlLmNvbSIsImV4cCI6MTg2MTk1NjAwMH0.OsxRKuZrNTnwyVjvCwB4jY8TbT-NPZ-UFCpRhCvuv2U"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"user":`,
-				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
-				`"email":"test2@example.com"`,
-				`"verified":true`,
-			},
-			ExpectedEvents: map[string]int{
-				"OnUserAuthRequest":   1,
-				"OnModelAfterUpdate":  1,
-				"OnModelBeforeUpdate": 1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserRequestEmailChange(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		// unauthorized
-		{
-			Method:          http.MethodPost,
-			Url:             "/api/users/request-email-change",
-			Body:            strings.NewReader(`{"newEmail":"change@example.com"}`),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as admin
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// invalid data
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail`),
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// empty data
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/request-email-change",
-			Body:   strings.NewReader(``),
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"newEmail":{"code":"validation_required"`,
-			},
-		},
-		// valid data (existing email)
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"test2@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"newEmail":{"code":"validation_user_email_exists"`,
-			},
-		},
-		// valid data (new email)
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/request-email-change",
-			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"OnMailerBeforeUserChangeEmailSend": 1,
-				"OnMailerAfterUserChangeEmailSend":  1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserConfirmEmailChange(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		// empty data
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-email-change",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":`,
-				`"token":{"code":"validation_required"`,
-				`"password":{"code":"validation_required"`,
-			},
-		},
-		// invalid data
-		{
-			Method:          http.MethodPost,
-			Url:             "/api/users/confirm-email-change",
-			Body:            strings.NewReader(`{"token`),
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// expired token and correct password
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-email-change",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdiYzg0ZDI3LTZiYTItYjQyYS0zODNmLTQxOTdjYzNkM2QwYyIsInR5cGUiOiJ1c2VyIiwiZW1haWwiOiJ0ZXN0MkBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoxNjQwOTkxNjAwfQ.DOqNtSDcXbWix8OsK13X-tjfWi6jZNlAzIZiwG_YDOs","password":"123456"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"token":{`,
-				`"code":"validation_invalid_token"`,
-			},
-		},
-		// valid token and incorrect password
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-email-change",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdiYzg0ZDI3LTZiYTItYjQyYS0zODNmLTQxOTdjYzNkM2QwYyIsInR5cGUiOiJ1c2VyIiwiZW1haWwiOiJ0ZXN0MkBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoxODkzNDUyNDAwfQ.aWMQJ_c49yFbzHO5TNhlkbKRokQ_isc2RbLGuSJx44c","password":"654321"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"password":{`,
-				`"code":"validation_invalid_password"`,
-			},
-		},
-		// valid token and correct password
-		{
-			Method:         http.MethodPost,
-			Url:            "/api/users/confirm-email-change",
-			Body:           strings.NewReader(`{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdiYzg0ZDI3LTZiYTItYjQyYS0zODNmLTQxOTdjYzNkM2QwYyIsInR5cGUiOiJ1c2VyIiwiZW1haWwiOiJ0ZXN0MkBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoxODkzNDUyNDAwfQ.aWMQJ_c49yFbzHO5TNhlkbKRokQ_isc2RbLGuSJx44c","password":"123456"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"user":`,
-				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
-				`"email":"change@example.com"`,
-				`"verified":true`,
-			},
-			ExpectedEvents: map[string]int{"OnUserAuthRequest": 1, "OnModelAfterUpdate": 1, "OnModelBeforeUpdate": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserRefresh(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		// unauthorized
-		{
-			Method:          http.MethodPost,
-			Url:             "/api/users/refresh",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as admin
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/refresh",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as user
-		{
-			Method: http.MethodPost,
-			Url:    "/api/users/refresh",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"token":`,
-				`"user":`,
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUserAuthRequest": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUsersList(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		// unauthorized
-		{
-			Method:          http.MethodGet,
-			Url:             "/api/users",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as user
-		{
-			Method: http.MethodGet,
-			Url:    "/api/users",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as admin
-		{
-			Method: http.MethodGet,
-			Url:    "/api/users",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":3`,
-				`"items":[{`,
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-				`"id":"7bc84d27-6ba2-b42a-383f-4197cc3d3d0c"`,
-				`"id":"97cc3d3d-6ba2-383f-b42a-7bc84d27410c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
-		},
-		// authorized as admin + paging and sorting
-		{
-			Method: http.MethodGet,
-			Url:    "/api/users?page=2&perPage=2&sort=-created",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":2`,
-				`"perPage":2`,
-				`"totalItems":3`,
-				`"items":[{`,
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
-		},
-		// authorized as admin + invalid filter
-		{
-			Method: http.MethodGet,
-			Url:    "/api/users?filter=invalidfield~'test2'",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		// authorized as admin + valid filter
-		{
-			Method: http.MethodGet,
-			Url:    "/api/users?filter=verified=true",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"page":1`,
-				`"perPage":30`,
-				`"totalItems":2`,
-				`"items":[{`,
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-				`"id":"97cc3d3d-6ba2-383f-b42a-7bc84d27410c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUsersListRequest": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserView(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodGet,
-			Url:             "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + nonexisting user id",
-			Method: http.MethodGet,
-			Url:    "/api/users/00000000-0000-0000-0000-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + existing user id",
-			Method: http.MethodGet,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUserViewRequest": 1},
-		},
-		{
-			Name:   "authorized as user - trying to view another user",
-			Method: http.MethodGet,
-			Url:    "/api/users/7bc84d27-6ba2-b42a-383f-4197cc3d3d0c",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as user - owner",
-			Method: http.MethodGet,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-			},
-			ExpectedEvents: map[string]int{"OnUserViewRequest": 1},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserDelete(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodDelete,
-			Url:             "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + nonexisting user id",
-			Method: http.MethodDelete,
-			Url:    "/api/users/00000000-0000-0000-0000-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin + existing user id",
-			Method: http.MethodDelete,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"OnUserBeforeDeleteRequest": 1,
-				"OnUserAfterDeleteRequest":  1,
-				"OnModelBeforeDelete":       2, // cascade delete to related Record model
-				"OnModelAfterDelete":        2, // cascade delete to related Record model
-			},
-		},
-		{
-			Name:   "authorized as user - trying to delete another user",
-			Method: http.MethodDelete,
-			Url:    "/api/users/7bc84d27-6ba2-b42a-383f-4197cc3d3d0c",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as user - owner",
-			Method: http.MethodDelete,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{
-				"OnUserBeforeDeleteRequest": 1,
-				"OnUserAfterDeleteRequest":  1,
-				"OnModelBeforeDelete":       2, // cascade delete to related Record model
-				"OnModelAfterDelete":        2, // cascade delete to related Record model
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserCreate(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:           "empty data",
-			Method:         http.MethodPost,
-			Url:            "/api/users",
-			Body:           strings.NewReader(``),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"email":{"code":"validation_required"`,
-				`"password":{"code":"validation_required"`,
-			},
-		},
-		{
-			Name:           "invalid data",
-			Method:         http.MethodPost,
-			Url:            "/api/users",
-			Body:           strings.NewReader(`{"email":"test@example.com","password":"1234","passwordConfirm":"4321"}`),
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"email":{"code":"validation_user_email_exists"`,
-				`"password":{"code":"validation_length_out_of_range"`,
-				`"passwordConfirm":{"code":"validation_values_mismatch"`,
-			},
-		},
-		{
-			Name:   "valid data but with disabled email/pass auth",
-			Method: http.MethodPost,
-			Url:    "/api/users",
-			Body:   strings.NewReader(`{"email":"newuser@example.com","password":"123456789","passwordConfirm":"123456789"}`),
-			BeforeFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
-				app.Settings().EmailAuth.Enabled = false
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:           "valid data",
-			Method:         http.MethodPost,
-			Url:            "/api/users",
-			Body:           strings.NewReader(`{"email":"newuser@example.com","password":"123456789","passwordConfirm":"123456789"}`),
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":`,
-				`"email":"newuser@example.com"`,
-			},
-			ExpectedEvents: map[string]int{
-				"OnUserBeforeCreateRequest": 1,
-				"OnUserAfterCreateRequest":  1,
-				"OnModelBeforeCreate":       2, // +1 for the created profile record
-				"OnModelAfterCreate":        2, // +1 for the created profile record
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUserUpdate(t *testing.T) {
-	scenarios := []tests.ApiScenario{
-		{
-			Name:            "unauthorized",
-			Method:          http.MethodPatch,
-			Url:             "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			Body:            strings.NewReader(`{"email":"new@example.com"}`),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as user (owner)",
-			Method: http.MethodPatch,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			Body:   strings.NewReader(`{"email":"new@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "User eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin - invalid/missing user id",
-			Method: http.MethodPatch,
-			Url:    "/api/users/invalid",
-			Body:   strings.NewReader(``),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{`"data":{}`},
-		},
-		{
-			Name:   "authorized as admin - empty data",
-			Method: http.MethodPatch,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			Body:   strings.NewReader(``),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-				`"email":"test@example.com"`,
-			},
-			ExpectedEvents: map[string]int{
-				"OnUserBeforeUpdateRequest": 1,
-				"OnUserAfterUpdateRequest":  1,
-				"OnModelBeforeUpdate":       1,
-				"OnModelAfterUpdate":        1,
-			},
-		},
-		{
-			Name:   "authorized as admin - invalid data",
-			Method: http.MethodPatch,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			Body:   strings.NewReader(`{"email":"test2@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 400,
-			ExpectedContent: []string{
-				`"data":{`,
-				`"email":{"code":"validation_user_email_exists"`,
-			},
-		},
-		{
-			Name:   "authorized as admin - valid data",
-			Method: http.MethodPatch,
-			Url:    "/api/users/4d0197cc-2b4a-3f83-a26b-d77bc8423d3c",
-			Body:   strings.NewReader(`{"email":"new@example.com"}`),
-			RequestHeaders: map[string]string{
-				"Authorization": "Admin eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			},
-			ExpectedStatus: 200,
-			ExpectedContent: []string{
-				`"id":"4d0197cc-2b4a-3f83-a26b-d77bc8423d3c"`,
-				`"email":"new@example.com"`,
-			},
-			ExpectedEvents: map[string]int{
-				"OnUserBeforeUpdateRequest": 1,
-				"OnUserAfterUpdateRequest":  1,
-				"OnModelBeforeUpdate":       1,
-				"OnModelAfterUpdate":        1,
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

cmd/admin.go

@@ -0,0 +1,141 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/fatih/color"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/spf13/cobra"
+)
+
+// NewAdminCommand creates and returns new command for managing
+// admin accounts (create, update, delete).
+func NewAdminCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:   "admin",
+		Short: "Manages admin accounts",
+	}
+
+	command.AddCommand(adminCreateCommand(app))
+	command.AddCommand(adminUpdateCommand(app))
+	command.AddCommand(adminDeleteCommand(app))
+
+	return command
+}
+
+func adminCreateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "create",
+		Example:      "admin create test@example.com 1234567890",
+		Short:        "Creates a new admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("Missing email and password arguments.")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Missing or invalid email address.")
+			}
+
+			if len(args[1]) < 8 {
+				return errors.New("The password must be at least 8 chars long.")
+			}
+
+			admin := &models.Admin{}
+			admin.Email = args[0]
+			admin.SetPassword(args[1])
+
+			if !app.Dao().HasTable(admin.TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			if err := app.Dao().SaveAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to create new admin account: %v", err)
+			}
+
+			color.Green("Successfully created new admin %s!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}
+
+func adminUpdateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "update",
+		Example:      "admin update test@example.com 1234567890",
+		Short:        "Changes the password of a single admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("Missing email and password arguments.")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Missing or invalid email address.")
+			}
+
+			if len(args[1]) < 8 {
+				return errors.New("The new password must be at least 8 chars long.")
+			}
+
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			admin, err := app.Dao().FindAdminByEmail(args[0])
+			if err != nil {
+				return fmt.Errorf("Admin with email %s doesn't exist.", args[0])
+			}
+
+			admin.SetPassword(args[1])
+
+			if err := app.Dao().SaveAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to change admin %s password: %v", admin.Email, err)
+			}
+
+			color.Green("Successfully changed admin %s password!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}
+
+func adminDeleteCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "delete",
+		Example:      "admin delete test@example.com",
+		Short:        "Deletes an existing admin account",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("Invalid or missing email address.")
+			}
+
+			if !app.Dao().HasTable((&models.Admin{}).TableName()) {
+				return errors.New("Migration are not initialized yet. Please run 'migrate up' and try again.")
+			}
+
+			admin, err := app.Dao().FindAdminByEmail(args[0])
+			if err != nil {
+				color.Yellow("Admin %s is already deleted.", args[0])
+				return nil
+			}
+
+			if err := app.Dao().DeleteAdmin(admin); err != nil {
+				return fmt.Errorf("Failed to delete admin %s: %v", admin.Email, err)
+			}
+
+			color.Green("Successfully deleted admin %s!", admin.Email)
+			return nil
+		},
+	}
+
+	return command
+}

cmd/admin_test.go

@@ -0,0 +1,221 @@
+package cmd_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/cmd"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestAdminCreateCommand(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"duplicated email",
+			"test@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test_new@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"create", s.email, s.password})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin account was actually created
+		admin, err := app.Dao().FindAdminByEmail(s.email)
+		if err != nil {
+			t.Errorf("[%s] Failed to fetch created admin %s: %v", s.name, s.email, err)
+		} else if !admin.ValidatePassword(s.password) {
+			t.Errorf("[%s] Expected the admin password to match", s.name)
+		}
+	}
+}
+
+func TestAdminUpdateCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"nonexisting admin",
+			"test_missing@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"update", s.email, s.password})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin password was actually changed
+		admin, err := app.Dao().FindAdminByEmail(s.email)
+		if err != nil {
+			t.Errorf("[%s] Failed to fetch admin %s: %v", s.name, s.email, err)
+		} else if !admin.ValidatePassword(s.password) {
+			t.Errorf("[%s] Expected the admin password to match", s.name)
+		}
+	}
+}
+
+func TestAdminDeleteCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		expectError bool
+	}{
+		{
+			"empty email",
+			"",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			true,
+		},
+		{
+			"nonexisting admin",
+			"test_missing@example.com",
+			false,
+		},
+		{
+			"existing admin",
+			"test@example.com",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		command := cmd.NewAdminCommand(app)
+		command.SetArgs([]string{"delete", s.email})
+
+		err := command.Execute()
+
+		hasErr := err != nil
+		if s.expectError != hasErr {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		// check whether the admin account was actually deleted
+		if _, err := app.Dao().FindAdminByEmail(s.email); err == nil {
+			t.Errorf("[%s] Expected the admin account to be deleted", s.name)
+		}
+	}
+}

cmd/migrate.go

@@ -1,241 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"path"
-	"time"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/daos"
-	"github.com/pocketbase/pocketbase/migrations"
-	"github.com/pocketbase/pocketbase/migrations/logs"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/inflector"
-	"github.com/pocketbase/pocketbase/tools/migrate"
-	"github.com/spf13/cobra"
-)
-
-// NewMigrateCommand creates and returns new command for handling DB migrations.
-func NewMigrateCommand(app core.App) *cobra.Command {
-	desc := `
-Supported arguments are:
-- up                   - runs all available migrations.
-- down [number]        - reverts the last [number] applied migrations.
-- create name [folder] - creates new migration template file.
-- collections [folder] - (Experimental) creates new migration file with the most recent local collections configuration.
-`
-	var databaseFlag string
-
-	command := &cobra.Command{
-		Use:       "migrate",
-		Short:     "Executes DB migration scripts",
-		ValidArgs: []string{"up", "down", "create", "collections"},
-		Long:      desc,
-		Run: func(command *cobra.Command, args []string) {
-			cmd := ""
-			if len(args) > 0 {
-				cmd = args[0]
-			}
-
-			// additional commands
-			// ---
-			if cmd == "create" {
-				if err := migrateCreateHandler(defaultMigrateCreateTemplate, args[1:]); err != nil {
-					log.Fatal(err)
-				}
-				return
-			}
-			if cmd == "collections" {
-				if err := migrateCollectionsHandler(app, args[1:]); err != nil {
-					log.Fatal(err)
-				}
-				return
-			}
-			// ---
-
-			// normalize
-			if databaseFlag != "logs" {
-				databaseFlag = "db"
-			}
-
-			connections := migrationsConnectionsMap(app)
-
-			runner, err := migrate.NewRunner(
-				connections[databaseFlag].DB,
-				connections[databaseFlag].MigrationsList,
-			)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			if err := runner.Run(args...); err != nil {
-				log.Fatal(err)
-			}
-		},
-	}
-
-	command.PersistentFlags().StringVar(
-		&databaseFlag,
-		"database",
-		"db",
-		"specify the database connection to use (db or logs)",
-	)
-
-	return command
-}
-
-type migrationsConnection struct {
-	DB             *dbx.DB
-	MigrationsList migrate.MigrationsList
-}
-
-func migrationsConnectionsMap(app core.App) map[string]migrationsConnection {
-	return map[string]migrationsConnection{
-		"db": {
-			DB:             app.DB(),
-			MigrationsList: migrations.AppMigrations,
-		},
-		"logs": {
-			DB:             app.LogsDB(),
-			MigrationsList: logs.LogsMigrations,
-		},
-	}
-}
-
-// -------------------------------------------------------------------
-// migrate create
-// -------------------------------------------------------------------
-
-const defaultMigrateCreateTemplate = `package migrations
-
-import (
-	"github.com/pocketbase/dbx"
-	m "github.com/pocketbase/pocketbase/migrations"
-)
-
-func init() {
-	m.Register(func(db dbx.Builder) error {
-		// add up queries...
-
-		return nil
-	}, func(db dbx.Builder) error {
-		// add down queries...
-
-		return nil
-	})
-}
-`
-
-func migrateCreateHandler(template string, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("Missing migration file name")
-	}
-
-	name := args[0]
-
-	var dir string
-	if len(args) == 2 {
-		dir = args[1]
-	}
-	if dir == "" {
-		// If not specified, auto point to the default migrations folder.
-		//
-		// NB!
-		// Since the create command makes sense only during development,
-		// it is expected the user to be in the app working directory
-		// and to be using `go run`
-		wd, err := os.Getwd()
-		if err != nil {
-			return err
-		}
-		dir = path.Join(wd, "migrations")
-	}
-
-	resultFilePath := path.Join(
-		dir,
-		fmt.Sprintf("%d_%s.go", time.Now().Unix(), inflector.Snakecase(name)),
-	)
-
-	confirm := false
-	prompt := &survey.Confirm{
-		Message: fmt.Sprintf("Do you really want to create migration %q?", resultFilePath),
-	}
-	survey.AskOne(prompt, &confirm)
-	if !confirm {
-		fmt.Println("The command has been cancelled")
-		return nil
-	}
-
-	// ensure that migrations dir exist
-	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
-		return err
-	}
-
-	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
-		return fmt.Errorf("Failed to save migration file %q\n", resultFilePath)
-	}
-
-	fmt.Printf("Successfully created file %q\n", resultFilePath)
-	return nil
-}
-
-// -------------------------------------------------------------------
-// migrate collections
-// -------------------------------------------------------------------
-
-const collectionsMigrateCreateTemplate = `package migrations
-
-import (
-	"encoding/json"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/daos"
-	m "github.com/pocketbase/pocketbase/migrations"
-	"github.com/pocketbase/pocketbase/models"
-)
-
-// Auto generated migration with the most recent collections configuration.
-func init() {
-	m.Register(func(db dbx.Builder) error {
-		jsonData := ` + "`" + `%s` + "`" + `
-
-		collections := []*models.Collection{}
-		if err := json.Unmarshal([]byte(jsonData), &collections); err != nil {
-			return err
-		}
-
-		return daos.New(db).ImportCollections(collections, true, nil)
-	}, func(db dbx.Builder) error {
-		// no revert since the configuration on the environment, on which
-		// the migration was executed, could have changed via the UI/API
-		return nil
-	})
-}
-`
-
-func migrateCollectionsHandler(app core.App, args []string) error {
-	createArgs := []string{"collections_snapshot"}
-	createArgs = append(createArgs, args...)
-
-	dao := daos.New(app.DB())
-
-	collections := []*models.Collection{}
-	if err := dao.CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
-		return fmt.Errorf("Failed to fetch migrations list: %v", err)
-	}
-
-	serialized, err := json.MarshalIndent(collections, "\t\t", "\t")
-	if err != nil {
-		return fmt.Errorf("Failed to serialize collections list: %v", err)
-	}
-
-	return migrateCreateHandler(
-		fmt.Sprintf(collectionsMigrateCreateTemplate, string(serialized)),
-		createArgs,
-	)
-}

cmd/serve.go

@@ -1,22 +1,12 @@
 package cmd
 
 import (
-	"crypto/tls"
-	"fmt"
-	"log"
-	"net"
+	"errors"
 	"net/http"
-	"path/filepath"
-	"time"
 
-	"github.com/fatih/color"
-	"github.com/labstack/echo/v5/middleware"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/migrate"
 	"github.com/spf13/cobra"
-	"golang.org/x/crypto/acme"
-	"golang.org/x/crypto/acme/autocert"
 )
 
 // NewServeCommand creates and returns new command responsible for
@@ -27,89 +17,38 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 	var httpsAddr string
 
 	command := &cobra.Command{
-		Use:   "serve",
-		Short: "Starts the web server (default to 127.0.0.1:8090)",
-		Run: func(command *cobra.Command, args []string) {
-			// ensure that the latest migrations are applied before starting the server
-			if err := runMigrations(app); err != nil {
-				panic(err)
-			}
-
-			// reload app settings in case a new default value was set with a migration
-			// (or if this is the first time the init migration was executed)
-			if err := app.RefreshSettings(); err != nil {
-				color.Yellow("=====================================")
-				color.Yellow("WARNING - Settings load error! \n%v", err)
-				color.Yellow("Fallback to the application defaults.")
-				color.Yellow("=====================================")
-			}
-
-			router, err := apis.InitApi(app)
-			if err != nil {
-				panic(err)
-			}
-
-			// configure cors
-			router.Use(middleware.CORSWithConfig(middleware.CORSConfig{
-				Skipper:      middleware.DefaultSkipper,
-				AllowOrigins: allowedOrigins,
-				AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
-			}))
-
-			// start http server
-			// ---
-			mainAddr := httpAddr
-			if httpsAddr != "" {
-				mainAddr = httpsAddr
-			}
-
-			mainHost, _, _ := net.SplitHostPort(mainAddr)
-
-			certManager := autocert.Manager{
-				Prompt:     autocert.AcceptTOS,
-				Cache:      autocert.DirCache(filepath.Join(app.DataDir(), ".autocert_cache")),
-				HostPolicy: autocert.HostWhitelist(mainHost, "www."+mainHost),
-			}
-
-			serverConfig := &http.Server{
-				TLSConfig: &tls.Config{
-					GetCertificate: certManager.GetCertificate,
-					NextProtos:     []string{acme.ALPNProto},
-				},
-				ReadTimeout: 60 * time.Second,
-				// WriteTimeout: 60 * time.Second, // breaks sse!
-				Handler: router,
-				Addr:    mainAddr,
-			}
-
-			if showStartBanner {
-				schema := "http"
-				if httpsAddr != "" {
-					schema = "https"
+		Use:          "serve [domain(s)]",
+		Args:         cobra.ArbitraryArgs,
+		Short:        "Starts the web server (default to 127.0.0.1:8090 if no domain is specified)",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			// set default listener addresses if at least one domain is specified
+			if len(args) > 0 {
+				if httpAddr == "" {
+					httpAddr = "0.0.0.0:80"
 				}
-				bold := color.New(color.Bold).Add(color.FgGreen)
-				bold.Printf("> Server started at: %s\n", color.CyanString("%s://%s", schema, serverConfig.Addr))
-				fmt.Printf("  - REST API: %s\n", color.CyanString("%s://%s/api/", schema, serverConfig.Addr))
-				fmt.Printf("  - Admin UI: %s\n", color.CyanString("%s://%s/_/", schema, serverConfig.Addr))
-			}
-
-			var serveErr error
-			if httpsAddr != "" {
-				// if httpAddr is set, start an HTTP server to redirect the traffic to the HTTPS version
-				if httpAddr != "" {
-					go http.ListenAndServe(httpAddr, certManager.HTTPHandler(nil))
+				if httpsAddr == "" {
+					httpsAddr = "0.0.0.0:443"
 				}
-
-				// start HTTPS server
-				serveErr = serverConfig.ListenAndServeTLS("", "")
 			} else {
-				// start HTTP server
-				serveErr = serverConfig.ListenAndServe()
+				if httpAddr == "" {
+					httpAddr = "127.0.0.1:8090"
+				}
 			}
 
-			if serveErr != http.ErrServerClosed {
-				log.Fatalln(serveErr)
+			_, err := apis.Serve(app, apis.ServeConfig{
+				HttpAddr:           httpAddr,
+				HttpsAddr:          httpsAddr,
+				ShowStartBanner:    showStartBanner,
+				AllowedOrigins:     allowedOrigins,
+				CertificateDomains: args,
+			})
+
+			if errors.Is(err, http.ErrServerClosed) {
+				return nil
 			}
+
+			return err
 		},
 	}
 
@@ -123,33 +62,16 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 	command.PersistentFlags().StringVar(
 		&httpAddr,
 		"http",
-		"127.0.0.1:8090",
-		"api HTTP server address",
+		"",
+		"TCP address to listen for the HTTP server\n(if domain args are specified - default to 0.0.0.0:80, otherwise - default to 127.0.0.1:8090)",
 	)
 
 	command.PersistentFlags().StringVar(
 		&httpsAddr,
 		"https",
 		"",
-		"api HTTPS server address (auto TLS via Let's Encrypt)\nthe incoming --http address traffic also will be redirected to this address",
+		"TCP address to listen for the HTTPS server\n(if domain args are specified - default to 0.0.0.0:443, otherwise - default to empty string, aka. no TLS)\nThe incoming HTTP traffic also will be auto redirected to the HTTPS version",
 	)
 
 	return command
 }
-
-func runMigrations(app core.App) error {
-	connections := migrationsConnectionsMap(app)
-
-	for _, c := range connections {
-		runner, err := migrate.NewRunner(c.DB, c.MigrationsList)
-		if err != nil {
-			return err
-		}
-
-		if _, err := runner.Up(); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

core/app.go

@@ -4,8 +4,12 @@
 package core
 
 import (
+	"context"
+	"log/slog"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
@@ -15,6 +19,11 @@ import (
 
 // App defines the main PocketBase app interface.
 type App interface {
+	// Deprecated:
+	// This method may get removed in the near future.
+	// It is recommended to access the app db instance from app.Dao().DB() or
+	// if you want more flexibility - app.Dao().ConcurrentDB() and app.Dao().NonconcurrentDB().
+	//
 	// DB returns the default app database instance.
 	DB() *dbx.DB
 
@@ -25,6 +34,11 @@ type App interface {
 	// trying to access the request logs table will result in error.
 	Dao() *daos.Dao
 
+	// Deprecated:
+	// This method may get removed in the near future.
+	// It is recommended to access the logs db instance from app.LogsDao().DB() or
+	// if you want more flexibility - app.LogsDao().ConcurrentDB() and app.LogsDao().NonconcurrentDB().
+	//
 	// LogsDB returns the app logs database instance.
 	LogsDB() *dbx.DB
 
@@ -35,6 +49,9 @@ type App interface {
 	// the users table from LogsDao will result in error.
 	LogsDao() *daos.Dao
 
+	// Logger returns the active app logger.
+	Logger() *slog.Logger
+
 	// DataDir returns the app data directory path.
 	DataDir() string
 
@@ -42,122 +59,225 @@ type App interface {
 	// (used for settings encryption).
 	EncryptionEnv() string
 
-	// IsDebug returns whether the app is in debug mode
-	// (showing more detailed error logs, executed sql statements, etc.).
-	IsDebug() bool
+	// IsDev returns whether the app is in dev mode.
+	IsDev() bool
 
 	// Settings returns the loaded app settings.
-	Settings() *Settings
+	Settings() *settings.Settings
 
-	// Cache returns the app internal cache store.
+	// Deprecated: Use app.Store() instead.
 	Cache() *store.Store[any]
 
+	// Store returns the app runtime store.
+	Store() *store.Store[any]
+
 	// SubscriptionsBroker returns the app realtime subscriptions broker instance.
 	SubscriptionsBroker() *subscriptions.Broker
 
 	// NewMailClient creates and returns a configured app mail client.
 	NewMailClient() mailer.Mailer
 
-	// NewFilesystem creates and returns a configured filesystem.System instance.
+	// NewFilesystem creates and returns a configured filesystem.System instance
+	// for managing regular app files (eg. collection uploads).
 	//
-	// NB! Make sure to call `Close()` on the returned result
+	// NB! Make sure to call Close() on the returned result
 	// after you are done working with it.
 	NewFilesystem() (*filesystem.System, error)
 
+	// NewBackupsFilesystem creates and returns a configured filesystem.System instance
+	// for managing app backups.
+	//
+	// NB! Make sure to call Close() on the returned result
+	// after you are done working with it.
+	NewBackupsFilesystem() (*filesystem.System, error)
+
 	// RefreshSettings reinitializes and reloads the stored application settings.
 	RefreshSettings() error
 
+	// IsBootstrapped checks if the application was initialized
+	// (aka. whether Bootstrap() was called).
+	IsBootstrapped() bool
+
 	// Bootstrap takes care for initializing the application
-	// (open db connections, load settings, etc.)
+	// (open db connections, load settings, etc.).
+	//
+	// It will call ResetBootstrapState() if the application was already bootstrapped.
 	Bootstrap() error
 
 	// ResetBootstrapState takes care for releasing initialized app resources
 	// (eg. closing db connections).
 	ResetBootstrapState() error
 
+	// CreateBackup creates a new backup of the current app pb_data directory.
+	//
+	// Backups can be stored on S3 if it is configured in app.Settings().Backups.
+	//
+	// Please refer to the godoc of the specific core.App implementation
+	// for details on the backup procedures.
+	CreateBackup(ctx context.Context, name string) error
+
+	// RestoreBackup restores the backup with the specified name and restarts
+	// the current running application process.
+	//
+	// The safely perform the restore it is recommended to have free disk space
+	// for at least 2x the size of the restored pb_data backup.
+	//
+	// Please refer to the godoc of the specific core.App implementation
+	// for details on the restore procedures.
+	//
+	// NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+	RestoreBackup(ctx context.Context, name string) error
+
+	// Restart restarts the current running application process.
+	//
+	// Currently it is relying on execve so it is supported only on UNIX based systems.
+	Restart() error
+
 	// ---------------------------------------------------------------
 	// App event hooks
 	// ---------------------------------------------------------------
 
+	// OnBeforeBootstrap hook is triggered before initializing the main
+	// application resources (eg. before db open and initial settings load).
+	OnBeforeBootstrap() *hook.Hook[*BootstrapEvent]
+
+	// OnAfterBootstrap hook is triggered after initializing the main
+	// application resources (eg. after db open and initial settings load).
+	OnAfterBootstrap() *hook.Hook[*BootstrapEvent]
+
 	// OnBeforeServe hook is triggered before serving the internal router (echo),
-	// allowing you to adjust its options and attach new routes.
+	// allowing you to adjust its options and attach new routes or middlewares.
 	OnBeforeServe() *hook.Hook[*ServeEvent]
 
+	// OnBeforeApiError hook is triggered right before sending an error API
+	// response to the client, allowing you to further modify the error data
+	// or to return a completely different API response.
+	OnBeforeApiError() *hook.Hook[*ApiErrorEvent]
+
+	// OnAfterApiError hook is triggered right after sending an error API
+	// response to the client.
+	// It could be used to log the final API error in external services.
+	OnAfterApiError() *hook.Hook[*ApiErrorEvent]
+
+	// OnTerminate hook is triggered when the app is in the process
+	// of being terminated (eg. on SIGTERM signal).
+	OnTerminate() *hook.Hook[*TerminateEvent]
+
 	// ---------------------------------------------------------------
 	// Dao event hooks
 	// ---------------------------------------------------------------
 
 	// OnModelBeforeCreate hook is triggered before inserting a new
-	// entry in the DB, allowing you to modify or validate the stored data.
-	OnModelBeforeCreate() *hook.Hook[*ModelEvent]
+	// model in the DB, allowing you to modify or validate the stored data.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeCreate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelAfterCreate hook is triggered after successfully
-	// inserting a new entry in the DB.
-	OnModelAfterCreate() *hook.Hook[*ModelEvent]
+	// inserting a new model in the DB.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterCreate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelBeforeUpdate hook is triggered before updating existing
-	// entry in the DB, allowing you to modify or validate the stored data.
-	OnModelBeforeUpdate() *hook.Hook[*ModelEvent]
+	// model in the DB, allowing you to modify or validate the stored data.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeUpdate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelAfterUpdate hook is triggered after successfully updating
-	// existing entry in the DB.
-	OnModelAfterUpdate() *hook.Hook[*ModelEvent]
+	// existing model in the DB.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterUpdate(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// OnModelBeforeDelete hook is triggered before deleting an
-	// existing entry from the DB.
-	OnModelBeforeDelete() *hook.Hook[*ModelEvent]
+	// existing model from the DB.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelBeforeDelete(tags ...string) *hook.TaggedHook[*ModelEvent]
 
-	// OnModelAfterDelete is triggered after successfully deleting an
-	// existing entry from the DB.
-	OnModelAfterDelete() *hook.Hook[*ModelEvent]
+	// OnModelAfterDelete hook is triggered after successfully deleting an
+	// existing model from the DB.
+	//
+	// If the optional "tags" list (table names and/or the Collection id for Record models)
+	// is specified, then all event handlers registered via the created hook
+	// will be triggered and called only if their event data origin matches the tags.
+	OnModelAfterDelete(tags ...string) *hook.TaggedHook[*ModelEvent]
 
 	// ---------------------------------------------------------------
 	// Mailer event hooks
 	// ---------------------------------------------------------------
 
-	// OnMailerBeforeAdminResetPasswordSend hook is triggered right before
-	// sending a password reset email to an admin.
-	//
-	// Could be used to send your own custom email template if
-	// [hook.StopPropagation] is returned in one of its listeners.
+	// OnMailerBeforeAdminResetPasswordSend hook is triggered right
+	// before sending a password reset email to an admin, allowing you
+	// to inspect and customize the email message that is being sent.
 	OnMailerBeforeAdminResetPasswordSend() *hook.Hook[*MailerAdminEvent]
 
 	// OnMailerAfterAdminResetPasswordSend hook is triggered after
 	// admin password reset email was successfully sent.
 	OnMailerAfterAdminResetPasswordSend() *hook.Hook[*MailerAdminEvent]
 
-	// OnMailerBeforeUserResetPasswordSend hook is triggered right before
-	// sending a password reset email to a user.
+	// OnMailerBeforeRecordResetPasswordSend hook is triggered right
+	// before sending a password reset email to an auth record, allowing
+	// you to inspect and customize the email message that is being sent.
 	//
-	// Could be used to send your own custom email template if
-	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeUserResetPasswordSend() *hook.Hook[*MailerUserEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
-	// OnMailerAfterUserResetPasswordSend hook is triggered after
-	// a user password reset email was successfully sent.
-	OnMailerAfterUserResetPasswordSend() *hook.Hook[*MailerUserEvent]
-
-	// OnMailerBeforeUserVerificationSend hook is triggered right before
-	// sending a verification email to a user.
+	// OnMailerAfterRecordResetPasswordSend hook is triggered after
+	// an auth record password reset email was successfully sent.
 	//
-	// Could be used to send your own custom email template if
-	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeUserVerificationSend() *hook.Hook[*MailerUserEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordResetPasswordSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
-	// OnMailerAfterUserVerificationSend hook is triggered after a user
-	// verification email was successfully sent.
-	OnMailerAfterUserVerificationSend() *hook.Hook[*MailerUserEvent]
-
-	// OnMailerBeforeUserChangeEmailSend hook is triggered right before
-	// sending a confirmation new address email to a a user.
+	// OnMailerBeforeRecordVerificationSend hook is triggered right
+	// before sending a verification email to an auth record, allowing
+	// you to inspect and customize the email message that is being sent.
 	//
-	// Could be used to send your own custom email template if
-	// [hook.StopPropagation] is returned in one of its listeners.
-	OnMailerBeforeUserChangeEmailSend() *hook.Hook[*MailerUserEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
-	// OnMailerAfterUserChangeEmailSend hook is triggered after a user
-	// change address email was successfully sent.
-	OnMailerAfterUserChangeEmailSend() *hook.Hook[*MailerUserEvent]
+	// OnMailerAfterRecordVerificationSend hook is triggered after a
+	// verification email was successfully sent to an auth record.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerBeforeRecordChangeEmailSend hook is triggered right before
+	// sending a confirmation new address email to an auth record, allowing
+	// you to inspect and customize the email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerBeforeRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerAfterRecordChangeEmailSend hook is triggered after a
+	// verification email was successfully sent to an auth record.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerAfterRecordChangeEmailSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
 
 	// ---------------------------------------------------------------
 	// Realtime API event hooks
@@ -167,6 +287,21 @@ type App interface {
 	// the SSE client connection.
 	OnRealtimeConnectRequest() *hook.Hook[*RealtimeConnectEvent]
 
+	// OnRealtimeDisconnectRequest hook is triggered on disconnected/interrupted
+	// SSE client connection.
+	OnRealtimeDisconnectRequest() *hook.Hook[*RealtimeDisconnectEvent]
+
+	// OnRealtimeBeforeMessageSend hook is triggered right before sending
+	// an SSE message to a client.
+	//
+	// Returning [hook.StopPropagation] will prevent sending the message.
+	// Returning any other non-nil error will close the realtime connection.
+	OnRealtimeBeforeMessageSend() *hook.Hook[*RealtimeMessageEvent]
+
+	// OnRealtimeAfterMessageSend hook is triggered right after sending
+	// an SSE message to a client.
+	OnRealtimeAfterMessageSend() *hook.Hook[*RealtimeMessageEvent]
+
 	// OnRealtimeBeforeSubscribeRequest hook is triggered before changing
 	// the client subscriptions, allowing you to further validate and
 	// modify the submitted change.
@@ -191,8 +326,7 @@ type App interface {
 	// Settings update request (after request data load and before settings persistence).
 	//
 	// Could be used to additionally validate the request data or
-	// implement completely different persistence behavior
-	// (returning [hook.StopPropagation]).
+	// implement completely different persistence behavior.
 	OnSettingsBeforeUpdateRequest() *hook.Hook[*SettingsUpdateEvent]
 
 	// OnSettingsAfterUpdateRequest hook is triggered after each
@@ -207,7 +341,26 @@ type App interface {
 	//
 	// Could be used to validate or modify the file response before
 	// returning it to the client.
-	OnFileDownloadRequest() *hook.Hook[*FileDownloadEvent]
+	OnFileDownloadRequest(tags ...string) *hook.TaggedHook[*FileDownloadEvent]
+
+	// OnFileBeforeTokenRequest hook is triggered before each file
+	// token API request.
+	//
+	// If no token or model was submitted, e.Model and e.Token will be empty,
+	// allowing you to implement your own custom model file auth implementation.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnFileBeforeTokenRequest(tags ...string) *hook.TaggedHook[*FileTokenEvent]
+
+	// OnFileAfterTokenRequest hook is triggered after each
+	// successful file token API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnFileAfterTokenRequest(tags ...string) *hook.TaggedHook[*FileTokenEvent]
 
 	// ---------------------------------------------------------------
 	// Admin API event hooks
@@ -227,7 +380,7 @@ type App interface {
 	// Admin create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
+	// completely different persistence behavior.
 	OnAdminBeforeCreateRequest() *hook.Hook[*AdminCreateEvent]
 
 	// OnAdminAfterCreateRequest hook is triggered after each
@@ -238,7 +391,7 @@ type App interface {
 	// Admin update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
+	// completely different persistence behavior.
 	OnAdminBeforeUpdateRequest() *hook.Hook[*AdminUpdateEvent]
 
 	// OnAdminAfterUpdateRequest hook is triggered after each
@@ -249,7 +402,7 @@ type App interface {
 	// Admin delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning [hook.StopPropagation]).
+	// completely different delete behavior.
 	OnAdminBeforeDeleteRequest() *hook.Hook[*AdminDeleteEvent]
 
 	// OnAdminAfterDeleteRequest hook is triggered after each
@@ -263,117 +416,345 @@ type App interface {
 	// authenticated admin data and token.
 	OnAdminAuthRequest() *hook.Hook[*AdminAuthEvent]
 
+	// OnAdminBeforeAuthWithPasswordRequest hook is triggered before each Admin
+	// auth with password API request (after request data load and before password validation).
+	//
+	// Could be used to implement for example a custom password validation
+	// or to locate a different Admin identity (by assigning [AdminAuthWithPasswordEvent.Admin]).
+	OnAdminBeforeAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent]
+
+	// OnAdminAfterAuthWithPasswordRequest hook is triggered after each
+	// successful Admin auth with password API request.
+	OnAdminAfterAuthWithPasswordRequest() *hook.Hook[*AdminAuthWithPasswordEvent]
+
+	// OnAdminBeforeAuthRefreshRequest hook is triggered before each Admin
+	// auth refresh API request (right before generating a new auth token).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different auth refresh behavior.
+	OnAdminBeforeAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent]
+
+	// OnAdminAfterAuthRefreshRequest hook is triggered after each
+	// successful auth refresh API request (right after generating a new auth token).
+	OnAdminAfterAuthRefreshRequest() *hook.Hook[*AdminAuthRefreshEvent]
+
+	// OnAdminBeforeRequestPasswordResetRequest hook is triggered before each Admin
+	// request password reset API request (after request data load and before sending the reset email).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different password reset behavior.
+	OnAdminBeforeRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent]
+
+	// OnAdminAfterRequestPasswordResetRequest hook is triggered after each
+	// successful request password reset API request.
+	OnAdminAfterRequestPasswordResetRequest() *hook.Hook[*AdminRequestPasswordResetEvent]
+
+	// OnAdminBeforeConfirmPasswordResetRequest hook is triggered before each Admin
+	// confirm password reset API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	OnAdminBeforeConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent]
+
+	// OnAdminAfterConfirmPasswordResetRequest hook is triggered after each
+	// successful confirm password reset API request.
+	OnAdminAfterConfirmPasswordResetRequest() *hook.Hook[*AdminConfirmPasswordResetEvent]
+
 	// ---------------------------------------------------------------
-	// User API event hooks
+	// Record Auth API event hooks
 	// ---------------------------------------------------------------
 
-	// OnUsersListRequest hook is triggered on each API Users list request.
+	// OnRecordAuthRequest hook is triggered on each successful API
+	// record authentication request (sign-in, token refresh, etc.).
+	//
+	// Could be used to additionally validate or modify the authenticated
+	// record data and token.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthRequest(tags ...string) *hook.TaggedHook[*RecordAuthEvent]
+
+	// OnRecordBeforeAuthWithPasswordRequest hook is triggered before each Record
+	// auth with password API request (after request data load and before password validation).
+	//
+	// Could be used to implement for example a custom password validation
+	// or to locate a different Record model (by reassigning [RecordAuthWithPasswordEvent.Record]).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent]
+
+	// OnRecordAfterAuthWithPasswordRequest hook is triggered after each
+	// successful Record auth with password API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordEvent]
+
+	// OnRecordBeforeAuthWithOAuth2Request hook is triggered before each Record
+	// OAuth2 sign-in/sign-up API request (after token exchange and before external provider linking).
+	//
+	// If the [RecordAuthWithOAuth2Event.Record] is not set, then the OAuth2
+	// request will try to create a new auth Record.
+	//
+	// To assign or link a different existing record model you can
+	// change the [RecordAuthWithOAuth2Event.Record] field.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event]
+
+	// OnRecordAfterAuthWithOAuth2Request hook is triggered after each
+	// successful Record OAuth2 API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2Event]
+
+	// OnRecordBeforeAuthRefreshRequest hook is triggered before each Record
+	// auth refresh API request (right before generating a new auth token).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different auth refresh behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent]
+
+	// OnRecordAfterAuthRefreshRequest hook is triggered after each
+	// successful auth refresh API request (right after generating a new auth token).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshEvent]
+
+	// OnRecordListExternalAuthsRequest hook is triggered on each API record external auths list request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnUsersListRequest() *hook.Hook[*UsersListEvent]
-
-	// OnUserViewRequest hook is triggered on each API User view request.
 	//
-	// Could be used to validate or modify the response before returning it to the client.
-	OnUserViewRequest() *hook.Hook[*UserViewEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordListExternalAuthsRequest(tags ...string) *hook.TaggedHook[*RecordListExternalAuthsEvent]
 
-	// OnUserBeforeCreateRequest hook is triggered before each API User
-	// create request (after request data load and before model persistence).
+	// OnRecordBeforeUnlinkExternalAuthRequest hook is triggered before each API record
+	// external auth unlink request (after models load and before the actual relation deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnUserBeforeCreateRequest() *hook.Hook[*UserCreateEvent]
+	// completely different delete behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent]
 
-	// OnUserAfterCreateRequest hook is triggered after each
-	// successful API User create request.
-	OnUserAfterCreateRequest() *hook.Hook[*UserCreateEvent]
+	// OnRecordAfterUnlinkExternalAuthRequest hook is triggered after each
+	// successful API record external auth unlink request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUnlinkExternalAuthRequest(tags ...string) *hook.TaggedHook[*RecordUnlinkExternalAuthEvent]
 
-	// OnUserBeforeUpdateRequest hook is triggered before each API User
-	// update request (after request data load and before model persistence).
+	// OnRecordBeforeRequestPasswordResetRequest hook is triggered before each Record
+	// request password reset API request (after request data load and before sending the reset email).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnUserBeforeUpdateRequest() *hook.Hook[*UserUpdateEvent]
+	// completely different password reset behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent]
 
-	// OnUserAfterUpdateRequest hook is triggered after each
-	// successful API User update request.
-	OnUserAfterUpdateRequest() *hook.Hook[*UserUpdateEvent]
+	// OnRecordAfterRequestPasswordResetRequest hook is triggered after each
+	// successful request password reset API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetEvent]
 
-	// OnUserBeforeDeleteRequest hook is triggered before each API User
-	// delete request (after model load and before actual deletion).
+	// OnRecordBeforeConfirmPasswordResetRequest hook is triggered before each Record
+	// confirm password reset API request (after request data load and before persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning [hook.StopPropagation]).
-	OnUserBeforeDeleteRequest() *hook.Hook[*UserDeleteEvent]
-
-	// OnUserAfterDeleteRequest hook is triggered after each
-	// successful API User delete request.
-	OnUserAfterDeleteRequest() *hook.Hook[*UserDeleteEvent]
-
-	// OnUserAuthRequest hook is triggered on each successful API User
-	// authentication request (sign-in, token refresh, etc.).
+	// completely different persistence behavior.
 	//
-	// Could be used to additionally validate or modify the
-	// authenticated user data and token.
-	OnUserAuthRequest() *hook.Hook[*UserAuthEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent]
 
-	// OnUserBeforeOauth2Register hook is triggered before each User OAuth2
-	// authentication request (when the client config has enabled new users registration).
+	// OnRecordAfterConfirmPasswordResetRequest hook is triggered after each
+	// successful confirm password reset API request.
 	//
-	// Could be used to additionally validate or modify the new user
-	// before persisting in the DB.
-	OnUserBeforeOauth2Register() *hook.Hook[*UserOauth2RegisterEvent]
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetEvent]
 
-	// OnUserAfterOauth2Register hook is triggered after each successful User
-	// OAuth2 authentication sign-up request (right after the new user persistence).
-	OnUserAfterOauth2Register() *hook.Hook[*UserOauth2RegisterEvent]
+	// OnRecordBeforeRequestVerificationRequest hook is triggered before each Record
+	// request verification API request (after request data load and before sending the verification email).
+	//
+	// Could be used to additionally validate the loaded request data or implement
+	// completely different verification behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent]
+
+	// OnRecordAfterRequestVerificationRequest hook is triggered after each
+	// successful request verification API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationEvent]
+
+	// OnRecordBeforeConfirmVerificationRequest hook is triggered before each Record
+	// confirm verification API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent]
+
+	// OnRecordAfterConfirmVerificationRequest hook is triggered after each
+	// successful confirm verification API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationEvent]
+
+	// OnRecordBeforeRequestEmailChangeRequest hook is triggered before each Record request email change API request
+	// (after request data load and before sending the email link to confirm the change).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different request email change behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent]
+
+	// OnRecordAfterRequestEmailChangeRequest hook is triggered after each
+	// successful request email change API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeEvent]
+
+	// OnRecordBeforeConfirmEmailChangeRequest hook is triggered before each Record
+	// confirm email change API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent]
+
+	// OnRecordAfterConfirmEmailChangeRequest hook is triggered after each
+	// successful confirm email change API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeEvent]
 
 	// ---------------------------------------------------------------
-	// Record API event hooks
+	// Record CRUD API event hooks
 	// ---------------------------------------------------------------
 
 	// OnRecordsListRequest hook is triggered on each API Records list request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnRecordsListRequest() *hook.Hook[*RecordsListEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordsListRequest(tags ...string) *hook.TaggedHook[*RecordsListEvent]
 
 	// OnRecordViewRequest hook is triggered on each API Record view request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
-	OnRecordViewRequest() *hook.Hook[*RecordViewEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordViewRequest(tags ...string) *hook.TaggedHook[*RecordViewEvent]
 
 	// OnRecordBeforeCreateRequest hook is triggered before each API Record
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeCreateRequest() *hook.Hook[*RecordCreateEvent]
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent]
 
 	// OnRecordAfterCreateRequest hook is triggered after each
 	// successful API Record create request.
-	OnRecordAfterCreateRequest() *hook.Hook[*RecordCreateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterCreateRequest(tags ...string) *hook.TaggedHook[*RecordCreateEvent]
 
 	// OnRecordBeforeUpdateRequest hook is triggered before each API Record
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeUpdateRequest() *hook.Hook[*RecordUpdateEvent]
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent]
 
 	// OnRecordAfterUpdateRequest hook is triggered after each
 	// successful API Record update request.
-	OnRecordAfterUpdateRequest() *hook.Hook[*RecordUpdateEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUpdateRequest(tags ...string) *hook.TaggedHook[*RecordUpdateEvent]
 
 	// OnRecordBeforeDeleteRequest hook is triggered before each API Record
 	// delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning [hook.StopPropagation]).
-	OnRecordBeforeDeleteRequest() *hook.Hook[*RecordDeleteEvent]
+	// completely different delete behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordBeforeDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent]
 
 	// OnRecordAfterDeleteRequest hook is triggered after each
 	// successful API Record delete request.
-	OnRecordAfterDeleteRequest() *hook.Hook[*RecordDeleteEvent]
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterDeleteRequest(tags ...string) *hook.TaggedHook[*RecordDeleteEvent]
 
 	// ---------------------------------------------------------------
 	// Collection API event hooks
@@ -393,7 +774,7 @@ type App interface {
 	// create request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
+	// completely different persistence behavior.
 	OnCollectionBeforeCreateRequest() *hook.Hook[*CollectionCreateEvent]
 
 	// OnCollectionAfterCreateRequest hook is triggered after each
@@ -404,7 +785,7 @@ type App interface {
 	// update request (after request data load and before model persistence).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different persistence behavior (returning [hook.StopPropagation]).
+	// completely different persistence behavior.
 	OnCollectionBeforeUpdateRequest() *hook.Hook[*CollectionUpdateEvent]
 
 	// OnCollectionAfterUpdateRequest hook is triggered after each
@@ -415,7 +796,7 @@ type App interface {
 	// Collection delete request (after model load and before actual deletion).
 	//
 	// Could be used to additionally validate the request data or implement
-	// completely different delete behavior (returning [hook.StopPropagation]).
+	// completely different delete behavior.
 	OnCollectionBeforeDeleteRequest() *hook.Hook[*CollectionDeleteEvent]
 
 	// OnCollectionAfterDeleteRequest hook is triggered after each
@@ -426,7 +807,7 @@ type App interface {
 	// collections import request (after request data load and before the actual import).
 	//
 	// Could be used to additionally validate the imported collections or
-	// to implement completely different import behavior (returning [hook.StopPropagation]).
+	// to implement completely different import behavior.
 	OnCollectionsBeforeImportRequest() *hook.Hook[*CollectionsImportEvent]
 
 	// OnCollectionsAfterImportRequest hook is triggered after each

core/base_backup.go

@@ -0,0 +1,371 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"time"
+
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// Deprecated: Replaced with StoreKeyActiveBackup.
+const CacheKeyActiveBackup string = "@activeBackup"
+
+const StoreKeyActiveBackup string = "@activeBackup"
+
+// CreateBackup creates a new backup of the current app pb_data directory.
+//
+// If name is empty, it will be autogenerated.
+// If backup with the same name exists, the new backup file will replace it.
+//
+// The backup is executed within a transaction, meaning that new writes
+// will be temporary "blocked" until the backup file is generated.
+//
+// To safely perform the backup, it is recommended to have free disk space
+// for at least 2x the size of the pb_data directory.
+//
+// By default backups are stored in pb_data/backups
+// (the backups directory itself is excluded from the generated backup).
+//
+// When using S3 storage for the uploaded collection files, you have to
+// take care manually to backup those since they are not part of the pb_data.
+//
+// Backups can be stored on S3 if it is configured in app.Settings().Backups.
+func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
+	if app.Store().Has(StoreKeyActiveBackup) {
+		return errors.New("try again later - another backup/restore operation has already been started")
+	}
+
+	if name == "" {
+		name = app.generateBackupName("pb_backup_")
+	}
+
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
+
+	// root dir entries to exclude from the backup generation
+	exclude := []string{LocalBackupsDirName, LocalTempDirName}
+
+	// make sure that the special temp directory exists
+	// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+	localTempDir := filepath.Join(app.DataDir(), LocalTempDirName)
+	if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
+		return fmt.Errorf("failed to create a temp dir: %w", err)
+	}
+
+	// Archive pb_data in a temp directory, exluding the "backups" and the temp dirs.
+	//
+	// Run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection).
+	// ---
+	tempPath := filepath.Join(localTempDir, "pb_backup_"+security.PseudorandomString(4))
+	createErr := app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+		// @todo consider experimenting with temp switching the readonly pragma after the db interface change
+		return archive.Create(app.DataDir(), tempPath, exclude...)
+	})
+	if createErr != nil {
+		return createErr
+	}
+	defer os.Remove(tempPath)
+
+	// Persist the backup in the backups filesystem.
+	// ---
+	fsys, err := app.NewBackupsFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	file, err := filesystem.NewFileFromPath(tempPath)
+	if err != nil {
+		return err
+	}
+	file.OriginalName = name
+	file.Name = file.OriginalName
+
+	if err := fsys.UploadFile(file, file.Name); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// RestoreBackup restores the backup with the specified name and restarts
+// the current running application process.
+//
+// NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+//
+// To safely perform the restore it is recommended to have free disk space
+// for at least 2x the size of the restored pb_data backup.
+//
+// The performed steps are:
+//
+//  1. Download the backup with the specified name in a temp location
+//     (this is in case of S3; otherwise it creates a temp copy of the zip)
+//
+//  2. Extract the backup in a temp directory inside the app "pb_data"
+//     (eg. "pb_data/.pb_temp_to_delete/pb_restore").
+//
+//  3. Move the current app "pb_data" content (excluding the local backups and the special temp dir)
+//     under another temp sub dir that will be deleted on the next app start up
+//     (eg. "pb_data/.pb_temp_to_delete/old_pb_data").
+//     This is because on some environments it may not be allowed
+//     to delete the currently open "pb_data" files.
+//
+//  4. Move the extracted dir content to the app "pb_data".
+//
+//  5. Restart the app (on successful app bootstap it will also remove the old pb_data).
+//
+// If a failure occure during the restore process the dir changes are reverted.
+// If for whatever reason the revert is not possible, it panics.
+func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
+	if runtime.GOOS == "windows" {
+		return errors.New("restore is not supported on windows")
+	}
+
+	if app.Store().Has(StoreKeyActiveBackup) {
+		return errors.New("try again later - another backup/restore operation has already been started")
+	}
+
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
+
+	fsys, err := app.NewBackupsFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	// fetch the backup file in a temp location
+	br, err := fsys.GetFile(name)
+	if err != nil {
+		return err
+	}
+	defer br.Close()
+
+	// make sure that the special temp directory exists
+	// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+	localTempDir := filepath.Join(app.DataDir(), LocalTempDirName)
+	if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
+		return fmt.Errorf("failed to create a temp dir: %w", err)
+	}
+
+	// create a temp zip file from the blob.Reader and try to extract it
+	tempZip, err := os.CreateTemp(localTempDir, "pb_restore_zip")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tempZip.Name())
+
+	if _, err := io.Copy(tempZip, br); err != nil {
+		return err
+	}
+
+	extractedDataDir := filepath.Join(localTempDir, "pb_restore_"+security.PseudorandomString(4))
+	defer os.RemoveAll(extractedDataDir)
+	if err := archive.Extract(tempZip.Name(), extractedDataDir); err != nil {
+		return err
+	}
+
+	// ensure that a database file exists
+	extractedDB := filepath.Join(extractedDataDir, "data.db")
+	if _, err := os.Stat(extractedDB); err != nil {
+		return fmt.Errorf("data.db file is missing or invalid: %w", err)
+	}
+
+	// remove the extracted zip file since we no longer need it
+	// (this is in case the app restarts and the defer calls are not called)
+	if err := os.Remove(tempZip.Name()); err != nil {
+		app.Logger().Debug(
+			"[RestoreBackup] Failed to remove the temp zip backup file",
+			slog.String("file", tempZip.Name()),
+			slog.String("error", err.Error()),
+		)
+	}
+
+	// root dir entries to exclude from the backup restore
+	exclude := []string{LocalBackupsDirName, LocalTempDirName}
+
+	// move the current pb_data content to a special temp location
+	// that will hold the old data between dirs replace
+	// (the temp dir will be automatically removed on the next app start)
+	oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(4))
+	if err := osutils.MoveDirContent(app.DataDir(), oldTempDataDir, exclude...); err != nil {
+		return fmt.Errorf("failed to move the current pb_data content to a temp location: %w", err)
+	}
+
+	// move the extracted archive content to the app's pb_data
+	if err := osutils.MoveDirContent(extractedDataDir, app.DataDir(), exclude...); err != nil {
+		return fmt.Errorf("failed to move the extracted archive content to pb_data: %w", err)
+	}
+
+	revertDataDirChanges := func() error {
+		if err := osutils.MoveDirContent(app.DataDir(), extractedDataDir, exclude...); err != nil {
+			return fmt.Errorf("failed to revert the extracted dir change: %w", err)
+		}
+
+		if err := osutils.MoveDirContent(oldTempDataDir, app.DataDir(), exclude...); err != nil {
+			return fmt.Errorf("failed to revert old pb_data dir change: %w", err)
+		}
+
+		return nil
+	}
+
+	// restart the app
+	if err := app.Restart(); err != nil {
+		if revertErr := revertDataDirChanges(); revertErr != nil {
+			panic(revertErr)
+		}
+
+		return fmt.Errorf("failed to restart the app process: %w", err)
+	}
+
+	return nil
+}
+
+// initAutobackupHooks registers the autobackup app serve hooks.
+func (app *BaseApp) initAutobackupHooks() error {
+	c := cron.New()
+	isServe := false
+
+	loadJob := func() {
+		c.Stop()
+
+		// make sure that app.Settings() is always up to date
+		//
+		// @todo remove with the refactoring as core.App and daos.Dao will be one.
+		if err := app.RefreshSettings(); err != nil {
+			app.Logger().Debug(
+				"[Backup cron] Failed to get the latest app settings",
+				slog.String("error", err.Error()),
+			)
+		}
+
+		rawSchedule := app.Settings().Backups.Cron
+		if rawSchedule == "" || !isServe || !app.IsBootstrapped() {
+			return
+		}
+
+		c.Add("@autobackup", rawSchedule, func() {
+			const autoPrefix = "@auto_pb_backup_"
+
+			name := app.generateBackupName(autoPrefix)
+
+			if err := app.CreateBackup(context.Background(), name); err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to create backup",
+					slog.String("name", name),
+					slog.String("error", err.Error()),
+				)
+			}
+
+			maxKeep := app.Settings().Backups.CronMaxKeep
+
+			if maxKeep == 0 {
+				return // no explicit limit
+			}
+
+			fsys, err := app.NewBackupsFilesystem()
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to initialize the backup filesystem",
+					slog.String("error", err.Error()),
+				)
+				return
+			}
+			defer fsys.Close()
+
+			files, err := fsys.List(autoPrefix)
+			if err != nil {
+				app.Logger().Debug(
+					"[Backup cron] Failed to list autogenerated backups",
+					slog.String("error", err.Error()),
+				)
+				return
+			}
+
+			if maxKeep >= len(files) {
+				return // nothing to remove
+			}
+
+			// sort desc
+			sort.Slice(files, func(i, j int) bool {
+				return files[i].ModTime.After(files[j].ModTime)
+			})
+
+			// keep only the most recent n auto backup files
+			toRemove := files[maxKeep:]
+
+			for _, f := range toRemove {
+				if err := fsys.Delete(f.Key); err != nil {
+					app.Logger().Debug(
+						"[Backup cron] Failed to remove old autogenerated backup",
+						slog.String("key", f.Key),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+		})
+
+		// restart the ticker
+		c.Start()
+	}
+
+	// load on app serve
+	app.OnBeforeServe().Add(func(e *ServeEvent) error {
+		isServe = true
+		loadJob()
+		return nil
+	})
+
+	// stop the ticker on app termination
+	app.OnTerminate().Add(func(e *TerminateEvent) error {
+		c.Stop()
+		return nil
+	})
+
+	// reload on app settings change
+	app.OnModelAfterUpdate((&models.Param{}).TableName()).Add(func(e *ModelEvent) error {
+		p := e.Model.(*models.Param)
+		if p == nil || p.Key != models.ParamAppSettings {
+			return nil
+		}
+
+		loadJob()
+
+		return nil
+	})
+
+	return nil
+}
+
+func (app *BaseApp) generateBackupName(prefix string) string {
+	appName := inflector.Snakecase(app.Settings().Meta.AppName)
+	if len(appName) > 50 {
+		appName = appName[:50]
+	}
+
+	return fmt.Sprintf(
+		"%s%s_%s.zip",
+		prefix,
+		appName,
+		time.Now().UTC().Format("20060102150405"),
+	)
+}

core/base_backup_test.go

@@ -0,0 +1,164 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestCreateBackup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// set some long app name with spaces and special characters
+	app.Settings().Meta.AppName = "test @! " + strings.Repeat("a", 100)
+
+	expectedAppNamePrefix := "test_" + strings.Repeat("a", 45)
+
+	// test pending error
+	app.Store().Set(core.StoreKeyActiveBackup, "")
+	if err := app.CreateBackup(context.Background(), "test.zip"); err == nil {
+		t.Fatal("Expected pending error, got nil")
+	}
+	app.Store().Remove(core.StoreKeyActiveBackup)
+
+	// create with auto generated name
+	if err := app.CreateBackup(context.Background(), ""); err != nil {
+		t.Fatal("Failed to create a backup with autogenerated name")
+	}
+
+	// create with custom name
+	if err := app.CreateBackup(context.Background(), "custom"); err != nil {
+		t.Fatal("Failed to create a backup with custom name")
+	}
+
+	// create new with the same name (aka. replace)
+	if err := app.CreateBackup(context.Background(), "custom"); err != nil {
+		t.Fatal("Failed to create and replace a backup with the same name")
+	}
+
+	backupsDir := filepath.Join(app.DataDir(), core.LocalBackupsDirName)
+
+	entries, err := os.ReadDir(backupsDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedFiles := []string{
+		`^pb_backup_` + expectedAppNamePrefix + `_\w+\.zip$`,
+		`^pb_backup_` + expectedAppNamePrefix + `_\w+\.zip.attrs$`,
+		"custom",
+		"custom.attrs",
+	}
+
+	if len(entries) != len(expectedFiles) {
+		names := getEntryNames(entries)
+		t.Fatalf("Expected %d backup files, got %d: \n%v", len(expectedFiles), len(entries), names)
+	}
+
+	for i, entry := range entries {
+		if !list.ExistInSliceWithRegex(entry.Name(), expectedFiles) {
+			t.Fatalf("[%d] Missing backup file %q", i, entry.Name())
+		}
+
+		if strings.HasSuffix(entry.Name(), ".attrs") {
+			continue
+		}
+
+		path := filepath.Join(backupsDir, entry.Name())
+
+		if err := verifyBackupContent(app, path); err != nil {
+			t.Fatalf("[%d] Failed to verify backup content: %v", i, err)
+		}
+	}
+}
+
+func TestRestoreBackup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// create a initial test backup to ensure that there are at least 1
+	// backup file and that the generated zip doesn't contain the backups dir
+	if err := app.CreateBackup(context.Background(), "initial"); err != nil {
+		t.Fatal("Failed to create test initial backup")
+	}
+
+	// create test backup
+	if err := app.CreateBackup(context.Background(), "test"); err != nil {
+		t.Fatal("Failed to create test backup")
+	}
+
+	// test pending error
+	app.Store().Set(core.StoreKeyActiveBackup, "")
+	if err := app.RestoreBackup(context.Background(), "test"); err == nil {
+		t.Fatal("Expected pending error, got nil")
+	}
+	app.Store().Remove(core.StoreKeyActiveBackup)
+
+	// missing backup
+	if err := app.RestoreBackup(context.Background(), "missing"); err == nil {
+		t.Fatal("Expected missing error, got nil")
+	}
+}
+
+// -------------------------------------------------------------------
+
+func verifyBackupContent(app core.App, path string) error {
+	dir, err := os.MkdirTemp("", "backup_test")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(dir)
+
+	if err := archive.Extract(path, dir); err != nil {
+		return err
+	}
+
+	expectedRootEntries := []string{
+		"storage",
+		"data.db",
+		"data.db-shm",
+		"data.db-wal",
+		"logs.db",
+		"logs.db-shm",
+		"logs.db-wal",
+		".gitignore",
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return err
+	}
+
+	if len(entries) != len(expectedRootEntries) {
+		names := getEntryNames(entries)
+		return fmt.Errorf("Expected %d backup files, got %d: \n%v", len(expectedRootEntries), len(entries), names)
+	}
+
+	for _, entry := range entries {
+		if !list.ExistInSliceWithRegex(entry.Name(), expectedRootEntries) {
+			return fmt.Errorf("Didn't expect %q entry", entry.Name())
+		}
+	}
+
+	return nil
+}
+
+func getEntryNames(entries []fs.DirEntry) []string {
+	names := make([]string, len(entries))
+
+	for i, entry := range entries {
+		names[i] = entry.Name()
+	}
+
+	return names
+}

core/base_settings_test.go

@@ -0,0 +1,63 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestBaseAppRefreshSettings(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// cleanup all stored settings
+	if _, err := app.DB().NewQuery("DELETE from _params;").Execute(); err != nil {
+		t.Fatalf("Failed to delete all test settings: %v", err)
+	}
+
+	// check if the new settings are saved in the db
+	app.ResetEventCalls()
+	if err := app.RefreshSettings(); err != nil {
+		t.Fatalf("Failed to refresh the settings after delete: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnModelBeforeCreate": 1,
+		"OnModelAfterCreate":  1,
+	})
+	param, err := app.Dao().FindParamByKey(models.ParamAppSettings)
+	if err != nil {
+		t.Fatalf("Expected new settings to be persisted, got %v", err)
+	}
+
+	// change the db entry and refresh the app settings (ensure that there was no db update)
+	param.Value = types.JsonRaw([]byte(`{"example": 123}`))
+	if err := app.Dao().SaveParam(param.Key, param.Value); err != nil {
+		t.Fatalf("Failed to update the test settings: %v", err)
+	}
+	app.ResetEventCalls()
+	if err := app.RefreshSettings(); err != nil {
+		t.Fatalf("Failed to refresh the app settings: %v", err)
+	}
+	testEventCalls(t, app, nil)
+
+	// try to refresh again without doing any changes
+	app.ResetEventCalls()
+	if err := app.RefreshSettings(); err != nil {
+		t.Fatalf("Failed to refresh the app settings without change: %v", err)
+	}
+	testEventCalls(t, app, nil)
+}
+
+func testEventCalls(t *testing.T, app *tests.TestApp, events map[string]int) {
+	if len(events) != len(app.EventCalls) {
+		t.Fatalf("Expected events doesn't match: \n%v, \ngot \n%v", events, app.EventCalls)
+	}
+
+	for name, total := range events {
+		if v, ok := app.EventCalls[name]; !ok || v != total {
+			t.Fatalf("Expected events doesn't exist or match: \n%v, \ngot \n%v", events, app.EventCalls)
+		}
+	}
+}

core/base_test.go

@@ -1,17 +1,31 @@
 package core
 
 import (
+	"fmt"
+	"log/slog"
 	"os"
 	"testing"
+	"time"
 
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/logger"
 	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/migrate"
 )
 
 func TestNewBaseApp(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "test_env", true)
+	app := NewBaseApp(BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "test_env",
+		IsDev:         true,
+	})
 
 	if app.dataDir != testDataDir {
 		t.Fatalf("expected dataDir %q, got %q", testDataDir, app.dataDir)
@@ -21,12 +35,12 @@ func TestNewBaseApp(t *testing.T) {
 		t.Fatalf("expected encryptionEnv test_env, got %q", app.dataDir)
 	}
 
-	if !app.isDebug {
-		t.Fatalf("expected isDebug true, got %v", app.isDebug)
+	if !app.isDev {
+		t.Fatalf("expected isDev true, got %v", app.isDev)
 	}
 
-	if app.cache == nil {
-		t.Fatal("expected cache to be set, got nil")
+	if app.store == nil {
+		t.Fatal("expected store to be set, got nil")
 	}
 
 	if app.settings == nil {
@@ -42,14 +56,24 @@ func TestBaseAppBootstrap(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+	})
 	defer app.ResetBootstrapState()
 
-	// bootstrap
+	if app.IsBootstrapped() {
+		t.Fatal("Didn't expect the application to be bootstrapped.")
+	}
+
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
 
+	if !app.IsBootstrapped() {
+		t.Fatal("Expected the application to be bootstrapped.")
+	}
+
 	if stat, err := os.Stat(testDataDir); err != nil || !stat.IsDir() {
 		t.Fatal("Expected test data directory to be created.")
 	}
@@ -90,6 +114,14 @@ func TestBaseAppBootstrap(t *testing.T) {
 		t.Fatal("Expected app.settings to be initialized, got nil.")
 	}
 
+	if app.logger == nil {
+		t.Fatal("Expected app.logger to be initialized, got nil.")
+	}
+
+	if _, ok := app.logger.Handler().(*logger.BatchHandler); !ok {
+		t.Fatal("Expected app.logger handler to be initialized.")
+	}
+
 	// reset
 	if err := app.ResetBootstrapState(); err != nil {
 		t.Fatal(err)
@@ -102,39 +134,39 @@ func TestBaseAppBootstrap(t *testing.T) {
 	if app.logsDao != nil {
 		t.Fatalf("Expected app.logsDao to be nil, got %v.", app.logsDao)
 	}
-
-	if app.settings != nil {
-		t.Fatalf("Expected app.settings to be nil, got %v.", app.settings)
-	}
 }
 
 func TestBaseAppGetters(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		IsDev:         true,
+	})
 	defer app.ResetBootstrapState()
 
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
 
-	if app.db != app.DB() {
-		t.Fatalf("Expected app.DB %v, got %v", app.DB(), app.db)
-	}
-
 	if app.dao != app.Dao() {
 		t.Fatalf("Expected app.Dao %v, got %v", app.Dao(), app.dao)
 	}
 
-	if app.logsDB != app.LogsDB() {
-		t.Fatalf("Expected app.LogsDB %v, got %v", app.LogsDB(), app.logsDB)
+	if app.dao.ConcurrentDB() != app.DB() {
+		t.Fatalf("Expected app.DB %v, got %v", app.DB(), app.dao.ConcurrentDB())
 	}
 
 	if app.logsDao != app.LogsDao() {
 		t.Fatalf("Expected app.LogsDao %v, got %v", app.LogsDao(), app.logsDao)
 	}
 
+	if app.logsDao.ConcurrentDB() != app.LogsDB() {
+		t.Fatalf("Expected app.LogsDB %v, got %v", app.LogsDB(), app.logsDao.ConcurrentDB())
+	}
+
 	if app.dataDir != app.DataDir() {
 		t.Fatalf("Expected app.DataDir %v, got %v", app.DataDir(), app.dataDir)
 	}
@@ -143,16 +175,20 @@ func TestBaseAppGetters(t *testing.T) {
 		t.Fatalf("Expected app.EncryptionEnv %v, got %v", app.EncryptionEnv(), app.encryptionEnv)
 	}
 
-	if app.isDebug != app.IsDebug() {
-		t.Fatalf("Expected app.IsDebug %v, got %v", app.IsDebug(), app.isDebug)
+	if app.isDev != app.IsDev() {
+		t.Fatalf("Expected app.IsDev %v, got %v", app.IsDev(), app.isDev)
 	}
 
 	if app.settings != app.Settings() {
 		t.Fatalf("Expected app.Settings %v, got %v", app.Settings(), app.settings)
 	}
 
-	if app.cache != app.Cache() {
-		t.Fatalf("Expected app.Cache %v, got %v", app.Cache(), app.cache)
+	if app.store != app.Store() {
+		t.Fatalf("Expected app.Store %v, got %v", app.Store(), app.store)
+	}
+
+	if app.logger != app.Logger() {
+		t.Fatalf("Expected app.Logger %v, got %v", app.Logger(), app.logger)
 	}
 
 	if app.subscriptionsBroker != app.SubscriptionsBroker() {
@@ -162,241 +198,14 @@ func TestBaseAppGetters(t *testing.T) {
 	if app.onBeforeServe != app.OnBeforeServe() || app.OnBeforeServe() == nil {
 		t.Fatalf("Getter app.OnBeforeServe does not match or nil (%v vs %v)", app.OnBeforeServe(), app.onBeforeServe)
 	}
-
-	if app.onModelBeforeCreate != app.OnModelBeforeCreate() || app.OnModelBeforeCreate() == nil {
-		t.Fatalf("Getter app.OnModelBeforeCreate does not match or nil (%v vs %v)", app.OnModelBeforeCreate(), app.onModelBeforeCreate)
-	}
-
-	if app.onModelAfterCreate != app.OnModelAfterCreate() || app.OnModelAfterCreate() == nil {
-		t.Fatalf("Getter app.OnModelAfterCreate does not match or nil (%v vs %v)", app.OnModelAfterCreate(), app.onModelAfterCreate)
-	}
-
-	if app.onModelBeforeUpdate != app.OnModelBeforeUpdate() || app.OnModelBeforeUpdate() == nil {
-		t.Fatalf("Getter app.OnModelBeforeUpdate does not match or nil (%v vs %v)", app.OnModelBeforeUpdate(), app.onModelBeforeUpdate)
-	}
-
-	if app.onModelAfterUpdate != app.OnModelAfterUpdate() || app.OnModelAfterUpdate() == nil {
-		t.Fatalf("Getter app.OnModelAfterUpdate does not match or nil (%v vs %v)", app.OnModelAfterUpdate(), app.onModelAfterUpdate)
-	}
-
-	if app.onModelBeforeDelete != app.OnModelBeforeDelete() || app.OnModelBeforeDelete() == nil {
-		t.Fatalf("Getter app.OnModelBeforeDelete does not match or nil (%v vs %v)", app.OnModelBeforeDelete(), app.onModelBeforeDelete)
-	}
-
-	if app.onModelAfterDelete != app.OnModelAfterDelete() || app.OnModelAfterDelete() == nil {
-		t.Fatalf("Getter app.OnModelAfterDelete does not match or nil (%v vs %v)", app.OnModelAfterDelete(), app.onModelAfterDelete)
-	}
-
-	if app.onMailerBeforeAdminResetPasswordSend != app.OnMailerBeforeAdminResetPasswordSend() || app.OnMailerBeforeAdminResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeAdminResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerBeforeAdminResetPasswordSend(), app.onMailerBeforeAdminResetPasswordSend)
-	}
-
-	if app.onMailerAfterAdminResetPasswordSend != app.OnMailerAfterAdminResetPasswordSend() || app.OnMailerAfterAdminResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterAdminResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerAfterAdminResetPasswordSend(), app.onMailerAfterAdminResetPasswordSend)
-	}
-
-	if app.onMailerBeforeUserResetPasswordSend != app.OnMailerBeforeUserResetPasswordSend() || app.OnMailerBeforeUserResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeUserResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerBeforeUserResetPasswordSend(), app.onMailerBeforeUserResetPasswordSend)
-	}
-
-	if app.onMailerAfterUserResetPasswordSend != app.OnMailerAfterUserResetPasswordSend() || app.OnMailerAfterUserResetPasswordSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterUserResetPasswordSend does not match or nil (%v vs %v)", app.OnMailerAfterUserResetPasswordSend(), app.onMailerAfterUserResetPasswordSend)
-	}
-
-	if app.onMailerBeforeUserVerificationSend != app.OnMailerBeforeUserVerificationSend() || app.OnMailerBeforeUserVerificationSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeUserVerificationSend does not match or nil (%v vs %v)", app.OnMailerBeforeUserVerificationSend(), app.onMailerBeforeUserVerificationSend)
-	}
-
-	if app.onMailerAfterUserVerificationSend != app.OnMailerAfterUserVerificationSend() || app.OnMailerAfterUserVerificationSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterUserVerificationSend does not match or nil (%v vs %v)", app.OnMailerAfterUserVerificationSend(), app.onMailerAfterUserVerificationSend)
-	}
-
-	if app.onMailerBeforeUserChangeEmailSend != app.OnMailerBeforeUserChangeEmailSend() || app.OnMailerBeforeUserChangeEmailSend() == nil {
-		t.Fatalf("Getter app.OnMailerBeforeUserChangeEmailSend does not match or nil (%v vs %v)", app.OnMailerBeforeUserChangeEmailSend(), app.onMailerBeforeUserChangeEmailSend)
-	}
-
-	if app.onMailerAfterUserChangeEmailSend != app.OnMailerAfterUserChangeEmailSend() || app.OnMailerAfterUserChangeEmailSend() == nil {
-		t.Fatalf("Getter app.OnMailerAfterUserChangeEmailSend does not match or nil (%v vs %v)", app.OnMailerAfterUserChangeEmailSend(), app.onMailerAfterUserChangeEmailSend)
-	}
-
-	if app.onRealtimeConnectRequest != app.OnRealtimeConnectRequest() || app.OnRealtimeConnectRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeConnectRequest does not match or nil (%v vs %v)", app.OnRealtimeConnectRequest(), app.onRealtimeConnectRequest)
-	}
-
-	if app.onRealtimeBeforeSubscribeRequest != app.OnRealtimeBeforeSubscribeRequest() || app.OnRealtimeBeforeSubscribeRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeBeforeSubscribeRequest does not match or nil (%v vs %v)", app.OnRealtimeBeforeSubscribeRequest(), app.onRealtimeBeforeSubscribeRequest)
-	}
-
-	if app.onRealtimeAfterSubscribeRequest != app.OnRealtimeAfterSubscribeRequest() || app.OnRealtimeAfterSubscribeRequest() == nil {
-		t.Fatalf("Getter app.OnRealtimeAfterSubscribeRequest does not match or nil (%v vs %v)", app.OnRealtimeAfterSubscribeRequest(), app.onRealtimeAfterSubscribeRequest)
-	}
-
-	if app.onSettingsListRequest != app.OnSettingsListRequest() || app.OnSettingsListRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsListRequest does not match or nil (%v vs %v)", app.OnSettingsListRequest(), app.onSettingsListRequest)
-	}
-
-	if app.onSettingsBeforeUpdateRequest != app.OnSettingsBeforeUpdateRequest() || app.OnSettingsBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnSettingsBeforeUpdateRequest(), app.onSettingsBeforeUpdateRequest)
-	}
-
-	if app.onSettingsAfterUpdateRequest != app.OnSettingsAfterUpdateRequest() || app.OnSettingsAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnSettingsAfterUpdateRequest does not match or nil (%v vs %v)", app.OnSettingsAfterUpdateRequest(), app.onSettingsAfterUpdateRequest)
-	}
-
-	if app.onFileDownloadRequest != app.OnFileDownloadRequest() || app.OnFileDownloadRequest() == nil {
-		t.Fatalf("Getter app.OnFileDownloadRequest does not match or nil (%v vs %v)", app.OnFileDownloadRequest(), app.onFileDownloadRequest)
-	}
-
-	if app.onAdminsListRequest != app.OnAdminsListRequest() || app.OnAdminsListRequest() == nil {
-		t.Fatalf("Getter app.OnAdminsListRequest does not match or nil (%v vs %v)", app.OnAdminsListRequest(), app.onAdminsListRequest)
-	}
-
-	if app.onAdminViewRequest != app.OnAdminViewRequest() || app.OnAdminViewRequest() == nil {
-		t.Fatalf("Getter app.OnAdminViewRequest does not match or nil (%v vs %v)", app.OnAdminViewRequest(), app.onAdminViewRequest)
-	}
-
-	if app.onAdminBeforeCreateRequest != app.OnAdminBeforeCreateRequest() || app.OnAdminBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeCreateRequest does not match or nil (%v vs %v)", app.OnAdminBeforeCreateRequest(), app.onAdminBeforeCreateRequest)
-	}
-
-	if app.onAdminAfterCreateRequest != app.OnAdminAfterCreateRequest() || app.OnAdminAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterCreateRequest does not match or nil (%v vs %v)", app.OnAdminAfterCreateRequest(), app.onAdminAfterCreateRequest)
-	}
-
-	if app.onAdminBeforeUpdateRequest != app.OnAdminBeforeUpdateRequest() || app.OnAdminBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnAdminBeforeUpdateRequest(), app.onAdminBeforeUpdateRequest)
-	}
-
-	if app.onAdminAfterUpdateRequest != app.OnAdminAfterUpdateRequest() || app.OnAdminAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterUpdateRequest does not match or nil (%v vs %v)", app.OnAdminAfterUpdateRequest(), app.onAdminAfterUpdateRequest)
-	}
-
-	if app.onAdminBeforeDeleteRequest != app.OnAdminBeforeDeleteRequest() || app.OnAdminBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnAdminBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnAdminBeforeDeleteRequest(), app.onAdminBeforeDeleteRequest)
-	}
-
-	if app.onAdminAfterDeleteRequest != app.OnAdminAfterDeleteRequest() || app.OnAdminAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAfterDeleteRequest does not match or nil (%v vs %v)", app.OnAdminAfterDeleteRequest(), app.onAdminAfterDeleteRequest)
-	}
-
-	if app.onAdminAuthRequest != app.OnAdminAuthRequest() || app.OnAdminAuthRequest() == nil {
-		t.Fatalf("Getter app.OnAdminAuthRequest does not match or nil (%v vs %v)", app.OnAdminAuthRequest(), app.onAdminAuthRequest)
-	}
-
-	if app.onUsersListRequest != app.OnUsersListRequest() || app.OnUsersListRequest() == nil {
-		t.Fatalf("Getter app.OnUsersListRequest does not match or nil (%v vs %v)", app.OnUsersListRequest(), app.onUsersListRequest)
-	}
-
-	if app.onUserViewRequest != app.OnUserViewRequest() || app.OnUserViewRequest() == nil {
-		t.Fatalf("Getter app.OnUserViewRequest does not match or nil (%v vs %v)", app.OnUserViewRequest(), app.onUserViewRequest)
-	}
-
-	if app.onUserBeforeCreateRequest != app.OnUserBeforeCreateRequest() || app.OnUserBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnUserBeforeCreateRequest does not match or nil (%v vs %v)", app.OnUserBeforeCreateRequest(), app.onUserBeforeCreateRequest)
-	}
-
-	if app.onUserAfterCreateRequest != app.OnUserAfterCreateRequest() || app.OnUserAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnUserAfterCreateRequest does not match or nil (%v vs %v)", app.OnUserAfterCreateRequest(), app.onUserAfterCreateRequest)
-	}
-
-	if app.onUserBeforeUpdateRequest != app.OnUserBeforeUpdateRequest() || app.OnUserBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnUserBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnUserBeforeUpdateRequest(), app.onUserBeforeUpdateRequest)
-	}
-
-	if app.onUserAfterUpdateRequest != app.OnUserAfterUpdateRequest() || app.OnUserAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnUserAfterUpdateRequest does not match or nil (%v vs %v)", app.OnUserAfterUpdateRequest(), app.onUserAfterUpdateRequest)
-	}
-
-	if app.onUserBeforeDeleteRequest != app.OnUserBeforeDeleteRequest() || app.OnUserBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnUserBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnUserBeforeDeleteRequest(), app.onUserBeforeDeleteRequest)
-	}
-
-	if app.onUserAfterDeleteRequest != app.OnUserAfterDeleteRequest() || app.OnUserAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnUserAfterDeleteRequest does not match or nil (%v vs %v)", app.OnUserAfterDeleteRequest(), app.onUserAfterDeleteRequest)
-	}
-
-	if app.onUserAuthRequest != app.OnUserAuthRequest() || app.OnUserAuthRequest() == nil {
-		t.Fatalf("Getter app.OnUserAuthRequest does not match or nil (%v vs %v)", app.OnUserAuthRequest(), app.onUserAuthRequest)
-	}
-
-	if app.onUserBeforeOauth2Register != app.OnUserBeforeOauth2Register() || app.OnUserBeforeOauth2Register() == nil {
-		t.Fatalf("Getter app.OnUserBeforeOauth2Register does not match or nil (%v vs %v)", app.OnUserBeforeOauth2Register(), app.onUserBeforeOauth2Register)
-	}
-
-	if app.onUserAfterOauth2Register != app.OnUserAfterOauth2Register() || app.OnUserAfterOauth2Register() == nil {
-		t.Fatalf("Getter app.OnUserAfterOauth2Register does not match or nil (%v vs %v)", app.OnUserAfterOauth2Register(), app.onUserAfterOauth2Register)
-	}
-
-	if app.onRecordsListRequest != app.OnRecordsListRequest() || app.OnRecordsListRequest() == nil {
-		t.Fatalf("Getter app.OnRecordsListRequest does not match or nil (%v vs %v)", app.OnRecordsListRequest(), app.onRecordsListRequest)
-	}
-
-	if app.onRecordViewRequest != app.OnRecordViewRequest() || app.OnRecordViewRequest() == nil {
-		t.Fatalf("Getter app.OnRecordViewRequest does not match or nil (%v vs %v)", app.OnRecordViewRequest(), app.onRecordViewRequest)
-	}
-
-	if app.onRecordBeforeCreateRequest != app.OnRecordBeforeCreateRequest() || app.OnRecordBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeCreateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeCreateRequest(), app.onRecordBeforeCreateRequest)
-	}
-
-	if app.onRecordAfterCreateRequest != app.OnRecordAfterCreateRequest() || app.OnRecordAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterCreateRequest does not match or nil (%v vs %v)", app.OnRecordAfterCreateRequest(), app.onRecordAfterCreateRequest)
-	}
-
-	if app.onRecordBeforeUpdateRequest != app.OnRecordBeforeUpdateRequest() || app.OnRecordBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnRecordBeforeUpdateRequest(), app.onRecordBeforeUpdateRequest)
-	}
-
-	if app.onRecordAfterUpdateRequest != app.OnRecordAfterUpdateRequest() || app.OnRecordAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterUpdateRequest does not match or nil (%v vs %v)", app.OnRecordAfterUpdateRequest(), app.onRecordAfterUpdateRequest)
-	}
-
-	if app.onRecordBeforeDeleteRequest != app.OnRecordBeforeDeleteRequest() || app.OnRecordBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnRecordBeforeDeleteRequest(), app.onRecordBeforeDeleteRequest)
-	}
-
-	if app.onRecordAfterDeleteRequest != app.OnRecordAfterDeleteRequest() || app.OnRecordAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnRecordAfterDeleteRequest does not match or nil (%v vs %v)", app.OnRecordAfterDeleteRequest(), app.onRecordAfterDeleteRequest)
-	}
-
-	if app.onCollectionsListRequest != app.OnCollectionsListRequest() || app.OnCollectionsListRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionsListRequest does not match or nil (%v vs %v)", app.OnCollectionsListRequest(), app.onCollectionsListRequest)
-	}
-
-	if app.onCollectionViewRequest != app.OnCollectionViewRequest() || app.OnCollectionViewRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionViewRequest does not match or nil (%v vs %v)", app.OnCollectionViewRequest(), app.onCollectionViewRequest)
-	}
-
-	if app.onCollectionBeforeCreateRequest != app.OnCollectionBeforeCreateRequest() || app.OnCollectionBeforeCreateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeCreateRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeCreateRequest(), app.onCollectionBeforeCreateRequest)
-	}
-
-	if app.onCollectionAfterCreateRequest != app.OnCollectionAfterCreateRequest() || app.OnCollectionAfterCreateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterCreateRequest does not match or nil (%v vs %v)", app.OnCollectionAfterCreateRequest(), app.onCollectionAfterCreateRequest)
-	}
-
-	if app.onCollectionBeforeUpdateRequest != app.OnCollectionBeforeUpdateRequest() || app.OnCollectionBeforeUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeUpdateRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeUpdateRequest(), app.onCollectionBeforeUpdateRequest)
-	}
-
-	if app.onCollectionAfterUpdateRequest != app.OnCollectionAfterUpdateRequest() || app.OnCollectionAfterUpdateRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterUpdateRequest does not match or nil (%v vs %v)", app.OnCollectionAfterUpdateRequest(), app.onCollectionAfterUpdateRequest)
-	}
-
-	if app.onCollectionBeforeDeleteRequest != app.OnCollectionBeforeDeleteRequest() || app.OnCollectionBeforeDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionBeforeDeleteRequest does not match or nil (%v vs %v)", app.OnCollectionBeforeDeleteRequest(), app.onCollectionBeforeDeleteRequest)
-	}
-
-	if app.onCollectionAfterDeleteRequest != app.OnCollectionAfterDeleteRequest() || app.OnCollectionAfterDeleteRequest() == nil {
-		t.Fatalf("Getter app.OnCollectionAfterDeleteRequest does not match or nil (%v vs %v)", app.OnCollectionAfterDeleteRequest(), app.onCollectionAfterDeleteRequest)
-	}
 }
 
 func TestBaseAppNewMailClient(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	client1 := app.NewMailClient()
 	if val, ok := client1.(*mailer.Sendmail); !ok {
@@ -412,10 +221,11 @@ func TestBaseAppNewMailClient(t *testing.T) {
 }
 
 func TestBaseAppNewFilesystem(t *testing.T) {
-	const testDataDir = "./pb_base_app_test_data_dir/"
-	defer os.RemoveAll(testDataDir)
-
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
 
 	// local
 	local, localErr := app.NewFilesystem()
@@ -436,3 +246,307 @@ func TestBaseAppNewFilesystem(t *testing.T) {
 		t.Fatalf("Expected nil s3 filesystem, got %v", s3)
 	}
 }
+
+func TestBaseAppNewBackupsFilesystem(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	// local
+	local, localErr := app.NewBackupsFilesystem()
+	if localErr != nil {
+		t.Fatal(localErr)
+	}
+	if local == nil {
+		t.Fatal("Expected local backups filesystem instance, got nil")
+	}
+
+	// misconfigured s3
+	app.Settings().Backups.S3.Enabled = true
+	s3, s3Err := app.NewBackupsFilesystem()
+	if s3Err == nil {
+		t.Fatal("Expected S3 error, got nil")
+	}
+	if s3 != nil {
+		t.Fatalf("Expected nil s3 backups filesystem, got %v", s3)
+	}
+}
+
+func TestBaseAppLoggerWrites(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	threshold := 200
+
+	totalLogs := func(app App, t *testing.T) int {
+		var total int
+
+		err := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
+		if err != nil {
+			t.Fatalf("Failed to fetch total logs: %v", err)
+		}
+
+		return total
+	}
+
+	// disabled logs retention
+	{
+		app.Settings().Logs.MaxDays = 0
+
+		for i := 0; i < threshold+1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+	}
+
+	// test batch logs writes
+	{
+		app.Settings().Logs.MaxDays = 1
+
+		for i := 0; i < threshold-1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+
+		// should trigger batch write
+		app.Logger().Error("test")
+
+		// should be added for the next batch write
+		app.Logger().Error("test")
+
+		if total := totalLogs(app, t); total != threshold {
+			t.Fatalf("Expected %d logs, got %d", threshold, total)
+		}
+
+		// wait for ~3 secs to check the timer trigger
+		time.Sleep(3200 * time.Millisecond)
+		if total := totalLogs(app, t); total != threshold+1 {
+			t.Fatalf("Expected %d logs, got %d", threshold+1, total)
+		}
+	}
+}
+
+func TestBaseAppRefreshSettingsLoggerMinLevelEnabled(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+	if !ok {
+		t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+	}
+
+	scenarios := []struct {
+		name  string
+		isDev bool
+		level int
+		// level->enabled map
+		expectations map[int]bool
+	}{
+		{
+			"dev mode",
+			true,
+			4,
+			map[int]bool{
+				3: true,
+				4: true,
+				5: true,
+			},
+		},
+		{
+			"nondev mode",
+			false,
+			4,
+			map[int]bool{
+				3: false,
+				4: true,
+				5: true,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app.isDev = s.isDev
+
+			app.Settings().Logs.MinLevel = s.level
+
+			if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+				t.Fatalf("Failed to save settings: %v", err)
+			}
+
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatalf("Failed to refresh app settings: %v", err)
+			}
+
+			for level, enabled := range s.expectations {
+				if v := handler.Enabled(nil, slog.Level(level)); v != enabled {
+					t.Fatalf("Expected level %d Enabled() to be %v, got %v", level, enabled, v)
+				}
+			}
+		})
+	}
+}
+
+func TestBaseAppLoggerLevelDevPrint(t *testing.T) {
+	app, cleanup, err := initTestBaseApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+
+	testLogLevel := 4
+
+	app.Settings().Logs.MinLevel = testLogLevel
+	if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name            string
+		isDev           bool
+		levels          []int
+		printedLevels   []int
+		persistedLevels []int
+	}{
+		{
+			"dev mode",
+			true,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+		{
+			"nondev mode",
+			false,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			var printedLevels []int
+			var persistedLevels []int
+
+			app.isDev = s.isDev
+
+			// trigger slog handler min level refresh
+			if err := app.RefreshSettings(); err != nil {
+				t.Fatal(err)
+			}
+
+			// track printed logs
+			originalPrintLog := printLog
+			defer func() {
+				printLog = originalPrintLog
+			}()
+			printLog = func(log *logger.Log) {
+				printedLevels = append(printedLevels, int(log.Level))
+			}
+
+			// track persisted logs
+			app.LogsDao().AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+				l, ok := m.(*models.Log)
+				if ok {
+					persistedLevels = append(persistedLevels, l.Level)
+				}
+				return nil
+			}
+
+			// write and persist logs
+			for _, l := range s.levels {
+				app.Logger().Log(nil, slog.Level(l), "test")
+			}
+			handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+			if !ok {
+				t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+			}
+			if err := handler.WriteAll(nil); err != nil {
+				t.Fatalf("Failed to write all logs: %v", err)
+			}
+
+			// check persisted log levels
+			if len(s.persistedLevels) != len(persistedLevels) {
+				t.Fatalf("Expected persisted levels \n%v\ngot\n%v", s.persistedLevels, persistedLevels)
+			}
+			for _, l := range persistedLevels {
+				if !list.ExistInSlice(l, s.persistedLevels) {
+					t.Fatalf("Missing expected persisted level %v in %v", l, persistedLevels)
+				}
+			}
+
+			// check printed log levels
+			if len(s.printedLevels) != len(printedLevels) {
+				t.Fatalf("Expected printed levels \n%v\ngot\n%v", s.printedLevels, printedLevels)
+			}
+			for _, l := range printedLevels {
+				if !list.ExistInSlice(l, s.printedLevels) {
+					t.Fatalf("Missing expected printed level %v in %v", l, printedLevels)
+				}
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+
+// note: make sure to call `defer cleanup()` when the app is no longer needed.
+func initTestBaseApp() (app *BaseApp, cleanup func(), err error) {
+	testDataDir, err := os.MkdirTemp("", "test_base_app")
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cleanup = func() {
+		os.RemoveAll(testDataDir)
+	}
+
+	app = NewBaseApp(BaseAppConfig{
+		DataDir: testDataDir,
+	})
+
+	initErr := func() error {
+		if err := app.Bootstrap(); err != nil {
+			return fmt.Errorf("bootstrap error: %w", err)
+		}
+
+		logsRunner, err := migrate.NewRunner(app.LogsDB(), logs.LogsMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := logsRunner.Up(); err != nil {
+			return fmt.Errorf("logsRunner migrations execution error: %w", err)
+		}
+
+		dataRunner, err := migrate.NewRunner(app.DB(), migrations.AppMigrations)
+		if err != nil {
+			return fmt.Errorf("logsRunner error: %w", err)
+		}
+		if _, err := dataRunner.Up(); err != nil {
+			return fmt.Errorf("dataRunner migrations execution error: %w", err)
+		}
+
+		return nil
+	}()
+	if initErr != nil {
+		cleanup()
+		return nil, nil, initErr
+	}
+
+	return app, cleanup, nil
+}

core/db_cgo.go

@@ -3,24 +3,48 @@
 package core
 
 import (
-	"fmt"
+	"database/sql"
 
-	_ "github.com/mattn/go-sqlite3"
+	"github.com/mattn/go-sqlite3"
 	"github.com/pocketbase/dbx"
 )
 
-func connectDB(dbPath string) (*dbx.DB, error) {
-	pragmas := "_foreign_keys=1&_journal_mode=WAL&_synchronous=NORMAL&_busy_timeout=8000"
+func init() {
+	// Registers the sqlite3 driver with a ConnectHook so that we can
+	// initialize the default PRAGMAs.
+	//
+	// Note 1: we don't define the PRAGMA as part of the dsn string
+	// because not all pragmas are available.
+	//
+	// Note 2: the busy_timeout pragma must be first because
+	// the connection needs to be set to block on busy before WAL mode
+	// is set in case it hasn't been already set by another connection.
+	sql.Register("pb_sqlite3",
+		&sqlite3.SQLiteDriver{
+			ConnectHook: func(conn *sqlite3.SQLiteConn) error {
+				_, err := conn.Exec(`
+					PRAGMA busy_timeout       = 10000;
+					PRAGMA journal_mode       = WAL;
+					PRAGMA journal_size_limit = 200000000;
+					PRAGMA synchronous        = NORMAL;
+					PRAGMA foreign_keys       = ON;
+					PRAGMA temp_store         = MEMORY;
+					PRAGMA cache_size         = -16000;
+				`, nil)
 
-	db, openErr := dbx.MustOpen("sqlite3", fmt.Sprintf("%s?%s", dbPath, pragmas))
-	if openErr != nil {
-		return nil, openErr
+				return err
+			},
+		},
+	)
+
+	dbx.BuilderFuncMap["pb_sqlite3"] = dbx.BuilderFuncMap["sqlite3"]
+}
+
+func connectDB(dbPath string) (*dbx.DB, error) {
+	db, err := dbx.Open("pb_sqlite3", dbPath)
+	if err != nil {
+		return nil, err
 	}
 
-	// additional pragmas not supported through the dsn string
-	_, err := db.NewQuery(`
-		pragma journal_size_limit = 100000000;
-	`).Execute()
-
-	return db, err
+	return db, nil
 }

core/db_nocgo.go

@@ -3,14 +3,20 @@
 package core
 
 import (
-	"fmt"
-
 	"github.com/pocketbase/dbx"
 	_ "modernc.org/sqlite"
 )
 
 func connectDB(dbPath string) (*dbx.DB, error) {
-	pragmas := "_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)&_pragma=synchronous(NORMAL)&_pragma=busy_timeout(8000)&_pragma=journal_size_limit(100000000)"
+	// Note: the busy_timeout pragma must be first because
+	// the connection needs to be set to block on busy before WAL mode
+	// is set in case it hasn't been already set by another connection.
+	pragmas := "?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=journal_size_limit(200000000)&_pragma=synchronous(NORMAL)&_pragma=foreign_keys(ON)&_pragma=temp_store(MEMORY)&_pragma=cache_size(-16000)"
 
-	return dbx.MustOpen("sqlite", fmt.Sprintf("%s?%s", dbPath, pragmas))
+	db, err := dbx.Open("sqlite", dbPath+pragmas)
+	if err != nil {
+		return nil, err
+	}
+
+	return db, nil
 }

core/events.go

@@ -1,24 +1,89 @@
 package core
 
 import (
+	"net/http"
+	"time"
+
+	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
-
-	"github.com/labstack/echo/v5"
+	"golang.org/x/crypto/acme/autocert"
 )
 
+var (
+	_ hook.Tagger = (*BaseModelEvent)(nil)
+	_ hook.Tagger = (*BaseCollectionEvent)(nil)
+)
+
+type BaseModelEvent struct {
+	Model models.Model
+}
+
+func (e *BaseModelEvent) Tags() []string {
+	if e.Model == nil {
+		return nil
+	}
+
+	if r, ok := e.Model.(*models.Record); ok && r.Collection() != nil {
+		return []string{r.Collection().Id, r.Collection().Name}
+	}
+
+	return []string{e.Model.TableName()}
+}
+
+type BaseCollectionEvent struct {
+	Collection *models.Collection
+}
+
+func (e *BaseCollectionEvent) Tags() []string {
+	if e.Collection == nil {
+		return nil
+	}
+
+	tags := make([]string, 0, 2)
+
+	if e.Collection.Id != "" {
+		tags = append(tags, e.Collection.Id)
+	}
+
+	if e.Collection.Name != "" {
+		tags = append(tags, e.Collection.Name)
+	}
+
+	return tags
+}
+
 // -------------------------------------------------------------------
 // Serve events data
 // -------------------------------------------------------------------
 
+type BootstrapEvent struct {
+	App App
+}
+
+type TerminateEvent struct {
+	App       App
+	IsRestart bool
+}
+
 type ServeEvent struct {
-	App    App
-	Router *echo.Echo
+	App         App
+	Router      *echo.Echo
+	Server      *http.Server
+	CertManager *autocert.Manager
+}
+
+type ApiErrorEvent struct {
+	HttpContext echo.Context
+	Error       error
 }
 
 // -------------------------------------------------------------------
@@ -26,22 +91,27 @@ type ServeEvent struct {
 // -------------------------------------------------------------------
 
 type ModelEvent struct {
-	Dao   *daos.Dao
-	Model models.Model
+	BaseModelEvent
+
+	Dao *daos.Dao
 }
 
 // -------------------------------------------------------------------
 // Mailer events data
 // -------------------------------------------------------------------
 
-type MailerUserEvent struct {
+type MailerRecordEvent struct {
+	BaseCollectionEvent
+
 	MailClient mailer.Mailer
-	User       *models.User
+	Message    *mailer.Message
+	Record     *models.Record
 	Meta       map[string]any
 }
 
 type MailerAdminEvent struct {
 	MailClient mailer.Mailer
+	Message    *mailer.Message
 	Admin      *models.Admin
 	Meta       map[string]any
 }
@@ -53,6 +123,18 @@ type MailerAdminEvent struct {
 type RealtimeConnectEvent struct {
 	HttpContext echo.Context
 	Client      subscriptions.Client
+	IdleTimeout time.Duration
+}
+
+type RealtimeDisconnectEvent struct {
+	HttpContext echo.Context
+	Client      subscriptions.Client
+}
+
+type RealtimeMessageEvent struct {
+	HttpContext echo.Context
+	Client      subscriptions.Client
+	Message     *subscriptions.Message
 }
 
 type RealtimeSubscribeEvent struct {
@@ -67,44 +149,153 @@ type RealtimeSubscribeEvent struct {
 
 type SettingsListEvent struct {
 	HttpContext      echo.Context
-	RedactedSettings *Settings
+	RedactedSettings *settings.Settings
 }
 
 type SettingsUpdateEvent struct {
 	HttpContext echo.Context
-	OldSettings *Settings
-	NewSettings *Settings
+	OldSettings *settings.Settings
+	NewSettings *settings.Settings
 }
 
 // -------------------------------------------------------------------
-// Record API events data
+// Record CRUD API events data
 // -------------------------------------------------------------------
 
 type RecordsListEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 	Records     []*models.Record
 	Result      *search.Result
 }
 
 type RecordViewEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
 type RecordCreateEvent struct {
-	HttpContext echo.Context
-	Record      *models.Record
+	BaseCollectionEvent
+
+	HttpContext   echo.Context
+	Record        *models.Record
+	UploadedFiles map[string][]*filesystem.File
 }
 
 type RecordUpdateEvent struct {
+	BaseCollectionEvent
+
+	HttpContext   echo.Context
+	Record        *models.Record
+	UploadedFiles map[string][]*filesystem.File
+}
+
+type RecordDeleteEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
 }
 
-type RecordDeleteEvent struct {
+// -------------------------------------------------------------------
+// Auth Record API events data
+// -------------------------------------------------------------------
+
+type RecordAuthEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
 	Record      *models.Record
+	Token       string
+	Meta        any
+}
+
+type RecordAuthWithPasswordEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+	Identity    string
+	Password    string
+}
+
+type RecordAuthWithOAuth2Event struct {
+	BaseCollectionEvent
+
+	HttpContext    echo.Context
+	ProviderName   string
+	ProviderClient auth.Provider
+	Record         *models.Record
+	OAuth2User     *auth.AuthUser
+	IsNewRecord    bool
+}
+
+type RecordAuthRefreshEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordRequestPasswordResetEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmPasswordResetEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordRequestVerificationEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmVerificationEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordRequestEmailChangeEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmEmailChangeEvent struct {
+	BaseCollectionEvent
+
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordListExternalAuthsEvent struct {
+	BaseCollectionEvent
+
+	HttpContext   echo.Context
+	Record        *models.Record
+	ExternalAuths []*models.ExternalAuth
+}
+
+type RecordUnlinkExternalAuthEvent struct {
+	BaseCollectionEvent
+
+	HttpContext  echo.Context
+	Record       *models.Record
+	ExternalAuth *models.ExternalAuth
 }
 
 // -------------------------------------------------------------------
@@ -143,47 +334,26 @@ type AdminAuthEvent struct {
 	Token       string
 }
 
-// -------------------------------------------------------------------
-// User API events data
-// -------------------------------------------------------------------
-
-type UsersListEvent struct {
+type AdminAuthWithPasswordEvent struct {
 	HttpContext echo.Context
-	Users       []*models.User
-	Result      *search.Result
+	Admin       *models.Admin
+	Identity    string
+	Password    string
 }
 
-type UserViewEvent struct {
+type AdminAuthRefreshEvent struct {
 	HttpContext echo.Context
-	User        *models.User
+	Admin       *models.Admin
 }
 
-type UserCreateEvent struct {
+type AdminRequestPasswordResetEvent struct {
 	HttpContext echo.Context
-	User        *models.User
+	Admin       *models.Admin
 }
 
-type UserUpdateEvent struct {
+type AdminConfirmPasswordResetEvent struct {
 	HttpContext echo.Context
-	User        *models.User
-}
-
-type UserDeleteEvent struct {
-	HttpContext echo.Context
-	User        *models.User
-}
-
-type UserAuthEvent struct {
-	HttpContext echo.Context
-	User        *models.User
-	Token       string
-	Meta        any
-}
-
-type UserOauth2RegisterEvent struct {
-	HttpContext echo.Context
-	User        *models.User
-	AuthData    *auth.AuthUser
+	Admin       *models.Admin
 }
 
 // -------------------------------------------------------------------
@@ -197,23 +367,27 @@ type CollectionsListEvent struct {
 }
 
 type CollectionViewEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionCreateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionUpdateEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionDeleteEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 }
 
 type CollectionsImportEvent struct {
@@ -225,9 +399,17 @@ type CollectionsImportEvent struct {
 // File API events data
 // -------------------------------------------------------------------
 
+type FileTokenEvent struct {
+	BaseModelEvent
+
+	HttpContext echo.Context
+	Token       string
+}
+
 type FileDownloadEvent struct {
+	BaseCollectionEvent
+
 	HttpContext echo.Context
-	Collection  *models.Collection
 	Record      *models.Record
 	FileField   *schema.SchemaField
 	ServedPath  string

core/events_test.go

@@ -0,0 +1,84 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestBaseCollectionEventTags(t *testing.T) {
+	c1 := new(models.Collection)
+
+	c2 := new(models.Collection)
+	c2.Id = "a"
+
+	c3 := new(models.Collection)
+	c3.Name = "b"
+
+	c4 := new(models.Collection)
+	c4.Id = "a"
+	c4.Name = "b"
+
+	scenarios := []struct {
+		collection   *models.Collection
+		expectedTags []string
+	}{
+		{c1, []string{}},
+		{c2, []string{"a"}},
+		{c3, []string{"b"}},
+		{c4, []string{"a", "b"}},
+	}
+
+	for i, s := range scenarios {
+		event := new(core.BaseCollectionEvent)
+		event.Collection = s.collection
+
+		tags := event.Tags()
+
+		if len(s.expectedTags) != len(tags) {
+			t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+		}
+
+		for _, tag := range s.expectedTags {
+			if !list.ExistInSlice(tag, tags) {
+				t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+			}
+		}
+	}
+}
+
+func TestModelEventTags(t *testing.T) {
+	m1 := new(models.Admin)
+
+	c := new(models.Collection)
+	c.Id = "a"
+	c.Name = "b"
+	m2 := models.NewRecord(c)
+
+	scenarios := []struct {
+		model        models.Model
+		expectedTags []string
+	}{
+		{m1, []string{"_admins"}},
+		{m2, []string{"a", "b"}},
+	}
+
+	for i, s := range scenarios {
+		event := new(core.ModelEvent)
+		event.Model = s.model
+
+		tags := event.Tags()
+
+		if len(s.expectedTags) != len(tags) {
+			t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+		}
+
+		for _, tag := range s.expectedTags {
+			if !list.ExistInSlice(tag, tags) {
+				t.Fatalf("[%d] Expected %v tags, got %v", i, s.expectedTags, tags)
+			}
+		}
+	}
+}

core/log_printer.go

@@ -0,0 +1,67 @@
+package core
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+var cachedColors = store.New[*color.Color](nil)
+
+// getColor returns [color.Color] object and cache it (if not already).
+func getColor(attrs ...color.Attribute) (c *color.Color) {
+	cacheKey := fmt.Sprint(attrs)
+	if c = cachedColors.Get(cacheKey); c == nil {
+		c = color.New(attrs...)
+		cachedColors.Set(cacheKey, c)
+	}
+	return
+}
+
+// printLog prints the provided log to the stderr.
+// (note: defined as variable to overwriting in the tests)
+var printLog = func(log *logger.Log) {
+	var str strings.Builder
+
+	switch log.Level {
+	case slog.LevelDebug:
+		str.WriteString(getColor(color.Bold, color.FgHiBlack).Sprint("DEBUG "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelInfo:
+		str.WriteString(getColor(color.Bold, color.FgWhite).Sprint("INFO "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelWarn:
+		str.WriteString(getColor(color.Bold, color.FgYellow).Sprint("WARN "))
+		str.WriteString(getColor(color.FgYellow).Sprint(log.Message))
+	case slog.LevelError:
+		str.WriteString(getColor(color.Bold, color.FgRed).Sprint("ERROR "))
+		str.WriteString(getColor(color.FgRed).Sprint(log.Message))
+	default:
+		str.WriteString(getColor(color.Bold, color.FgCyan).Sprintf("[%d] ", log.Level))
+		str.WriteString(getColor(color.FgCyan).Sprint(log.Message))
+	}
+
+	str.WriteString("\n")
+
+	if v, ok := log.Data["type"]; ok && cast.ToString(v) == "request" {
+		padding := 0
+		keys := []string{"error", "details"}
+		for _, k := range keys {
+			if v := log.Data[k]; v != nil {
+				str.WriteString(getColor(color.FgHiRed).Sprintf("%s└─ %v", strings.Repeat(" ", padding), v))
+				str.WriteString("\n")
+				padding += 3
+			}
+		}
+	} else if len(log.Data) > 0 {
+		str.WriteString(getColor(color.FgHiBlack).Sprintf("└─ %v", log.Data))
+		str.WriteString("\n")
+	}
+
+	fmt.Print(str.String())
+}

core/settings.go

@@ -1,413 +0,0 @@
-package core
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"sync"
-
-	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/go-ozzo/ozzo-validation/v4/is"
-	"github.com/pocketbase/pocketbase/tools/auth"
-	"github.com/pocketbase/pocketbase/tools/security"
-)
-
-// Common settings placeholder tokens
-const (
-	EmailPlaceholderAppUrl string = "%APP_URL%"
-	EmailPlaceholderToken  string = "%TOKEN%"
-)
-
-// Settings defines common app configuration options.
-type Settings struct {
-	mux sync.RWMutex
-
-	Meta                    MetaConfig         `form:"meta" json:"meta"`
-	Logs                    LogsConfig         `form:"logs" json:"logs"`
-	Smtp                    SmtpConfig         `form:"smtp" json:"smtp"`
-	S3                      S3Config           `form:"s3" json:"s3"`
-	AdminAuthToken          TokenConfig        `form:"adminAuthToken" json:"adminAuthToken"`
-	AdminPasswordResetToken TokenConfig        `form:"adminPasswordResetToken" json:"adminPasswordResetToken"`
-	UserAuthToken           TokenConfig        `form:"userAuthToken" json:"userAuthToken"`
-	UserPasswordResetToken  TokenConfig        `form:"userPasswordResetToken" json:"userPasswordResetToken"`
-	UserEmailChangeToken    TokenConfig        `form:"userEmailChangeToken" json:"userEmailChangeToken"`
-	UserVerificationToken   TokenConfig        `form:"userVerificationToken" json:"userVerificationToken"`
-	EmailAuth               EmailAuthConfig    `form:"emailAuth" json:"emailAuth"`
-	GoogleAuth              AuthProviderConfig `form:"googleAuth" json:"googleAuth"`
-	FacebookAuth            AuthProviderConfig `form:"facebookAuth" json:"facebookAuth"`
-	GithubAuth              AuthProviderConfig `form:"githubAuth" json:"githubAuth"`
-	GitlabAuth              AuthProviderConfig `form:"gitlabAuth" json:"gitlabAuth"`
-}
-
-// NewSettings creates and returns a new default Settings instance.
-func NewSettings() *Settings {
-	return &Settings{
-		Meta: MetaConfig{
-			AppName:                   "Acme",
-			AppUrl:                    "http://localhost:8090",
-			SenderName:                "Support",
-			SenderAddress:             "support@example.com",
-			UserVerificationUrl:       EmailPlaceholderAppUrl + "/_/#/users/confirm-verification/" + EmailPlaceholderToken,
-			UserResetPasswordUrl:      EmailPlaceholderAppUrl + "/_/#/users/confirm-password-reset/" + EmailPlaceholderToken,
-			UserConfirmEmailChangeUrl: EmailPlaceholderAppUrl + "/_/#/users/confirm-email-change/" + EmailPlaceholderToken,
-		},
-		Logs: LogsConfig{
-			MaxDays: 7,
-		},
-		Smtp: SmtpConfig{
-			Enabled:  false,
-			Host:     "smtp.example.com",
-			Port:     587,
-			Username: "",
-			Password: "",
-			Tls:      false,
-		},
-		AdminAuthToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 1209600, // 14 days,
-		},
-		AdminPasswordResetToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 1800, // 30 minutes,
-		},
-		UserAuthToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 1209600, // 14 days,
-		},
-		UserPasswordResetToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 1800, // 30 minutes,
-		},
-		UserVerificationToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 604800, // 7 days,
-		},
-		UserEmailChangeToken: TokenConfig{
-			Secret:   security.RandomString(50),
-			Duration: 1800, // 30 minutes,
-		},
-		EmailAuth: EmailAuthConfig{
-			Enabled:           true,
-			MinPasswordLength: 8,
-		},
-		GoogleAuth: AuthProviderConfig{
-			Enabled:            false,
-			AllowRegistrations: true,
-		},
-		FacebookAuth: AuthProviderConfig{
-			Enabled:            false,
-			AllowRegistrations: true,
-		},
-		GithubAuth: AuthProviderConfig{
-			Enabled:            false,
-			AllowRegistrations: true,
-		},
-		GitlabAuth: AuthProviderConfig{
-			Enabled:            false,
-			AllowRegistrations: true,
-		},
-	}
-}
-
-// Validate makes Settings validatable by implementing [validation.Validatable] interface.
-func (s *Settings) Validate() error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-
-	return validation.ValidateStruct(s,
-		validation.Field(&s.Meta),
-		validation.Field(&s.Logs),
-		validation.Field(&s.AdminAuthToken),
-		validation.Field(&s.AdminPasswordResetToken),
-		validation.Field(&s.UserAuthToken),
-		validation.Field(&s.UserPasswordResetToken),
-		validation.Field(&s.UserEmailChangeToken),
-		validation.Field(&s.UserVerificationToken),
-		validation.Field(&s.Smtp),
-		validation.Field(&s.S3),
-		validation.Field(&s.EmailAuth),
-		validation.Field(&s.GoogleAuth),
-		validation.Field(&s.FacebookAuth),
-		validation.Field(&s.GithubAuth),
-		validation.Field(&s.GitlabAuth),
-	)
-}
-
-// Merge merges `other` settings into the current one.
-func (s *Settings) Merge(other *Settings) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-
-	bytes, err := json.Marshal(other)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(bytes, s)
-}
-
-// Clone creates a new deep copy of the current settings.
-func (s *Settings) Clone() (*Settings, error) {
-	settings := &Settings{}
-	if err := settings.Merge(s); err != nil {
-		return nil, err
-	}
-	return settings, nil
-}
-
-// RedactClone creates a new deep copy of the current settings,
-// while replacing the secret values with `******`.
-func (s *Settings) RedactClone() (*Settings, error) {
-	clone, err := s.Clone()
-	if err != nil {
-		return nil, err
-	}
-
-	mask := "******"
-
-	sensitiveFields := []*string{
-		&clone.Smtp.Password,
-		&clone.S3.Secret,
-		&clone.AdminAuthToken.Secret,
-		&clone.AdminPasswordResetToken.Secret,
-		&clone.UserAuthToken.Secret,
-		&clone.UserPasswordResetToken.Secret,
-		&clone.UserEmailChangeToken.Secret,
-		&clone.UserVerificationToken.Secret,
-		&clone.GoogleAuth.ClientSecret,
-		&clone.FacebookAuth.ClientSecret,
-		&clone.GithubAuth.ClientSecret,
-		&clone.GitlabAuth.ClientSecret,
-	}
-
-	// mask all sensitive fields
-	for _, v := range sensitiveFields {
-		if v != nil && *v != "" {
-			*v = mask
-		}
-	}
-
-	return clone, nil
-}
-
-// NamedAuthProviderConfigs returns a map with all registered OAuth2
-// provider configurations (indexed by their name identifier).
-func (s *Settings) NamedAuthProviderConfigs() map[string]AuthProviderConfig {
-	return map[string]AuthProviderConfig{
-		auth.NameGoogle:   s.GoogleAuth,
-		auth.NameFacebook: s.FacebookAuth,
-		auth.NameGithub:   s.GithubAuth,
-		auth.NameGitlab:   s.GitlabAuth,
-	}
-}
-
-// -------------------------------------------------------------------
-
-type TokenConfig struct {
-	Secret   string `form:"secret" json:"secret"`
-	Duration int64  `form:"duration" json:"duration"`
-}
-
-// Validate makes TokenConfig validatable by implementing [validation.Validatable] interface.
-func (c TokenConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.Secret, validation.Required, validation.Length(30, 300)),
-		validation.Field(&c.Duration, validation.Required, validation.Min(5), validation.Max(31536000)),
-	)
-}
-
-// -------------------------------------------------------------------
-
-type SmtpConfig struct {
-	Enabled  bool   `form:"enabled" json:"enabled"`
-	Host     string `form:"host" json:"host"`
-	Port     int    `form:"port" json:"port"`
-	Username string `form:"username" json:"username"`
-	Password string `form:"password" json:"password"`
-
-	// Whether to enforce TLS encryption for the mail server connection.
-	//
-	// When set to false StartTLS command is send, leaving the server
-	// to decide whether to upgrade the connection or not.
-	Tls bool `form:"tls" json:"tls"`
-}
-
-// Validate makes SmtpConfig validatable by implementing [validation.Validatable] interface.
-func (c SmtpConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.Host, is.Host, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.Port, validation.When(c.Enabled, validation.Required), validation.Min(0)),
-	)
-}
-
-// -------------------------------------------------------------------
-
-type S3Config struct {
-	Enabled        bool   `form:"enabled" json:"enabled"`
-	Bucket         string `form:"bucket" json:"bucket"`
-	Region         string `form:"region" json:"region"`
-	Endpoint       string `form:"endpoint" json:"endpoint"`
-	AccessKey      string `form:"accessKey" json:"accessKey"`
-	Secret         string `form:"secret" json:"secret"`
-	ForcePathStyle bool   `form:"forcePathStyle" json:"forcePathStyle"`
-}
-
-// Validate makes S3Config validatable by implementing [validation.Validatable] interface.
-func (c S3Config) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.Endpoint, is.URL, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.Bucket, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.Region, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.AccessKey, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.Secret, validation.When(c.Enabled, validation.Required)),
-	)
-}
-
-// -------------------------------------------------------------------
-
-type MetaConfig struct {
-	AppName                   string `form:"appName" json:"appName"`
-	AppUrl                    string `form:"appUrl" json:"appUrl"`
-	SenderName                string `form:"senderName" json:"senderName"`
-	SenderAddress             string `form:"senderAddress" json:"senderAddress"`
-	UserVerificationUrl       string `form:"userVerificationUrl" json:"userVerificationUrl"`
-	UserResetPasswordUrl      string `form:"userResetPasswordUrl" json:"userResetPasswordUrl"`
-	UserConfirmEmailChangeUrl string `form:"userConfirmEmailChangeUrl" json:"userConfirmEmailChangeUrl"`
-}
-
-// Validate makes MetaConfig validatable by implementing [validation.Validatable] interface.
-func (c MetaConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.AppName, validation.Required, validation.Length(1, 255)),
-		validation.Field(&c.AppUrl, validation.Required, is.URL),
-		validation.Field(&c.SenderName, validation.Required, validation.Length(1, 255)),
-		validation.Field(&c.SenderAddress, is.Email, validation.Required),
-		validation.Field(
-			&c.UserVerificationUrl,
-			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
-		),
-		validation.Field(
-			&c.UserResetPasswordUrl,
-			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
-		),
-		validation.Field(
-			&c.UserConfirmEmailChangeUrl,
-			validation.Required,
-			validation.By(c.checkPlaceholders(EmailPlaceholderToken)),
-		),
-	)
-}
-
-func (c *MetaConfig) checkPlaceholders(params ...string) validation.RuleFunc {
-	return func(value any) error {
-		v, _ := value.(string)
-		if v == "" {
-			return nil // nothing to check
-		}
-
-		for _, param := range params {
-			if !strings.Contains(v, param) {
-				return validation.NewError("validation_missing_required_param", fmt.Sprintf("Missing required parameter %q", param))
-			}
-		}
-
-		return nil
-	}
-}
-
-// -------------------------------------------------------------------
-
-type LogsConfig struct {
-	MaxDays int `form:"maxDays" json:"maxDays"`
-}
-
-// Validate makes LogsConfig validatable by implementing [validation.Validatable] interface.
-func (c LogsConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.MaxDays, validation.Min(0)),
-	)
-}
-
-// -------------------------------------------------------------------
-
-type AuthProviderConfig struct {
-	Enabled            bool   `form:"enabled" json:"enabled"`
-	AllowRegistrations bool   `form:"allowRegistrations" json:"allowRegistrations"`
-	ClientId           string `form:"clientId" json:"clientId,omitempty"`
-	ClientSecret       string `form:"clientSecret" json:"clientSecret,omitempty"`
-	AuthUrl            string `form:"authUrl" json:"authUrl,omitempty"`
-	TokenUrl           string `form:"tokenUrl" json:"tokenUrl,omitempty"`
-	UserApiUrl         string `form:"userApiUrl" json:"userApiUrl,omitempty"`
-}
-
-// Validate makes `ProviderConfig` validatable by implementing [validation.Validatable] interface.
-func (c AuthProviderConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(&c.ClientId, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.ClientSecret, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.AuthUrl, is.URL),
-		validation.Field(&c.TokenUrl, is.URL),
-		validation.Field(&c.UserApiUrl, is.URL),
-	)
-}
-
-// SetupProvider loads the current AuthProviderConfig into the specified provider.
-func (c AuthProviderConfig) SetupProvider(provider auth.Provider) error {
-	if !c.Enabled {
-		return errors.New("The provider is not enabled.")
-	}
-
-	if c.ClientId != "" {
-		provider.SetClientId(c.ClientId)
-	}
-
-	if c.ClientSecret != "" {
-		provider.SetClientSecret(c.ClientSecret)
-	}
-
-	if c.AuthUrl != "" {
-		provider.SetAuthUrl(c.AuthUrl)
-	}
-
-	if c.UserApiUrl != "" {
-		provider.SetUserApiUrl(c.UserApiUrl)
-	}
-
-	if c.TokenUrl != "" {
-		provider.SetTokenUrl(c.TokenUrl)
-	}
-
-	return nil
-}
-
-// -------------------------------------------------------------------
-
-type EmailAuthConfig struct {
-	Enabled           bool     `form:"enabled" json:"enabled"`
-	ExceptDomains     []string `form:"exceptDomains" json:"exceptDomains"`
-	OnlyDomains       []string `form:"onlyDomains" json:"onlyDomains"`
-	MinPasswordLength int      `form:"minPasswordLength" json:"minPasswordLength"`
-}
-
-// Validate makes `EmailAuthConfig` validatable by implementing [validation.Validatable] interface.
-func (c EmailAuthConfig) Validate() error {
-	return validation.ValidateStruct(&c,
-		validation.Field(
-			&c.ExceptDomains,
-			validation.When(len(c.OnlyDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
-		),
-		validation.Field(
-			&c.OnlyDomains,
-			validation.When(len(c.ExceptDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
-		),
-		validation.Field(
-			&c.MinPasswordLength,
-			validation.When(c.Enabled, validation.Required),
-			validation.Min(5),
-			validation.Max(100),
-		),
-	)
-}

core/settings_test.go

@@ -1,618 +0,0 @@
-package core_test
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/auth"
-)
-
-func TestSettingsValidate(t *testing.T) {
-	s := core.NewSettings()
-
-	// set invalid settings data
-	s.Meta.AppName = ""
-	s.Logs.MaxDays = -10
-	s.Smtp.Enabled = true
-	s.Smtp.Host = ""
-	s.S3.Enabled = true
-	s.S3.Endpoint = "invalid"
-	s.AdminAuthToken.Duration = -10
-	s.AdminPasswordResetToken.Duration = -10
-	s.UserAuthToken.Duration = -10
-	s.UserPasswordResetToken.Duration = -10
-	s.UserEmailChangeToken.Duration = -10
-	s.UserVerificationToken.Duration = -10
-	s.EmailAuth.Enabled = true
-	s.EmailAuth.MinPasswordLength = -10
-	s.GoogleAuth.Enabled = true
-	s.GoogleAuth.ClientId = ""
-	s.FacebookAuth.Enabled = true
-	s.FacebookAuth.ClientId = ""
-	s.GithubAuth.Enabled = true
-	s.GithubAuth.ClientId = ""
-	s.GitlabAuth.Enabled = true
-	s.GitlabAuth.ClientId = ""
-
-	// check if Validate() is triggering the members validate methods.
-	err := s.Validate()
-	if err == nil {
-		t.Fatalf("Expected error, got nil")
-	}
-
-	expectations := []string{
-		`"meta":{`,
-		`"logs":{`,
-		`"smtp":{`,
-		`"s3":{`,
-		`"adminAuthToken":{`,
-		`"adminPasswordResetToken":{`,
-		`"userAuthToken":{`,
-		`"userPasswordResetToken":{`,
-		`"userEmailChangeToken":{`,
-		`"userVerificationToken":{`,
-		`"emailAuth":{`,
-		`"googleAuth":{`,
-		`"facebookAuth":{`,
-		`"githubAuth":{`,
-		`"gitlabAuth":{`,
-	}
-
-	errBytes, _ := json.Marshal(err)
-	jsonErr := string(errBytes)
-	for _, expected := range expectations {
-		if !strings.Contains(jsonErr, expected) {
-			t.Errorf("Expected error key %s in %v", expected, jsonErr)
-		}
-	}
-}
-
-func TestSettingsMerge(t *testing.T) {
-	s1 := core.NewSettings()
-	s1.Meta.AppUrl = "old_app_url"
-
-	s2 := core.NewSettings()
-	s2.Meta.AppName = "test"
-	s2.Logs.MaxDays = 123
-	s2.Smtp.Host = "test"
-	s2.Smtp.Enabled = true
-	s2.S3.Enabled = true
-	s2.S3.Endpoint = "test"
-	s2.AdminAuthToken.Duration = 1
-	s2.AdminPasswordResetToken.Duration = 2
-	s2.UserAuthToken.Duration = 3
-	s2.UserPasswordResetToken.Duration = 4
-	s2.UserEmailChangeToken.Duration = 5
-	s2.UserVerificationToken.Duration = 6
-	s2.EmailAuth.Enabled = false
-	s2.EmailAuth.MinPasswordLength = 30
-	s2.GoogleAuth.Enabled = true
-	s2.GoogleAuth.ClientId = "google_test"
-	s2.FacebookAuth.Enabled = true
-	s2.FacebookAuth.ClientId = "facebook_test"
-	s2.GithubAuth.Enabled = true
-	s2.GithubAuth.ClientId = "github_test"
-	s2.GitlabAuth.Enabled = true
-	s2.GitlabAuth.ClientId = "gitlab_test"
-
-	if err := s1.Merge(s2); err != nil {
-		t.Fatal(err)
-	}
-
-	s1Encoded, err := json.Marshal(s1)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	s2Encoded, err := json.Marshal(s2)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if string(s1Encoded) != string(s2Encoded) {
-		t.Fatalf("Expected the same serialization, got %v VS %v", string(s1Encoded), string(s2Encoded))
-	}
-}
-
-func TestSettingsClone(t *testing.T) {
-	s1 := core.NewSettings()
-
-	s2, err := s1.Clone()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	s1Bytes, err := json.Marshal(s1)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	s2Bytes, err := json.Marshal(s2)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if string(s1Bytes) != string(s2Bytes) {
-		t.Fatalf("Expected equivalent serialization, got %v VS %v", string(s1Bytes), string(s2Bytes))
-	}
-
-	// verify that it is a deep copy
-	s1.Meta.AppName = "new"
-	if s1.Meta.AppName == s2.Meta.AppName {
-		t.Fatalf("Expected s1 and s2 to have different Meta.AppName, got %s", s1.Meta.AppName)
-	}
-}
-
-func TestSettingsRedactClone(t *testing.T) {
-	s1 := core.NewSettings()
-	s1.Meta.AppName = "test123" // control field
-	s1.Smtp.Password = "test123"
-	s1.Smtp.Tls = true
-	s1.S3.Secret = "test123"
-	s1.AdminAuthToken.Secret = "test123"
-	s1.AdminPasswordResetToken.Secret = "test123"
-	s1.UserAuthToken.Secret = "test123"
-	s1.UserPasswordResetToken.Secret = "test123"
-	s1.UserEmailChangeToken.Secret = "test123"
-	s1.UserVerificationToken.Secret = "test123"
-	s1.GoogleAuth.ClientSecret = "test123"
-	s1.FacebookAuth.ClientSecret = "test123"
-	s1.GithubAuth.ClientSecret = "test123"
-	s1.GitlabAuth.ClientSecret = "test123"
-
-	s2, err := s1.RedactClone()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	encoded, err := json.Marshal(s2)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","senderName":"Support","senderAddress":"support@example.com","userVerificationUrl":"%APP_URL%/_/#/users/confirm-verification/%TOKEN%","userResetPasswordUrl":"%APP_URL%/_/#/users/confirm-password-reset/%TOKEN%","userConfirmEmailChangeUrl":"%APP_URL%/_/#/users/confirm-email-change/%TOKEN%"},"logs":{"maxDays":7},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"userAuthToken":{"secret":"******","duration":1209600},"userPasswordResetToken":{"secret":"******","duration":1800},"userEmailChangeToken":{"secret":"******","duration":1800},"userVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":true,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":8},"googleAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"facebookAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"githubAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"allowRegistrations":true,"clientSecret":"******"}}`
-
-	if encodedStr := string(encoded); encodedStr != expected {
-		t.Fatalf("Expected %v, got \n%v", expected, encodedStr)
-	}
-}
-
-func TestNamedAuthProviderConfigs(t *testing.T) {
-	s := core.NewSettings()
-
-	s.GoogleAuth.ClientId = "google_test"
-	s.FacebookAuth.ClientId = "facebook_test"
-	s.GithubAuth.ClientId = "github_test"
-	s.GitlabAuth.ClientId = "gitlab_test"
-	s.GitlabAuth.Enabled = true
-
-	result := s.NamedAuthProviderConfigs()
-
-	encoded, err := json.Marshal(result)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expected := `{"facebook":{"enabled":false,"allowRegistrations":true,"clientId":"facebook_test"},"github":{"enabled":false,"allowRegistrations":true,"clientId":"github_test"},"gitlab":{"enabled":true,"allowRegistrations":true,"clientId":"gitlab_test"},"google":{"enabled":false,"allowRegistrations":true,"clientId":"google_test"}}`
-
-	if encodedStr := string(encoded); encodedStr != expected {
-		t.Fatalf("Expected the same serialization, got %v", encodedStr)
-	}
-}
-
-func TestTokenConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.TokenConfig
-		expectError bool
-	}{
-		// zero values
-		{
-			core.TokenConfig{},
-			true,
-		},
-		// invalid data
-		{
-			core.TokenConfig{
-				Secret:   "test",
-				Duration: 4,
-			},
-			true,
-		},
-		// valid data
-		{
-			core.TokenConfig{
-				Secret:   "testtesttesttesttesttesttestte",
-				Duration: 100,
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestSmtpConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.SmtpConfig
-		expectError bool
-	}{
-		// zero values (disabled)
-		{
-			core.SmtpConfig{},
-			false,
-		},
-		// zero values (enabled)
-		{
-			core.SmtpConfig{Enabled: true},
-			true,
-		},
-		// invalid data
-		{
-			core.SmtpConfig{
-				Enabled: true,
-				Host:    "test:test:test",
-				Port:    -10,
-			},
-			true,
-		},
-		// valid data
-		{
-			core.SmtpConfig{
-				Enabled: true,
-				Host:    "example.com",
-				Port:    100,
-				Tls:     true,
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestS3ConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.S3Config
-		expectError bool
-	}{
-		// zero values (disabled)
-		{
-			core.S3Config{},
-			false,
-		},
-		// zero values (enabled)
-		{
-			core.S3Config{Enabled: true},
-			true,
-		},
-		// invalid data
-		{
-			core.S3Config{
-				Enabled:  true,
-				Endpoint: "test:test:test",
-			},
-			true,
-		},
-		// valid data (url endpoint)
-		{
-			core.S3Config{
-				Enabled:   true,
-				Endpoint:  "https://localhost:8090",
-				Bucket:    "test",
-				Region:    "test",
-				AccessKey: "test",
-				Secret:    "test",
-			},
-			false,
-		},
-		// valid data (hostname endpoint)
-		{
-			core.S3Config{
-				Enabled:   true,
-				Endpoint:  "example.com",
-				Bucket:    "test",
-				Region:    "test",
-				AccessKey: "test",
-				Secret:    "test",
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestMetaConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.MetaConfig
-		expectError bool
-	}{
-		// zero values
-		{
-			core.MetaConfig{},
-			true,
-		},
-		// invalid data
-		{
-			core.MetaConfig{
-				AppName:                   strings.Repeat("a", 300),
-				AppUrl:                    "test",
-				SenderName:                strings.Repeat("a", 300),
-				SenderAddress:             "invalid_email",
-				UserVerificationUrl:       "test",
-				UserResetPasswordUrl:      "test",
-				UserConfirmEmailChangeUrl: "test",
-			},
-			true,
-		},
-		// invalid data (missing required placeholders)
-		{
-			core.MetaConfig{
-				AppName:                   "test",
-				AppUrl:                    "https://example.com",
-				SenderName:                "test",
-				SenderAddress:             "test@example.com",
-				UserVerificationUrl:       "https://example.com",
-				UserResetPasswordUrl:      "https://example.com",
-				UserConfirmEmailChangeUrl: "https://example.com",
-			},
-			true,
-		},
-		// valid data
-		{
-			core.MetaConfig{
-				AppName:                   "test",
-				AppUrl:                    "https://example.com",
-				SenderName:                "test",
-				SenderAddress:             "test@example.com",
-				UserVerificationUrl:       "https://example.com/" + core.EmailPlaceholderToken,
-				UserResetPasswordUrl:      "https://example.com/" + core.EmailPlaceholderToken,
-				UserConfirmEmailChangeUrl: "https://example.com/" + core.EmailPlaceholderToken,
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestLogsConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.LogsConfig
-		expectError bool
-	}{
-		// zero values
-		{
-			core.LogsConfig{},
-			false,
-		},
-		// invalid data
-		{
-			core.LogsConfig{MaxDays: -10},
-			true,
-		},
-		// valid data
-		{
-			core.LogsConfig{MaxDays: 1},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestAuthProviderConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.AuthProviderConfig
-		expectError bool
-	}{
-		// zero values (disabled)
-		{
-			core.AuthProviderConfig{},
-			false,
-		},
-		// zero values (enabled)
-		{
-			core.AuthProviderConfig{Enabled: true},
-			true,
-		},
-		// invalid data
-		{
-			core.AuthProviderConfig{
-				Enabled:      true,
-				ClientId:     "",
-				ClientSecret: "",
-				AuthUrl:      "test",
-				TokenUrl:     "test",
-				UserApiUrl:   "test",
-			},
-			true,
-		},
-		// valid data (only the required)
-		{
-			core.AuthProviderConfig{
-				Enabled:      true,
-				ClientId:     "test",
-				ClientSecret: "test",
-			},
-			false,
-		},
-		// valid data (fill all fields)
-		{
-			core.AuthProviderConfig{
-				Enabled:      true,
-				ClientId:     "test",
-				ClientSecret: "test",
-				AuthUrl:      "https://example.com",
-				TokenUrl:     "https://example.com",
-				UserApiUrl:   "https://example.com",
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}
-
-func TestAuthProviderConfigSetupProvider(t *testing.T) {
-	provider := auth.NewGithubProvider()
-
-	// disabled config
-	c1 := core.AuthProviderConfig{Enabled: false}
-	if err := c1.SetupProvider(provider); err == nil {
-		t.Errorf("Expected error, got nil")
-	}
-
-	c2 := core.AuthProviderConfig{
-		Enabled:      true,
-		ClientId:     "test_ClientId",
-		ClientSecret: "test_ClientSecret",
-		AuthUrl:      "test_AuthUrl",
-		UserApiUrl:   "test_UserApiUrl",
-		TokenUrl:     "test_TokenUrl",
-	}
-	if err := c2.SetupProvider(provider); err != nil {
-		t.Error(err)
-	}
-	encoded, _ := json.Marshal(c2)
-	expected := `{"enabled":true,"allowRegistrations":false,"clientId":"test_ClientId","clientSecret":"test_ClientSecret","authUrl":"test_AuthUrl","tokenUrl":"test_TokenUrl","userApiUrl":"test_UserApiUrl"}`
-	if string(encoded) != expected {
-		t.Errorf("Expected %s, got %s", expected, string(encoded))
-	}
-}
-
-func TestEmailAuthConfigValidate(t *testing.T) {
-	scenarios := []struct {
-		config      core.EmailAuthConfig
-		expectError bool
-	}{
-		// zero values (disabled)
-		{
-			core.EmailAuthConfig{},
-			false,
-		},
-		// zero values (enabled)
-		{
-			core.EmailAuthConfig{Enabled: true},
-			true,
-		},
-		// invalid data (only the required)
-		{
-			core.EmailAuthConfig{
-				Enabled:           true,
-				MinPasswordLength: 4,
-			},
-			true,
-		},
-		// valid data (only the required)
-		{
-			core.EmailAuthConfig{
-				Enabled:           true,
-				MinPasswordLength: 5,
-			},
-			false,
-		},
-		// invalid data (both OnlyDomains and ExceptDomains set)
-		{
-			core.EmailAuthConfig{
-				Enabled:           true,
-				MinPasswordLength: 5,
-				OnlyDomains:       []string{"example.com", "test.com"},
-				ExceptDomains:     []string{"example.com", "test.com"},
-			},
-			true,
-		},
-		// valid data (only onlyDomains set)
-		{
-			core.EmailAuthConfig{
-				Enabled:           true,
-				MinPasswordLength: 5,
-				OnlyDomains:       []string{"example.com", "test.com"},
-			},
-			false,
-		},
-		// valid data (only exceptDomains set)
-		{
-			core.EmailAuthConfig{
-				Enabled:           true,
-				MinPasswordLength: 5,
-				ExceptDomains:     []string{"example.com", "test.com"},
-			},
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		result := scenario.config.Validate()
-
-		if result != nil && !scenario.expectError {
-			t.Errorf("(%d) Didn't expect error, got %v", i, result)
-		}
-
-		if result == nil && scenario.expectError {
-			t.Errorf("(%d) Expected error, got nil", i)
-		}
-	}
-}

daos/admin.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
@@ -45,10 +46,11 @@ func (dao *Dao) FindAdminByEmail(email string) (*models.Admin, error) {
 	return model, nil
 }
 
-// FindAdminByToken finds the admin associated with the provided JWT token.
+// FindAdminByToken finds the admin associated with the provided JWT.
 //
-// Returns an error if the JWT token is invalid or expired.
+// Returns an error if the JWT is invalid or expired.
 func (dao *Dao) FindAdminByToken(token string, baseTokenKey string) (*models.Admin, error) {
+	// @todo consider caching the unverified claims
 	unverifiedClaims, err := security.ParseUnverifiedJWT(token)
 	if err != nil {
 		return nil, err
@@ -86,20 +88,22 @@ func (dao *Dao) TotalAdmins() (int, error) {
 
 // IsAdminEmailUnique checks if the provided email address is not
 // already in use by other admins.
-func (dao *Dao) IsAdminEmailUnique(email string, excludeId string) bool {
+func (dao *Dao) IsAdminEmailUnique(email string, excludeIds ...string) bool {
 	if email == "" {
 		return false
 	}
 
-	var exists bool
-	err := dao.AdminQuery().
-		Select("count(*)").
-		AndWhere(dbx.Not(dbx.HashExp{"id": excludeId})).
+	query := dao.AdminQuery().Select("count(*)").
 		AndWhere(dbx.HashExp{"email": email}).
-		Limit(1).
-		Row(&exists)
+		Limit(1)
 
-	return err == nil && !exists
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
+
+	var exists bool
+
+	return query.Row(&exists) == nil && !exists
 }
 
 // DeleteAdmin deletes the provided Admin model.

daos/admin_test.go

@@ -8,6 +8,8 @@ import (
 )
 
 func TestAdminQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -20,6 +22,8 @@ func TestAdminQuery(t *testing.T) {
 }
 
 func TestFindAdminById(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -27,8 +31,9 @@ func TestFindAdminById(t *testing.T) {
 		id          string
 		expectError bool
 	}{
-		{"00000000-2b4a-a26b-4d01-42d3c3d77bc8", true},
-		{"3f8397cc-2b4a-a26b-4d01-42d3c3d77bc8", false},
+		{" ", true},
+		{"missing", true},
+		{"9q2trqumvlyr3bd", false},
 	}
 
 	for i, scenario := range scenarios {
@@ -46,6 +51,8 @@ func TestFindAdminById(t *testing.T) {
 }
 
 func TestFindAdminByEmail(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -53,6 +60,7 @@ func TestFindAdminByEmail(t *testing.T) {
 		email       string
 		expectError bool
 	}{
+		{"", true},
 		{"invalid", true},
 		{"missing@example.com", true},
 		{"test@example.com", false},
@@ -74,6 +82,8 @@ func TestFindAdminByEmail(t *testing.T) {
 }
 
 func TestFindAdminByToken(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -83,23 +93,30 @@ func TestFindAdminByToken(t *testing.T) {
 		expectedEmail string
 		expectError   bool
 	}{
-		// invalid base key (password reset key for auth token)
+		// invalid auth token
 		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
-			app.Settings().AdminPasswordResetToken.Secret,
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MDk5MTY2MX0.qrbkI2TITtFKMP6vrATrBVKPGjEiDIBeQ0mlqPGMVeY",
+			app.Settings().AdminAuthToken.Secret,
 			"",
 			true,
 		},
 		// expired token
 		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MDk5MTY2MX0.uXZ_ywsZeRFSvDNQ9zBoYUXKXw7VEr48Fzx-E06OkS8",
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MDk5MTY2MX0.I7w8iktkleQvC7_UIRpD7rNzcU4OnF7i7SFIUu6lD_4",
 			app.Settings().AdminAuthToken.Secret,
 			"",
 			true,
 		},
+		// wrong base token (password reset token secret instead of auth secret)
+		{
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
+			app.Settings().AdminPasswordResetToken.Secret,
+			"",
+			true,
+		},
 		// valid token
 		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg3MzQ2Mjc5Mn0.AtRtXR6FHBrCUGkj5OffhmxLbSZaQ4L_Qgw4gfoHyfo",
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImV4cCI6MjIwODk4NTI2MX0.M1m--VOqGyv0d23eeUc0r9xE8ZzHaYVmVFw1VZW6gT8",
 			app.Settings().AdminAuthToken.Secret,
 			"test@example.com",
 			false,
@@ -122,6 +139,8 @@ func TestFindAdminByToken(t *testing.T) {
 }
 
 func TestTotalAdmins(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -129,8 +148,8 @@ func TestTotalAdmins(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if result1 != 2 {
-		t.Fatalf("Expected 2 admins, got %d", result1)
+	if result1 != 3 {
+		t.Fatalf("Expected 3 admins, got %d", result1)
 	}
 
 	// delete all
@@ -146,6 +165,8 @@ func TestTotalAdmins(t *testing.T) {
 }
 
 func TestIsAdminEmailUnique(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -156,8 +177,10 @@ func TestIsAdminEmailUnique(t *testing.T) {
 	}{
 		{"", "", false},
 		{"test@example.com", "", false},
+		{"test2@example.com", "", false},
+		{"test3@example.com", "", false},
 		{"new@example.com", "", true},
-		{"test@example.com", "2b4a97cc-3f83-4d01-a26b-3d77bc842d3c", true},
+		{"test@example.com", "sywbhecnh46rhm0", true},
 	}
 
 	for i, scenario := range scenarios {
@@ -169,6 +192,8 @@ func TestIsAdminEmailUnique(t *testing.T) {
 }
 
 func TestDeleteAdmin(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -186,15 +211,24 @@ func TestDeleteAdmin(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	admin3, err := app.Dao().FindAdminByEmail("test3@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	deleteErr1 := app.Dao().DeleteAdmin(admin1)
 	if deleteErr1 != nil {
 		t.Fatal(deleteErr1)
 	}
 
-	// cannot delete the only remaining admin
 	deleteErr2 := app.Dao().DeleteAdmin(admin2)
-	if deleteErr2 == nil {
+	if deleteErr2 != nil {
+		t.Fatal(deleteErr2)
+	}
+
+	// cannot delete the only remaining admin
+	deleteErr3 := app.Dao().DeleteAdmin(admin3)
+	if deleteErr3 == nil {
 		t.Fatal("Expected delete error, got nil")
 	}
 
@@ -205,6 +239,8 @@ func TestDeleteAdmin(t *testing.T) {
 }
 
 func TestSaveAdmin(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/base.go

@@ -6,41 +6,110 @@ package daos
 import (
 	"errors"
 	"fmt"
+	"time"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// New creates a new Dao instance with the provided db builder.
+// New creates a new Dao instance with the provided db builder
+// (for both async and sync db operations).
 func New(db dbx.Builder) *Dao {
+	return NewMultiDB(db, db)
+}
+
+// NewMultiDB creates a new Dao instance with the provided dedicated
+// async and sync db builders.
+func NewMultiDB(concurrentDB, nonconcurrentDB dbx.Builder) *Dao {
 	return &Dao{
-		db: db,
+		concurrentDB:      concurrentDB,
+		nonconcurrentDB:   nonconcurrentDB,
+		MaxLockRetries:    8,
+		ModelQueryTimeout: 30 * time.Second,
 	}
 }
 
 // Dao handles various db operations.
-// Think of Dao as a repository and service layer in one.
+//
+// You can think of Dao as a repository and service layer in one.
 type Dao struct {
-	db dbx.Builder
+	// in a transaction both refer to the same *dbx.TX instance
+	concurrentDB    dbx.Builder
+	nonconcurrentDB dbx.Builder
 
-	BeforeCreateFunc func(eventDao *Dao, m models.Model) error
-	AfterCreateFunc  func(eventDao *Dao, m models.Model)
-	BeforeUpdateFunc func(eventDao *Dao, m models.Model) error
-	AfterUpdateFunc  func(eventDao *Dao, m models.Model)
-	BeforeDeleteFunc func(eventDao *Dao, m models.Model) error
-	AfterDeleteFunc  func(eventDao *Dao, m models.Model)
+	// MaxLockRetries specifies the default max "database is locked" auto retry attempts.
+	MaxLockRetries int
+
+	// ModelQueryTimeout is the default max duration of a running ModelQuery().
+	//
+	// This field has no effect if an explicit query context is already specified.
+	ModelQueryTimeout time.Duration
+
+	// write hooks
+	BeforeCreateFunc func(eventDao *Dao, m models.Model, action func() error) error
+	AfterCreateFunc  func(eventDao *Dao, m models.Model) error
+	BeforeUpdateFunc func(eventDao *Dao, m models.Model, action func() error) error
+	AfterUpdateFunc  func(eventDao *Dao, m models.Model) error
+	BeforeDeleteFunc func(eventDao *Dao, m models.Model, action func() error) error
+	AfterDeleteFunc  func(eventDao *Dao, m models.Model) error
 }
 
-// DB returns the internal db builder (*dbx.DB or *dbx.TX).
+// DB returns the default dao db builder (*dbx.DB or *dbx.TX).
+//
+// Currently the default db builder is dao.concurrentDB but that may change in the future.
 func (dao *Dao) DB() dbx.Builder {
-	return dao.db
+	return dao.ConcurrentDB()
 }
 
-// ModelQuery creates a new query with preset Select and From fields
-// based on the provided model argument.
+// ConcurrentDB returns the dao concurrent (aka. multiple open connections)
+// db builder (*dbx.DB or *dbx.TX).
+//
+// In a transaction the concurrentDB and nonconcurrentDB refer to the same *dbx.TX instance.
+func (dao *Dao) ConcurrentDB() dbx.Builder {
+	return dao.concurrentDB
+}
+
+// NonconcurrentDB returns the dao nonconcurrent (aka. single open connection)
+// db builder (*dbx.DB or *dbx.TX).
+//
+// In a transaction the concurrentDB and nonconcurrentDB refer to the same *dbx.TX instance.
+func (dao *Dao) NonconcurrentDB() dbx.Builder {
+	return dao.nonconcurrentDB
+}
+
+// Clone returns a new Dao with the same configuration options as the current one.
+func (dao *Dao) Clone() *Dao {
+	clone := *dao
+
+	return &clone
+}
+
+// WithoutHooks returns a new Dao with the same configuration options
+// as the current one, but without create/update/delete hooks.
+func (dao *Dao) WithoutHooks() *Dao {
+	clone := dao.Clone()
+
+	clone.BeforeCreateFunc = nil
+	clone.AfterCreateFunc = nil
+	clone.BeforeUpdateFunc = nil
+	clone.AfterUpdateFunc = nil
+	clone.BeforeDeleteFunc = nil
+	clone.AfterDeleteFunc = nil
+
+	return clone
+}
+
+// ModelQuery creates a new preconfigured select query with preset
+// SELECT, FROM and other common fields based on the provided model.
 func (dao *Dao) ModelQuery(m models.Model) *dbx.SelectQuery {
 	tableName := m.TableName()
-	return dao.db.Select(fmt.Sprintf("{{%s}}.*", tableName)).From(tableName)
+
+	return dao.DB().
+		Select("{{" + tableName + "}}.*").
+		From(tableName).
+		WithBuildHook(func(query *dbx.Query) {
+			query.WithExecHook(execLockRetry(dao.ModelQueryTimeout, dao.MaxLockRetries))
+		})
 }
 
 // FindById finds a single db record with the specified id and
@@ -57,13 +126,25 @@ type afterCallGroup struct {
 
 // RunInTransaction wraps fn into a transaction.
 //
-// It is safe to nest RunInTransaction calls.
+// It is safe to nest RunInTransaction calls as long as you use the txDao.
 func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
-	switch txOrDB := dao.db.(type) {
+	switch txOrDB := dao.NonconcurrentDB().(type) {
 	case *dbx.Tx:
 		// nested transactions are not supported by default
 		// so execute the function within the current transaction
-		return fn(dao)
+		// ---
+		// create a new dao with the same hooks to avoid semaphore deadlock when nesting
+		txDao := New(txOrDB)
+		txDao.MaxLockRetries = dao.MaxLockRetries
+		txDao.ModelQueryTimeout = dao.ModelQueryTimeout
+		txDao.BeforeCreateFunc = dao.BeforeCreateFunc
+		txDao.BeforeUpdateFunc = dao.BeforeUpdateFunc
+		txDao.BeforeDeleteFunc = dao.BeforeDeleteFunc
+		txDao.AfterCreateFunc = dao.AfterCreateFunc
+		txDao.AfterUpdateFunc = dao.AfterUpdateFunc
+		txDao.AfterDeleteFunc = dao.AfterDeleteFunc
+
+		return fn(txDao)
 	case *dbx.DB:
 		afterCalls := []afterCallGroup{}
 
@@ -71,58 +152,72 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 			txDao := New(tx)
 
 			if dao.BeforeCreateFunc != nil {
-				txDao.BeforeCreateFunc = func(eventDao *Dao, m models.Model) error {
-					return dao.BeforeCreateFunc(eventDao, m)
+				txDao.BeforeCreateFunc = func(eventDao *Dao, m models.Model, action func() error) error {
+					return dao.BeforeCreateFunc(eventDao, m, action)
 				}
 			}
 			if dao.BeforeUpdateFunc != nil {
-				txDao.BeforeUpdateFunc = func(eventDao *Dao, m models.Model) error {
-					return dao.BeforeUpdateFunc(eventDao, m)
+				txDao.BeforeUpdateFunc = func(eventDao *Dao, m models.Model, action func() error) error {
+					return dao.BeforeUpdateFunc(eventDao, m, action)
 				}
 			}
 			if dao.BeforeDeleteFunc != nil {
-				txDao.BeforeDeleteFunc = func(eventDao *Dao, m models.Model) error {
-					return dao.BeforeDeleteFunc(eventDao, m)
+				txDao.BeforeDeleteFunc = func(eventDao *Dao, m models.Model, action func() error) error {
+					return dao.BeforeDeleteFunc(eventDao, m, action)
 				}
 			}
 
 			if dao.AfterCreateFunc != nil {
-				txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) {
+				txDao.AfterCreateFunc = func(eventDao *Dao, m models.Model) error {
 					afterCalls = append(afterCalls, afterCallGroup{"create", eventDao, m})
+					return nil
 				}
 			}
 			if dao.AfterUpdateFunc != nil {
-				txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) {
+				txDao.AfterUpdateFunc = func(eventDao *Dao, m models.Model) error {
 					afterCalls = append(afterCalls, afterCallGroup{"update", eventDao, m})
+					return nil
 				}
 			}
 			if dao.AfterDeleteFunc != nil {
-				txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) {
+				txDao.AfterDeleteFunc = func(eventDao *Dao, m models.Model) error {
 					afterCalls = append(afterCalls, afterCallGroup{"delete", eventDao, m})
+					return nil
 				}
 			}
 
 			return fn(txDao)
 		})
-
-		if txError == nil {
-			// execute after event calls on successful transaction
-			for _, call := range afterCalls {
-				switch call.Action {
-				case "create":
-					dao.AfterCreateFunc(call.EventDao, call.Model)
-				case "update":
-					dao.AfterUpdateFunc(call.EventDao, call.Model)
-				case "delete":
-					dao.AfterDeleteFunc(call.EventDao, call.Model)
-				}
-			}
+		if txError != nil {
+			return txError
 		}
 
-		return txError
+		// execute after event calls on successful transaction
+		// (note: using the non-transaction dao to allow following queries in the after hooks)
+		var errs []error
+		for _, call := range afterCalls {
+			var err error
+			switch call.Action {
+			case "create":
+				err = dao.AfterCreateFunc(dao, call.Model)
+			case "update":
+				err = dao.AfterUpdateFunc(dao, call.Model)
+			case "delete":
+				err = dao.AfterDeleteFunc(dao, call.Model)
+			}
+
+			if err != nil {
+				errs = append(errs, err)
+			}
+		}
+		if len(errs) > 0 {
+			return fmt.Errorf("after transaction errors: %w", errors.Join(errs...))
+		}
+
+		return nil
 	}
 
-	return errors.New("Failed to start transaction (unknown dao.db)")
+	return errors.New("failed to start transaction (unknown dao.NonconcurrentDB() instance)")
 }
 
 // Delete deletes the provided model.
@@ -131,30 +226,41 @@ func (dao *Dao) Delete(m models.Model) error {
 		return errors.New("ID is not set")
 	}
 
-	if dao.BeforeDeleteFunc != nil {
-		if err := dao.BeforeDeleteFunc(dao, m); err != nil {
-			return err
+	return dao.lockRetry(func(retryDao *Dao) error {
+		action := func() error {
+			if err := retryDao.NonconcurrentDB().Model(m).Delete(); err != nil {
+				return err
+			}
+
+			if retryDao.AfterDeleteFunc != nil {
+				retryDao.AfterDeleteFunc(retryDao, m)
+			}
+
+			return nil
 		}
-	}
 
-	if err := dao.db.Model(m).Delete(); err != nil {
-		return err
-	}
+		if retryDao.BeforeDeleteFunc != nil {
+			return retryDao.BeforeDeleteFunc(retryDao, m, action)
+		}
 
-	if dao.AfterDeleteFunc != nil {
-		dao.AfterDeleteFunc(dao, m)
-	}
-
-	return nil
+		return action()
+	})
 }
 
-// Save upserts (update or create if primary key is not set) the provided model.
+// Save persists the provided model in the database.
+//
+// If m.IsNew() is true, the method will perform a create, otherwise an update.
+// To explicitly mark a model for update you can use m.MarkAsNotNew().
 func (dao *Dao) Save(m models.Model) error {
 	if m.IsNew() {
-		return dao.create(m)
+		return dao.lockRetry(func(retryDao *Dao) error {
+			return retryDao.create(m)
+		})
 	}
 
-	return dao.update(m)
+	return dao.lockRetry(func(retryDao *Dao) error {
+		return retryDao.update(m)
+	})
 }
 
 func (dao *Dao) update(m models.Model) error {
@@ -168,35 +274,35 @@ func (dao *Dao) update(m models.Model) error {
 
 	m.RefreshUpdated()
 
+	action := func() error {
+		if v, ok := any(m).(models.ColumnValueMapper); ok {
+			dataMap := v.ColumnValueMap()
+
+			_, err := dao.NonconcurrentDB().Update(
+				m.TableName(),
+				dataMap,
+				dbx.HashExp{"id": m.GetId()},
+			).Execute()
+
+			if err != nil {
+				return err
+			}
+		} else if err := dao.NonconcurrentDB().Model(m).Update(); err != nil {
+			return err
+		}
+
+		if dao.AfterUpdateFunc != nil {
+			return dao.AfterUpdateFunc(dao, m)
+		}
+
+		return nil
+	}
+
 	if dao.BeforeUpdateFunc != nil {
-		if err := dao.BeforeUpdateFunc(dao, m); err != nil {
-			return err
-		}
+		return dao.BeforeUpdateFunc(dao, m, action)
 	}
 
-	if v, ok := any(m).(models.ColumnValueMapper); ok {
-		dataMap := v.ColumnValueMap()
-
-		_, err := dao.db.Update(
-			m.TableName(),
-			dataMap,
-			dbx.HashExp{"id": m.GetId()},
-		).Execute()
-
-		if err != nil {
-			return err
-		}
-	} else {
-		if err := dao.db.Model(m).Update(); err != nil {
-			return err
-		}
-	}
-
-	if dao.AfterUpdateFunc != nil {
-		dao.AfterUpdateFunc(dao, m)
-	}
-
-	return nil
+	return action()
 }
 
 func (dao *Dao) create(m models.Model) error {
@@ -216,34 +322,51 @@ func (dao *Dao) create(m models.Model) error {
 		m.RefreshUpdated()
 	}
 
+	action := func() error {
+		if v, ok := any(m).(models.ColumnValueMapper); ok {
+			dataMap := v.ColumnValueMap()
+			if _, ok := dataMap["id"]; !ok {
+				dataMap["id"] = m.GetId()
+			}
+
+			_, err := dao.NonconcurrentDB().Insert(m.TableName(), dataMap).Execute()
+			if err != nil {
+				return err
+			}
+		} else if err := dao.NonconcurrentDB().Model(m).Insert(); err != nil {
+			return err
+		}
+
+		// clears the "new" model flag
+		m.MarkAsNotNew()
+
+		if dao.AfterCreateFunc != nil {
+			return dao.AfterCreateFunc(dao, m)
+		}
+
+		return nil
+	}
+
 	if dao.BeforeCreateFunc != nil {
-		if err := dao.BeforeCreateFunc(dao, m); err != nil {
-			return err
-		}
+		return dao.BeforeCreateFunc(dao, m, action)
 	}
 
-	if v, ok := any(m).(models.ColumnValueMapper); ok {
-		dataMap := v.ColumnValueMap()
-		if _, ok := dataMap["id"]; !ok {
-			dataMap["id"] = m.GetId()
-		}
+	return action()
+}
+
+func (dao *Dao) lockRetry(op func(retryDao *Dao) error) error {
+	retryDao := dao
 
-		_, err := dao.db.Insert(m.TableName(), dataMap).Execute()
-		if err != nil {
-			return err
-		}
-	} else {
-		if err := dao.db.Model(m).Insert(); err != nil {
-			return err
+	return baseLockRetry(func(attempt int) error {
+		if attempt == 2 {
+			// assign new Dao without the before hooks to avoid triggering
+			// the already fired before callbacks multiple times
+			retryDao = NewMultiDB(dao.concurrentDB, dao.nonconcurrentDB)
+			retryDao.AfterCreateFunc = dao.AfterCreateFunc
+			retryDao.AfterUpdateFunc = dao.AfterUpdateFunc
+			retryDao.AfterDeleteFunc = dao.AfterDeleteFunc
 		}
-	}
-
-	// clears the "new" model flag
-	m.UnmarkAsNew()
-
-	if dao.AfterCreateFunc != nil {
-		dao.AfterCreateFunc(dao, m)
-	}
 
-	return nil
+		return op(retryDao)
+	}, dao.MaxLockRetries)
 }

daos/base_retry.go

@@ -0,0 +1,65 @@
+package daos
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+)
+
+// default retries intervals (in ms)
+var defaultRetryIntervals = []int{100, 250, 350, 500, 700, 1000}
+
+func execLockRetry(timeout time.Duration, maxRetries int) dbx.ExecHookFunc {
+	return func(q *dbx.Query, op func() error) error {
+		if q.Context() == nil {
+			cancelCtx, cancel := context.WithTimeout(context.Background(), timeout)
+			defer func() {
+				cancel()
+				//nolint:staticcheck
+				q.WithContext(nil) // reset
+			}()
+			q.WithContext(cancelCtx)
+		}
+
+		execErr := baseLockRetry(func(attempt int) error {
+			return op()
+		}, maxRetries)
+		if execErr != nil && !errors.Is(execErr, sql.ErrNoRows) {
+			execErr = fmt.Errorf("%w; failed query: %s", execErr, q.SQL())
+		}
+
+		return execErr
+	}
+}
+
+func baseLockRetry(op func(attempt int) error, maxRetries int) error {
+	attempt := 1
+
+Retry:
+	err := op(attempt)
+
+	if err != nil &&
+		attempt <= maxRetries &&
+		// we are checking the err message to handle both the cgo and noncgo errors
+		strings.Contains(err.Error(), "database is locked") {
+		// wait and retry
+		time.Sleep(getDefaultRetryInterval(attempt))
+		attempt++
+		goto Retry
+	}
+
+	return err
+}
+
+func getDefaultRetryInterval(attempt int) time.Duration {
+	if attempt < 0 || attempt > len(defaultRetryIntervals)-1 {
+		return time.Duration(defaultRetryIntervals[len(defaultRetryIntervals)-1]) * time.Millisecond
+	}
+
+	return time.Duration(defaultRetryIntervals[attempt]) * time.Millisecond
+}

daos/base_retry_test.go

@@ -0,0 +1,64 @@
+package daos
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestGetDefaultRetryInterval(t *testing.T) {
+	t.Parallel()
+
+	if i := getDefaultRetryInterval(-1); i.Milliseconds() != 1000 {
+		t.Fatalf("Expected 1000ms, got %v", i)
+	}
+
+	if i := getDefaultRetryInterval(999); i.Milliseconds() != 1000 {
+		t.Fatalf("Expected 1000ms, got %v", i)
+	}
+
+	if i := getDefaultRetryInterval(3); i.Milliseconds() != 500 {
+		t.Fatalf("Expected 500ms, got %v", i)
+	}
+}
+
+func TestBaseLockRetry(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		err              error
+		failUntilAttempt int
+		expectedAttempts int
+	}{
+		{nil, 3, 1},
+		{errors.New("test"), 3, 1},
+		{errors.New("database is locked"), 3, 3},
+	}
+
+	for i, s := range scenarios {
+		lastAttempt := 0
+
+		err := baseLockRetry(func(attempt int) error {
+			lastAttempt = attempt
+
+			if attempt < s.failUntilAttempt {
+				return s.err
+			}
+
+			return nil
+		}, s.failUntilAttempt+2)
+
+		if lastAttempt != s.expectedAttempts {
+			t.Errorf("[%d] Expected lastAttempt to be %d, got %d", i, s.expectedAttempts, lastAttempt)
+		}
+
+		if s.failUntilAttempt == s.expectedAttempts && err != nil {
+			t.Errorf("[%d] Expected nil, got err %v", i, err)
+			continue
+		}
+
+		if s.failUntilAttempt != s.expectedAttempts && s.err != nil && err == nil {
+			t.Errorf("[%d] Expected error %q, got nil", i, s.err)
+			continue
+		}
+	}
+}

daos/base_test.go

@@ -3,6 +3,7 @@ package daos_test
 import (
 	"errors"
 	"testing"
+	"time"
 
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
@@ -20,6 +21,180 @@ func TestNew(t *testing.T) {
 	}
 }
 
+func TestNewMultiDB(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	dao := daos.NewMultiDB(testApp.Dao().ConcurrentDB(), testApp.Dao().NonconcurrentDB())
+
+	if dao.DB() != testApp.Dao().ConcurrentDB() {
+		t.Fatal("[db-concurrentDB] The 2 db instances are different")
+	}
+
+	if dao.ConcurrentDB() != testApp.Dao().ConcurrentDB() {
+		t.Fatal("[concurrentDB-concurrentDB] The 2 db instances are different")
+	}
+
+	if dao.NonconcurrentDB() != testApp.Dao().NonconcurrentDB() {
+		t.Fatal("[nonconcurrentDB-nonconcurrentDB] The 2 db instances are different")
+	}
+}
+
+func TestDaoClone(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	hookCalls := map[string]int{}
+
+	dao := daos.NewMultiDB(testApp.Dao().ConcurrentDB(), testApp.Dao().NonconcurrentDB())
+	dao.MaxLockRetries = 1
+	dao.ModelQueryTimeout = 2
+	dao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeDeleteFunc"]++
+		return action()
+	}
+	dao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeUpdateFunc"]++
+		return action()
+	}
+	dao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeCreateFunc"]++
+		return action()
+	}
+	dao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterDeleteFunc"]++
+		return nil
+	}
+	dao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterUpdateFunc"]++
+		return nil
+	}
+	dao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterCreateFunc"]++
+		return nil
+	}
+
+	clone := dao.Clone()
+	clone.MaxLockRetries = 3
+	clone.ModelQueryTimeout = 4
+	clone.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["NewAfterCreateFunc"]++
+		return nil
+	}
+
+	if dao.MaxLockRetries == clone.MaxLockRetries {
+		t.Fatal("Expected different MaxLockRetries")
+	}
+
+	if dao.ModelQueryTimeout == clone.ModelQueryTimeout {
+		t.Fatal("Expected different ModelQueryTimeout")
+	}
+
+	emptyAction := func() error { return nil }
+
+	// trigger hooks
+	dao.BeforeDeleteFunc(nil, nil, emptyAction)
+	dao.BeforeUpdateFunc(nil, nil, emptyAction)
+	dao.BeforeCreateFunc(nil, nil, emptyAction)
+	dao.AfterDeleteFunc(nil, nil)
+	dao.AfterUpdateFunc(nil, nil)
+	dao.AfterCreateFunc(nil, nil)
+	clone.BeforeDeleteFunc(nil, nil, emptyAction)
+	clone.BeforeUpdateFunc(nil, nil, emptyAction)
+	clone.BeforeCreateFunc(nil, nil, emptyAction)
+	clone.AfterDeleteFunc(nil, nil)
+	clone.AfterUpdateFunc(nil, nil)
+	clone.AfterCreateFunc(nil, nil)
+
+	expectations := []struct {
+		hook  string
+		total int
+	}{
+		{"BeforeDeleteFunc", 2},
+		{"BeforeUpdateFunc", 2},
+		{"BeforeCreateFunc", 2},
+		{"AfterDeleteFunc", 2},
+		{"AfterUpdateFunc", 2},
+		{"AfterCreateFunc", 1},
+		{"NewAfterCreateFunc", 1},
+	}
+
+	for _, e := range expectations {
+		if hookCalls[e.hook] != e.total {
+			t.Errorf("Expected %s to be caleed %d", e.hook, e.total)
+		}
+	}
+}
+
+func TestDaoWithoutHooks(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	hookCalls := map[string]int{}
+
+	dao := daos.NewMultiDB(testApp.Dao().ConcurrentDB(), testApp.Dao().NonconcurrentDB())
+	dao.MaxLockRetries = 1
+	dao.ModelQueryTimeout = 2
+	dao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeDeleteFunc"]++
+		return action()
+	}
+	dao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeUpdateFunc"]++
+		return action()
+	}
+	dao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		hookCalls["BeforeCreateFunc"]++
+		return action()
+	}
+	dao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterDeleteFunc"]++
+		return nil
+	}
+	dao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterUpdateFunc"]++
+		return nil
+	}
+	dao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		hookCalls["AfterCreateFunc"]++
+		return nil
+	}
+
+	new := dao.WithoutHooks()
+
+	if new.MaxLockRetries != dao.MaxLockRetries {
+		t.Fatalf("Expected MaxLockRetries %d, got %d", new.Clone().MaxLockRetries, dao.MaxLockRetries)
+	}
+
+	if new.ModelQueryTimeout != dao.ModelQueryTimeout {
+		t.Fatalf("Expected ModelQueryTimeout %d, got %d", new.Clone().ModelQueryTimeout, dao.ModelQueryTimeout)
+	}
+
+	if new.BeforeDeleteFunc != nil {
+		t.Fatal("Expected BeforeDeleteFunc to be nil")
+	}
+
+	if new.BeforeUpdateFunc != nil {
+		t.Fatal("Expected BeforeUpdateFunc to be nil")
+	}
+
+	if new.BeforeCreateFunc != nil {
+		t.Fatal("Expected BeforeCreateFunc to be nil")
+	}
+
+	if new.AfterDeleteFunc != nil {
+		t.Fatal("Expected AfterDeleteFunc to be nil")
+	}
+
+	if new.AfterUpdateFunc != nil {
+		t.Fatal("Expected AfterUpdateFunc to be nil")
+	}
+
+	if new.AfterCreateFunc != nil {
+		t.Fatal("Expected AfterCreateFunc to be nil")
+	}
+}
+
 func TestDaoModelQuery(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
@@ -35,8 +210,8 @@ func TestDaoModelQuery(t *testing.T) {
 			"SELECT {{_collections}}.* FROM `_collections`",
 		},
 		{
-			&models.User{},
-			"SELECT {{_users}}.* FROM `_users`",
+			&models.Admin{},
+			"SELECT {{_admins}}.* FROM `_admins`",
 		},
 		{
 			&models.Request{},
@@ -52,6 +227,24 @@ func TestDaoModelQuery(t *testing.T) {
 	}
 }
 
+func TestDaoModelQueryCancellation(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	dao := daos.New(testApp.DB())
+
+	m := &models.Admin{}
+
+	if err := dao.ModelQuery(m).One(m); err != nil {
+		t.Fatalf("Failed to execute control query: %v", err)
+	}
+
+	dao.ModelQueryTimeout = 0 * time.Millisecond
+	if err := dao.ModelQuery(m).One(m); err == nil {
+		t.Fatal("Expected to be cancelled, got nil")
+	}
+}
+
 func TestDaoFindById(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
@@ -64,19 +257,19 @@ func TestDaoFindById(t *testing.T) {
 		// missing id
 		{
 			&models.Collection{},
-			"00000000-075d-49fe-9d09-ea7e951000dc",
+			"missing",
 			true,
 		},
 		// existing collection id
 		{
 			&models.Collection{},
-			"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+			"wsmn24bux7wo113",
 			false,
 		},
-		// existing user id
+		// existing admin id
 		{
-			&models.User{},
-			"97cc3d3d-6ba2-383f-b42a-7bc84d27410c",
+			&models.Admin{},
+			"sbmbsdb40jyxf7h",
 			false,
 		},
 	}
@@ -289,19 +482,186 @@ func TestDaoDelete(t *testing.T) {
 	}
 }
 
+func TestDaoRetryCreate(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init mock retry dao
+	retryBeforeCreateHookCalls := 0
+	retryAfterCreateHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeCreateHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryAfterCreateHookCalls++
+		return nil
+	}
+
+	model := &models.Admin{Email: "new@example.com"}
+	if err := retryDao.Save(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeCreateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeCreateHookCalls)
+	}
+
+	if retryAfterCreateHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterCreateHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeCreateHookCalls = 0
+	retryAfterCreateHookCalls = 0
+	retryDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeCreateHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	dummy := &models.Admin{Email: "test@example.com"}
+	if err := retryDao.Save(dummy); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeCreateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeCreateHookCalls)
+	}
+
+	if retryAfterCreateHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterCreateHookCalls)
+	}
+}
+
+func TestDaoRetryUpdate(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	model, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// init mock retry dao
+	retryBeforeUpdateHookCalls := 0
+	retryAfterUpdateHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeUpdateHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryAfterUpdateHookCalls++
+		return nil
+	}
+
+	if err := retryDao.Save(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeUpdateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeUpdateHookCalls)
+	}
+
+	if retryAfterUpdateHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterUpdateHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeUpdateHookCalls = 0
+	retryAfterUpdateHookCalls = 0
+	retryDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeUpdateHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	if err := retryDao.Save(model); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeUpdateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeUpdateHookCalls)
+	}
+
+	if retryAfterUpdateHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterUpdateHookCalls)
+	}
+}
+
+func TestDaoRetryDelete(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init mock retry dao
+	retryBeforeDeleteHookCalls := 0
+	retryAfterDeleteHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeDeleteHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryAfterDeleteHookCalls++
+		return nil
+	}
+
+	model, _ := retryDao.FindAdminByEmail("test@example.com")
+	if err := retryDao.Delete(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeDeleteHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeDeleteHookCalls)
+	}
+
+	if retryAfterDeleteHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterDeleteHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeDeleteHookCalls = 0
+	retryAfterDeleteHookCalls = 0
+	retryDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
+		retryBeforeDeleteHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	dummy := &models.Admin{}
+	dummy.RefreshId()
+	dummy.MarkAsNotNew()
+	if err := retryDao.Delete(dummy); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeDeleteHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeDeleteHookCalls)
+	}
+
+	if retryAfterDeleteHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterDeleteHookCalls)
+	}
+}
+
 func TestDaoBeforeHooksError(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
 	baseDao := testApp.Dao()
 
-	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		return errors.New("before_create")
 	}
-	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		return errors.New("before_update")
 	}
-	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		return errors.New("before_delete")
 	}
 
@@ -340,27 +700,30 @@ func TestDaoTransactionHooksCallsOnFailure(t *testing.T) {
 
 	baseDao := testApp.Dao()
 
-	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeCreateFuncCalls++
-		return nil
+		return action()
 	}
-	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeUpdateFuncCalls++
-		return nil
+		return action()
 	}
-	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeDeleteFuncCalls++
-		return nil
+		return action()
 	}
 
-	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterCreateFuncCalls++
+		return nil
 	}
-	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterUpdateFuncCalls++
+		return nil
 	}
-	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterDeleteFuncCalls++
+		return nil
 	}
 
 	existingModel, _ := testApp.Dao().FindAdminByEmail("test@example.com")
@@ -428,27 +791,30 @@ func TestDaoTransactionHooksCallsOnSuccess(t *testing.T) {
 
 	baseDao := testApp.Dao()
 
-	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeCreateFuncCalls++
-		return nil
+		return action()
 	}
-	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeUpdateFuncCalls++
-		return nil
+		return action()
 	}
-	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+	baseDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model, action func() error) error {
 		beforeDeleteFuncCalls++
-		return nil
+		return action()
 	}
 
-	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterCreateFuncCalls++
+		return nil
 	}
-	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterUpdateFuncCalls++
+		return nil
 	}
-	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
+	baseDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
 		afterDeleteFuncCalls++
+		return nil
 	}
 
 	existingModel, _ := testApp.Dao().FindAdminByEmail("test@example.com")

daos/collection.go

@@ -1,6 +1,8 @@
 package daos
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"strings"
@@ -8,6 +10,7 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/list"
 )
 
 // CollectionQuery returns a new Collection select query.
@@ -15,15 +18,31 @@ func (dao *Dao) CollectionQuery() *dbx.SelectQuery {
 	return dao.ModelQuery(&models.Collection{})
 }
 
-// FindCollectionByNameOrId finds the first collection by its name or id.
+// FindCollectionsByType finds all collections by the given type.
+func (dao *Dao) FindCollectionsByType(collectionType string) ([]*models.Collection, error) {
+	collections := []*models.Collection{}
+
+	err := dao.CollectionQuery().
+		AndWhere(dbx.HashExp{"type": collectionType}).
+		OrderBy("created ASC").
+		All(&collections)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return collections, nil
+}
+
+// FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.
 func (dao *Dao) FindCollectionByNameOrId(nameOrId string) (*models.Collection, error) {
 	model := &models.Collection{}
 
 	err := dao.CollectionQuery().
-		AndWhere(dbx.Or(
-			dbx.HashExp{"id": nameOrId},
-			dbx.HashExp{"name": nameOrId},
-		)).
+		AndWhere(dbx.NewExp("[[id]] = {:id} OR LOWER([[name]])={:name}", dbx.Params{
+			"id":   nameOrId,
+			"name": strings.ToLower(nameOrId),
+		})).
 		Limit(1).
 		One(model)
 
@@ -37,58 +56,47 @@ func (dao *Dao) FindCollectionByNameOrId(nameOrId string) (*models.Collection, e
 // IsCollectionNameUnique checks that there is no existing collection
 // with the provided name (case insensitive!).
 //
-// Note: case sensitive check because the name is used also as a table name for the records.
-func (dao *Dao) IsCollectionNameUnique(name string, excludeId string) bool {
+// Note: case insensitive check because the name is used also as a table name for the records.
+func (dao *Dao) IsCollectionNameUnique(name string, excludeIds ...string) bool {
 	if name == "" {
 		return false
 	}
 
-	var exists bool
-	err := dao.CollectionQuery().
+	query := dao.CollectionQuery().
 		Select("count(*)").
-		AndWhere(dbx.Not(dbx.HashExp{"id": excludeId})).
 		AndWhere(dbx.NewExp("LOWER([[name]])={:name}", dbx.Params{"name": strings.ToLower(name)})).
-		Limit(1).
-		Row(&exists)
+		Limit(1)
 
-	return err == nil && !exists
-}
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
 
-// FindCollectionsWithUserFields finds all collections that has
-// at least one user schema field.
-func (dao *Dao) FindCollectionsWithUserFields() ([]*models.Collection, error) {
-	result := []*models.Collection{}
+	var exists bool
 
-	err := dao.CollectionQuery().
-		InnerJoin(
-			"json_each(schema) as jsonField",
-			dbx.NewExp(
-				"json_extract(jsonField.value, '$.type') = {:type}",
-				dbx.Params{"type": schema.FieldTypeUser},
-			),
-		).
-		All(&result)
-
-	return result, err
+	return query.Row(&exists) == nil && !exists
 }
 
 // FindCollectionReferences returns information for all
 // relation schema fields referencing the provided collection.
 //
 // If the provided collection has reference to itself then it will be
-// also included in the result. To exlude it, pass the collection id
+// also included in the result. To exclude it, pass the collection id
 // as the excludeId argument.
-func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeId string) (map[*models.Collection][]*schema.SchemaField, error) {
+func (dao *Dao) FindCollectionReferences(collection *models.Collection, excludeIds ...string) (map[*models.Collection][]*schema.SchemaField, error) {
 	collections := []*models.Collection{}
 
-	err := dao.CollectionQuery().
-		AndWhere(dbx.Not(dbx.HashExp{"id": excludeId})).
-		All(&collections)
-	if err != nil {
+	query := dao.CollectionQuery()
+
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
+
+	if err := query.All(&collections); err != nil {
 		return nil, err
 	}
 
 	result := map[*models.Collection][]*schema.SchemaField{}
+
 	for _, c := range collections {
 		for _, f := range c.Schema.Fields() {
 			if f.Type != schema.FieldTypeRelation {
@@ -123,21 +131,39 @@ func (dao *Dao) DeleteCollection(collection *models.Collection) error {
 		return err
 	}
 	if total := len(result); total > 0 {
-		return fmt.Errorf("The collection %q has external relation field references (%d).", collection.Name, total)
+		names := make([]string, 0, len(result))
+		for ref := range result {
+			names = append(names, ref.Name)
+		}
+		return fmt.Errorf("The collection %q has external relation field references (%s).", collection.Name, strings.Join(names, ", "))
 	}
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
-		// delete the related records table
-		if err := txDao.DeleteTable(collection.Name); err != nil {
-			return err
+		// delete the related view or records table
+		if collection.IsView() {
+			if err := txDao.DeleteView(collection.Name); err != nil {
+				return err
+			}
+		} else {
+			if err := txDao.DeleteTable(collection.Name); err != nil {
+				return err
+			}
+		}
+
+		// trigger views resave to check for dependencies
+		if err := txDao.resaveViewsWithChangedSchema(collection.Id); err != nil {
+			return fmt.Errorf("The collection has a view dependency - %w", err)
 		}
 
 		return txDao.Delete(collection)
 	})
 }
 
-// SaveCollection upserts the provided Collection model and updates
+// SaveCollection persists the provided Collection model and updates
 // its related records table schema.
+//
+// If collection.IsNew() is true, the method will perform a create, otherwise an update.
+// To explicitly mark a collection for update you can use collection.MarkAsNotNew().
 func (dao *Dao) SaveCollection(collection *models.Collection) error {
 	var oldCollection *models.Collection
 
@@ -151,15 +177,41 @@ func (dao *Dao) SaveCollection(collection *models.Collection) error {
 		}
 	}
 
-	return dao.RunInTransaction(func(txDao *Dao) error {
-		// persist the collection model
-		if err := txDao.Save(collection); err != nil {
-			return err
+	txErr := dao.RunInTransaction(func(txDao *Dao) error {
+		// set default collection type
+		if collection.Type == "" {
+			collection.Type = models.CollectionTypeBase
 		}
 
-		// sync the changes with the related records table
-		return txDao.SyncRecordTableSchema(collection, oldCollection)
+		switch collection.Type {
+		case models.CollectionTypeView:
+			if err := txDao.saveViewCollection(collection, oldCollection); err != nil {
+				return err
+			}
+		default:
+			// persist the collection model
+			if err := txDao.Save(collection); err != nil {
+				return err
+			}
+
+			// sync the changes with the related records table
+			if err := txDao.SyncRecordTableSchema(collection, oldCollection); err != nil {
+				return err
+			}
+		}
+
+		return nil
 	})
+
+	if txErr != nil {
+		return txErr
+	}
+
+	// trigger an update for all views with changed schema as a result of the current collection save
+	// (ignoring view errors to allow users to update the query from the UI)
+	dao.resaveViewsWithChangedSchema(collection.Id)
+
+	return nil
 }
 
 // ImportCollections imports the provided collections list within a single transaction.
@@ -172,7 +224,7 @@ func (dao *Dao) SaveCollection(collection *models.Collection) error {
 func (dao *Dao) ImportCollections(
 	importedCollections []*models.Collection,
 	deleteMissing bool,
-	beforeRecordsSync func(txDao *Dao, mappedImported, mappedExisting map[string]*models.Collection) error,
+	afterSync func(txDao *Dao, mappedImported, mappedExisting map[string]*models.Collection) error,
 ) error {
 	if len(importedCollections) == 0 {
 		return errors.New("No collections to import")
@@ -180,7 +232,7 @@ func (dao *Dao) ImportCollections(
 
 	return dao.RunInTransaction(func(txDao *Dao) error {
 		existingCollections := []*models.Collection{}
-		if err := txDao.CollectionQuery().OrderBy("created ASC").All(&existingCollections); err != nil {
+		if err := txDao.CollectionQuery().OrderBy("updated ASC").All(&existingCollections); err != nil {
 			return err
 		}
 		mappedExisting := make(map[string]*models.Collection, len(existingCollections))
@@ -196,7 +248,14 @@ func (dao *Dao) ImportCollections(
 				imported.RefreshId()
 			}
 
+			// set default type if missing
+			if imported.Type == "" {
+				imported.Type = models.CollectionTypeBase
+			}
+
 			if existing, ok := mappedExisting[imported.GetId()]; ok {
+				imported.MarkAsNotNew()
+
 				// preserve original created date
 				if !existing.Created.IsZero() {
 					imported.Created = existing.Created
@@ -204,11 +263,11 @@ func (dao *Dao) ImportCollections(
 
 				// extend existing schema
 				if !deleteMissing {
-					schema, _ := existing.Schema.Clone()
+					schemaClone, _ := existing.Schema.Clone()
 					for _, f := range imported.Schema.Fields() {
-						schema.AddField(f) // add or replace
+						schemaClone.AddField(f) // add or replace
 					}
-					imported.Schema = *schema
+					imported.Schema = *schemaClone
 				}
 			} else {
 				imported.MarkAsNew()
@@ -229,6 +288,17 @@ func (dao *Dao) ImportCollections(
 					return fmt.Errorf("System collection %q cannot be deleted.", existing.Name)
 				}
 
+				// delete the related records table or view
+				if existing.IsView() {
+					if err := txDao.DeleteView(existing.Name); err != nil {
+						return err
+					}
+				} else {
+					if err := txDao.DeleteTable(existing.Name); err != nil {
+						return err
+					}
+				}
+
 				// delete the collection
 				if err := txDao.Delete(existing); err != nil {
 					return err
@@ -243,29 +313,184 @@ func (dao *Dao) ImportCollections(
 			}
 		}
 
-		if beforeRecordsSync != nil {
-			if err := beforeRecordsSync(txDao, mappedImported, mappedExisting); err != nil {
+		// sync record tables
+		for _, imported := range importedCollections {
+			if imported.IsView() {
+				continue
+			}
+
+			existing := mappedExisting[imported.GetId()]
+
+			if err := txDao.SyncRecordTableSchema(imported, existing); err != nil {
 				return err
 			}
 		}
 
-		// delete the record tables of the deleted collections
-		if deleteMissing {
-			for _, existing := range existingCollections {
-				if mappedImported[existing.GetId()] != nil {
-					continue // exist
-				}
+		// sync views
+		for _, imported := range importedCollections {
+			if !imported.IsView() {
+				continue
+			}
 
-				if err := txDao.DeleteTable(existing.Name); err != nil {
-					return err
-				}
+			existing := mappedExisting[imported.GetId()]
+
+			if err := txDao.saveViewCollection(imported, existing); err != nil {
+				return err
 			}
 		}
 
-		// sync the upserted collections with the related records table
-		for _, imported := range importedCollections {
-			existing := mappedExisting[imported.GetId()]
-			if err := txDao.SyncRecordTableSchema(imported, existing); err != nil {
+		if afterSync != nil {
+			if err := afterSync(txDao, mappedImported, mappedExisting); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+// saveViewCollection persists the provided View collection changes:
+//   - deletes the old related SQL view (if any)
+//   - creates a new SQL view with the latest newCollection.Options.Query
+//   - generates a new schema based on newCollection.Options.Query
+//   - updates newCollection.Schema based on the generated view table info and query
+//   - saves the newCollection
+//
+// This method returns an error if newCollection is not a "view".
+func (dao *Dao) saveViewCollection(newCollection, oldCollection *models.Collection) error {
+	if !newCollection.IsView() {
+		return errors.New("not a view collection")
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		query := newCollection.ViewOptions().Query
+
+		// generate collection schema from the query
+		viewSchema, err := txDao.CreateViewSchema(query)
+		if err != nil {
+			return err
+		}
+
+		// delete old renamed view
+		if oldCollection != nil {
+			if err := txDao.DeleteView(oldCollection.Name); err != nil {
+				return err
+			}
+		}
+
+		// wrap view query if necessary
+		query, err = txDao.normalizeViewQueryId(query)
+		if err != nil {
+			return fmt.Errorf("failed to normalize view query id: %w", err)
+		}
+
+		// (re)create the view
+		if err := txDao.SaveView(newCollection.Name, query); err != nil {
+			return err
+		}
+
+		newCollection.Schema = viewSchema
+
+		return txDao.Save(newCollection)
+	})
+}
+
+// @todo consider removing once custom id types are supported
+//
+// normalizeViewQueryId wraps (if necessary) the provided view query
+// with a subselect to ensure that the id column is a text since
+// currently we don't support non-string model ids
+// (see https://github.com/pocketbase/pocketbase/issues/3110).
+func (dao *Dao) normalizeViewQueryId(query string) (string, error) {
+	query = strings.Trim(strings.TrimSpace(query), ";")
+
+	parsed, err := dao.parseQueryToFields(query)
+	if err != nil {
+		return "", err
+	}
+
+	needWrapping := true
+
+	idField := parsed[schema.FieldNameId]
+	if idField != nil && idField.field != nil &&
+		idField.field.Type != schema.FieldTypeJson &&
+		idField.field.Type != schema.FieldTypeNumber &&
+		idField.field.Type != schema.FieldTypeBool {
+		needWrapping = false
+	}
+
+	if !needWrapping {
+		return query, nil // no changes needed
+	}
+
+	// raw parse to preserve the columns order
+	rawParsed := new(identifiersParser)
+	if err := rawParsed.parse(query); err != nil {
+		return "", err
+	}
+
+	columns := make([]string, 0, len(rawParsed.columns))
+	for _, col := range rawParsed.columns {
+		if col.alias == schema.FieldNameId {
+			columns = append(columns, fmt.Sprintf("cast([[%s]] as text) [[%s]]", col.alias, col.alias))
+		} else {
+			columns = append(columns, "[["+col.alias+"]]")
+		}
+	}
+
+	query = fmt.Sprintf("SELECT %s FROM (%s)", strings.Join(columns, ","), query)
+
+	return query, nil
+}
+
+// resaveViewsWithChangedSchema updates all view collections with changed schemas.
+func (dao *Dao) resaveViewsWithChangedSchema(excludeIds ...string) error {
+	collections, err := dao.FindCollectionsByType(models.CollectionTypeView)
+	if err != nil {
+		return err
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		for _, collection := range collections {
+			if len(excludeIds) > 0 && list.ExistInSlice(collection.Id, excludeIds) {
+				continue
+			}
+
+			// clone the existing schema so that it is safe for temp modifications
+			oldSchema, err := collection.Schema.Clone()
+			if err != nil {
+				return err
+			}
+
+			// generate a new schema from the query
+			newSchema, err := txDao.CreateViewSchema(collection.ViewOptions().Query)
+			if err != nil {
+				return err
+			}
+
+			// unset the schema field ids to exclude from the comparison
+			for _, f := range oldSchema.Fields() {
+				f.Id = ""
+			}
+			for _, f := range newSchema.Fields() {
+				f.Id = ""
+			}
+
+			encodedNewSchema, err := json.Marshal(newSchema)
+			if err != nil {
+				return err
+			}
+
+			encodedOldSchema, err := json.Marshal(oldSchema)
+			if err != nil {
+				return err
+			}
+
+			if bytes.EqualFold(encodedNewSchema, encodedOldSchema) {
+				continue // no changes
+			}
+
+			if err := txDao.saveViewCollection(collection, nil); err != nil {
 				return err
 			}
 		}

daos/collection_test.go

@@ -3,16 +3,21 @@ package daos_test
 import (
 	"encoding/json"
 	"errors"
+	"strings"
 	"testing"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestCollectionQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -24,7 +29,46 @@ func TestCollectionQuery(t *testing.T) {
 	}
 }
 
+func TestFindCollectionsByType(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionType string
+		expectError    bool
+		expectTotal    int
+	}{
+		{"", false, 0},
+		{"unknown", false, 0},
+		{models.CollectionTypeAuth, false, 3},
+		{models.CollectionTypeBase, false, 5},
+	}
+
+	for i, scenario := range scenarios {
+		collections, err := app.Dao().FindCollectionsByType(scenario.collectionType)
+
+		hasErr := err != nil
+		if hasErr != scenario.expectError {
+			t.Errorf("[%d] Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
+		}
+
+		if len(collections) != scenario.expectTotal {
+			t.Errorf("[%d] Expected %d collections, got %d", i, scenario.expectTotal, len(collections))
+		}
+
+		for _, c := range collections {
+			if c.Type != scenario.collectionType {
+				t.Errorf("[%d] Expected collection with type %s, got %s: \n%v", i, scenario.collectionType, c.Type, c)
+			}
+		}
+	}
+}
+
 func TestFindCollectionByNameOrId(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -34,9 +78,9 @@ func TestFindCollectionByNameOrId(t *testing.T) {
 	}{
 		{"", true},
 		{"missing", true},
-		{"00000000-075d-49fe-9d09-ea7e951000dc", true},
-		{"3f2888f8-075d-49fe-9d09-ea7e951000dc", false},
-		{"demo", false},
+		{"wsmn24bux7wo113", false},
+		{"demo1", false},
+		{"DEMO1", false}, // case insensitive check
 	}
 
 	for i, scenario := range scenarios {
@@ -44,16 +88,18 @@ func TestFindCollectionByNameOrId(t *testing.T) {
 
 		hasErr := err != nil
 		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
+			t.Errorf("[%d] Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
 		}
 
-		if model != nil && model.Id != scenario.nameOrId && model.Name != scenario.nameOrId {
-			t.Errorf("(%d) Expected model with identifier %s, got %v", i, scenario.nameOrId, model)
+		if model != nil && model.Id != scenario.nameOrId && !strings.EqualFold(model.Name, scenario.nameOrId) {
+			t.Errorf("[%d] Expected model with identifier %s, got %v", i, scenario.nameOrId, model)
 		}
 	}
 }
 
 func TestIsCollectionNameUnique(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -63,51 +109,38 @@ func TestIsCollectionNameUnique(t *testing.T) {
 		expected  bool
 	}{
 		{"", "", false},
-		{"demo", "", false},
+		{"demo1", "", false},
+		{"Demo1", "", false},
 		{"new", "", true},
-		{"demo", "3f2888f8-075d-49fe-9d09-ea7e951000dc", true},
+		{"demo1", "wsmn24bux7wo113", true},
 	}
 
 	for i, scenario := range scenarios {
 		result := app.Dao().IsCollectionNameUnique(scenario.name, scenario.excludeId)
 		if result != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, result)
-		}
-	}
-}
-
-func TestFindCollectionsWithUserFields(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	result, err := app.Dao().FindCollectionsWithUserFields()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expectedNames := []string{"demo2", models.ProfileCollectionName}
-
-	if len(result) != len(expectedNames) {
-		t.Fatalf("Expected collections %v, got %v", expectedNames, result)
-	}
-
-	for i, col := range result {
-		if !list.ExistInSlice(col.Name, expectedNames) {
-			t.Errorf("(%d) Couldn't find %s in %v", i, col.Name, expectedNames)
+			t.Errorf("[%d] Expected %v, got %v", i, scenario.expected, result)
 		}
 	}
 }
 
 func TestFindCollectionReferences(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	collection, err := app.Dao().FindCollectionByNameOrId("demo")
+	collection, err := app.Dao().FindCollectionByNameOrId("demo3")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	result, err := app.Dao().FindCollectionReferences(collection, collection.Id)
+	result, err := app.Dao().FindCollectionReferences(
+		collection,
+		collection.Id,
+		// test whether "nonempty" exclude ids condition will be skipped
+		"",
+		"",
+	)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -116,37 +149,70 @@ func TestFindCollectionReferences(t *testing.T) {
 		t.Fatalf("Expected 1 collection, got %d: %v", len(result), result)
 	}
 
-	expectedFields := []string{"onerel", "manyrels", "cascaderel"}
+	expectedFields := []string{
+		"rel_one_no_cascade",
+		"rel_one_no_cascade_required",
+		"rel_one_cascade",
+		"rel_one_unique",
+		"rel_many_no_cascade",
+		"rel_many_no_cascade_required",
+		"rel_many_cascade",
+		"rel_many_unique",
+	}
 
 	for col, fields := range result {
-		if col.Name != "demo2" {
-			t.Fatalf("Expected collection demo2, got %s", col.Name)
+		if col.Name != "demo4" {
+			t.Fatalf("Expected collection demo4, got %s", col.Name)
 		}
 		if len(fields) != len(expectedFields) {
 			t.Fatalf("Expected fields %v, got %v", expectedFields, fields)
 		}
 		for i, f := range fields {
 			if !list.ExistInSlice(f.Name, expectedFields) {
-				t.Fatalf("(%d) Didn't expect field %v", i, f)
+				t.Fatalf("[%d] Didn't expect field %v", i, f)
 			}
 		}
 	}
 }
 
 func TestDeleteCollection(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	c0 := &models.Collection{}
-	c1, err := app.Dao().FindCollectionByNameOrId("demo")
+	colUnsaved := &models.Collection{}
+
+	colAuth, err := app.Dao().FindCollectionByNameOrId("users")
 	if err != nil {
 		t.Fatal(err)
 	}
-	c2, err := app.Dao().FindCollectionByNameOrId("demo2")
+
+	colReferenced, err := app.Dao().FindCollectionByNameOrId("demo2")
 	if err != nil {
 		t.Fatal(err)
 	}
-	c3, err := app.Dao().FindCollectionByNameOrId(models.ProfileCollectionName)
+
+	colSystem, err := app.Dao().FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+	colSystem.System = true
+	if err := app.Dao().Save(colSystem); err != nil {
+		t.Fatal(err)
+	}
+
+	colBase, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	colView1, err := app.Dao().FindCollectionByNameOrId("view1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	colView2, err := app.Dao().FindCollectionByNameOrId("view2")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -155,28 +221,58 @@ func TestDeleteCollection(t *testing.T) {
 		model       *models.Collection
 		expectError bool
 	}{
-		{c0, true},
-		{c1, true}, // is part of a reference
-		{c2, false},
-		{c3, true}, // system
+		{colUnsaved, true},
+		{colReferenced, true},
+		{colSystem, true},
+		{colBase, true},  // depend on view1, view2 and view2
+		{colView1, true}, // view2 depend on it
+		{colView2, false},
+		{colView1, false}, // no longer has dependent collections
+		{colBase, false},  // no longer has dependent views
+		{colAuth, false},  // should delete also its related external auths
 	}
 
-	for i, scenario := range scenarios {
-		err := app.Dao().DeleteCollection(scenario.model)
-		hasErr := err != nil
+	for i, s := range scenarios {
+		err := app.Dao().DeleteCollection(s.model)
 
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr %v, got %v", i, scenario.expectError, hasErr)
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%d] Expected hasErr %v, got %v (%v)", i, s.expectError, hasErr, err)
+			continue
+		}
+
+		if hasErr {
+			continue
+		}
+
+		if app.Dao().HasTable(s.model.Name) {
+			t.Errorf("[%d] Expected table/view %s to be deleted", i, s.model.Name)
+		}
+
+		// check if the external auths were deleted
+		if s.model.IsAuth() {
+			var total int
+			err := app.Dao().ExternalAuthQuery().
+				Select("count(*)").
+				AndWhere(dbx.HashExp{"collectionId": s.model.Id}).
+				Row(&total)
+
+			if err != nil || total > 0 {
+				t.Fatalf("[%d] Expected external auths to be deleted, got %v (%v)", i, total, err)
+			}
 		}
 	}
 }
 
 func TestSaveCollectionCreate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
 	collection := &models.Collection{
 		Name: "new_test",
+		Type: models.CollectionTypeBase,
 		Schema: schema.NewSchema(
 			&schema.SchemaField{
 				Type: schema.FieldTypeText,
@@ -201,7 +297,7 @@ func TestSaveCollectionCreate(t *testing.T) {
 	}
 
 	// check if the records table has the schema fields
-	columns, err := app.Dao().GetTableColumns(collection.Name)
+	columns, err := app.Dao().TableColumns(collection.Name)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -211,12 +307,14 @@ func TestSaveCollectionCreate(t *testing.T) {
 	}
 	for i, c := range columns {
 		if !list.ExistInSlice(c, expectedColumns) {
-			t.Fatalf("(%d) Didn't expect record column %s", i, c)
+			t.Fatalf("[%d] Didn't expect record column %s", i, c)
 		}
 	}
 }
 
 func TestSaveCollectionUpdate(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -239,8 +337,8 @@ func TestSaveCollectionUpdate(t *testing.T) {
 	}
 
 	// check if the records table has the schema fields
-	expectedColumns := []string{"id", "created", "updated", "title_update", "test"}
-	columns, err := app.Dao().GetTableColumns(collection.Name)
+	expectedColumns := []string{"id", "created", "updated", "title_update", "test", "files"}
+	columns, err := app.Dao().TableColumns(collection.Name)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -249,12 +347,189 @@ func TestSaveCollectionUpdate(t *testing.T) {
 	}
 	for i, c := range columns {
 		if !list.ExistInSlice(c, expectedColumns) {
-			t.Fatalf("(%d) Didn't expect record column %s", i, c)
+			t.Fatalf("[%d] Didn't expect record column %s", i, c)
 		}
 	}
 }
 
+// indirect update of a field used in view should cause view(s) update
+func TestSaveCollectionIndirectViewsUpdate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// update MaxSelect fields
+	{
+		relMany := collection.Schema.GetFieldByName("rel_many")
+		relManyOpt := relMany.Options.(*schema.RelationOptions)
+		relManyOpt.MaxSelect = types.Pointer(1)
+
+		fileOne := collection.Schema.GetFieldByName("file_one")
+		fileOneOpt := fileOne.Options.(*schema.FileOptions)
+		fileOneOpt.MaxSelect = 10
+
+		if err := app.Dao().SaveCollection(collection); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// check view1 schema
+	{
+		view1, err := app.Dao().FindCollectionByNameOrId("view1")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		relMany := view1.Schema.GetFieldByName("rel_many")
+		relManyOpt := relMany.Options.(*schema.RelationOptions)
+		if relManyOpt.MaxSelect == nil || *relManyOpt.MaxSelect != 1 {
+			t.Fatalf("Expected view1.rel_many MaxSelect to be %d, got %v", 1, relManyOpt.MaxSelect)
+		}
+
+		fileOne := view1.Schema.GetFieldByName("file_one")
+		fileOneOpt := fileOne.Options.(*schema.FileOptions)
+		if fileOneOpt.MaxSelect != 10 {
+			t.Fatalf("Expected view1.file_one MaxSelect to be %d, got %v", 10, fileOneOpt.MaxSelect)
+		}
+	}
+
+	// check view2 schema
+	{
+		view2, err := app.Dao().FindCollectionByNameOrId("view2")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		relMany := view2.Schema.GetFieldByName("rel_many")
+		relManyOpt := relMany.Options.(*schema.RelationOptions)
+		if relManyOpt.MaxSelect == nil || *relManyOpt.MaxSelect != 1 {
+			t.Fatalf("Expected view2.rel_many MaxSelect to be %d, got %v", 1, relManyOpt.MaxSelect)
+		}
+	}
+}
+
+func TestSaveCollectionViewWrapping(t *testing.T) {
+	t.Parallel()
+
+	viewName := "test_wrapping"
+
+	scenarios := []struct {
+		name     string
+		query    string
+		expected string
+	}{
+		{
+			"no wrapping - text field",
+			"select text as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select text as id, bool from demo1)",
+		},
+		{
+			"no wrapping - id field",
+			"select text as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select text as id, bool from demo1)",
+		},
+		{
+			"no wrapping - relation field",
+			"select rel_one as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select rel_one as id, bool from demo1)",
+		},
+		{
+			"no wrapping - select field",
+			"select select_many as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select select_many as id, bool from demo1)",
+		},
+		{
+			"no wrapping - email field",
+			"select email as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select email as id, bool from demo1)",
+		},
+		{
+			"no wrapping - datetime field",
+			"select datetime as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select datetime as id, bool from demo1)",
+		},
+		{
+			"no wrapping - url field",
+			"select url as id, bool from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select url as id, bool from demo1)",
+		},
+		{
+			"wrapping - bool field",
+			"select bool as id, text as txt, url from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT cast(`id` as text) `id`,`txt`,`url` FROM (select bool as id, text as txt, url from demo1))",
+		},
+		{
+			"wrapping - bool field (different order)",
+			"select text as txt, url, bool as id from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT `txt`,`url`,cast(`id` as text) `id` FROM (select text as txt, url, bool as id from demo1))",
+		},
+		{
+			"wrapping - json field",
+			"select json as id, text, url from demo1",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT cast(`id` as text) `id`,`text`,`url` FROM (select json as id, text, url from demo1))",
+		},
+		{
+			"wrapping - numeric id",
+			"select 1 as id",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT cast(`id` as text) `id` FROM (select 1 as id))",
+		},
+		{
+			"wrapping - expresion",
+			"select ('test') as id",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT cast(`id` as text) `id` FROM (select ('test') as id))",
+		},
+		{
+			"no wrapping - cast as text",
+			"select cast('test' as text) as id",
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select cast('test' as text) as id)",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection := &models.Collection{
+				Name: viewName,
+				Type: models.CollectionTypeView,
+				Options: types.JsonMap{
+					"query": s.query,
+				},
+			}
+
+			err := app.Dao().SaveCollection(collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var sql string
+
+			rowErr := app.Dao().DB().NewQuery("SELECT sql FROM sqlite_master WHERE type='view' AND name={:name}").
+				Bind(dbx.Params{"name": viewName}).
+				Row(&sql)
+			if rowErr != nil {
+				t.Fatalf("Failed to retrieve view sql: %v", rowErr)
+			}
+
+			if sql != s.expected {
+				t.Fatalf("Expected query \n%v, \ngot \n%v", s.expected, sql)
+			}
+		})
+	}
+}
+
 func TestImportCollections(t *testing.T) {
+	t.Parallel()
+
+	totalCollections := 11
+
 	scenarios := []struct {
 		name                   string
 		jsonData               string
@@ -262,31 +537,24 @@ func TestImportCollections(t *testing.T) {
 		beforeRecordsSync      func(txDao *daos.Dao, mappedImported, mappedExisting map[string]*models.Collection) error
 		expectError            bool
 		expectCollectionsCount int
+		beforeTestFunc         func(testApp *tests.TestApp, resultCollections []*models.Collection)
 		afterTestFunc          func(testApp *tests.TestApp, resultCollections []*models.Collection)
 	}{
 		{
 			name:                   "empty collections",
 			jsonData:               `[]`,
 			expectError:            true,
-			expectCollectionsCount: 5,
-		},
-		{
-			name: "check db constraints",
-			jsonData: `[
-				{"name": "import_test", "schema": []}
-			]`,
-			deleteMissing:          false,
-			expectError:            true,
-			expectCollectionsCount: 5,
+			expectCollectionsCount: totalCollections,
 		},
 		{
 			name: "minimal collection import",
 			jsonData: `[
-				{"name": "import_test", "schema": [{"name":"test", "type": "text"}]}
+				{"name": "import_test1", "schema": [{"name":"test", "type": "text"}]},
+				{"name": "import_test2", "type": "auth"}
 			]`,
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 6,
+			expectCollectionsCount: totalCollections + 2,
 		},
 		{
 			name: "minimal collection import + failed beforeRecordsSync",
@@ -298,7 +566,7 @@ func TestImportCollections(t *testing.T) {
 			},
 			deleteMissing:          false,
 			expectError:            true,
-			expectCollectionsCount: 5,
+			expectCollectionsCount: totalCollections,
 		},
 		{
 			name: "minimal collection import + successful beforeRecordsSync",
@@ -310,13 +578,13 @@ func TestImportCollections(t *testing.T) {
 			},
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 6,
+			expectCollectionsCount: totalCollections + 1,
 		},
 		{
 			name: "new + update + delete system collection",
 			jsonData: `[
 				{
-					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
+					"id":"wsmn24bux7wo113",
 					"name":"demo",
 					"schema":[
 						{
@@ -346,51 +614,50 @@ func TestImportCollections(t *testing.T) {
 			]`,
 			deleteMissing:          true,
 			expectError:            true,
-			expectCollectionsCount: 5,
+			expectCollectionsCount: totalCollections,
 		},
 		{
 			name: "new + update + delete non-system collection",
 			jsonData: `[
 				{
-					"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
-					"name":"profiles",
-					"system":true,
-					"listRule":"userId = @request.user.id",
-					"viewRule":"created > 'test_change'",
-					"createRule":"userId = @request.user.id",
-					"updateRule":"userId = @request.user.id",
-					"deleteRule":"userId = @request.user.id",
-					"schema":[
+					"id": "kpv709sk2lqbqk8",
+					"system": true,
+					"name": "nologin",
+					"type": "auth",
+					"options": {
+						"allowEmailAuth": false,
+						"allowOAuth2Auth": false,
+						"allowUsernameAuth": false,
+						"exceptEmailDomains": [],
+						"manageRule": "@request.auth.collectionName = 'users'",
+						"minPasswordLength": 8,
+						"onlyEmailDomains": [],
+						"requireEmail": true
+					},
+					"listRule": "",
+					"viewRule": "",
+					"createRule": "",
+					"updateRule": "",
+					"deleteRule": "",
+					"schema": [
 						{
-							"id":"koih1lqx",
-							"name":"userId",
-							"type":"user",
-							"system":true,
-							"required":true,
-							"unique":true,
-							"options":{
-								"maxSelect":1,
-								"cascadeDelete":true
-							}
-						},
-						{
-							"id":"69ycbg3q",
-							"name":"rel",
-							"type":"relation",
-							"system":false,
-							"required":false,
-							"unique":false,
-							"options":{
-								"maxSelect":2,
-								"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
-								"cascadeDelete":false
+							"id": "x8zzktwe",
+							"name": "name",
+							"type": "text",
+							"system": false,
+							"required": false,
+							"unique": false,
+							"options": {
+								"min": null,
+								"max": null,
+								"pattern": ""
 							}
 						}
 					]
 				},
 				{
-					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
-					"name":"demo",
+					"id":"wsmn24bux7wo113",
+					"name":"demo1_rename",
 					"schema":[
 						{
 							"id":"_2hlxbmp",
@@ -417,48 +684,26 @@ func TestImportCollections(t *testing.T) {
 							"type":"bool"
 						}
 					]
+				},
+				{
+					"id": "test_new_view",
+					"name": "new_view",
+					"type": "view",
+					"options": {
+						"query": "select id from demo2"
+					}
 				}
 			]`,
 			deleteMissing:          true,
 			expectError:            false,
-			expectCollectionsCount: 3,
+			expectCollectionsCount: 4,
 		},
 		{
 			name: "test with deleteMissing: false",
 			jsonData: `[
 				{
-					"id":"abe78266-fd4d-4aea-962d-8c0138ac522b",
-					"name":"profiles",
-					"system":true,
-					"listRule":"userId = @request.user.id",
-					"viewRule":"created > 'test_change'",
-					"createRule":"userId = @request.user.id",
-					"updateRule":"userId = @request.user.id",
-					"deleteRule":"userId = @request.user.id",
-					"schema":[
-						{
-							"id":"69ycbg3q",
-							"name":"rel",
-							"type":"relation",
-							"system":false,
-							"required":false,
-							"unique":false,
-							"options":{
-								"maxSelect":2,
-								"collectionId":"abe78266-fd4d-4aea-962d-8c0138ac522b",
-								"cascadeDelete":true
-							}
-						},
-						{
-							"id":"abcd_import",
-							"name":"new_field",
-							"type":"bool"
-						}
-					]
-				},
-				{
-					"id":"3f2888f8-075d-49fe-9d09-ea7e951000dc",
-					"name":"demo",
+					"id":"wsmn24bux7wo113",
+					"name":"demo1",
 					"schema":[
 						{
 							"id":"_2hlxbmp",
@@ -506,14 +751,15 @@ func TestImportCollections(t *testing.T) {
 			]`,
 			deleteMissing:          false,
 			expectError:            false,
-			expectCollectionsCount: 6,
+			expectCollectionsCount: totalCollections + 1,
 			afterTestFunc: func(testApp *tests.TestApp, resultCollections []*models.Collection) {
 				expectedCollectionFields := map[string]int{
-					"profiles":   6,
-					"demo":       3,
-					"demo2":      14,
-					"demo3":      1,
-					"demo4":      6,
+					"nologin":    1,
+					"demo1":      15,
+					"demo2":      2,
+					"demo3":      2,
+					"demo4":      13,
+					"demo5":      6,
 					"new_import": 1,
 				}
 				for name, expectedCount := range expectedCollectionFields {
@@ -530,37 +776,38 @@ func TestImportCollections(t *testing.T) {
 		},
 	}
 
-	for _, scenario := range scenarios {
-		testApp, _ := tests.NewTestApp()
-		defer testApp.Cleanup()
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
 
-		importedCollections := []*models.Collection{}
+			importedCollections := []*models.Collection{}
 
-		// load data
-		loadErr := json.Unmarshal([]byte(scenario.jsonData), &importedCollections)
-		if loadErr != nil {
-			t.Fatalf("[%s] Failed to load  data: %v", scenario.name, loadErr)
-			continue
-		}
+			// load data
+			loadErr := json.Unmarshal([]byte(s.jsonData), &importedCollections)
+			if loadErr != nil {
+				t.Fatalf("Failed to load  data: %v", loadErr)
+			}
 
-		err := testApp.Dao().ImportCollections(importedCollections, scenario.deleteMissing, scenario.beforeRecordsSync)
+			err := testApp.Dao().ImportCollections(importedCollections, s.deleteMissing, s.beforeRecordsSync)
 
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("[%s] Expected hasErr to be %v, got %v (%v)", scenario.name, scenario.expectError, hasErr, err)
-		}
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
 
-		// check collections count
-		collections := []*models.Collection{}
-		if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
-			t.Fatal(err)
-		}
-		if len(collections) != scenario.expectCollectionsCount {
-			t.Errorf("[%s] Expected %d collections, got %d", scenario.name, scenario.expectCollectionsCount, len(collections))
-		}
+			// check collections count
+			collections := []*models.Collection{}
+			if err := testApp.Dao().CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
 
-		if scenario.afterTestFunc != nil {
-			scenario.afterTestFunc(testApp, collections)
-		}
+			if s.afterTestFunc != nil {
+				s.afterTestFunc(testApp, collections)
+			}
+		})
 	}
 }

daos/external_auth.go

@@ -0,0 +1,88 @@
+package daos
+
+import (
+	"errors"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+// ExternalAuthQuery returns a new ExternalAuth select query.
+func (dao *Dao) ExternalAuthQuery() *dbx.SelectQuery {
+	return dao.ModelQuery(&models.ExternalAuth{})
+}
+
+// FindAllExternalAuthsByRecord returns all ExternalAuth models
+// linked to the provided auth record.
+func (dao *Dao) FindAllExternalAuthsByRecord(authRecord *models.Record) ([]*models.ExternalAuth, error) {
+	auths := []*models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.HashExp{
+			"collectionId": authRecord.Collection().Id,
+			"recordId":     authRecord.Id,
+		}).
+		OrderBy("created ASC").
+		All(&auths)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return auths, nil
+}
+
+// FindExternalAuthByRecordAndProvider returns the first available
+// ExternalAuth model for the specified record data and provider.
+func (dao *Dao) FindExternalAuthByRecordAndProvider(authRecord *models.Record, provider string) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.HashExp{
+			"collectionId": authRecord.Collection().Id,
+			"recordId":     authRecord.Id,
+			"provider":     provider,
+		}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+// FindFirstExternalAuthByExpr returns the first available
+// ExternalAuth model that satisfies the non-nil expression.
+func (dao *Dao) FindFirstExternalAuthByExpr(expr dbx.Expression) (*models.ExternalAuth, error) {
+	model := &models.ExternalAuth{}
+
+	err := dao.ExternalAuthQuery().
+		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
+		AndWhere(expr).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+// SaveExternalAuth upserts the provided ExternalAuth model.
+func (dao *Dao) SaveExternalAuth(model *models.ExternalAuth) error {
+	// extra check the model data in case the provider's API response
+	// has changed and no longer returns the expected fields
+	if model.CollectionId == "" || model.RecordId == "" || model.Provider == "" || model.ProviderId == "" {
+		return errors.New("Missing required ExternalAuth fields.")
+	}
+
+	return dao.Save(model)
+}
+
+// DeleteExternalAuth deletes the provided ExternalAuth model.
+func (dao *Dao) DeleteExternalAuth(model *models.ExternalAuth) error {
+	return dao.Delete(model)
+}

daos/external_auth_test.go

@@ -0,0 +1,204 @@
+package daos_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestExternalAuthQuery(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	expected := "SELECT {{_externalAuths}}.* FROM `_externalAuths`"
+
+	sql := app.Dao().ExternalAuthQuery().Build().SQL()
+	if sql != expected {
+		t.Errorf("Expected sql %s, got %s", expected, sql)
+	}
+}
+
+func TestFindAllExternalAuthsByRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		userId        string
+		expectedCount int
+	}{
+		{"oap640cot4yru2s", 0},
+		{"4q1xlclmfloku33", 2},
+	}
+
+	for i, s := range scenarios {
+		record, err := app.Dao().FindRecordById("users", s.userId)
+		if err != nil {
+			t.Errorf("(%d) Unexpected record fetch error %v", i, err)
+			continue
+		}
+
+		auths, err := app.Dao().FindAllExternalAuthsByRecord(record)
+		if err != nil {
+			t.Errorf("(%d) Unexpected auths fetch error %v", i, err)
+			continue
+		}
+
+		if len(auths) != s.expectedCount {
+			t.Errorf("(%d) Expected %d auths, got %d", i, s.expectedCount, len(auths))
+		}
+
+		for _, auth := range auths {
+			if auth.RecordId != record.Id {
+				t.Errorf("(%d) Expected all auths to be linked to record id %s, got %v", i, record.Id, auth)
+			}
+		}
+	}
+}
+
+func TestFindFirstExternalAuthByExpr(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		expr       dbx.Expression
+		expectedId string
+	}{
+		{dbx.HashExp{"provider": "github", "providerId": ""}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id1"}, ""},
+		{dbx.HashExp{"provider": "github", "providerId": "id2"}, ""},
+		{dbx.HashExp{"provider": "google", "providerId": "test123"}, "clmflokuq1xl341"},
+		{dbx.HashExp{"provider": "gitlab", "providerId": "test123"}, "dlmflokuq1xl342"},
+	}
+
+	for i, s := range scenarios {
+		auth, err := app.Dao().FindFirstExternalAuthByExpr(s.expr)
+
+		hasErr := err != nil
+		expectErr := s.expectedId == ""
+		if hasErr != expectErr {
+			t.Errorf("(%d) Expected hasErr %v, got %v", i, expectErr, err)
+			continue
+		}
+
+		if auth != nil && auth.Id != s.expectedId {
+			t.Errorf("(%d) Expected external auth with ID %s, got \n%v", i, s.expectedId, auth)
+		}
+	}
+}
+
+func TestFindExternalAuthByRecordAndProvider(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		userId     string
+		provider   string
+		expectedId string
+	}{
+		{"bgs820n361vj1qd", "google", ""},
+		{"4q1xlclmfloku33", "google", "clmflokuq1xl341"},
+		{"4q1xlclmfloku33", "gitlab", "dlmflokuq1xl342"},
+	}
+
+	for i, s := range scenarios {
+		record, err := app.Dao().FindRecordById("users", s.userId)
+		if err != nil {
+			t.Errorf("(%d) Unexpected record fetch error %v", i, err)
+			continue
+		}
+
+		auth, err := app.Dao().FindExternalAuthByRecordAndProvider(record, s.provider)
+
+		hasErr := err != nil
+		expectErr := s.expectedId == ""
+		if hasErr != expectErr {
+			t.Errorf("(%d) Expected hasErr %v, got %v", i, expectErr, err)
+			continue
+		}
+
+		if auth != nil && auth.Id != s.expectedId {
+			t.Errorf("(%d) Expected external auth with ID %s, got \n%v", i, s.expectedId, auth)
+		}
+	}
+}
+
+func TestSaveExternalAuth(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// save with empty provider data
+	emptyAuth := &models.ExternalAuth{}
+	if err := app.Dao().SaveExternalAuth(emptyAuth); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	auth := &models.ExternalAuth{
+		RecordId:     "o1y0dd0spd786md",
+		CollectionId: "v851q4r790rhknl",
+		Provider:     "test",
+		ProviderId:   "test_id",
+	}
+
+	if err := app.Dao().SaveExternalAuth(auth); err != nil {
+		t.Fatal(err)
+	}
+
+	// check if it was really saved
+	foundAuth, err := app.Dao().FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionId": "v851q4r790rhknl",
+		"provider":     "test",
+		"providerId":   "test_id",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if auth.Id != foundAuth.Id {
+		t.Fatalf("Expected ExternalAuth with id %s, got \n%v", auth.Id, foundAuth)
+	}
+}
+
+func TestDeleteExternalAuth(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.Dao().FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	auths, err := app.Dao().FindAllExternalAuthsByRecord(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, auth := range auths {
+		if err := app.Dao().DeleteExternalAuth(auth); err != nil {
+			t.Fatalf("Failed to delete the ExternalAuth relation, got \n%v", err)
+		}
+	}
+
+	// check if the relations were really deleted
+	newAuths, err := app.Dao().FindAllExternalAuthsByRecord(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(newAuths) != 0 {
+		t.Fatalf("Expected all record %s ExternalAuth relations to be deleted, got \n%v", record.Id, newAuths)
+	}
+}

daos/log.go

@@ -0,0 +1,67 @@
+package daos
+
+import (
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// LogQuery returns a new Log select query.
+func (dao *Dao) LogQuery() *dbx.SelectQuery {
+	return dao.ModelQuery(&models.Log{})
+}
+
+// FindLogById finds a single Log entry by its id.
+func (dao *Dao) FindLogById(id string) (*models.Log, error) {
+	model := &models.Log{}
+
+	err := dao.LogQuery().
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+type LogsStatsItem struct {
+	Total int            `db:"total" json:"total"`
+	Date  types.DateTime `db:"date" json:"date"`
+}
+
+// LogsStats returns hourly grouped requests logs statistics.
+func (dao *Dao) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
+	result := []*LogsStatsItem{}
+
+	query := dao.LogQuery().
+		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
+		GroupBy("date")
+
+	if expr != nil {
+		query.AndWhere(expr)
+	}
+
+	err := query.All(&result)
+
+	return result, err
+}
+
+// DeleteOldLogs delete all requests that are created before createdBefore.
+func (dao *Dao) DeleteOldLogs(createdBefore time.Time) error {
+	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
+	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
+
+	_, err := dao.NonconcurrentDB().Delete((&models.Log{}).TableName(), expr).Execute()
+
+	return err
+}
+
+// SaveLog upserts the provided Log model.
+func (dao *Dao) SaveLog(log *models.Log) error {
+	return dao.Save(log)
+}

daos/log_test.go

@@ -11,23 +11,27 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-func TestRequestQuery(t *testing.T) {
+func TestLogQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	expected := "SELECT {{_requests}}.* FROM `_requests`"
+	expected := "SELECT {{_logs}}.* FROM `_logs`"
 
-	sql := app.Dao().RequestQuery().Build().SQL()
+	sql := app.Dao().LogQuery().Build().SQL()
 	if sql != expected {
 		t.Errorf("Expected sql %s, got %s", expected, sql)
 	}
 }
 
-func TestFindRequestById(t *testing.T) {
+func TestFindLogById(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		id          string
@@ -40,7 +44,7 @@ func TestFindRequestById(t *testing.T) {
 	}
 
 	for i, scenario := range scenarios {
-		admin, err := app.LogsDao().FindRequestById(scenario.id)
+		admin, err := app.LogsDao().FindLogById(scenario.id)
 
 		hasErr := err != nil
 		if hasErr != scenario.expectError {
@@ -53,17 +57,19 @@ func TestFindRequestById(t *testing.T) {
 	}
 }
 
-func TestRequestsStats(t *testing.T) {
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
-	expected := `[{"total":1,"date":"2022-05-01 10:00:00.000"},{"total":1,"date":"2022-05-02 10:00:00.000"}]`
+	expected := `[{"total":1,"date":"2022-05-01 10:00:00.000Z"},{"total":1,"date":"2022-05-02 10:00:00.000Z"}]`
 
 	now := time.Now().UTC().Format(types.DefaultDateLayout)
 	exp := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": now})
-	result, err := app.LogsDao().RequestsStats(exp)
+	result, err := app.LogsDao().LogsStats(exp)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -74,20 +80,22 @@ func TestRequestsStats(t *testing.T) {
 	}
 }
 
-func TestDeleteOldRequests(t *testing.T) {
+func TestDeleteOldLogs(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
 	scenarios := []struct {
 		date          string
 		expectedTotal int
 	}{
-		{"2022-01-01 10:00:00.000", 2}, // no requests to delete before that time
-		{"2022-05-01 11:00:00.000", 1}, // only 1 request should have left
-		{"2022-05-03 11:00:00.000", 0}, // no more requests should have left
-		{"2022-05-04 11:00:00.000", 0}, // no more requests should have left
+		{"2022-01-01 10:00:00.000Z", 2}, // no logs to delete before that time
+		{"2022-05-01 11:00:00.000Z", 1}, // only 1 log should have left
+		{"2022-05-03 11:00:00.000Z", 0}, // no more logs should have left
+		{"2022-05-04 11:00:00.000Z", 0}, // no more logs should have left
 	}
 
 	for i, scenario := range scenarios {
@@ -96,53 +104,55 @@ func TestDeleteOldRequests(t *testing.T) {
 			t.Errorf("(%d) Date error %v", i, dateErr)
 		}
 
-		deleteErr := app.LogsDao().DeleteOldRequests(date)
+		deleteErr := app.LogsDao().DeleteOldLogs(date)
 		if deleteErr != nil {
 			t.Errorf("(%d) Delete error %v", i, deleteErr)
 		}
 
-		// check total remaining requests
+		// check total remaining logs
 		var total int
-		countErr := app.LogsDao().RequestQuery().Select("count(*)").Row(&total)
+		countErr := app.LogsDao().LogQuery().Select("count(*)").Row(&total)
 		if countErr != nil {
 			t.Errorf("(%d) Count error %v", i, countErr)
 		}
 
 		if total != scenario.expectedTotal {
-			t.Errorf("(%d) Expected %d remaining requests, got %d", i, scenario.expectedTotal, total)
+			t.Errorf("(%d) Expected %d remaining logs, got %d", i, scenario.expectedTotal, total)
 		}
 	}
 }
 
-func TestSaveRequest(t *testing.T) {
+func TestSaveLog(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	tests.MockRequestLogsData(app)
+	tests.MockLogsData(app)
 
-	// create new request
-	newRequest := &models.Request{}
-	newRequest.Method = "get"
-	newRequest.Meta = types.JsonMap{}
-	createErr := app.LogsDao().SaveRequest(newRequest)
+	// create new log
+	newLog := &models.Log{}
+	newLog.Level = -4
+	newLog.Data = types.JsonMap{}
+	createErr := app.LogsDao().SaveLog(newLog)
 	if createErr != nil {
 		t.Fatal(createErr)
 	}
 
 	// check if it was really created
-	existingRequest, fetchErr := app.LogsDao().FindRequestById(newRequest.Id)
+	existingLog, fetchErr := app.LogsDao().FindLogById(newLog.Id)
 	if fetchErr != nil {
 		t.Fatal(fetchErr)
 	}
 
-	existingRequest.Method = "post"
-	updateErr := app.LogsDao().SaveRequest(existingRequest)
+	existingLog.Level = 4
+	updateErr := app.LogsDao().SaveLog(existingLog)
 	if updateErr != nil {
 		t.Fatal(updateErr)
 	}
 	// refresh instance to check if it was really updated
-	existingRequest, _ = app.LogsDao().FindRequestById(existingRequest.Id)
-	if existingRequest.Method != "post" {
-		t.Fatalf("Expected request method to be %s, got %s", "post", existingRequest.Method)
+	existingLog, _ = app.LogsDao().FindLogById(existingLog.Id)
+	if existingLog.Level != 4 {
+		t.Fatalf("Expected log level to be %d, got %d", 4, existingLog.Level)
 	}
 }

daos/param_test.go

@@ -11,6 +11,8 @@ import (
 )
 
 func TestParamQuery(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -23,6 +25,8 @@ func TestParamQuery(t *testing.T) {
 }
 
 func TestFindParamByKey(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -50,6 +54,8 @@ func TestFindParamByKey(t *testing.T) {
 }
 
 func TestSaveParam(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -92,6 +98,8 @@ func TestSaveParam(t *testing.T) {
 }
 
 func TestSaveParamEncrypted(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -126,6 +134,8 @@ func TestSaveParamEncrypted(t *testing.T) {
 }
 
 func TestDeleteParam(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

daos/record_expand.go

@@ -3,14 +3,22 @@ package daos
 import (
 	"errors"
 	"fmt"
+	"log"
+	"regexp"
 	"strings"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 // MaxExpandDepth specifies the max allowed nested expand depth path.
+//
+// @todo Consider eventually reusing resolvers.maxNestedRels
 const MaxExpandDepth = 6
 
 // ExpandFetchFunc defines the function that is used to fetch the expanded relation records.
@@ -18,21 +26,27 @@ type ExpandFetchFunc func(relCollection *models.Collection, relIds []string) ([]
 
 // ExpandRecord expands the relations of a single Record model.
 //
+// If optFetchFunc is not set, then a default function will be used
+// that returns all relation records.
+//
 // Returns a map with the failed expand parameters and their errors.
-func (dao *Dao) ExpandRecord(record *models.Record, expands []string, fetchFunc ExpandFetchFunc) map[string]error {
-	return dao.ExpandRecords([]*models.Record{record}, expands, fetchFunc)
+func (dao *Dao) ExpandRecord(record *models.Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error {
+	return dao.ExpandRecords([]*models.Record{record}, expands, optFetchFunc)
 }
 
 // ExpandRecords expands the relations of the provided Record models list.
 //
+// If optFetchFunc is not set, then a default function will be used
+// that returns all relation records.
+//
 // Returns a map with the failed expand parameters and their errors.
-func (dao *Dao) ExpandRecords(records []*models.Record, expands []string, fetchFunc ExpandFetchFunc) map[string]error {
+func (dao *Dao) ExpandRecords(records []*models.Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error {
 	normalized := normalizeExpands(expands)
 
 	failed := map[string]error{}
 
 	for _, expand := range normalized {
-		if err := dao.expandRecords(records, expand, fetchFunc, 1); err != nil {
+		if err := dao.expandRecords(records, expand, optFetchFunc, 1); err != nil {
 			failed[expand] = err
 		}
 	}
@@ -40,42 +54,144 @@ func (dao *Dao) ExpandRecords(records []*models.Record, expands []string, fetchF
 	return failed
 }
 
+// Deprecated
+var indirectExpandRegexOld = regexp.MustCompile(`^(\w+)\((\w+)\)$`)
+
+var indirectExpandRegex = regexp.MustCompile(`^(\w+)_via_(\w+)$`)
+
 // notes:
-// - fetchFunc must be non-nil func
+// - if fetchFunc is nil, dao.FindRecordsByIds will be used
 // - all records are expected to be from the same collection
 // - if MaxExpandDepth is reached, the function returns nil ignoring the remaining expand path
 func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetchFunc ExpandFetchFunc, recursionLevel int) error {
 	if fetchFunc == nil {
-		return errors.New("Relation records fetchFunc is not set.")
+		// load a default fetchFunc
+		fetchFunc = func(relCollection *models.Collection, relIds []string) ([]*models.Record, error) {
+			return dao.FindRecordsByIds(relCollection.Id, relIds)
+		}
 	}
 
 	if expandPath == "" || recursionLevel > MaxExpandDepth || len(records) == 0 {
 		return nil
 	}
 
-	parts := strings.SplitN(expandPath, ".", 2)
-
-	// extract the relation field (if exist)
 	mainCollection := records[0].Collection()
-	relField := mainCollection.Schema.GetFieldByName(parts[0])
-	if relField == nil || relField.Type != schema.FieldTypeRelation {
-		return fmt.Errorf("Couldn't find relation field %q in collection %q.", parts[0], mainCollection.Name)
-	}
-	relField.InitOptions()
-	relFieldOptions, ok := relField.Options.(*schema.RelationOptions)
-	if !ok {
-		return fmt.Errorf("Cannot initialize the options of relation field %q.", parts[0])
+
+	var relField *schema.SchemaField
+	var relFieldOptions *schema.RelationOptions
+	var relCollection *models.Collection
+
+	parts := strings.SplitN(expandPath, ".", 2)
+	var matches []string
+
+	// @todo remove the old syntax support
+	if strings.Contains(parts[0], "(") {
+		matches = indirectExpandRegexOld.FindStringSubmatch(parts[0])
+		if len(matches) == 3 {
+			log.Printf(
+				"%s expand format is deprecated and will be removed in the future. Consider replacing it with %s_via_%s.\n",
+				matches[0],
+				matches[1],
+				matches[2],
+			)
+		}
+	} else {
+		matches = indirectExpandRegex.FindStringSubmatch(parts[0])
 	}
 
-	relCollection, err := dao.FindCollectionByNameOrId(relFieldOptions.CollectionId)
-	if err != nil {
-		return fmt.Errorf("Couldn't find collection %q.", relFieldOptions.CollectionId)
+	if len(matches) == 3 {
+		indirectRel, _ := dao.FindCollectionByNameOrId(matches[1])
+		if indirectRel == nil {
+			return fmt.Errorf("couldn't find back-related collection %q", matches[1])
+		}
+
+		indirectRelField := indirectRel.Schema.GetFieldByName(matches[2])
+		if indirectRelField == nil || indirectRelField.Type != schema.FieldTypeRelation {
+			return fmt.Errorf("couldn't find back-relation field %q in collection %q", matches[2], indirectRel.Name)
+		}
+
+		indirectRelField.InitOptions()
+		indirectRelFieldOptions, _ := indirectRelField.Options.(*schema.RelationOptions)
+		if indirectRelFieldOptions == nil || indirectRelFieldOptions.CollectionId != mainCollection.Id {
+			return fmt.Errorf("invalid back-relation field path %q", parts[0])
+		}
+
+		// add the related id(s) as a dynamic relation field value to
+		// allow further expand checks at later stage in a more unified manner
+		prepErr := func() error {
+			q := dao.DB().Select("id").
+				From(indirectRel.Name).
+				Limit(1000) // the limit is arbitrary chosen and may change in the future
+
+			if indirectRelFieldOptions.IsMultiple() {
+				q.AndWhere(dbx.Exists(dbx.NewExp(fmt.Sprintf(
+					"SELECT 1 FROM %s je WHERE je.value = {:id}",
+					dbutils.JsonEach(indirectRelField.Name),
+				))))
+			} else {
+				q.AndWhere(dbx.NewExp("[[" + indirectRelField.Name + "]] = {:id}"))
+			}
+
+			pq := q.Build().Prepare()
+
+			for _, record := range records {
+				var relIds []string
+
+				err := pq.Bind(dbx.Params{"id": record.Id}).Column(&relIds)
+				if err != nil {
+					return errors.Join(err, pq.Close())
+				}
+
+				if len(relIds) > 0 {
+					record.Set(parts[0], relIds)
+				}
+			}
+
+			return pq.Close()
+		}()
+		if prepErr != nil {
+			return prepErr
+		}
+
+		relFieldOptions = &schema.RelationOptions{
+			MaxSelect:    nil,
+			CollectionId: indirectRel.Id,
+		}
+		if dbutils.HasSingleColumnUniqueIndex(indirectRelField.Name, indirectRel.Indexes) {
+			relFieldOptions.MaxSelect = types.Pointer(1)
+		}
+		// indirect/back relation
+		relField = &schema.SchemaField{
+			Id:      "_" + parts[0] + security.PseudorandomString(3),
+			Type:    schema.FieldTypeRelation,
+			Name:    parts[0],
+			Options: relFieldOptions,
+		}
+		relCollection = indirectRel
+	} else {
+		// direct relation
+		relField = mainCollection.Schema.GetFieldByName(parts[0])
+		if relField == nil || relField.Type != schema.FieldTypeRelation {
+			return fmt.Errorf("Couldn't find relation field %q in collection %q.", parts[0], mainCollection.Name)
+		}
+		relField.InitOptions()
+		relFieldOptions, _ = relField.Options.(*schema.RelationOptions)
+		if relFieldOptions == nil {
+			return fmt.Errorf("Couldn't initialize the options of relation field %q.", parts[0])
+		}
+
+		relCollection, _ = dao.FindCollectionByNameOrId(relFieldOptions.CollectionId)
+		if relCollection == nil {
+			return fmt.Errorf("Couldn't find related collection %q.", relFieldOptions.CollectionId)
+		}
 	}
 
+	// ---------------------------------------------------------------
+
 	// extract the id of the relations to expand
 	relIds := make([]string, 0, len(records))
 	for _, record := range records {
-		relIds = append(relIds, record.GetStringSliceDataValue(relField.Name)...)
+		relIds = append(relIds, record.GetStringSlice(relField.Name)...)
 	}
 
 	// fetch rels
@@ -93,13 +209,13 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 	}
 
 	// reindex with the rel id
-	indexedRels := map[string]*models.Record{}
+	indexedRels := make(map[string]*models.Record, len(rels))
 	for _, rel := range rels {
 		indexedRels[rel.GetId()] = rel
 	}
 
 	for _, model := range records {
-		relIds := model.GetStringSliceDataValue(relField.Name)
+		relIds := model.GetStringSlice(relField.Name)
 
 		validRels := make([]*models.Record, 0, len(relIds))
 		for _, id := range relIds {
@@ -112,14 +228,38 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 			continue // no valid relations
 		}
 
-		expandData := model.GetExpand()
+		expandData := model.Expand()
 
-		// normalize and set the expanded relations
-		if relFieldOptions.MaxSelect == 1 {
+		// normalize access to the previously expanded rel records (if any)
+		var oldExpandedRels []*models.Record
+		switch v := expandData[relField.Name].(type) {
+		case nil:
+			// no old expands
+		case *models.Record:
+			oldExpandedRels = []*models.Record{v}
+		case []*models.Record:
+			oldExpandedRels = v
+		}
+
+		// merge expands
+		for _, oldExpandedRel := range oldExpandedRels {
+			// find a matching rel record
+			for _, rel := range validRels {
+				if rel.Id != oldExpandedRel.Id {
+					continue
+				}
+
+				rel.MergeExpand(oldExpandedRel.Expand())
+			}
+		}
+
+		// update the expanded data
+		if relFieldOptions.MaxSelect != nil && *relFieldOptions.MaxSelect <= 1 {
 			expandData[relField.Name] = validRels[0]
 		} else {
 			expandData[relField.Name] = validRels
 		}
+
 		model.SetExpand(expandData)
 	}
 
@@ -160,3 +300,14 @@ func normalizeExpands(paths []string) []string {
 
 	return list.ToUniqueStringSlice(result)
 }
+
+func isRelFieldUnique(collection *models.Collection, fieldName string) bool {
+	for _, idx := range collection.Indexes {
+		parsed := dbutils.ParseIndex(idx)
+		if parsed.Unique && len(parsed.Columns) == 1 && strings.EqualFold(parsed.Columns[0].Name, fieldName) {
+			return true
+		}
+	}
+
+	return false
+}

daos/record_expand_test.go

@@ -8,259 +8,473 @@ import (
 
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
 func TestExpandRecords(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	col, _ := app.Dao().FindCollectionByNameOrId("demo4")
-
 	scenarios := []struct {
+		testName             string
+		collectionIdOrName   string
 		recordIds            []string
 		expands              []string
 		fetchFunc            daos.ExpandFetchFunc
 		expectExpandProps    int
 		expectExpandFailures int
 	}{
-		// empty records
 		{
+			"empty records",
+			"",
 			[]string{},
-			[]string{"onerel", "manyrels.onerel.manyrels"},
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			0,
 		},
-		// empty expand
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
+			"empty expand",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
 			[]string{},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			0,
 		},
-		// empty fetchFunc
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
-			[]string{"onerel", "manyrels.onerel.manyrels"},
-			nil,
-			0,
-			2,
-		},
-		// fetchFunc with error
-		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
-			[]string{"onerel", "manyrels.onerel.manyrels"},
+			"fetchFunc with error",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
 				return nil, errors.New("test error")
 			},
 			0,
 			2,
 		},
-		// missing relation field
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
-			[]string{"invalid"},
+			"missing relation field",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"missing"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			1,
 		},
-		// existing, but non-relation type field
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
+			"existing, but non-relation type field",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
 			[]string{"title"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			1,
 		},
-		// invalid/missing second level expand
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b", "df55c8ff-45ef-4c82-8aed-6e2183fe1125"},
-			[]string{"manyrels.invalid"},
+			"invalid/missing second level expand",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"rel_one_no_cascade.title"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			1,
 		},
-		// expand normalizations
 		{
+			"with nil fetchfunc",
+			"users",
 			[]string{
-				"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-				"df55c8ff-45ef-4c82-8aed-6e2183fe1125",
-				"b84cd893-7119-43c9-8505-3c4e22da28a9",
-				"054f9f24-0a0a-4e09-87b1-bc7ff2b336a2",
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
+			},
+			[]string{"rel"},
+			nil,
+			2,
+			0,
+		},
+		{
+			"expand normalizations",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{
+				"self_rel_one", "self_rel_many.self_rel_many.rel_one_no_cascade",
+				"self_rel_many.self_rel_one.self_rel_many.self_rel_one.rel_one_no_cascade",
+				"self_rel_many", "self_rel_many.",
+				"  self_rel_many  ", "",
 			},
-			[]string{"manyrels.onerel.manyrels.onerel", "manyrels.onerel", "onerel", "onerel.", " onerel ", ""},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			9,
 			0,
 		},
-		// single expand
 		{
+			"single expand",
+			"users",
 			[]string{
-				"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-				"df55c8ff-45ef-4c82-8aed-6e2183fe1125",
-				"b84cd893-7119-43c9-8505-3c4e22da28a9", // no manyrels
-				"054f9f24-0a0a-4e09-87b1-bc7ff2b336a2", // no manyrels
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
 			},
-			[]string{"manyrels"},
+			[]string{"rel"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			2,
 			0,
 		},
-		// maxExpandDepth reached
 		{
-			[]string{"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b"},
-			[]string{"manyrels.onerel.manyrels.onerel.manyrels.onerel.manyrels.onerel.manyrels"},
+			"with nil fetchfunc",
+			"users",
+			[]string{
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
+			},
+			[]string{"rel"},
+			nil,
+			2,
+			0,
+		},
+		{
+			"maxExpandDepth reached",
+			"demo4",
+			[]string{"qzaqccwrmva4o1n"},
+			[]string{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			6,
 			0,
 		},
+		{
+			"simple back single relation field expand (deprecated syntax)",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{"demo4(rel_one_no_cascade_required)"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"simple back expand via single relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested back expand via single relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{
+				"demo4_via_rel_one_no_cascade_required.self_rel_many.self_rel_many.self_rel_one",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
+		{
+			"nested back expand via multiple relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
+		{
+			"expand multiple relations sharing a common path",
+			"demo4",
+			[]string{"qzaqccwrmva4o1n"},
+			[]string{
+				"rel_one_no_cascade",
+				"rel_many_no_cascade",
+				"self_rel_many.self_rel_one.rel_many_cascade",
+				"self_rel_many.self_rel_one.rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
 	}
 
-	for i, s := range scenarios {
+	for _, s := range scenarios {
 		ids := list.ToUniqueStringSlice(s.recordIds)
-		records, _ := app.Dao().FindRecordsByIds(col, ids, nil)
+		records, _ := app.Dao().FindRecordsByIds(s.collectionIdOrName, ids)
 		failed := app.Dao().ExpandRecords(records, s.expands, s.fetchFunc)
 
 		if len(failed) != s.expectExpandFailures {
-			t.Errorf("(%d) Expected %d failures, got %d: \n%v", i, s.expectExpandFailures, len(failed), failed)
+			t.Errorf("[%s] Expected %d failures, got %d: \n%v", s.testName, s.expectExpandFailures, len(failed), failed)
 		}
 
 		encoded, _ := json.Marshal(records)
 		encodedStr := string(encoded)
-		totalExpandProps := strings.Count(encodedStr, "@expand")
+		totalExpandProps := strings.Count(encodedStr, schema.FieldNameExpand)
 
 		if s.expectExpandProps != totalExpandProps {
-			t.Errorf("(%d) Expected %d @expand props, got %d: \n%v", i, s.expectExpandProps, totalExpandProps, encodedStr)
+			t.Errorf("[%s] Expected %d expand props, got %d: \n%v", s.testName, s.expectExpandProps, totalExpandProps, encodedStr)
 		}
 	}
 }
 
 func TestExpandRecord(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	col, _ := app.Dao().FindCollectionByNameOrId("demo4")
-
 	scenarios := []struct {
+		testName             string
+		collectionIdOrName   string
 		recordId             string
 		expands              []string
 		fetchFunc            daos.ExpandFetchFunc
 		expectExpandProps    int
 		expectExpandFailures int
 	}{
-		// empty expand
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
+			"empty expand",
+			"demo4",
+			"i9naidtvr6qsgb4",
 			[]string{},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			0,
 		},
-		// empty fetchFunc
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"onerel", "manyrels.onerel.manyrels"},
-			nil,
-			0,
-			2,
-		},
-		// fetchFunc with error
-		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"onerel", "manyrels.onerel.manyrels"},
+			"fetchFunc with error",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
 				return nil, errors.New("test error")
 			},
 			0,
 			2,
 		},
-		// invalid missing first level expand
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"invalid"},
+			"missing relation field",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"missing"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			1,
 		},
-		// invalid missing second level expand
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"manyrels.invalid"},
+			"existing, but non-relation type field",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"title"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			0,
 			1,
 		},
-		// expand normalizations
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"manyrels.onerel.manyrels", "manyrels.onerel", "onerel", " onerel "},
+			"invalid/missing second level expand",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{"rel_one_no_cascade.title"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
-			3,
 			0,
-		},
-		// single expand
-		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"manyrels"},
-			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
-			},
 			1,
+		},
+		{
+			"expand normalizations",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{
+				"self_rel_one", "self_rel_many.self_rel_many.rel_one_no_cascade",
+				"self_rel_many.self_rel_one.self_rel_many.self_rel_one.rel_one_no_cascade",
+				"self_rel_many", "self_rel_many.",
+				"  self_rel_many  ", "",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			8,
 			0,
 		},
-		// maxExpandDepth reached
 		{
-			"b8ba58f9-e2d7-42a0-b0e7-a11efd98236b",
-			[]string{"manyrels.onerel.manyrels.onerel.manyrels.onerel.manyrels.onerel.manyrels"},
+			"no rels to expand",
+			"users",
+			"oap640cot4yru2s",
+			[]string{"rel"},
 			func(c *models.Collection, ids []string) ([]*models.Record, error) {
-				return app.Dao().FindRecordsByIds(c, ids, nil)
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			0,
+		},
+		{
+			"maxExpandDepth reached",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
 			},
 			6,
 			0,
 		},
+		{
+			"simple indirect expand via single relation field (deprecated syntax)",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{"demo4(rel_one_no_cascade_required)"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"simple indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{
+				"demo4(rel_one_no_cascade_required).self_rel_many.self_rel_many.self_rel_one",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
+		{
+			"nested indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
 	}
 
-	for i, s := range scenarios {
-		record, _ := app.Dao().FindFirstRecordByData(col, "id", s.recordId)
+	for _, s := range scenarios {
+		record, _ := app.Dao().FindRecordById(s.collectionIdOrName, s.recordId)
 		failed := app.Dao().ExpandRecord(record, s.expands, s.fetchFunc)
 
 		if len(failed) != s.expectExpandFailures {
-			t.Errorf("(%d) Expected %d failures, got %d: \n%v", i, s.expectExpandFailures, len(failed), failed)
+			t.Errorf("[%s] Expected %d failures, got %d: \n%v", s.testName, s.expectExpandFailures, len(failed), failed)
 		}
 
 		encoded, _ := json.Marshal(record)
 		encodedStr := string(encoded)
-		totalExpandProps := strings.Count(encodedStr, "@expand")
+		totalExpandProps := strings.Count(encodedStr, schema.FieldNameExpand)
 
 		if s.expectExpandProps != totalExpandProps {
-			t.Errorf("(%d) Expected %d @expand props, got %d: \n%v", i, s.expectExpandProps, totalExpandProps, encodedStr)
+			t.Errorf("[%s] Expected %d expand props, got %d: \n%v", s.testName, s.expectExpandProps, totalExpandProps, encodedStr)
+		}
+	}
+}
+
+func TestIndirectExpandSingeVsArrayResult(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.Dao().FindRecordById("demo3", "7nwo8tuiatetxdm")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// non-unique indirect expand
+	{
+		errs := app.Dao().ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
+			return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+		})
+		if len(errs) > 0 {
+			t.Fatal(errs)
+		}
+
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].([]*models.Record)
+		if !ok {
+			t.Fatalf("Expected the expanded result to be a slice, got %v", result)
+		}
+	}
+
+	// unique indirect expand
+	{
+		// mock a unique constraint for the rel_one_cascade field
+		// ---
+		demo4, err := app.Dao().FindCollectionByNameOrId("demo4")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		demo4.Indexes = append(demo4.Indexes, "create unique index idx_unique_expand on demo4 (rel_one_cascade)")
+
+		if err := app.Dao().SaveCollection(demo4); err != nil {
+			t.Fatalf("Failed to mock unique constraint: %v", err)
+		}
+		// ---
+
+		errs := app.Dao().ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *models.Collection, ids []string) ([]*models.Record, error) {
+			return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+		})
+		if len(errs) > 0 {
+			t.Fatal(errs)
+		}
+
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].(*models.Record)
+		if !ok {
+			t.Fatalf("Expected the expanded result to be a single model, got %v", result)
 		}
 	}
 }

daos/record_table_sync.go

@@ -0,0 +1,360 @@
+package daos
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// SyncRecordTableSchema compares the two provided collections
+// and applies the necessary related record table changes.
+//
+// If `oldCollection` is null, then only `newCollection` is used to create the record table.
+func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldCollection *models.Collection) error {
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		// create
+		// -----------------------------------------------------------
+		if oldCollection == nil {
+			cols := map[string]string{
+				schema.FieldNameId:      "TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL",
+				schema.FieldNameCreated: "TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL",
+				schema.FieldNameUpdated: "TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL",
+			}
+
+			if newCollection.IsAuth() {
+				cols[schema.FieldNameUsername] = "TEXT NOT NULL"
+				cols[schema.FieldNameEmail] = "TEXT DEFAULT '' NOT NULL"
+				cols[schema.FieldNameEmailVisibility] = "BOOLEAN DEFAULT FALSE NOT NULL"
+				cols[schema.FieldNameVerified] = "BOOLEAN DEFAULT FALSE NOT NULL"
+				cols[schema.FieldNameTokenKey] = "TEXT NOT NULL"
+				cols[schema.FieldNamePasswordHash] = "TEXT NOT NULL"
+				cols[schema.FieldNameLastResetSentAt] = "TEXT DEFAULT '' NOT NULL"
+				cols[schema.FieldNameLastVerificationSentAt] = "TEXT DEFAULT '' NOT NULL"
+			}
+
+			// ensure that the new collection has an id
+			if !newCollection.HasId() {
+				newCollection.RefreshId()
+				newCollection.MarkAsNew()
+			}
+
+			tableName := newCollection.Name
+
+			// add schema field definitions
+			for _, field := range newCollection.Schema.Fields() {
+				cols[field.Name] = field.ColDefinition()
+			}
+
+			// create table
+			if _, err := txDao.DB().CreateTable(tableName, cols).Execute(); err != nil {
+				return err
+			}
+
+			// add named unique index on the email and tokenKey columns
+			if newCollection.IsAuth() {
+				_, err := txDao.DB().NewQuery(fmt.Sprintf(
+					`
+					CREATE UNIQUE INDEX _%s_username_idx ON {{%s}} ([[username]]);
+					CREATE UNIQUE INDEX _%s_email_idx ON {{%s}} ([[email]]) WHERE [[email]] != '';
+					CREATE UNIQUE INDEX _%s_tokenKey_idx ON {{%s}} ([[tokenKey]]);
+					`,
+					newCollection.Id, tableName,
+					newCollection.Id, tableName,
+					newCollection.Id, tableName,
+				)).Execute()
+				if err != nil {
+					return err
+				}
+			}
+
+			return txDao.createCollectionIndexes(newCollection)
+		}
+
+		// update
+		// -----------------------------------------------------------
+		oldTableName := oldCollection.Name
+		newTableName := newCollection.Name
+		oldSchema := oldCollection.Schema
+		newSchema := newCollection.Schema
+		deletedFieldNames := []string{}
+		renamedFieldNames := map[string]string{}
+
+		// drop old indexes (if any)
+		if err := txDao.dropCollectionIndex(oldCollection); err != nil {
+			return err
+		}
+
+		// check for renamed table
+		if !strings.EqualFold(oldTableName, newTableName) {
+			_, err := txDao.DB().RenameTable("{{"+oldTableName+"}}", "{{"+newTableName+"}}").Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		// check for deleted columns
+		for _, oldField := range oldSchema.Fields() {
+			if f := newSchema.GetFieldById(oldField.Id); f != nil {
+				continue // exist
+			}
+
+			_, err := txDao.DB().DropColumn(newTableName, oldField.Name).Execute()
+			if err != nil {
+				return fmt.Errorf("failed to drop column %s - %w", oldField.Name, err)
+			}
+
+			deletedFieldNames = append(deletedFieldNames, oldField.Name)
+		}
+
+		// check for new or renamed columns
+		toRename := map[string]string{}
+		for _, field := range newSchema.Fields() {
+			oldField := oldSchema.GetFieldById(field.Id)
+			// Note:
+			// We are using a temporary column name when adding or renaming columns
+			// to ensure that there are no name collisions in case there is
+			// names switch/reuse of existing columns (eg. name, title -> title, name).
+			// This way we are always doing 1 more rename operation but it provides better dev experience.
+
+			if oldField == nil {
+				tempName := field.Name + security.PseudorandomString(5)
+				toRename[tempName] = field.Name
+
+				// add
+				_, err := txDao.DB().AddColumn(newTableName, tempName, field.ColDefinition()).Execute()
+				if err != nil {
+					return fmt.Errorf("failed to add column %s - %w", field.Name, err)
+				}
+			} else if oldField.Name != field.Name {
+				tempName := field.Name + security.PseudorandomString(5)
+				toRename[tempName] = field.Name
+
+				// rename
+				_, err := txDao.DB().RenameColumn(newTableName, oldField.Name, tempName).Execute()
+				if err != nil {
+					return fmt.Errorf("failed to rename column %s - %w", oldField.Name, err)
+				}
+
+				renamedFieldNames[oldField.Name] = field.Name
+			}
+		}
+
+		// set the actual columns name
+		for tempName, actualName := range toRename {
+			_, err := txDao.DB().RenameColumn(newTableName, tempName, actualName).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		if err := txDao.normalizeSingleVsMultipleFieldChanges(newCollection, oldCollection); err != nil {
+			return err
+		}
+
+		return txDao.createCollectionIndexes(newCollection)
+	})
+}
+
+func (dao *Dao) normalizeSingleVsMultipleFieldChanges(newCollection, oldCollection *models.Collection) error {
+	if newCollection.IsView() || oldCollection == nil {
+		return nil // view or not an update
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		// temporary disable the schema error checks to prevent view and trigger errors
+		// when "altering" (aka. deleting and recreating) the non-normalized columns
+		if _, err := txDao.DB().NewQuery("PRAGMA writable_schema = ON").Execute(); err != nil {
+			return err
+		}
+		// executed with defer to make sure that the pragma is always reverted
+		// in case of an error and when nested transactions are used
+		defer txDao.DB().NewQuery("PRAGMA writable_schema = RESET").Execute()
+
+		for _, newField := range newCollection.Schema.Fields() {
+			// allow to continue even if there is no old field for the cases
+			// when a new field is added and there are already inserted data
+			var isOldMultiple bool
+			if oldField := oldCollection.Schema.GetFieldById(newField.Id); oldField != nil {
+				if opt, ok := oldField.Options.(schema.MultiValuer); ok {
+					isOldMultiple = opt.IsMultiple()
+				}
+			}
+
+			var isNewMultiple bool
+			if opt, ok := newField.Options.(schema.MultiValuer); ok {
+				isNewMultiple = opt.IsMultiple()
+			}
+
+			if isOldMultiple == isNewMultiple {
+				continue // no change
+			}
+
+			// update the column definition by:
+			// 1. inserting a new column with the new definition
+			// 2. copy normalized values from the original column to the new one
+			// 3. drop the original column
+			// 4. rename the new column to the original column
+			// -------------------------------------------------------
+
+			originalName := newField.Name
+			tempName := "_" + newField.Name + security.PseudorandomString(5)
+
+			_, err := txDao.DB().AddColumn(newCollection.Name, tempName, newField.ColDefinition()).Execute()
+			if err != nil {
+				return err
+			}
+
+			var copyQuery *dbx.Query
+
+			if !isOldMultiple && isNewMultiple {
+				// single -> multiple (convert to array)
+				copyQuery = txDao.DB().NewQuery(fmt.Sprintf(
+					`UPDATE {{%s}} set [[%s]] = (
+							CASE
+								WHEN COALESCE([[%s]], '') = ''
+								THEN '[]'
+								ELSE (
+									CASE
+										WHEN json_valid([[%s]]) AND json_type([[%s]]) == 'array'
+										THEN [[%s]]
+										ELSE json_array([[%s]])
+									END
+								)
+							END
+						)`,
+					newCollection.Name,
+					tempName,
+					originalName,
+					originalName,
+					originalName,
+					originalName,
+					originalName,
+				))
+			} else {
+				// multiple -> single (keep only the last element)
+				//
+				// note: for file fields the actual file objects are not
+				// deleted allowing additional custom handling via migration
+				copyQuery = txDao.DB().NewQuery(fmt.Sprintf(
+					`UPDATE {{%s}} set [[%s]] = (
+						CASE
+							WHEN COALESCE([[%s]], '[]') = '[]'
+							THEN ''
+							ELSE (
+								CASE
+									WHEN json_valid([[%s]]) AND json_type([[%s]]) == 'array'
+									THEN COALESCE(json_extract([[%s]], '$[#-1]'), '')
+									ELSE [[%s]]
+								END
+							)
+						END
+					)`,
+					newCollection.Name,
+					tempName,
+					originalName,
+					originalName,
+					originalName,
+					originalName,
+					originalName,
+				))
+			}
+
+			// copy the normalized values
+			if _, err := copyQuery.Execute(); err != nil {
+				return err
+			}
+
+			// drop the original column
+			if _, err := txDao.DB().DropColumn(newCollection.Name, originalName).Execute(); err != nil {
+				return err
+			}
+
+			// rename the new column back to the original
+			if _, err := txDao.DB().RenameColumn(newCollection.Name, tempName, originalName).Execute(); err != nil {
+				return err
+			}
+		}
+
+		// revert the pragma and reload the schema
+		_, revertErr := txDao.DB().NewQuery("PRAGMA writable_schema = RESET").Execute()
+
+		return revertErr
+	})
+}
+
+func (dao *Dao) dropCollectionIndex(collection *models.Collection) error {
+	if collection.IsView() {
+		return nil // views don't have indexes
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		for _, raw := range collection.Indexes {
+			parsed := dbutils.ParseIndex(raw)
+
+			if !parsed.IsValid() {
+				continue
+			}
+
+			if _, err := txDao.DB().NewQuery(fmt.Sprintf("DROP INDEX IF EXISTS [[%s]]", parsed.IndexName)).Execute(); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+func (dao *Dao) createCollectionIndexes(collection *models.Collection) error {
+	if collection.IsView() {
+		return nil // views don't have indexes
+	}
+
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		// drop new indexes in case a duplicated index name is used
+		if err := txDao.dropCollectionIndex(collection); err != nil {
+			return err
+		}
+
+		// upsert new indexes
+		//
+		// note: we are returning validation errors because the indexes cannot be
+		//       validated in a form, aka. before persisting the related collection
+		//       record table changes
+		errs := validation.Errors{}
+		for i, idx := range collection.Indexes {
+			parsed := dbutils.ParseIndex(idx)
+
+			// ensure that the index is always for the current collection
+			parsed.TableName = collection.Name
+
+			if !parsed.IsValid() {
+				errs[strconv.Itoa(i)] = validation.NewError(
+					"validation_invalid_index_expression",
+					"Invalid CREATE INDEX expression.",
+				)
+				continue
+			}
+
+			if _, err := txDao.DB().NewQuery(parsed.Build()).Execute(); err != nil {
+				errs[strconv.Itoa(i)] = validation.NewError(
+					"validation_invalid_index_expression",
+					fmt.Sprintf("Failed to create index %s - %v.", parsed.IndexName, err.Error()),
+				)
+				continue
+			}
+		}
+
+		if len(errs) > 0 {
+			return validation.Errors{"indexes": errs}
+		}
+
+		return nil
+	})
+}

daos/record_table_sync_test.go

@@ -0,0 +1,323 @@
+package daos_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestSyncRecordTableSchema(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	oldCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection.Name = "demo_renamed"
+	updatedCollection.Schema.RemoveField(updatedCollection.Schema.GetFieldByName("active").Id)
+	updatedCollection.Schema.AddField(
+		&schema.SchemaField{
+			Name: "new_field",
+			Type: schema.FieldTypeEmail,
+		},
+	)
+	updatedCollection.Schema.AddField(
+		&schema.SchemaField{
+			Id:   updatedCollection.Schema.GetFieldByName("title").Id,
+			Name: "title_renamed",
+			Type: schema.FieldTypeEmail,
+		},
+	)
+	updatedCollection.Indexes = types.JsonArray[string]{"create index idx_title_renamed on anything (title_renamed)"}
+
+	scenarios := []struct {
+		name                 string
+		newCollection        *models.Collection
+		oldCollection        *models.Collection
+		expectedColumns      []string
+		expectedIndexesCount int
+	}{
+		{
+			"new base collection",
+			&models.Collection{
+				Name: "new_table",
+				Schema: schema.NewSchema(
+					&schema.SchemaField{
+						Name: "test",
+						Type: schema.FieldTypeText,
+					},
+				),
+			},
+			nil,
+			[]string{"id", "created", "updated", "test"},
+			0,
+		},
+		{
+			"new auth collection",
+			&models.Collection{
+				Name: "new_table_auth",
+				Type: models.CollectionTypeAuth,
+				Schema: schema.NewSchema(
+					&schema.SchemaField{
+						Name: "test",
+						Type: schema.FieldTypeText,
+					},
+				),
+				Indexes: types.JsonArray[string]{"create index idx_auth_test on anything (email, username)"},
+			},
+			nil,
+			[]string{
+				"id", "created", "updated", "test",
+				"username", "email", "verified", "emailVisibility",
+				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt",
+			},
+			4,
+		},
+		{
+			"no changes",
+			oldCollection,
+			oldCollection,
+			[]string{"id", "created", "updated", "title", "active"},
+			3,
+		},
+		{
+			"renamed table, deleted column, renamed columnd and new column",
+			updatedCollection,
+			oldCollection,
+			[]string{"id", "created", "updated", "title_renamed", "new_field"},
+			1,
+		},
+	}
+
+	for _, s := range scenarios {
+		err := app.Dao().SyncRecordTableSchema(s.newCollection, s.oldCollection)
+		if err != nil {
+			t.Errorf("[%s] %v", s.name, err)
+			continue
+		}
+
+		if !app.Dao().HasTable(s.newCollection.Name) {
+			t.Errorf("[%s] Expected table %s to exist", s.name, s.newCollection.Name)
+		}
+
+		cols, _ := app.Dao().TableColumns(s.newCollection.Name)
+		if len(cols) != len(s.expectedColumns) {
+			t.Errorf("[%s] Expected columns %v, got %v", s.name, s.expectedColumns, cols)
+		}
+
+		for _, c := range cols {
+			if !list.ExistInSlice(c, s.expectedColumns) {
+				t.Errorf("[%s] Couldn't find column %s in %v", s.name, c, s.expectedColumns)
+			}
+		}
+
+		indexes, _ := app.Dao().TableIndexes(s.newCollection.Name)
+
+		if totalIndexes := len(indexes); totalIndexes != s.expectedIndexesCount {
+			t.Errorf("[%s] Expected %d indexes, got %d:\n%v", s.name, s.expectedIndexesCount, totalIndexes, indexes)
+		}
+	}
+}
+
+func TestSingleVsMultipleValuesNormalization(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// mock field changes
+	{
+		selectOneField := collection.Schema.GetFieldByName("select_one")
+		opt := selectOneField.Options.(*schema.SelectOptions)
+		opt.MaxSelect = 2
+	}
+	{
+		selectManyField := collection.Schema.GetFieldByName("select_many")
+		opt := selectManyField.Options.(*schema.SelectOptions)
+		opt.MaxSelect = 1
+	}
+	{
+		fileOneField := collection.Schema.GetFieldByName("file_one")
+		opt := fileOneField.Options.(*schema.FileOptions)
+		opt.MaxSelect = 2
+	}
+	{
+		fileManyField := collection.Schema.GetFieldByName("file_many")
+		opt := fileManyField.Options.(*schema.FileOptions)
+		opt.MaxSelect = 1
+	}
+	{
+		relOneField := collection.Schema.GetFieldByName("rel_one")
+		opt := relOneField.Options.(*schema.RelationOptions)
+		opt.MaxSelect = types.Pointer(2)
+	}
+	{
+		relManyField := collection.Schema.GetFieldByName("rel_many")
+		opt := relManyField.Options.(*schema.RelationOptions)
+		opt.MaxSelect = types.Pointer(1)
+	}
+	{
+		// new multivaluer field to check whether the array normalization
+		// will be applied for already inserted data
+		collection.Schema.AddField(&schema.SchemaField{
+			Name: "new_multiple",
+			Type: schema.FieldTypeSelect,
+			Options: &schema.SelectOptions{
+				Values:    []string{"a", "b", "c"},
+				MaxSelect: 3,
+			},
+		})
+	}
+
+	if err := app.Dao().SaveCollection(collection); err != nil {
+		t.Fatal(err)
+	}
+
+	// ensures that the writable schema was reverted to its expected default
+	var writableSchema bool
+	app.Dao().DB().NewQuery("PRAGMA writable_schema").Row(&writableSchema)
+	if writableSchema == true {
+		t.Fatalf("Expected writable_schema to be OFF, got %v", writableSchema)
+	}
+
+	// check whether the columns DEFAULT definition was updated
+	// ---------------------------------------------------------------
+	tableInfo, err := app.Dao().TableInfo(collection.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tableInfoExpectations := map[string]string{
+		"select_one":   `'[]'`,
+		"select_many":  `''`,
+		"file_one":     `'[]'`,
+		"file_many":    `''`,
+		"rel_one":      `'[]'`,
+		"rel_many":     `''`,
+		"new_multiple": `'[]'`,
+	}
+	for col, dflt := range tableInfoExpectations {
+		t.Run("check default for "+col, func(t *testing.T) {
+			var row *models.TableInfoRow
+			for _, r := range tableInfo {
+				if r.Name == col {
+					row = r
+					break
+				}
+			}
+			if row == nil {
+				t.Fatalf("Missing info for column %q", col)
+			}
+
+			if v := row.DefaultValue.String(); v != dflt {
+				t.Fatalf("Expected default value %q, got %q", dflt, v)
+			}
+		})
+	}
+
+	// check whether the values were normalized
+	// ---------------------------------------------------------------
+	type fieldsExpectation struct {
+		SelectOne   string `db:"select_one"`
+		SelectMany  string `db:"select_many"`
+		FileOne     string `db:"file_one"`
+		FileMany    string `db:"file_many"`
+		RelOne      string `db:"rel_one"`
+		RelMany     string `db:"rel_many"`
+		NewMultiple string `db:"new_multiple"`
+	}
+
+	fieldsScenarios := []struct {
+		recordId string
+		expected fieldsExpectation
+	}{
+		{
+			"imy661ixudk5izi",
+			fieldsExpectation{
+				SelectOne:   `[]`,
+				SelectMany:  ``,
+				FileOne:     `[]`,
+				FileMany:    ``,
+				RelOne:      `[]`,
+				RelMany:     ``,
+				NewMultiple: `[]`,
+			},
+		},
+		{
+			"al1h9ijdeojtsjy",
+			fieldsExpectation{
+				SelectOne:   `["optionB"]`,
+				SelectMany:  `optionB`,
+				FileOne:     `["300_Jsjq7RdBgA.png"]`,
+				FileMany:    ``,
+				RelOne:      `["84nmscqy84lsi1t"]`,
+				RelMany:     `oap640cot4yru2s`,
+				NewMultiple: `[]`,
+			},
+		},
+		{
+			"84nmscqy84lsi1t",
+			fieldsExpectation{
+				SelectOne:   `["optionB"]`,
+				SelectMany:  `optionC`,
+				FileOne:     `["test_d61b33QdDU.txt"]`,
+				FileMany:    `test_tC1Yc87DfC.txt`,
+				RelOne:      `[]`,
+				RelMany:     `oap640cot4yru2s`,
+				NewMultiple: `[]`,
+			},
+		},
+	}
+
+	for _, s := range fieldsScenarios {
+		t.Run("check fields for record "+s.recordId, func(t *testing.T) {
+			result := new(fieldsExpectation)
+
+			err := app.Dao().DB().Select(
+				"select_one",
+				"select_many",
+				"file_one",
+				"file_many",
+				"rel_one",
+				"rel_many",
+				"new_multiple",
+			).From(collection.Name).Where(dbx.HashExp{"id": s.recordId}).One(result)
+			if err != nil {
+				t.Fatalf("Failed to load record: %v", err)
+			}
+
+			encodedResult, err := json.Marshal(result)
+			if err != nil {
+				t.Fatalf("Failed to encode result: %v", err)
+			}
+
+			encodedExpectation, err := json.Marshal(s.expected)
+			if err != nil {
+				t.Fatalf("Failed to encode expectation: %v", err)
+			}
+
+			if !bytes.EqualFold(encodedExpectation, encodedResult) {
+				t.Fatalf("Expected \n%s, \ngot \n%s", encodedExpectation, encodedResult)
+			}
+		})
+	}
+}

daos/request.go

@@ -1,70 +0,0 @@
-package daos
-
-import (
-	"time"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/types"
-)
-
-// RequestQuery returns a new Request logs select query.
-func (dao *Dao) RequestQuery() *dbx.SelectQuery {
-	return dao.ModelQuery(&models.Request{})
-}
-
-// FindRequestById finds a single Request log by its id.
-func (dao *Dao) FindRequestById(id string) (*models.Request, error) {
-	model := &models.Request{}
-
-	err := dao.RequestQuery().
-		AndWhere(dbx.HashExp{"id": id}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return model, nil
-}
-
-type RequestsStatsItem struct {
-	Total int            `db:"total" json:"total"`
-	Date  types.DateTime `db:"date" json:"date"`
-}
-
-// RequestsStats returns hourly grouped requests logs statistics.
-func (dao *Dao) RequestsStats(expr dbx.Expression) ([]*RequestsStatsItem, error) {
-	result := []*RequestsStatsItem{}
-
-	query := dao.RequestQuery().
-		Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date").
-		GroupBy("date")
-
-	if expr != nil {
-		query.AndWhere(expr)
-	}
-
-	err := query.All(&result)
-
-	return result, err
-}
-
-// DeleteOldRequests delete all requests that are created before createdBefore.
-func (dao *Dao) DeleteOldRequests(createdBefore time.Time) error {
-	m := models.Request{}
-	tableName := m.TableName()
-
-	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
-	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
-
-	_, err := dao.DB().Delete(tableName, expr).Execute()
-
-	return err
-}
-
-// SaveRequest upserts the provided Request model.
-func (dao *Dao) SaveRequest(request *models.Request) error {
-	return dao.Save(request)
-}

daos/settings.go

@@ -0,0 +1,63 @@
+package daos
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/settings"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// FindSettings returns and decode the serialized app settings param value.
+//
+// The method will first try to decode the param value without decryption.
+// If it fails and optEncryptionKey is set, it will try again by first
+// decrypting the value and then decode it again.
+//
+// Returns an error if it fails to decode the stored serialized param value.
+func (dao *Dao) FindSettings(optEncryptionKey ...string) (*settings.Settings, error) {
+	param, err := dao.FindParamByKey(models.ParamAppSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	result := settings.New()
+
+	// try first without decryption
+	plainDecodeErr := json.Unmarshal(param.Value, result)
+
+	// failed, try to decrypt
+	if plainDecodeErr != nil {
+		var encryptionKey string
+		if len(optEncryptionKey) > 0 && optEncryptionKey[0] != "" {
+			encryptionKey = optEncryptionKey[0]
+		}
+
+		// load without decrypt has failed and there is no encryption key to use for decrypt
+		if encryptionKey == "" {
+			return nil, errors.New("failed to load the stored app settings - missing or invalid encryption key")
+		}
+
+		// decrypt
+		decrypted, decryptErr := security.Decrypt(string(param.Value), encryptionKey)
+		if decryptErr != nil {
+			return nil, decryptErr
+		}
+
+		// decode again
+		decryptedDecodeErr := json.Unmarshal(decrypted, result)
+		if decryptedDecodeErr != nil {
+			return nil, decryptedDecodeErr
+		}
+	}
+
+	return result, nil
+}
+
+// SaveSettings persists the specified settings configuration.
+//
+// If optEncryptionKey is set, then the stored serialized value will be encrypted with it.
+func (dao *Dao) SaveSettings(newSettings *settings.Settings, optEncryptionKey ...string) error {
+	return dao.SaveParam(models.ParamAppSettings, newSettings, optEncryptionKey...)
+}

daos/settings_test.go

@@ -0,0 +1,52 @@
+package daos_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestSaveAndFindSettings(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	encryptionKey := security.PseudorandomString(32)
+
+	// change unencrypted app settings
+	app.Settings().Meta.AppName = "save_unencrypted"
+	if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+		t.Fatal(err)
+	}
+
+	// check if the change was persisted
+	s1, err := app.Dao().FindSettings()
+	if err != nil {
+		t.Fatalf("Failed to fetch settings: %v", err)
+	}
+	if s1.Meta.AppName != "save_unencrypted" {
+		t.Fatalf("Expected settings to be changed with app name %q, got \n%v", "save_unencrypted", s1)
+	}
+
+	// make another change but this time provide an encryption key
+	app.Settings().Meta.AppName = "save_encrypted"
+	if err := app.Dao().SaveSettings(app.Settings(), encryptionKey); err != nil {
+		t.Fatal(err)
+	}
+
+	// try to fetch the settings without encryption key (should fail)
+	if s2, err := app.Dao().FindSettings(); err == nil {
+		t.Fatalf("Expected FindSettings to fail without an encryption key, got \n%v", s2)
+	}
+
+	// try again but this time with an encryption key
+	s3, err := app.Dao().FindSettings(encryptionKey)
+	if err != nil {
+		t.Fatalf("Failed to fetch settings with an encryption key %s: %v", encryptionKey, err)
+	}
+	if s3.Meta.AppName != "save_encrypted" {
+		t.Fatalf("Expected settings to be changed with app name %q, got \n%v", "save_encrypted", s3)
+	}
+}

daos/table.go

@@ -1,16 +1,19 @@
 package daos
 
 import (
+	"fmt"
+
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
 )
 
-// HasTable checks if a table with the provided name exists (case insensitive).
+// HasTable checks if a table (or view) with the provided name exists (case insensitive).
 func (dao *Dao) HasTable(tableName string) bool {
 	var exists bool
 
 	err := dao.DB().Select("count(*)").
 		From("sqlite_schema").
-		AndWhere(dbx.HashExp{"type": "table"}).
+		AndWhere(dbx.HashExp{"type": []any{"table", "view"}}).
 		AndWhere(dbx.NewExp("LOWER([[name]])=LOWER({:tableName})", dbx.Params{"tableName": tableName})).
 		Limit(1).
 		Row(&exists)
@@ -18,8 +21,8 @@ func (dao *Dao) HasTable(tableName string) bool {
 	return err == nil && exists
 }
 
-// GetTableColumns returns all column names of a single table by its name.
-func (dao *Dao) GetTableColumns(tableName string) ([]string, error) {
+// TableColumns returns all column names of a single table by its name.
+func (dao *Dao) TableColumns(tableName string) ([]string, error) {
 	columns := []string{}
 
 	err := dao.DB().NewQuery("SELECT name FROM PRAGMA_TABLE_INFO({:tableName})").
@@ -29,9 +32,75 @@ func (dao *Dao) GetTableColumns(tableName string) ([]string, error) {
 	return columns, err
 }
 
+// TableInfo returns the `table_info` pragma result for the specified table.
+func (dao *Dao) TableInfo(tableName string) ([]*models.TableInfoRow, error) {
+	info := []*models.TableInfoRow{}
+
+	err := dao.DB().NewQuery("SELECT * FROM PRAGMA_TABLE_INFO({:tableName})").
+		Bind(dbx.Params{"tableName": tableName}).
+		All(&info)
+	if err != nil {
+		return nil, err
+	}
+
+	// mattn/go-sqlite3 doesn't throw an error on invalid or missing table
+	// so we additionally have to check whether the loaded info result is nonempty
+	if len(info) == 0 {
+		return nil, fmt.Errorf("empty table info probably due to invalid or missing table %s", tableName)
+	}
+
+	return info, nil
+}
+
+// TableIndexes returns a name grouped map with all non empty index of the specified table.
+//
+// Note: This method doesn't return an error on nonexisting table.
+func (dao *Dao) TableIndexes(tableName string) (map[string]string, error) {
+	indexes := []struct {
+		Name string
+		Sql  string
+	}{}
+
+	err := dao.DB().Select("name", "sql").
+		From("sqlite_master").
+		AndWhere(dbx.NewExp("sql is not null")).
+		AndWhere(dbx.HashExp{
+			"type":     "index",
+			"tbl_name": tableName,
+		}).
+		All(&indexes)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]string, len(indexes))
+
+	for _, idx := range indexes {
+		result[idx.Name] = idx.Sql
+	}
+
+	return result, nil
+}
+
 // DeleteTable drops the specified table.
+//
+// This method is a no-op if a table with the provided name doesn't exist.
+//
+// Be aware that this method is vulnerable to SQL injection and the
+// "tableName" argument must come only from trusted input!
 func (dao *Dao) DeleteTable(tableName string) error {
-	_, err := dao.DB().DropTable(tableName).Execute()
+	_, err := dao.DB().NewQuery(fmt.Sprintf(
+		"DROP TABLE IF EXISTS {{%s}}",
+		tableName,
+	)).Execute()
+
+	return err
+}
+
+// Vacuum executes VACUUM on the current dao.DB() instance in order to
+// reclaim unused db disk space.
+func (dao *Dao) Vacuum() error {
+	_, err := dao.DB().NewQuery("VACUUM").Execute()
 
 	return err
 }

daos/table_test.go

@@ -1,13 +1,19 @@
 package daos_test
 
 import (
+	"context"
+	"database/sql"
+	"encoding/json"
 	"testing"
+	"time"
 
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
 func TestHasTable(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -20,17 +26,20 @@ func TestHasTable(t *testing.T) {
 		{"_admins", true},
 		{"demo3", true},
 		{"DEMO3", true}, // table names are case insensitives by default
+		{"view1", true}, // view
 	}
 
 	for i, scenario := range scenarios {
 		result := app.Dao().HasTable(scenario.tableName)
 		if result != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, result)
+			t.Errorf("[%d] Expected %v, got %v", i, scenario.expected, result)
 		}
 	}
 }
 
-func TestGetTableColumns(t *testing.T) {
+func TestTableColumns(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -42,22 +51,55 @@ func TestGetTableColumns(t *testing.T) {
 		{"_params", []string{"id", "key", "value", "created", "updated"}},
 	}
 
-	for i, scenario := range scenarios {
-		columns, _ := app.Dao().GetTableColumns(scenario.tableName)
+	for i, s := range scenarios {
+		columns, _ := app.Dao().TableColumns(s.tableName)
 
-		if len(columns) != len(scenario.expected) {
-			t.Errorf("(%d) Expected columns %v, got %v", i, scenario.expected, columns)
+		if len(columns) != len(s.expected) {
+			t.Errorf("[%d] Expected columns %v, got %v", i, s.expected, columns)
+			continue
 		}
 
 		for _, c := range columns {
-			if !list.ExistInSlice(c, scenario.expected) {
-				t.Errorf("(%d) Didn't expect column %s", i, c)
+			if !list.ExistInSlice(c, s.expected) {
+				t.Errorf("[%d] Didn't expect column %s", i, c)
 			}
 		}
 	}
 }
 
+func TestTableInfo(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  string
+	}{
+		{"", "null"},
+		{"missing", "null"},
+		{
+			"_admins",
+			`[{"PK":1,"Index":0,"Name":"id","Type":"TEXT","NotNull":false,"DefaultValue":null},{"PK":0,"Index":1,"Name":"avatar","Type":"INTEGER","NotNull":true,"DefaultValue":0},{"PK":0,"Index":2,"Name":"email","Type":"TEXT","NotNull":true,"DefaultValue":null},{"PK":0,"Index":3,"Name":"tokenKey","Type":"TEXT","NotNull":true,"DefaultValue":null},{"PK":0,"Index":4,"Name":"passwordHash","Type":"TEXT","NotNull":true,"DefaultValue":null},{"PK":0,"Index":5,"Name":"lastResetSentAt","Type":"TEXT","NotNull":true,"DefaultValue":""},{"PK":0,"Index":6,"Name":"created","Type":"TEXT","NotNull":true,"DefaultValue":""},{"PK":0,"Index":7,"Name":"updated","Type":"TEXT","NotNull":true,"DefaultValue":""}]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		rows, _ := app.Dao().TableInfo(s.tableName)
+
+		raw, _ := json.Marshal(rows)
+		rawStr := string(raw)
+
+		if rawStr != s.expected {
+			t.Errorf("[%d] Expected \n%v, \ngot \n%v", i, s.expected, rawStr)
+		}
+	}
+}
+
 func TestDeleteTable(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -66,16 +108,88 @@ func TestDeleteTable(t *testing.T) {
 		expectError bool
 	}{
 		{"", true},
-		{"test", true},
+		{"test", false}, // missing tables are ignored
 		{"_admins", false},
 		{"demo3", false},
 	}
 
-	for i, scenario := range scenarios {
-		err := app.Dao().DeleteTable(scenario.tableName)
+	for i, s := range scenarios {
+		err := app.Dao().DeleteTable(s.tableName)
+
 		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr %v, got %v", i, scenario.expectError, hasErr)
+		if hasErr != s.expectError {
+			t.Errorf("[%d] Expected hasErr %v, got %v", i, s.expectError, hasErr)
+		}
+	}
+}
+
+func TestVacuum(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	calledQueries := []string{}
+	app.DB().QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.DB().ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	if err := app.Dao().Vacuum(); err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(calledQueries); total != 1 {
+		t.Fatalf("Expected 1 query, got %d", total)
+	}
+
+	if calledQueries[0] != "VACUUM" {
+		t.Fatalf("Expected VACUUM query, got %s", calledQueries[0])
+	}
+}
+
+func TestTableIndexes(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		table         string
+		expectError   bool
+		expectIndexes []string
+	}{
+		{
+			"missing",
+			false,
+			nil,
+		},
+		{
+			"demo2",
+			false,
+			[]string{"idx_demo2_created", "idx_unique_demo2_title", "idx_demo2_active"},
+		},
+	}
+
+	for _, s := range scenarios {
+		result, err := app.Dao().TableIndexes(s.table)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%s] Expected hasErr %v, got %v", s.table, s.expectError, hasErr)
+		}
+
+		if len(s.expectIndexes) != len(result) {
+			t.Errorf("[%s] Expected %d indexes, got %d:\n%v", s.table, len(s.expectIndexes), len(result), result)
+			continue
+		}
+
+		for _, name := range s.expectIndexes {
+			if result[name] == "" {
+				t.Errorf("[%s] Missing index %q in \n%v", s.table, name, result)
+			}
 		}
 	}
 }

daos/user.go

@@ -1,281 +0,0 @@
-package daos
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"log"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/models/schema"
-	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/security"
-)
-
-// UserQuery returns a new User model select query.
-func (dao *Dao) UserQuery() *dbx.SelectQuery {
-	return dao.ModelQuery(&models.User{})
-}
-
-// LoadProfile loads the profile record associated to the provided user.
-func (dao *Dao) LoadProfile(user *models.User) error {
-	collection, err := dao.FindCollectionByNameOrId(models.ProfileCollectionName)
-	if err != nil {
-		return err
-	}
-
-	profile, err := dao.FindFirstRecordByData(collection, models.ProfileCollectionUserFieldName, user.Id)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	user.Profile = profile
-
-	return nil
-}
-
-// LoadProfiles loads the profile records associated to the provied users list.
-func (dao *Dao) LoadProfiles(users []*models.User) error {
-	collection, err := dao.FindCollectionByNameOrId(models.ProfileCollectionName)
-	if err != nil {
-		return err
-	}
-
-	// extract user ids
-	ids := make([]string, len(users))
-	usersMap := map[string]*models.User{}
-	for i, user := range users {
-		ids[i] = user.Id
-		usersMap[user.Id] = user
-	}
-
-	profiles, err := dao.FindRecordsByExpr(collection, dbx.HashExp{
-		models.ProfileCollectionUserFieldName: list.ToInterfaceSlice(ids),
-	})
-	if err != nil {
-		return err
-	}
-
-	// populate each user.Profile member
-	for _, profile := range profiles {
-		userId := profile.GetStringDataValue(models.ProfileCollectionUserFieldName)
-		user, ok := usersMap[userId]
-		if !ok {
-			continue
-		}
-		user.Profile = profile
-	}
-
-	return nil
-}
-
-// FindUserById finds a single User model by its id.
-//
-// This method also auto loads the related user profile record
-// into the found model.
-func (dao *Dao) FindUserById(id string) (*models.User, error) {
-	model := &models.User{}
-
-	err := dao.UserQuery().
-		AndWhere(dbx.HashExp{"id": id}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	// try to load the user profile (if exist)
-	if err := dao.LoadProfile(model); err != nil {
-		log.Println(err)
-	}
-
-	return model, nil
-}
-
-// FindUserByEmail finds a single User model by its email address.
-//
-// This method also auto loads the related user profile record
-// into the found model.
-func (dao *Dao) FindUserByEmail(email string) (*models.User, error) {
-	model := &models.User{}
-
-	err := dao.UserQuery().
-		AndWhere(dbx.HashExp{"email": email}).
-		Limit(1).
-		One(model)
-
-	if err != nil {
-		return nil, err
-	}
-
-	// try to load the user profile (if exist)
-	if err := dao.LoadProfile(model); err != nil {
-		log.Println(err)
-	}
-
-	return model, nil
-}
-
-// FindUserByToken finds the user associated with the provided JWT token.
-// Returns an error if the JWT token is invalid or expired.
-//
-// This method also auto loads the related user profile record
-// into the found model.
-func (dao *Dao) FindUserByToken(token string, baseTokenKey string) (*models.User, error) {
-	unverifiedClaims, err := security.ParseUnverifiedJWT(token)
-	if err != nil {
-		return nil, err
-	}
-
-	// check required claims
-	id, _ := unverifiedClaims["id"].(string)
-	if id == "" {
-		return nil, errors.New("Missing or invalid token claims.")
-	}
-
-	user, err := dao.FindUserById(id)
-	if err != nil || user == nil {
-		return nil, err
-	}
-
-	verificationKey := user.TokenKey + baseTokenKey
-
-	// verify token signature
-	if _, err := security.ParseJWT(token, verificationKey); err != nil {
-		return nil, err
-	}
-
-	return user, nil
-}
-
-// IsUserEmailUnique checks if the provided email address is not
-// already in use by other users.
-func (dao *Dao) IsUserEmailUnique(email string, excludeId string) bool {
-	if email == "" {
-		return false
-	}
-
-	var exists bool
-	err := dao.UserQuery().
-		Select("count(*)").
-		AndWhere(dbx.Not(dbx.HashExp{"id": excludeId})).
-		AndWhere(dbx.HashExp{"email": email}).
-		Limit(1).
-		Row(&exists)
-
-	return err == nil && !exists
-}
-
-// DeleteUser deletes the provided User model.
-//
-// This method will also cascade the delete operation to all
-// Record models that references the provided User model
-// (delete or set to NULL, depending on the related user shema field settings).
-//
-// The delete operation may fail if the user is part of a required
-// reference in another Record model (aka. cannot be deleted or set to NULL).
-func (dao *Dao) DeleteUser(user *models.User) error {
-	// fetch related records
-	// note: the select is outside of the transaction to prevent SQLITE_LOCKED error when mixing read&write in a single transaction
-	relatedRecords, err := dao.FindUserRelatedRecords(user)
-	if err != nil {
-		return err
-	}
-
-	return dao.RunInTransaction(func(txDao *Dao) error {
-		// check if related records has to be deleted (if `CascadeDelete` is set)
-		// OR
-		// just unset the user related fields (if they are not required)
-		// -----------------------------------------------------------
-	recordsLoop:
-		for _, record := range relatedRecords {
-			var needSave bool
-
-			for _, field := range record.Collection().Schema.Fields() {
-				if field.Type != schema.FieldTypeUser {
-					continue // not a user field
-				}
-
-				ids := record.GetStringSliceDataValue(field.Name)
-
-				// unset the user id
-				for i := len(ids) - 1; i >= 0; i-- {
-					if ids[i] == user.Id {
-						ids = append(ids[:i], ids[i+1:]...)
-						break
-					}
-				}
-
-				options, _ := field.Options.(*schema.UserOptions)
-
-				// cascade delete
-				// (only if there are no other user references in case of multiple select)
-				if options.CascadeDelete && len(ids) == 0 {
-					if err := txDao.DeleteRecord(record); err != nil {
-						return err
-					}
-					// no need to further iterate the user fields (the record is deleted)
-					continue recordsLoop
-				}
-
-				if field.Required && len(ids) == 0 {
-					return fmt.Errorf("Failed delete the user because a record exist with required user reference to the current model (%q, %q).", record.Id, record.Collection().Name)
-				}
-
-				// apply the reference changes
-				record.SetDataValue(field.Name, field.PrepareValue(ids))
-				needSave = true
-			}
-
-			if needSave {
-				if err := txDao.SaveRecord(record); err != nil {
-					return err
-				}
-			}
-		}
-		// -----------------------------------------------------------
-
-		return txDao.Delete(user)
-	})
-}
-
-// SaveUser upserts the provided User model.
-//
-// An empty profile record will be created if the user
-// doesn't have a profile record set yet.
-func (dao *Dao) SaveUser(user *models.User) error {
-	profileCollection, err := dao.FindCollectionByNameOrId(models.ProfileCollectionName)
-	if err != nil {
-		return err
-	}
-
-	// fetch the related user profile record (if exist)
-	var userProfile *models.Record
-	if user.HasId() {
-		userProfile, _ = dao.FindFirstRecordByData(
-			profileCollection,
-			models.ProfileCollectionUserFieldName,
-			user.Id,
-		)
-	}
-
-	return dao.RunInTransaction(func(txDao *Dao) error {
-		if err := txDao.Save(user); err != nil {
-			return err
-		}
-
-		// create default/empty profile record if doesn't exist
-		if userProfile == nil {
-			userProfile = models.NewRecord(profileCollection)
-			userProfile.SetDataValue(models.ProfileCollectionUserFieldName, user.Id)
-			if err := txDao.Save(userProfile); err != nil {
-				return err
-			}
-			user.Profile = userProfile
-		}
-
-		return nil
-	})
-}

daos/user_test.go

@@ -1,274 +0,0 @@
-package daos_test
-
-import (
-	"testing"
-
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tests"
-)
-
-func TestUserQuery(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	expected := "SELECT {{_users}}.* FROM `_users`"
-
-	sql := app.Dao().UserQuery().Build().SQL()
-	if sql != expected {
-		t.Errorf("Expected sql %s, got %s", expected, sql)
-	}
-}
-
-func TestLoadProfile(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	// try to load missing profile (shouldn't return an error)
-	// ---
-	newUser := &models.User{}
-	err1 := app.Dao().LoadProfile(newUser)
-	if err1 != nil {
-		t.Fatalf("Expected nil, got error %v", err1)
-	}
-
-	// try to load existing profile
-	// ---
-	existingUser, _ := app.Dao().FindUserByEmail("test@example.com")
-	existingUser.Profile = nil // reset
-
-	err2 := app.Dao().LoadProfile(existingUser)
-	if err2 != nil {
-		t.Fatal(err2)
-	}
-
-	if existingUser.Profile == nil {
-		t.Fatal("Expected user profile to be loaded, got nil")
-	}
-
-	if existingUser.Profile.GetStringDataValue("name") != "test" {
-		t.Fatalf("Expected profile.name to be 'test', got %s", existingUser.Profile.GetStringDataValue("name"))
-	}
-}
-
-func TestLoadProfiles(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	u0 := &models.User{}
-	u1, _ := app.Dao().FindUserByEmail("test@example.com")
-	u2, _ := app.Dao().FindUserByEmail("test2@example.com")
-
-	users := []*models.User{u0, u1, u2}
-
-	err := app.Dao().LoadProfiles(users)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if u0.Profile != nil {
-		t.Errorf("Expected profile to be nil for u0, got %v", u0.Profile)
-	}
-	if u1.Profile == nil {
-		t.Errorf("Expected profile to be set for u1, got nil")
-	}
-	if u2.Profile == nil {
-		t.Errorf("Expected profile to be set for u2, got nil")
-	}
-}
-
-func TestFindUserById(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		id          string
-		expectError bool
-	}{
-		{"00000000-2b4a-a26b-4d01-42d3c3d77bc8", true},
-		{"97cc3d3d-6ba2-383f-b42a-7bc84d27410c", false},
-	}
-
-	for i, scenario := range scenarios {
-		user, err := app.Dao().FindUserById(scenario.id)
-
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
-		}
-
-		if user != nil && user.Id != scenario.id {
-			t.Errorf("(%d) Expected user with id %s, got %s", i, scenario.id, user.Id)
-		}
-	}
-}
-
-func TestFindUserByEmail(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		email       string
-		expectError bool
-	}{
-		{"invalid", true},
-		{"missing@example.com", true},
-		{"test@example.com", false},
-	}
-
-	for i, scenario := range scenarios {
-		user, err := app.Dao().FindUserByEmail(scenario.email)
-
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
-			continue
-		}
-
-		if !scenario.expectError && user.Email != scenario.email {
-			t.Errorf("(%d) Expected user with email %s, got %s", i, scenario.email, user.Email)
-		}
-	}
-}
-
-func TestFindUserByToken(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		token         string
-		baseKey       string
-		expectedEmail string
-		expectError   bool
-	}{
-		// invalid base key (password reset key for auth token)
-		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			app.Settings().UserPasswordResetToken.Secret,
-			"",
-			true,
-		},
-		// expired token
-		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNjQwOTkxNjYxfQ.RrSG5NwysI38DEZrIQiz3lUgI6sEuYGTll_jLRbBSiw",
-			app.Settings().UserAuthToken.Secret,
-			"",
-			true,
-		},
-		// valid token
-		{
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRkMDE5N2NjLTJiNGEtM2Y4My1hMjZiLWQ3N2JjODQyM2QzYyIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxODkzNDc0MDAwfQ.Wq5ac1q1f5WntIzEngXk22ydMj-eFgvfSRg7dhmPKic",
-			app.Settings().UserAuthToken.Secret,
-			"test@example.com",
-			false,
-		},
-	}
-
-	for i, scenario := range scenarios {
-		user, err := app.Dao().FindUserByToken(scenario.token, scenario.baseKey)
-
-		hasErr := err != nil
-		if hasErr != scenario.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, scenario.expectError, hasErr, err)
-			continue
-		}
-
-		if !scenario.expectError && user.Email != scenario.expectedEmail {
-			t.Errorf("(%d) Expected user model %s, got %s", i, scenario.expectedEmail, user.Email)
-		}
-	}
-}
-
-func TestIsUserEmailUnique(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	scenarios := []struct {
-		email     string
-		excludeId string
-		expected  bool
-	}{
-		{"", "", false},
-		{"test@example.com", "", false},
-		{"new@example.com", "", true},
-		{"test@example.com", "4d0197cc-2b4a-3f83-a26b-d77bc8423d3c", true},
-	}
-
-	for i, scenario := range scenarios {
-		result := app.Dao().IsUserEmailUnique(scenario.email, scenario.excludeId)
-		if result != scenario.expected {
-			t.Errorf("(%d) Expected %v, got %v", i, scenario.expected, result)
-		}
-	}
-}
-
-func TestDeleteUser(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	// try to delete unsaved user
-	// ---
-	err1 := app.Dao().DeleteUser(&models.User{})
-	if err1 == nil {
-		t.Fatal("Expected error, got nil")
-	}
-
-	// try to delete existing user
-	// ---
-	user, _ := app.Dao().FindUserByEmail("test3@example.com")
-	err2 := app.Dao().DeleteUser(user)
-	if err2 != nil {
-		t.Fatalf("Expected nil, got error %v", err2)
-	}
-
-	// check if the delete operation was cascaded to the profiles collection (record delete)
-	profilesCol, _ := app.Dao().FindCollectionByNameOrId(models.ProfileCollectionName)
-	profile, _ := app.Dao().FindRecordById(profilesCol, user.Profile.Id, nil)
-	if profile != nil {
-		t.Fatalf("Expected user profile to be deleted, got %v", profile)
-	}
-
-	// check if delete operation was cascaded to the related demo2 collection (null set)
-	demo2Col, _ := app.Dao().FindCollectionByNameOrId("demo2")
-	record, _ := app.Dao().FindRecordById(demo2Col, "94568ca2-0bee-49d7-b749-06cb97956fd9", nil)
-	if record == nil {
-		t.Fatal("Expected to found related record, got nil")
-	}
-	if record.GetStringDataValue("user") != "" {
-		t.Fatalf("Expected user field to be set to empty string, got %v", record.GetStringDataValue("user"))
-	}
-}
-
-func TestSaveUser(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	// create
-	// ---
-	u1 := &models.User{}
-	u1.Email = "new@example.com"
-	u1.SetPassword("123456")
-	err1 := app.Dao().SaveUser(u1)
-	if err1 != nil {
-		t.Fatal(err1)
-	}
-	u1, refreshErr1 := app.Dao().FindUserByEmail("new@example.com")
-	if refreshErr1 != nil {
-		t.Fatalf("Expected user with email new@example.com to have been created, got error %v", refreshErr1)
-	}
-	if u1.Profile == nil {
-		t.Fatalf("Expected creating a user to create also an empty profile record")
-	}
-
-	// update
-	// ---
-	u2, _ := app.Dao().FindUserByEmail("test@example.com")
-	u2.Email = "test_update@example.com"
-	err2 := app.Dao().SaveUser(u2)
-	if err2 != nil {
-		t.Fatal(err2)
-	}
-	u2, refreshErr2 := app.Dao().FindUserByEmail("test_update@example.com")
-	if u2 == nil {
-		t.Fatalf("Couldn't find user with email test_update@example.com (%v)", refreshErr2)
-	}
-}

daos/view.go

@@ -0,0 +1,627 @@
+package daos
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/tokenizer"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// DeleteView drops the specified view name.
+//
+// This method is a no-op if a view with the provided name doesn't exist.
+//
+// Be aware that this method is vulnerable to SQL injection and the
+// "name" argument must come only from trusted input!
+func (dao *Dao) DeleteView(name string) error {
+	_, err := dao.DB().NewQuery(fmt.Sprintf(
+		"DROP VIEW IF EXISTS {{%s}}",
+		name,
+	)).Execute()
+
+	return err
+}
+
+// SaveView creates (or updates already existing) persistent SQL view.
+//
+// Be aware that this method is vulnerable to SQL injection and the
+// "selectQuery" argument must come only from trusted input!
+func (dao *Dao) SaveView(name string, selectQuery string) error {
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		// delete old view (if exists)
+		if err := txDao.DeleteView(name); err != nil {
+			return err
+		}
+
+		selectQuery = strings.Trim(strings.TrimSpace(selectQuery), ";")
+
+		// try to eagerly detect multiple inline statements
+		tk := tokenizer.NewFromString(selectQuery)
+		tk.Separators(';')
+		if queryParts, _ := tk.ScanAll(); len(queryParts) > 1 {
+			return errors.New("multiple statements are not supported")
+		}
+
+		// (re)create the view
+		//
+		// note: the query is wrapped in a secondary SELECT as a rudimentary
+		// measure to discourage multiple inline sql statements execution.
+		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, selectQuery)
+		if _, err := txDao.DB().NewQuery(viewQuery).Execute(); err != nil {
+			return err
+		}
+
+		// fetch the view table info to ensure that the view was created
+		// because missing tables or columns won't return an error
+		if _, err := txDao.TableInfo(name); err != nil {
+			// manually cleanup previously created view in case the func
+			// is called in a nested transaction and the error is discarded
+			txDao.DeleteView(name)
+
+			return err
+		}
+
+		return nil
+	})
+}
+
+// CreateViewSchema creates a new view schema from the provided select query.
+//
+// There are some caveats:
+// - The select query must have an "id" column.
+// - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+func (dao *Dao) CreateViewSchema(selectQuery string) (schema.Schema, error) {
+	result := schema.NewSchema()
+
+	suggestedFields, err := dao.parseQueryToFields(selectQuery)
+	if err != nil {
+		return result, err
+	}
+
+	// note wrap in a transaction in case the selectQuery contains
+	// multiple statements allowing us to rollback on any error
+	txErr := dao.RunInTransaction(func(txDao *Dao) error {
+		tempView := "_temp_" + security.PseudorandomString(5)
+		// create a temp view with the provided query
+		if err := txDao.SaveView(tempView, selectQuery); err != nil {
+			return err
+		}
+		defer txDao.DeleteView(tempView)
+
+		// extract the generated view table info
+		info, err := txDao.TableInfo(tempView)
+		if err != nil {
+			return err
+		}
+
+		var hasId bool
+
+		for _, row := range info {
+			if row.Name == schema.FieldNameId {
+				hasId = true
+			}
+
+			if list.ExistInSlice(row.Name, schema.BaseModelFieldNames()) {
+				continue // skip base model fields since they are not part of the schema
+			}
+
+			var field *schema.SchemaField
+
+			if f, ok := suggestedFields[row.Name]; ok {
+				field = f.field
+			} else {
+				field = defaultViewField(row.Name)
+			}
+
+			result.AddField(field)
+		}
+
+		if !hasId {
+			return errors.New("missing required id column (you can use `(ROW_NUMBER() OVER()) as id` if you don't have one)")
+		}
+
+		return nil
+	})
+
+	return result, txErr
+}
+
+// FindRecordByViewFile returns the original models.Record of the
+// provided view collection file.
+func (dao *Dao) FindRecordByViewFile(
+	viewCollectionNameOrId string,
+	fileFieldName string,
+	filename string,
+) (*models.Record, error) {
+	view, err := dao.FindCollectionByNameOrId(viewCollectionNameOrId)
+	if err != nil {
+		return nil, err
+	}
+
+	if !view.IsView() {
+		return nil, errors.New("not a view collection")
+	}
+
+	var findFirstNonViewQueryFileField func(int) (*queryField, error)
+	findFirstNonViewQueryFileField = func(level int) (*queryField, error) {
+		// check the level depth to prevent infinite circular recursion
+		// (the limit is arbitrary and may change in the future)
+		if level > 5 {
+			return nil, errors.New("reached the max recursion level of view collection file field queries")
+		}
+
+		queryFields, err := dao.parseQueryToFields(view.ViewOptions().Query)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, item := range queryFields {
+			if item.collection == nil ||
+				item.original == nil ||
+				item.field.Name != fileFieldName {
+				continue
+			}
+
+			if item.collection.IsView() {
+				view = item.collection
+				fileFieldName = item.original.Name
+				return findFirstNonViewQueryFileField(level + 1)
+			}
+
+			return item, nil
+		}
+
+		return nil, errors.New("no query file field found")
+	}
+
+	qf, err := findFirstNonViewQueryFileField(1)
+	if err != nil {
+		return nil, err
+	}
+
+	cleanFieldName := inflector.Columnify(qf.original.Name)
+
+	record := &models.Record{}
+
+	query := dao.RecordQuery(qf.collection).Limit(1)
+
+	if opt, ok := qf.original.Options.(schema.MultiValuer); !ok || !opt.IsMultiple() {
+		query.AndWhere(dbx.HashExp{cleanFieldName: filename})
+	} else {
+		query.InnerJoin(fmt.Sprintf(
+			`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) as {{_je_file}}`,
+			cleanFieldName, cleanFieldName, cleanFieldName,
+		), dbx.HashExp{"_je_file.value": filename})
+	}
+
+	if err := query.One(record); err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// -------------------------------------------------------------------
+// Raw query to schema helpers
+// -------------------------------------------------------------------
+
+type queryField struct {
+	// field is the final resolved field.
+	field *schema.SchemaField
+
+	// collection refers to the original field's collection model.
+	// It could be nil if the found query field is not from a collection schema.
+	collection *models.Collection
+
+	// original is the original found collection field.
+	// It could be nil if the found query field is not from a collection schema.
+	original *schema.SchemaField
+}
+
+func defaultViewField(name string) *schema.SchemaField {
+	return &schema.SchemaField{
+		Name: name,
+		Type: schema.FieldTypeJson,
+		Options: &schema.JsonOptions{
+			MaxSize: 1, // the size doesn't matter in this case
+		},
+	}
+}
+
+var castRegex = regexp.MustCompile(`(?i)^cast\s*\(.*\s+as\s+(\w+)\s*\)$`)
+
+func (dao *Dao) parseQueryToFields(selectQuery string) (map[string]*queryField, error) {
+	p := new(identifiersParser)
+	if err := p.parse(selectQuery); err != nil {
+		return nil, err
+	}
+
+	collections, err := dao.findCollectionsByIdentifiers(p.tables)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]*queryField, len(p.columns))
+
+	var mainTable identifier
+
+	if len(p.tables) > 0 {
+		mainTable = p.tables[0]
+	}
+
+	for _, col := range p.columns {
+		colLower := strings.ToLower(col.original)
+
+		// numeric aggregations
+		if strings.HasPrefix(colLower, "count(") || strings.HasPrefix(colLower, "total(") {
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeNumber,
+				},
+			}
+			continue
+		}
+
+		castMatch := castRegex.FindStringSubmatch(colLower)
+
+		// numeric casts
+		if len(castMatch) == 2 {
+			switch castMatch[1] {
+			case "real", "integer", "int", "decimal", "numeric":
+				result[col.alias] = &queryField{
+					field: &schema.SchemaField{
+						Name: col.alias,
+						Type: schema.FieldTypeNumber,
+					},
+				}
+				continue
+			case "text":
+				result[col.alias] = &queryField{
+					field: &schema.SchemaField{
+						Name: col.alias,
+						Type: schema.FieldTypeText,
+					},
+				}
+				continue
+			case "boolean", "bool":
+				result[col.alias] = &queryField{
+					field: &schema.SchemaField{
+						Name: col.alias,
+						Type: schema.FieldTypeBool,
+					},
+				}
+				continue
+			}
+		}
+
+		parts := strings.Split(col.original, ".")
+
+		var fieldName string
+		var collection *models.Collection
+
+		if len(parts) == 2 {
+			fieldName = parts[1]
+			collection = collections[parts[0]]
+		} else {
+			fieldName = parts[0]
+			collection = collections[mainTable.alias]
+		}
+
+		// fallback to the default field if the found column is not from a collection schema
+		if collection == nil {
+			result[col.alias] = &queryField{
+				field: defaultViewField(col.alias),
+			}
+			continue
+		}
+
+		if fieldName == "*" {
+			return nil, errors.New("dynamic column names are not supported")
+		}
+
+		// find the first field by name (case insensitive)
+		var field *schema.SchemaField
+		for _, f := range collection.Schema.Fields() {
+			if strings.EqualFold(f.Name, fieldName) {
+				field = f
+				break
+			}
+		}
+
+		if field != nil {
+			clone := *field
+			clone.Id = "" // unset to prevent duplications if the same field is aliased multiple times
+			clone.Name = col.alias
+			result[col.alias] = &queryField{
+				field:      &clone,
+				collection: collection,
+				original:   field,
+			}
+			continue
+		}
+
+		if fieldName == schema.FieldNameId {
+			// convert to relation since it is a direct id reference
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeRelation,
+					Options: &schema.RelationOptions{
+						MaxSelect:    types.Pointer(1),
+						CollectionId: collection.Id,
+					},
+				},
+				collection: collection,
+			}
+		} else if fieldName == schema.FieldNameCreated || fieldName == schema.FieldNameUpdated {
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeDate,
+				},
+				collection: collection,
+			}
+		} else if fieldName == schema.FieldNameUsername && collection.IsAuth() {
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeText,
+				},
+				collection: collection,
+			}
+		} else if fieldName == schema.FieldNameEmail && collection.IsAuth() {
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeEmail,
+				},
+				collection: collection,
+			}
+		} else if (fieldName == schema.FieldNameVerified || fieldName == schema.FieldNameEmailVisibility) && collection.IsAuth() {
+			result[col.alias] = &queryField{
+				field: &schema.SchemaField{
+					Name: col.alias,
+					Type: schema.FieldTypeBool,
+				},
+				collection: collection,
+			}
+		} else {
+			result[col.alias] = &queryField{
+				field:      defaultViewField(col.alias),
+				collection: collection,
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func (dao *Dao) findCollectionsByIdentifiers(tables []identifier) (map[string]*models.Collection, error) {
+	names := make([]any, 0, len(tables))
+
+	for _, table := range tables {
+		if strings.Contains(table.alias, "(") {
+			continue // skip expressions
+		}
+		names = append(names, table.original)
+	}
+
+	if len(names) == 0 {
+		return nil, nil
+	}
+
+	result := make(map[string]*models.Collection, len(names))
+	collections := make([]*models.Collection, 0, len(names))
+
+	err := dao.CollectionQuery().
+		AndWhere(dbx.In("name", names...)).
+		All(&collections)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, table := range tables {
+		for _, collection := range collections {
+			if collection.Name == table.original {
+				result[table.alias] = collection
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// -------------------------------------------------------------------
+// Raw query identifiers parser
+// -------------------------------------------------------------------
+
+var joinReplaceRegex = regexp.MustCompile(`(?im)\s+(inner join|outer join|left join|right join|join)\s+?`)
+var discardReplaceRegex = regexp.MustCompile(`(?im)\s+(where|group by|having|order|limit|with)\s+?`)
+var commentsReplaceRegex = regexp.MustCompile(`(?m)(\/\*[\s\S]+\*\/)|(--.+$)`)
+
+type identifier struct {
+	original string
+	alias    string
+}
+
+type identifiersParser struct {
+	columns []identifier
+	tables  []identifier
+}
+
+func (p *identifiersParser) parse(selectQuery string) error {
+	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
+	str = joinReplaceRegex.ReplaceAllString(str, " _join_ ")
+	str = discardReplaceRegex.ReplaceAllString(str, " _discard_ ")
+	str = commentsReplaceRegex.ReplaceAllString(str, "")
+
+	tk := tokenizer.NewFromString(str)
+	tk.Separators(',', ' ', '\n', '\t')
+	tk.KeepSeparator(true)
+
+	var skip bool
+	var partType string
+	var activeBuilder *strings.Builder
+	var selectParts strings.Builder
+	var fromParts strings.Builder
+	var joinParts strings.Builder
+
+	for {
+		token, err := tk.Scan()
+		if err != nil {
+			if err != io.EOF {
+				return err
+			}
+			break
+		}
+
+		trimmed := strings.ToLower(strings.TrimSpace(token))
+
+		switch trimmed {
+		case "select":
+			skip = false
+			partType = "select"
+			activeBuilder = &selectParts
+		case "distinct":
+			continue // ignore as it is not important for the identifiers parsing
+		case "from":
+			skip = false
+			partType = "from"
+			activeBuilder = &fromParts
+		case "_join_":
+			skip = false
+
+			// the previous part was also a join
+			if partType == "join" {
+				joinParts.WriteString(",")
+			}
+
+			partType = "join"
+			activeBuilder = &joinParts
+		case "_discard_":
+			// skip following tokens
+			skip = true
+		default:
+			isJoin := partType == "join"
+
+			if isJoin && trimmed == "on" {
+				skip = true
+			}
+
+			if !skip && activeBuilder != nil {
+				activeBuilder.WriteString(" ")
+				activeBuilder.WriteString(token)
+			}
+		}
+	}
+
+	selects, err := extractIdentifiers(selectParts.String())
+	if err != nil {
+		return err
+	}
+
+	froms, err := extractIdentifiers(fromParts.String())
+	if err != nil {
+		return err
+	}
+
+	joins, err := extractIdentifiers(joinParts.String())
+	if err != nil {
+		return err
+	}
+
+	p.columns = selects
+	p.tables = froms
+	p.tables = append(p.tables, joins...)
+
+	return nil
+}
+
+func extractIdentifiers(rawExpression string) ([]identifier, error) {
+	rawTk := tokenizer.NewFromString(rawExpression)
+	rawTk.Separators(',')
+
+	rawIdentifiers, err := rawTk.ScanAll()
+	if err != nil {
+		return nil, err
+	}
+
+	result := make([]identifier, 0, len(rawIdentifiers))
+
+	for _, rawIdentifier := range rawIdentifiers {
+		tk := tokenizer.NewFromString(rawIdentifier)
+		tk.Separators(' ', '\n', '\t')
+
+		parts, err := tk.ScanAll()
+		if err != nil {
+			return nil, err
+		}
+
+		resolved, err := identifierFromParts(parts)
+		if err != nil {
+			return nil, err
+		}
+
+		result = append(result, resolved)
+	}
+
+	return result, nil
+}
+
+func identifierFromParts(parts []string) (identifier, error) {
+	var result identifier
+
+	switch len(parts) {
+	case 3:
+		if !strings.EqualFold(parts[1], "as") {
+			return result, fmt.Errorf(`invalid identifier part - expected "as", got %v`, parts[1])
+		}
+
+		result.original = parts[0]
+		result.alias = parts[2]
+	case 2:
+		result.original = parts[0]
+		result.alias = parts[1]
+	case 1:
+		subParts := strings.Split(parts[0], ".")
+		result.original = parts[0]
+		result.alias = subParts[len(subParts)-1]
+	default:
+		return result, fmt.Errorf(`invalid identifier parts %v`, parts)
+	}
+
+	result.original = trimRawIdentifier(result.original)
+
+	// we trim the single quote even though it is not a valid column quote character
+	// because SQLite allows it if the context expects an identifier and not string literal
+	// (https://www.sqlite.org/lang_keywords.html)
+	result.alias = trimRawIdentifier(result.alias, "'")
+
+	return result, nil
+}
+
+func trimRawIdentifier(rawIdentifier string, extraTrimChars ...string) string {
+	trimChars := "`\"[];"
+	if len(extraTrimChars) > 0 {
+		trimChars += strings.Join(extraTrimChars, "")
+	}
+
+	parts := strings.Split(rawIdentifier, ".")
+
+	for i := range parts {
+		parts[i] = strings.Trim(parts[i], trimChars)
+	}
+
+	return strings.Join(parts, ".")
+}

daos/view_test.go

@@ -0,0 +1,629 @@
+package daos_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func ensureNoTempViews(app core.App, t *testing.T) {
+	var total int
+
+	err := app.Dao().DB().Select("count(*)").
+		From("sqlite_schema").
+		AndWhere(dbx.HashExp{"type": "view"}).
+		AndWhere(dbx.NewExp(`[[name]] LIKE '%\_temp\_%' ESCAPE '\'`)).
+		Limit(1).
+		Row(&total)
+	if err != nil {
+		t.Fatalf("Failed to check for temp views: %v", err)
+	}
+
+	if total > 0 {
+		t.Fatalf("Expected all temp views to be deleted, got %d", total)
+	}
+}
+
+func TestDeleteView(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		viewName    string
+		expectError bool
+	}{
+		{"", true},
+		{"demo1", true},    // not a view table
+		{"missing", false}, // missing or already deleted
+		{"view1", false},   // existing
+		{"VieW1", false},   // view names are case insensitives
+	}
+
+	for i, s := range scenarios {
+		err := app.Dao().DeleteView(s.viewName)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%d - %q] Expected hasErr %v, got %v (%v)", i, s.viewName, s.expectError, hasErr, err)
+		}
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestSaveView(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		scenarioName  string
+		viewName      string
+		query         string
+		expectError   bool
+		expectColumns []string
+	}{
+		{
+			"empty name and query",
+			"",
+			"",
+			true,
+			nil,
+		},
+		{
+			"empty name",
+			"",
+			"select * from _admins",
+			true,
+			nil,
+		},
+		{
+			"empty query",
+			"123Test",
+			"",
+			true,
+			nil,
+		},
+		{
+			"invalid query",
+			"123Test",
+			"123 456",
+			true,
+			nil,
+		},
+		{
+			"missing table",
+			"123Test",
+			"select id from missing",
+			true,
+			nil,
+		},
+		{
+			"non select query",
+			"123Test",
+			"drop table _admins",
+			true,
+			nil,
+		},
+		{
+			"multiple select queries",
+			"123Test",
+			"select *, count(id) as c  from _admins; select * from demo1;",
+			true,
+			nil,
+		},
+		{
+			"try to break the parent parenthesis",
+			"123Test",
+			"select *, count(id) as c  from `_admins`)",
+			true,
+			nil,
+		},
+		{
+			"simple select query (+ trimmed semicolon)",
+			"123Test",
+			";select *, count(id) as c  from _admins;",
+			false,
+			[]string{
+				"id", "created", "updated",
+				"passwordHash", "tokenKey", "email",
+				"lastResetSentAt", "avatar", "c",
+			},
+		},
+		{
+			"update old view with new query",
+			"123Test",
+			"select 1 as test from _admins",
+			false,
+			[]string{"test"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.scenarioName, func(t *testing.T) {
+			err := app.Dao().SaveView(s.viewName, s.query)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			infoRows, err := app.Dao().TableInfo(s.viewName)
+			if err != nil {
+				t.Fatalf("Failed to fetch table info for %s: %v", s.viewName, err)
+			}
+
+			if len(s.expectColumns) != len(infoRows) {
+				t.Fatalf("Expected %d columns, got %d", len(s.expectColumns), len(infoRows))
+			}
+
+			for _, row := range infoRows {
+				if !list.ExistInSlice(row.Name, s.expectColumns) {
+					t.Fatalf("Missing %q column in %v", row.Name, s.expectColumns)
+				}
+			}
+		})
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestCreateViewSchemaWithDiscardedNestedTransaction(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+		_, err := txDao.CreateViewSchema("select id from missing")
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		return nil
+	})
+
+	ensureNoTempViews(app, t)
+}
+
+func TestCreateViewSchema(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		query        string
+		expectError  bool
+		expectFields map[string]string // name-type pairs
+	}{
+		{
+			"empty query",
+			"",
+			true,
+			nil,
+		},
+		{
+			"invalid query",
+			"test 123456",
+			true,
+			nil,
+		},
+		{
+			"missing table",
+			"select id from missing",
+			true,
+			nil,
+		},
+		{
+			"query with wildcard column",
+			"select a.id, a.* from demo1 a",
+			true,
+			nil,
+		},
+		{
+			"query without id",
+			"select text, url, created, updated from demo1",
+			true,
+			nil,
+		},
+		{
+			"query with comments",
+			`
+				select
+				-- test single line
+				id,
+				text,
+				/* multi
+					line comment */
+				url, created, updated from demo1
+			`,
+			false,
+			map[string]string{
+				"text": schema.FieldTypeText,
+				"url":  schema.FieldTypeUrl,
+			},
+		},
+		{
+			"query with all fields and quoted identifiers",
+			`
+				select
+					"id",
+					"created",
+					"updated",
+					[text],
+					` + "`bool`" + `,
+					"url",
+					"select_one",
+					"select_many",
+					"file_one",
+					"demo1"."file_many",
+					` + "`demo1`." + "`number`" + ` number_alias,
+					"email",
+					"datetime",
+					"json",
+					"rel_one",
+					"rel_many",
+					'single_quoted_custom_literal' as 'single_quoted_column'
+				from demo1
+			`,
+			false,
+			map[string]string{
+				"text":                 schema.FieldTypeText,
+				"bool":                 schema.FieldTypeBool,
+				"url":                  schema.FieldTypeUrl,
+				"select_one":           schema.FieldTypeSelect,
+				"select_many":          schema.FieldTypeSelect,
+				"file_one":             schema.FieldTypeFile,
+				"file_many":            schema.FieldTypeFile,
+				"number_alias":         schema.FieldTypeNumber,
+				"email":                schema.FieldTypeEmail,
+				"datetime":             schema.FieldTypeDate,
+				"json":                 schema.FieldTypeJson,
+				"rel_one":              schema.FieldTypeRelation,
+				"rel_many":             schema.FieldTypeRelation,
+				"single_quoted_column": schema.FieldTypeJson,
+			},
+		},
+		{
+			"query with indirect relations fields",
+			"select a.id, b.id as bid, b.created from demo1 as a left join demo2 b",
+			false,
+			map[string]string{
+				"bid": schema.FieldTypeRelation,
+			},
+		},
+		{
+			"query with multiple froms, joins and style of aliasses",
+			`
+				select
+					a.id as id,
+					b.id as bid,
+					lj.id cid,
+					ij.id as did,
+					a.bool,
+					_admins.id as eid,
+					_admins.email
+				from demo1 a, demo2 as b
+				left join demo3 lj on lj.id = 123
+				inner join demo4 as ij on ij.id = 123
+				join _admins
+				where 1=1
+				group by a.id
+				limit 10
+			`,
+			false,
+			map[string]string{
+				"bid":   schema.FieldTypeRelation,
+				"cid":   schema.FieldTypeRelation,
+				"did":   schema.FieldTypeRelation,
+				"bool":  schema.FieldTypeBool,
+				"eid":   schema.FieldTypeJson, // not from collection
+				"email": schema.FieldTypeJson, // not from collection
+			},
+		},
+		{
+			"query with casts",
+			`select
+				a.id,
+				count(a.id) count,
+				cast(a.id as int) cast_int,
+				cast(a.id as integer) cast_integer,
+				cast(a.id as real) cast_real,
+				cast(a.id as decimal) cast_decimal,
+				cast(a.id as numeric) cast_numeric,
+				cast(a.id as text) cast_text,
+				cast(a.id as bool) cast_bool,
+				cast(a.id as boolean) cast_boolean,
+				avg(a.id) avg,
+				sum(a.id) sum,
+				total(a.id) total,
+				min(a.id) min,
+				max(a.id) max
+			from demo1 a`,
+			false,
+			map[string]string{
+				"count":        schema.FieldTypeNumber,
+				"total":        schema.FieldTypeNumber,
+				"cast_int":     schema.FieldTypeNumber,
+				"cast_integer": schema.FieldTypeNumber,
+				"cast_real":    schema.FieldTypeNumber,
+				"cast_decimal": schema.FieldTypeNumber,
+				"cast_numeric": schema.FieldTypeNumber,
+				"cast_text":    schema.FieldTypeText,
+				"cast_bool":    schema.FieldTypeBool,
+				"cast_boolean": schema.FieldTypeBool,
+				// json because they are nullable
+				"sum": schema.FieldTypeJson,
+				"avg": schema.FieldTypeJson,
+				"min": schema.FieldTypeJson,
+				"max": schema.FieldTypeJson,
+			},
+		},
+		{
+			"query with reserved auth collection fields",
+			`
+				select
+					a.id,
+					a.username,
+					a.email,
+					a.emailVisibility,
+					a.verified,
+					demo1.id relid
+				from users a
+				left join demo1
+			`,
+			false,
+			map[string]string{
+				"username":        schema.FieldTypeText,
+				"email":           schema.FieldTypeEmail,
+				"emailVisibility": schema.FieldTypeBool,
+				"verified":        schema.FieldTypeBool,
+				"relid":           schema.FieldTypeRelation,
+			},
+		},
+		{
+			"query with unknown fields and aliases",
+			`select
+				id,
+				id as id2,
+				text as text_alias,
+				url as url_alias,
+				"demo1"."bool" as bool_alias,
+				number as number_alias,
+				created created_alias,
+				updated updated_alias,
+				123 as custom
+			from demo1`,
+			false,
+			map[string]string{
+				"id2":           schema.FieldTypeRelation,
+				"text_alias":    schema.FieldTypeText,
+				"url_alias":     schema.FieldTypeUrl,
+				"bool_alias":    schema.FieldTypeBool,
+				"number_alias":  schema.FieldTypeNumber,
+				"created_alias": schema.FieldTypeDate,
+				"updated_alias": schema.FieldTypeDate,
+				"custom":        schema.FieldTypeJson,
+			},
+		},
+		{
+			"query with distinct and reordered id column",
+			`select distinct
+				id as id2,
+				id,
+				123 as custom
+			from demo1`,
+			false,
+			map[string]string{
+				"id2":    schema.FieldTypeRelation,
+				"custom": schema.FieldTypeJson,
+			},
+		},
+		{
+			"query with aliasing the same field multiple times",
+			`select
+				a.id as id,
+				a.text as alias1,
+				a.text as alias2,
+				b.text as alias3,
+				b.text as alias4
+			from demo1 a
+			left join demo1 as b`,
+			false,
+			map[string]string{
+				"alias1": schema.FieldTypeText,
+				"alias2": schema.FieldTypeText,
+				"alias3": schema.FieldTypeText,
+				"alias4": schema.FieldTypeText,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		result, err := app.Dao().CreateViewSchema(s.query)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+			continue
+		}
+
+		if hasErr {
+			continue
+		}
+
+		if len(s.expectFields) != len(result.Fields()) {
+			serialized, _ := json.Marshal(result)
+			t.Errorf("[%s] Expected %d fields, got %d: \n%s", s.name, len(s.expectFields), len(result.Fields()), serialized)
+			continue
+		}
+
+		for name, typ := range s.expectFields {
+			field := result.GetFieldByName(name)
+
+			if field == nil {
+				t.Errorf("[%s] Expected to find field %s, got nil", s.name, name)
+				continue
+			}
+
+			if field.Type != typ {
+				t.Errorf("[%s] Expected field %s to be %q, got %s", s.name, name, typ, field.Type)
+				continue
+			}
+		}
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestFindRecordByViewFile(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	prevCollection, err := app.Dao().FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalLevels := 6
+
+	// create collection view mocks
+	fileOneAlias := "file_one one0"
+	fileManyAlias := "file_many many0"
+	mockCollections := make([]*models.Collection, 0, totalLevels)
+	for i := 0; i <= totalLevels; i++ {
+		view := new(models.Collection)
+		view.Type = models.CollectionTypeView
+		view.Name = fmt.Sprintf("_test_view%d", i)
+		view.SetOptions(&models.CollectionViewOptions{
+			Query: fmt.Sprintf(
+				"select id, %s, %s from %s",
+				fileOneAlias,
+				fileManyAlias,
+				prevCollection.Name,
+			),
+		})
+
+		// save view
+		if err := app.Dao().SaveCollection(view); err != nil {
+			t.Fatalf("Failed to save view%d: %v", i, err)
+		}
+
+		mockCollections = append(mockCollections, view)
+		prevCollection = view
+		fileOneAlias = fmt.Sprintf("one%d one%d", i, i+1)
+		fileManyAlias = fmt.Sprintf("many%d many%d", i, i+1)
+	}
+
+	fileOneName := "test_d61b33QdDU.txt"
+	fileManyName := "test_QZFjKjXchk.txt"
+	expectedRecordId := "84nmscqy84lsi1t"
+
+	scenarios := []struct {
+		name               string
+		collectionNameOrId string
+		fileFieldName      string
+		filename           string
+		expectError        bool
+		expectRecordId     string
+	}{
+		{
+			"missing collection",
+			"missing",
+			"a",
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"non-view collection",
+			"demo1",
+			"file_one",
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"view collection after the max recursion limit",
+			mockCollections[totalLevels-1].Name,
+			fmt.Sprintf("one%d", totalLevels-1),
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"first view collection (single file)",
+			mockCollections[0].Name,
+			"one0",
+			fileOneName,
+			false,
+			expectedRecordId,
+		},
+		{
+			"first view collection (many files)",
+			mockCollections[0].Name,
+			"many0",
+			fileManyName,
+			false,
+			expectedRecordId,
+		},
+
+		{
+			"last view collection before the recursion limit (single file)",
+			mockCollections[totalLevels-2].Name,
+			fmt.Sprintf("one%d", totalLevels-2),
+			fileOneName,
+			false,
+			expectedRecordId,
+		},
+		{
+			"last view collection before the recursion limit (many files)",
+			mockCollections[totalLevels-2].Name,
+			fmt.Sprintf("many%d", totalLevels-2),
+			fileManyName,
+			false,
+			expectedRecordId,
+		},
+	}
+
+	for _, s := range scenarios {
+		record, err := app.Dao().FindRecordByViewFile(
+			s.collectionNameOrId,
+			s.fileFieldName,
+			s.filename,
+		)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+			continue
+		}
+
+		if hasErr {
+			continue
+		}
+
+		if record.Id != s.expectRecordId {
+			t.Errorf("[%s] Expected recordId %q, got %q", s.name, s.expectRecordId, record.Id)
+		}
+	}
+}

examples/base/.gitignore

@@ -0,0 +1,6 @@
+# ignore everything
+/*
+
+# exclude from the ignore filter
+!.gitignore
+!main.go

examples/base/main.go

@@ -2,21 +2,122 @@ package main
 
 import (
 	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
 
-	"github.com/labstack/echo/v5"
 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/ghupdate"
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
 )
 
 func main() {
 	app := pocketbase.New()
 
+	// ---------------------------------------------------------------
+	// Optional plugin flags:
+	// ---------------------------------------------------------------
+
+	var hooksDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&hooksDir,
+		"hooksDir",
+		"",
+		"the directory with the JS app hooks",
+	)
+
+	var hooksWatch bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&hooksWatch,
+		"hooksWatch",
+		true,
+		"auto restart the app on pb_hooks file change",
+	)
+
+	var hooksPool int
+	app.RootCmd.PersistentFlags().IntVar(
+		&hooksPool,
+		"hooksPool",
+		25,
+		"the total prewarm goja.Runtime instances for the JS app hooks execution",
+	)
+
+	var migrationsDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&migrationsDir,
+		"migrationsDir",
+		"",
+		"the directory with the user defined migrations",
+	)
+
+	var automigrate bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&automigrate,
+		"automigrate",
+		true,
+		"enable/disable auto migrations",
+	)
+
+	var publicDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&publicDir,
+		"publicDir",
+		defaultPublicDir(),
+		"the directory to serve static files",
+	)
+
+	var indexFallback bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&indexFallback,
+		"indexFallback",
+		true,
+		"fallback the request to index.html on missing static path (eg. when pretty urls are used with SPA)",
+	)
+
+	var queryTimeout int
+	app.RootCmd.PersistentFlags().IntVar(
+		&queryTimeout,
+		"queryTimeout",
+		30,
+		"the default SELECT queries timeout in seconds",
+	)
+
+	app.RootCmd.ParseFlags(os.Args[1:])
+
+	// ---------------------------------------------------------------
+	// Plugins and hooks:
+	// ---------------------------------------------------------------
+
+	// load jsvm (hooks and migrations)
+	jsvm.MustRegister(app, jsvm.Config{
+		MigrationsDir: migrationsDir,
+		HooksDir:      hooksDir,
+		HooksWatch:    hooksWatch,
+		HooksPoolSize: hooksPool,
+	})
+
+	// migrate command (with js templates)
+	migratecmd.MustRegister(app, app.RootCmd, migratecmd.Config{
+		TemplateLang: migratecmd.TemplateLangJS,
+		Automigrate:  automigrate,
+		Dir:          migrationsDir,
+	})
+
+	// GitHub selfupdate
+	ghupdate.MustRegister(app, app.RootCmd, ghupdate.Config{})
+
+	app.OnAfterBootstrap().PreAdd(func(e *core.BootstrapEvent) error {
+		app.Dao().ModelQueryTimeout = time.Duration(queryTimeout) * time.Second
+		return nil
+	})
+
 	app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
 		// serves static files from the provided public dir (if exists)
-		subFs := echo.MustSubFS(e.Router.Filesystem, "pb_public")
-		e.Router.GET("/*", apis.StaticDirectoryHandler(subFs, false))
-
+		e.Router.GET("/*", apis.StaticDirectoryHandler(os.DirFS(publicDir), indexFallback))
 		return nil
 	})
 
@@ -24,3 +125,13 @@ func main() {
 		log.Fatal(err)
 	}
 }
+
+// the default pb_public dir location is relative to the executable
+func defaultPublicDir() string {
+	if strings.HasPrefix(os.Args[0], os.TempDir()) {
+		// most likely ran with go run
+		return "./pb_public"
+	}
+
+	return filepath.Join(os.Args[0], "../pb_public")
+}

forms/admin_login.go

@@ -1,6 +1,7 @@
 package forms
 
 import (
+	"database/sql"
 	"errors"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -10,72 +11,70 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminLogin specifies an admin email/pass login form.
+// AdminLogin is an admin email/pass login form.
 type AdminLogin struct {
-	config AdminLoginConfig
+	app core.App
+	dao *daos.Dao
 
-	Email    string `form:"email" json:"email"`
+	Identity string `form:"identity" json:"identity"`
 	Password string `form:"password" json:"password"`
 }
 
-// AdminLoginConfig is the [AdminLogin] factory initializer config.
+// NewAdminLogin creates a new [AdminLogin] form initialized with
+// the provided [core.App] instance.
 //
-// NB! App is a required struct member.
-type AdminLoginConfig struct {
-	App   core.App
-	TxDao *daos.Dao
-}
-
-// NewAdminLogin creates a new [AdminLogin] form with initializer
-// config created from the provided [core.App] instance.
-//
-// If you want to submit the form as part of another transaction, use
-// [NewAdminLoginWithConfig] with explicitly set TxDao.
+// If you want to submit the form as part of a transaction,
+// you can change the default Dao via [SetDao()].
 func NewAdminLogin(app core.App) *AdminLogin {
-	return NewAdminLoginWithConfig(AdminLoginConfig{
-		App: app,
-	})
+	return &AdminLogin{
+		app: app,
+		dao: app.Dao(),
+	}
 }
 
-// NewAdminLoginWithConfig creates a new [AdminLogin] form
-// with the provided config or panics on invalid configuration.
-func NewAdminLoginWithConfig(config AdminLoginConfig) *AdminLogin {
-	form := &AdminLogin{config: config}
-
-	if form.config.App == nil {
-		panic("Missing required config.App instance.")
-	}
-
-	if form.config.TxDao == nil {
-		form.config.TxDao = form.config.App.Dao()
-	}
-
-	return form
+// SetDao replaces the default form Dao instance with the provided one.
+func (form *AdminLogin) SetDao(dao *daos.Dao) {
+	form.dao = dao
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *AdminLogin) Validate() error {
 	return validation.ValidateStruct(form,
-		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.Email),
+		validation.Field(&form.Identity, validation.Required, validation.Length(1, 255), is.EmailFormat),
 		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
 	)
 }
 
 // Submit validates and submits the admin form.
 // On success returns the authorized admin model.
-func (form *AdminLogin) Submit() (*models.Admin, error) {
+//
+// You can optionally provide a list of InterceptorFunc to
+// further modify the form behavior before persisting it.
+func (form *AdminLogin) Submit(interceptors ...InterceptorFunc[*models.Admin]) (*models.Admin, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
 
-	admin, err := form.config.TxDao.FindAdminByEmail(form.Email)
-	if err != nil {
-		return nil, err
+	admin, fetchErr := form.dao.FindAdminByEmail(form.Identity)
+
+	// ignore not found errors to allow custom fetch implementations
+	if fetchErr != nil && !errors.Is(fetchErr, sql.ErrNoRows) {
+		return nil, fetchErr
 	}
 
-	if admin.ValidatePassword(form.Password) {
-		return admin, nil
+	interceptorsErr := runInterceptors(admin, func(m *models.Admin) error {
+		admin = m
+
+		if admin == nil || !admin.ValidatePassword(form.Password) {
+			return errors.New("Invalid login credentials.")
+		}
+
+		return nil
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
-	return nil, errors.New("Invalid login credentials.")
+	return admin, nil
 }

forms/admin_login_test.go

@@ -1,54 +1,17 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestAdminLoginPanic(t *testing.T) {
-	defer func() {
-		if recover() == nil {
-			t.Fatal("The form did not panic")
-		}
-	}()
+func TestAdminLoginValidateAndSubmit(t *testing.T) {
+	t.Parallel()
 
-	forms.NewAdminLogin(nil)
-}
-
-func TestAdminLoginValidate(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	form := forms.NewAdminLogin(app)
-
-	scenarios := []struct {
-		email       string
-		password    string
-		expectError bool
-	}{
-		{"", "", true},
-		{"", "123", true},
-		{"test@example.com", "", true},
-		{"test", "123", true},
-		{"test@example.com", "123", false},
-	}
-
-	for i, s := range scenarios {
-		form.Email = s.email
-		form.Password = s.password
-
-		err := form.Validate()
-
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
-		}
-	}
-}
-
-func TestAdminLoginSubmit(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -62,14 +25,14 @@ func TestAdminLoginSubmit(t *testing.T) {
 		{"", "", true},
 		{"", "1234567890", true},
 		{"test@example.com", "", true},
-		{"test", "1234567890", true},
+		{"test", "test", true},
 		{"missing@example.com", "1234567890", true},
 		{"test@example.com", "123456789", true},
 		{"test@example.com", "1234567890", false},
 	}
 
 	for i, s := range scenarios {
-		form.Email = s.email
+		form.Identity = s.email
 		form.Password = s.password
 
 		admin, err := form.Submit()
@@ -88,3 +51,50 @@ func TestAdminLoginSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminLoginInterceptors(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	form := forms.NewAdminLogin(testApp)
+	form.Identity = "test@example.com"
+	form.Password = "123456"
+	var interceptorAdmin *models.Admin
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorAdmin = admin
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorAdmin == nil || interceptorAdmin.Email != form.Identity {
+		t.Fatalf("Expected Admin model with email %s, got %v", form.Identity, interceptorAdmin)
+	}
+}

forms/admin_password_reset_confirm.go

@@ -8,55 +8,41 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminPasswordResetConfirm specifies an admin password reset confirmation form.
+// AdminPasswordResetConfirm is an admin password reset confirmation form.
 type AdminPasswordResetConfirm struct {
-	config AdminPasswordResetConfirmConfig
+	app core.App
+	dao *daos.Dao
 
 	Token           string `form:"token" json:"token"`
 	Password        string `form:"password" json:"password"`
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// AdminPasswordResetConfirmConfig is the [AdminPasswordResetConfirm] factory initializer config.
-//
-// NB! App is required struct member.
-type AdminPasswordResetConfirmConfig struct {
-	App   core.App
-	TxDao *daos.Dao
-}
-
 // NewAdminPasswordResetConfirm creates a new [AdminPasswordResetConfirm]
-// form with initializer config created from the provided [core.App] instance.
+// form initialized with from the provided [core.App] instance.
 //
-// If you want to submit the form as part of another transaction, use
-// [NewAdminPasswordResetConfirmWithConfig] with explicitly set TxDao.
+// If you want to submit the form as part of a transaction,
+// you can change the default Dao via [SetDao()].
 func NewAdminPasswordResetConfirm(app core.App) *AdminPasswordResetConfirm {
-	return NewAdminPasswordResetConfirmWithConfig(AdminPasswordResetConfirmConfig{
-		App: app,
-	})
+	return &AdminPasswordResetConfirm{
+		app: app,
+		dao: app.Dao(),
+	}
 }
 
-// NewAdminPasswordResetConfirmWithConfig creates a new [AdminPasswordResetConfirm]
-// form with the provided config or panics on invalid configuration.
-func NewAdminPasswordResetConfirmWithConfig(config AdminPasswordResetConfirmConfig) *AdminPasswordResetConfirm {
-	form := &AdminPasswordResetConfirm{config: config}
-
-	if form.config.App == nil {
-		panic("Missing required config.App instance.")
-	}
-
-	if form.config.TxDao == nil {
-		form.config.TxDao = form.config.App.Dao()
-	}
-
-	return form
+// SetDao replaces the form Dao instance with the provided one.
+//
+// This is useful if you want to use a specific transaction Dao instance
+// instead of the default app.Dao().
+func (form *AdminPasswordResetConfirm) SetDao(dao *daos.Dao) {
+	form.dao = dao
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *AdminPasswordResetConfirm) Validate() error {
 	return validation.ValidateStruct(form,
 		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
-		validation.Field(&form.Password, validation.Required, validation.Length(10, 100)),
+		validation.Field(&form.Password, validation.Required, validation.Length(10, 72)),
 		validation.Field(&form.PasswordConfirm, validation.Required, validation.By(validators.Compare(form.Password))),
 	)
 }
@@ -67,10 +53,7 @@ func (form *AdminPasswordResetConfirm) checkToken(value any) error {
 		return nil // nothing to check
 	}
 
-	admin, err := form.config.TxDao.FindAdminByToken(
-		v,
-		form.config.App.Settings().AdminPasswordResetToken.Secret,
-	)
+	admin, err := form.dao.FindAdminByToken(v, form.app.Settings().AdminPasswordResetToken.Secret)
 	if err != nil || admin == nil {
 		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
 	}
@@ -80,14 +63,17 @@ func (form *AdminPasswordResetConfirm) checkToken(value any) error {
 
 // Submit validates and submits the admin password reset confirmation form.
 // On success returns the updated admin model associated to `form.Token`.
-func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
+//
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *AdminPasswordResetConfirm) Submit(interceptors ...InterceptorFunc[*models.Admin]) (*models.Admin, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
 
-	admin, err := form.config.TxDao.FindAdminByToken(
+	admin, err := form.dao.FindAdminByToken(
 		form.Token,
-		form.config.App.Settings().AdminPasswordResetToken.Secret,
+		form.app.Settings().AdminPasswordResetToken.Secret,
 	)
 	if err != nil {
 		return nil, err
@@ -97,8 +83,13 @@ func (form *AdminPasswordResetConfirm) Submit() (*models.Admin, error) {
 		return nil, err
 	}
 
-	if err := form.config.TxDao.SaveAdmin(admin); err != nil {
-		return nil, err
+	interceptorsErr := runInterceptors(admin, func(m *models.Admin) error {
+		admin = m
+		return form.dao.SaveAdmin(m)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
 	return admin, nil

forms/admin_password_reset_confirm_test.go

@@ -1,24 +1,18 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
 
-func TestAdminPasswordResetPanic(t *testing.T) {
-	defer func() {
-		if recover() == nil {
-			t.Fatal("The form did not panic")
-		}
-	}()
+func TestAdminPasswordResetConfirmValidateAndSubmit(t *testing.T) {
+	t.Parallel()
 
-	forms.NewAdminPasswordResetConfirm(nil)
-}
-
-func TestAdminPasswordResetConfirmValidate(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -38,16 +32,23 @@ func TestAdminPasswordResetConfirmValidate(t *testing.T) {
 		{"test", "123", "123", true},
 		{
 			// expired
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MTY0MDk5MTY2MX0.GLwCOsgWTTEKXTK-AyGW838de1OeZGIjfHH0FoRLqZg",
 			"1234567890",
 			"1234567890",
 			true,
 		},
 		{
-			// valid
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg5MzQ3NDAwMH0.72IhlL_5CpNGE0ZKM7sV9aAKa3wxQaMZdDiHBo0orpw",
-			"1234567890",
+			// valid with mismatched passwords
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
 			"1234567890",
+			"1234567891",
+			true,
+		},
+		{
+			// valid with matching passwords
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc",
+			"1234567891",
+			"1234567891",
 			false,
 		},
 	}
@@ -57,59 +58,29 @@ func TestAdminPasswordResetConfirmValidate(t *testing.T) {
 		form.Password = s.password
 		form.PasswordConfirm = s.passwordConfirm
 
-		err := form.Validate()
-
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
+				interceptorCalls++
+				return next(m)
+			}
 		}
-	}
-}
 
-func TestAdminPasswordResetConfirmSubmit(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
+		admin, err := form.Submit(interceptor)
 
-	form := forms.NewAdminPasswordResetConfirm(app)
-
-	scenarios := []struct {
-		token           string
-		password        string
-		passwordConfirm string
-		expectError     bool
-	}{
-		{"", "", "", true},
-		{"", "123", "", true},
-		{"", "", "123", true},
-		{"test", "", "", true},
-		{"test", "123", "", true},
-		{"test", "123", "123", true},
-		{
-			// expired
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTY0MTAxMzIwMH0.Gp_1b5WVhqjj2o3nJhNUlJmpdiwFLXN72LbMP-26gjA",
-			"1234567890",
-			"1234567890",
-			true,
-		},
-		{
-			// valid
-			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJiNGE5N2NjLTNmODMtNGQwMS1hMjZiLTNkNzdiYzg0MmQzYyIsInR5cGUiOiJhZG1pbiIsImV4cCI6MTg5MzQ3NDAwMH0.72IhlL_5CpNGE0ZKM7sV9aAKa3wxQaMZdDiHBo0orpw",
-			"1234567890",
-			"1234567890",
-			false,
-		},
-	}
-
-	for i, s := range scenarios {
-		form.Token = s.token
-		form.Password = s.password
-		form.PasswordConfirm = s.passwordConfirm
-
-		admin, err := form.Submit()
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
 			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+			continue
 		}
 
 		if s.expectError {
@@ -128,3 +99,56 @@ func TestAdminPasswordResetConfirmSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminPasswordResetConfirmInterceptors(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewAdminPasswordResetConfirm(testApp)
+	form.Token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhZG1pbiIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4MTYwMH0.kwFEler6KSMKJNstuaSDvE1QnNdCta5qSnjaIQ0hhhc"
+	form.Password = "1234567891"
+	form.PasswordConfirm = "1234567891"
+	interceptorTokenKey := admin.TokenKey
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorTokenKey = admin.TokenKey
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorTokenKey == admin.TokenKey {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/admin_password_reset_request.go

@@ -2,6 +2,7 @@ package forms
 
 import (
 	"errors"
+	"fmt"
 	"time"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
@@ -9,51 +10,35 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
-// AdminPasswordResetRequest specifies an admin password reset request form.
+// AdminPasswordResetRequest is an admin password reset request form.
 type AdminPasswordResetRequest struct {
-	config AdminPasswordResetRequestConfig
+	app             core.App
+	dao             *daos.Dao
+	resendThreshold float64 // in seconds
 
 	Email string `form:"email" json:"email"`
 }
 
-// AdminPasswordResetRequestConfig is the [AdminPasswordResetRequest] factory initializer config.
-//
-// NB! App is required struct member.
-type AdminPasswordResetRequestConfig struct {
-	App             core.App
-	TxDao           *daos.Dao
-	ResendThreshold float64 // in seconds
-}
-
 // NewAdminPasswordResetRequest creates a new [AdminPasswordResetRequest]
-// form with initializer config created from the provided [core.App] instance.
+// form initialized with from the provided [core.App] instance.
 //
-// If you want to submit the form as part of another transaction, use
-// [NewAdminPasswordResetRequestWithConfig] with explicitly set TxDao.
+// If you want to submit the form as part of a transaction,
+// you can change the default Dao via [SetDao()].
 func NewAdminPasswordResetRequest(app core.App) *AdminPasswordResetRequest {
-	return NewAdminPasswordResetRequestWithConfig(AdminPasswordResetRequestConfig{
-		App:             app,
-		ResendThreshold: 120, // 2min
-	})
+	return &AdminPasswordResetRequest{
+		app:             app,
+		dao:             app.Dao(),
+		resendThreshold: 120, // 2min
+	}
 }
 
-// NewAdminPasswordResetRequestWithConfig creates a new [AdminPasswordResetRequest]
-// form with the provided config or panics on invalid configuration.
-func NewAdminPasswordResetRequestWithConfig(config AdminPasswordResetRequestConfig) *AdminPasswordResetRequest {
-	form := &AdminPasswordResetRequest{config: config}
-
-	if form.config.App == nil {
-		panic("Missing required config.App instance.")
-	}
-
-	if form.config.TxDao == nil {
-		form.config.TxDao = form.config.App.Dao()
-	}
-
-	return form
+// SetDao replaces the default form Dao instance with the provided one.
+func (form *AdminPasswordResetRequest) SetDao(dao *daos.Dao) {
+	form.dao = dao
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -65,35 +50,40 @@ func (form *AdminPasswordResetRequest) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 		),
 	)
 }
 
 // Submit validates and submits the form.
 // On success sends a password reset email to the `form.Email` admin.
-func (form *AdminPasswordResetRequest) Submit() error {
+//
+// You can optionally provide a list of InterceptorFunc to further
+// modify the form behavior before persisting it.
+func (form *AdminPasswordResetRequest) Submit(interceptors ...InterceptorFunc[*models.Admin]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	admin, err := form.config.TxDao.FindAdminByEmail(form.Email)
+	admin, err := form.dao.FindAdminByEmail(form.Email)
 	if err != nil {
-		return err
+		return fmt.Errorf("Failed to fetch admin with email %s: %w", form.Email, err)
 	}
 
 	now := time.Now().UTC()
 	lastResetSentAt := admin.LastResetSentAt.Time()
-	if now.Sub(lastResetSentAt).Seconds() < form.config.ResendThreshold {
+	if now.Sub(lastResetSentAt).Seconds() < form.resendThreshold {
 		return errors.New("You have already requested a password reset.")
 	}
 
-	if err := mails.SendAdminPasswordReset(form.config.App, admin); err != nil {
-		return err
-	}
+	return runInterceptors(admin, func(m *models.Admin) error {
+		if err := mails.SendAdminPasswordReset(form.app, m); err != nil {
+			return err
+		}
 
-	// update last sent timestamp
-	admin.LastResetSentAt = types.NowDateTime()
+		// update last sent timestamp
+		m.LastResetSentAt = types.NowDateTime()
 
-	return form.config.TxDao.SaveAdmin(admin)
+		return form.dao.SaveAdmin(m)
+	}, interceptors...)
 }

forms/admin_password_reset_request_test.go

@@ -1,52 +1,17 @@
 package forms_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestAdminPasswordResetRequestPanic(t *testing.T) {
-	defer func() {
-		if recover() == nil {
-			t.Fatal("The form did not panic")
-		}
-	}()
+func TestAdminPasswordResetRequestValidateAndSubmit(t *testing.T) {
+	t.Parallel()
 
-	forms.NewAdminPasswordResetRequest(nil)
-}
-
-func TestAdminPasswordResetRequestValidate(t *testing.T) {
-	testApp, _ := tests.NewTestApp()
-	defer testApp.Cleanup()
-
-	form := forms.NewAdminPasswordResetRequest(testApp)
-
-	scenarios := []struct {
-		email       string
-		expectError bool
-	}{
-		{"", true},
-		{"", true},
-		{"invalid", true},
-		{"missing@example.com", false}, // doesn't check for existing admin
-		{"test@example.com", false},
-	}
-
-	for i, s := range scenarios {
-		form.Email = s.email
-
-		err := form.Validate()
-
-		hasErr := err != nil
-		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
-		}
-	}
-}
-
-func TestAdminPasswordResetRequestSubmit(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
 
@@ -70,7 +35,24 @@ func TestAdminPasswordResetRequestSubmit(t *testing.T) {
 
 		adminBefore, _ := testApp.Dao().FindAdminByEmail(s.email)
 
-		err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
+				interceptorCalls++
+				return next(m)
+			}
+		}
+
+		err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -92,3 +74,54 @@ func TestAdminPasswordResetRequestSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestAdminPasswordResetRequestInterceptors(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	admin, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewAdminPasswordResetRequest(testApp)
+	form.Email = admin.Email
+	interceptorLastResetSentAt := admin.LastResetSentAt
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptor1Called = true
+			return next(admin)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(admin *models.Admin) error {
+			interceptorLastResetSentAt = admin.LastResetSentAt
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorLastResetSentAt.String() != admin.LastResetSentAt.String() {
+		t.Fatalf("Expected the form model to NOT be filled before calling the interceptors")
+	}
+}

forms/admin_upsert.go

@@ -9,10 +9,11 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 )
 
-// AdminUpsert specifies a [models.Admin] upsert (create/update) form.
+// AdminUpsert is a [models.Admin] upsert (create/update) form.
 type AdminUpsert struct {
-	config AdminUpsertConfig
-	admin  *models.Admin
+	app   core.App
+	dao   *daos.Dao
+	admin *models.Admin
 
 	Id              string `form:"id" json:"id"`
 	Avatar          int    `form:"avatar" json:"avatar"`
@@ -21,41 +22,17 @@ type AdminUpsert struct {
 	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
 }
 
-// AdminUpsertConfig is the [AdminUpsert] factory initializer config.
-//
-// NB! App is a required struct member.
-type AdminUpsertConfig struct {
-	App   core.App
-	TxDao *daos.Dao
-}
-
 // NewAdminUpsert creates a new [AdminUpsert] form with initializer
 // config created from the provided [core.App] and [models.Admin] instances
 // (for create you could pass a pointer to an empty Admin - `&models.Admin{}`).
 //
-// If you want to submit the form as part of another transaction, use
-// [NewAdminUpsertWithConfig] with explicitly set TxDao.
+// If you want to submit the form as part of a transaction,
+// you can change the default Dao via [SetDao()].
 func NewAdminUpsert(app core.App, admin *models.Admin) *AdminUpsert {
-	return NewAdminUpsertWithConfig(AdminUpsertConfig{
-		App: app,
-	}, admin)
-}
-
-// NewAdminUpsertWithConfig creates a new [AdminUpsert] form
-// with the provided config and [models.Admin] instance or panics on invalid configuration
-// (for create you could pass a pointer to an empty Admin - `&models.Admin{}`).
-func NewAdminUpsertWithConfig(config AdminUpsertConfig, admin *models.Admin) *AdminUpsert {
 	form := &AdminUpsert{
-		config: config,
-		admin:  admin,
-	}
-
-	if form.config.App == nil || form.admin == nil {
-		panic("Invalid initializer config or nil upsert model.")
-	}
-
-	if form.config.TxDao == nil {
-		form.config.TxDao = form.config.App.Dao()
+		app:   app,
+		dao:   app.Dao(),
+		admin: admin,
 	}
 
 	// load defaults
@@ -66,6 +43,11 @@ func NewAdminUpsertWithConfig(config AdminUpsertConfig, admin *models.Admin) *Ad
 	return form
 }
 
+// SetDao replaces the default form Dao instance with the provided one.
+func (form *AdminUpsert) SetDao(dao *daos.Dao) {
+	form.dao = dao
+}
+
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
 func (form *AdminUpsert) Validate() error {
 	return validation.ValidateStruct(form,
@@ -75,6 +57,7 @@ func (form *AdminUpsert) Validate() error {
 				form.admin.IsNew(),
 				validation.Length(models.DefaultIdLength, models.DefaultIdLength),
 				validation.Match(idRegex),
+				validation.By(validators.UniqueId(form.dao, form.admin.TableName())),
 			).Else(validation.In(form.admin.Id)),
 		),
 		validation.Field(
@@ -86,13 +69,13 @@ func (form *AdminUpsert) Validate() error {
 			&form.Email,
 			validation.Required,
 			validation.Length(1, 255),
-			is.Email,
+			is.EmailFormat,
 			validation.By(form.checkUniqueEmail),
 		),
 		validation.Field(
 			&form.Password,
 			validation.When(form.admin.IsNew(), validation.Required),
-			validation.Length(10, 100),
+			validation.Length(10, 72),
 		),
 		validation.Field(
 			&form.PasswordConfirm,
@@ -105,7 +88,7 @@ func (form *AdminUpsert) Validate() error {
 func (form *AdminUpsert) checkUniqueEmail(value any) error {
 	v, _ := value.(string)
 
-	if form.config.TxDao.IsAdminEmailUnique(v, form.admin.Id) {
+	if form.dao.IsAdminEmailUnique(v, form.admin.Id) {
 		return nil
 	}
 
@@ -116,7 +99,7 @@ func (form *AdminUpsert) checkUniqueEmail(value any) error {
 //
 // You can optionally provide a list of InterceptorFunc to further
 // modify the form behavior before persisting it.
-func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
+func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc[*models.Admin]) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -134,7 +117,7 @@ func (form *AdminUpsert) Submit(interceptors ...InterceptorFunc) error {
 		form.admin.SetPassword(form.Password)
 	}
 
-	return runInterceptors(func() error {
-		return form.config.TxDao.SaveAdmin(form.admin)
+	return runInterceptors(form.admin, func(admin *models.Admin) error {
+		return form.dao.SaveAdmin(admin)
 	}, interceptors...)
 }

forms/admin_upsert_test.go

@@ -6,36 +6,14 @@ import (
 	"fmt"
 	"testing"
 
-	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
-func TestAdminUpsertPanic1(t *testing.T) {
-	defer func() {
-		if recover() == nil {
-			t.Fatal("The form did not panic")
-		}
-	}()
-
-	forms.NewAdminUpsert(nil, nil)
-}
-
-func TestAdminUpsertPanic2(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
-
-	defer func() {
-		if recover() == nil {
-			t.Fatal("The form did not panic")
-		}
-	}()
-
-	forms.NewAdminUpsert(app, nil)
-}
-
 func TestNewAdminUpsert(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -54,125 +32,9 @@ func TestNewAdminUpsert(t *testing.T) {
 	}
 }
 
-func TestAdminUpsertValidate(t *testing.T) {
-	app, _ := tests.NewTestApp()
-	defer app.Cleanup()
+func TestAdminUpsertValidateAndSubmit(t *testing.T) {
+	t.Parallel()
 
-	scenarios := []struct {
-		id              string
-		avatar          int
-		email           string
-		password        string
-		passwordConfirm string
-		expectedErrors  int
-	}{
-		{
-			"",
-			-1,
-			"",
-			"",
-			"",
-			3,
-		},
-		{
-			"",
-			10,
-			"invalid",
-			"12345678",
-			"87654321",
-			4,
-		},
-		{
-			// existing email
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
-			3,
-			"test2@example.com",
-			"1234567890",
-			"1234567890",
-			1,
-		},
-		{
-			// mismatching passwords
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
-			3,
-			"test@example.com",
-			"1234567890",
-			"1234567891",
-			1,
-		},
-		{
-			// create without setting password
-			"",
-			9,
-			"test_create@example.com",
-			"",
-			"",
-			1,
-		},
-		{
-			// create with existing email
-			"",
-			9,
-			"test@example.com",
-			"1234567890!",
-			"1234567890!",
-			1,
-		},
-		{
-			// update without setting password
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
-			3,
-			"test_update@example.com",
-			"",
-			"",
-			0,
-		},
-		{
-			// create with password
-			"",
-			9,
-			"test_create@example.com",
-			"1234567890!",
-			"1234567890!",
-			0,
-		},
-		{
-			// update with password
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
-			4,
-			"test_update@example.com",
-			"1234567890",
-			"1234567890",
-			0,
-		},
-	}
-
-	for i, s := range scenarios {
-		admin := &models.Admin{}
-		if s.id != "" {
-			admin, _ = app.Dao().FindAdminById(s.id)
-		}
-
-		form := forms.NewAdminUpsert(app, admin)
-		form.Avatar = s.avatar
-		form.Email = s.email
-		form.Password = s.password
-		form.PasswordConfirm = s.passwordConfirm
-
-		result := form.Validate()
-		errs, ok := result.(validation.Errors)
-		if !ok && result != nil {
-			t.Errorf("(%d) Failed to parse errors %v", i, result)
-			continue
-		}
-
-		if len(errs) != s.expectedErrors {
-			t.Errorf("(%d) Expected %d errors, got %d (%v)", i, s.expectedErrors, len(errs), errs)
-		}
-	}
-}
-
-func TestAdminUpsertSubmit(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -189,7 +51,7 @@ func TestAdminUpsertSubmit(t *testing.T) {
 		},
 		{
 			// update empty
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			"sywbhecnh46rhm0",
 			`{}`,
 			false,
 		},
@@ -225,7 +87,7 @@ func TestAdminUpsertSubmit(t *testing.T) {
 		},
 		{
 			// update failure - existing email
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			"sywbhecnh46rhm0",
 			`{
 				"email": "test2@example.com"
 			}`,
@@ -233,7 +95,7 @@ func TestAdminUpsertSubmit(t *testing.T) {
 		},
 		{
 			// update failure - mismatching passwords
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			"sywbhecnh46rhm0",
 			`{
 				"password":        "1234567890",
 				"passwordConfirm": "1234567891"
@@ -241,16 +103,16 @@ func TestAdminUpsertSubmit(t *testing.T) {
 			true,
 		},
 		{
-			// update succcess - new email
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			// update success - new email
+			"sywbhecnh46rhm0",
 			`{
 				"email": "test_update@example.com"
 			}`,
 			false,
 		},
 		{
-			// update succcess - new password
-			"2b4a97cc-3f83-4d01-a26b-3d77bc842d3c",
+			// update success - new password
+			"sywbhecnh46rhm0",
 			`{
 				"password":        "1234567890",
 				"passwordConfirm": "1234567890"
@@ -279,10 +141,10 @@ func TestAdminUpsertSubmit(t *testing.T) {
 
 		interceptorCalls := 0
 
-		err := form.Submit(func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-			return func() error {
+		err := form.Submit(func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+			return func(m *models.Admin) error {
 				interceptorCalls++
-				return next()
+				return next(m)
 			}
 		})
 
@@ -325,6 +187,8 @@ func TestAdminUpsertSubmit(t *testing.T) {
 }
 
 func TestAdminUpsertSubmitInterceptors(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
@@ -338,16 +202,16 @@ func TestAdminUpsertSubmitInterceptors(t *testing.T) {
 	interceptorAdminEmail := ""
 
 	interceptor1Called := false
-	interceptor1 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor1 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
 			interceptor1Called = true
-			return next()
+			return next(m)
 		}
 	}
 
 	interceptor2Called := false
-	interceptor2 := func(next forms.InterceptorNextFunc) forms.InterceptorNextFunc {
-		return func() error {
+	interceptor2 := func(next forms.InterceptorNextFunc[*models.Admin]) forms.InterceptorNextFunc[*models.Admin] {
+		return func(m *models.Admin) error {
 			interceptorAdminEmail = admin.Email // to check if the record was filled
 			interceptor2Called = true
 			return testErr
@@ -373,6 +237,8 @@ func TestAdminUpsertSubmitInterceptors(t *testing.T) {
 }
 
 func TestAdminUpsertWithCustomId(t *testing.T) {
+	t.Parallel()
+
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 

forms/apple_client_secret_create.go

@@ -0,0 +1,87 @@
+package forms
+
+import (
+	"regexp"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+var privateKeyRegex = regexp.MustCompile(`(?m)-----BEGIN PRIVATE KEY----[\s\S]+-----END PRIVATE KEY-----`)
+
+// AppleClientSecretCreate is a form struct to generate a new Apple Client Secret.
+//
+// Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+type AppleClientSecretCreate struct {
+	app core.App
+
+	// ClientId is the identifier of your app (aka. Service ID).
+	ClientId string `form:"clientId" json:"clientId"`
+
+	// TeamId is a 10-character string associated with your developer account
+	// (usually could be found next to your name in the Apple Developer site).
+	TeamId string `form:"teamId" json:"teamId"`
+
+	// KeyId is a 10-character key identifier generated for the "Sign in with Apple"
+	// private key associated with your developer account.
+	KeyId string `form:"keyId" json:"keyId"`
+
+	// PrivateKey is the private key associated to your app.
+	// Usually wrapped within -----BEGIN PRIVATE KEY----- X -----END PRIVATE KEY-----.
+	PrivateKey string `form:"privateKey" json:"privateKey"`
+
+	// Duration specifies how long the generated JWT should be considered valid.
+	// The specified value must be in seconds and max 15777000 (~6months).
+	Duration int `form:"duration" json:"duration"`
+}
+
+// NewAppleClientSecretCreate creates a new [AppleClientSecretCreate] form with initializer
+// config created from the provided [core.App] instances.
+func NewAppleClientSecretCreate(app core.App) *AppleClientSecretCreate {
+	form := &AppleClientSecretCreate{
+		app: app,
+	}
+
+	return form
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *AppleClientSecretCreate) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.ClientId, validation.Required),
+		validation.Field(&form.TeamId, validation.Required, validation.Length(10, 10)),
+		validation.Field(&form.KeyId, validation.Required, validation.Length(10, 10)),
+		validation.Field(&form.PrivateKey, validation.Required, validation.Match(privateKeyRegex)),
+		validation.Field(&form.Duration, validation.Required, validation.Min(1), validation.Max(15777000)),
+	)
+}
+
+// Submit validates the form and returns a new Apple Client Secret JWT.
+func (form *AppleClientSecretCreate) Submit() (string, error) {
+	if err := form.Validate(); err != nil {
+		return "", err
+	}
+
+	signKey, err := jwt.ParseECPrivateKeyFromPEM([]byte(strings.TrimSpace(form.PrivateKey)))
+	if err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+
+	claims := &jwt.RegisteredClaims{
+		Audience:  jwt.ClaimStrings{"https://appleid.apple.com"},
+		Subject:   form.ClientId,
+		Issuer:    form.TeamId,
+		IssuedAt:  jwt.NewNumericDate(now),
+		ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(form.Duration) * time.Second)),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	token.Header["kid"] = form.KeyId
+
+	return token.SignedString(signKey)
+}