updated go deps

.github/SECURITY.md

@@ -0,0 +1,5 @@
+# Security
+
+If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
+
+All reports will be promptly addressed, and you'll be credited accordingly.

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '>=1.19.3'
+          go-version: '>=1.19.4'
 
       # This step usually is not needed because the /ui/dist is pregenerated locally
       # but its here to ensure that each release embeds the latest admin ui artifacts.

.gitignore

@@ -6,10 +6,6 @@
 # goreleaser builds folder
 /.builds/
 
-# examples app directories
-pb_data
-pb_public
-
 # tests coverage
 coverage.out
 

CHANGELOG.md

@@ -1,3 +1,237 @@
+## v0.10.3
+
+- ! Renamed the metadata key `original_filename` to `original-filename` due to an S3 file upload error caused by the underscore character ([#1343](https://github.com/pocketbase/pocketbase/pull/1343); thanks @yuxiang-gao).
+
+- Fixed request verification docs api url ([#1332](https://github.com/pocketbase/pocketbase/pull/1332); thanks @JoyMajumdar2001)
+
+- Excluded `collectionId` and `collectionName` from the displayable relation props list ([1322](https://github.com/pocketbase/pocketbase/issues/1322); thanks @dhall2).
+
+
+## v0.10.2
+
+- Fixed nested multiple expands with shared path ([#586](https://github.com/pocketbase/pocketbase/issues/586#issuecomment-1357784227)).
+  A new helper method `models.Record.MergeExpand(map[string]any)` was also added to simplify the expand handling and unit testing.
+
+
+## v0.10.1
+
+- Fixed nested transactions deadlock when authenticating with OAuth2 ([#1291](https://github.com/pocketbase/pocketbase/issues/1291)).
+
+
+## v0.10.0
+
+- Added `/api/health` endpoint (thanks @MarvinJWendt).
+
+- Added support for SMTP `LOGIN` auth for Microsoft/Outlook and other providers that don't support the `PLAIN` auth method ([#1217](https://github.com/pocketbase/pocketbase/discussions/1217#discussioncomment-4387970)).
+
+- Reduced memory consumption (you can expect ~20% less allocated memory).
+
+- Added support for split (concurrent and nonconcurrent) DB connections pool increasing even further the concurrent throughput without blocking reads on heavy write load.
+
+- Improved record references delete performance.
+
+- Removed the unnecessary parenthesis in the generated filter SQL query, reducing the "_parse stack overflow_" errors.
+
+- Fixed `~` expressions backslash literal escaping ([#1231](https://github.com/pocketbase/pocketbase/discussions/1231)).
+
+- Refactored the `core.app.Bootstrap()` to be called before starting the cobra commands ([#1267](https://github.com/pocketbase/pocketbase/discussions/1267)).
+
+- ! Changed `pocketbase.NewWithConfig(config Config)` to `pocketbase.NewWithConfig(config *Config)` and added 4 new config settings:
+  ```go
+  DataMaxOpenConns int // default to core.DefaultDataMaxOpenConns
+  DataMaxIdleConns int // default to core.DefaultDataMaxIdleConns
+  LogsMaxOpenConns int // default to core.DefaultLogsMaxOpenConns
+  LogsMaxIdleConns int // default to core.DefaultLogsMaxIdleConns
+  ```
+
+- Added new helper method `core.App.IsBootstrapped()` to check the current app bootstrap state.
+
+- ! Changed `core.NewBaseApp(dir, encryptionEnv, isDebug)` to `NewBaseApp(config *BaseAppConfig)`.
+
+- ! Removed `rest.UploadedFile` struct (see below `filesystem.File`).
+
+- Added generic file resource struct that allows loading and uploading file content from
+  different sources (at the moment multipart/form-data requests and from the local filesystem).
+  ```
+  filesystem.File{}
+  filesystem.NewFileFromPath(path)
+  filesystem.NewFileFromMultipart(multipartHeader)
+  filesystem/System.UploadFile(file)
+  ```
+
+- Refactored `forms.RecordUpsert` to allow more easily loading and removing files programmatically.
+  ```
+  forms.RecordUpsert.AddFiles(key, filesystem.File...) // add new filesystem.File to the form for upload
+  forms.RecordUpsert.RemoveFiles(key, filenames...)     // marks the filenames for deletion
+  ```
+
+- Trigger the `password` validators if any of the others password change fields is set.
+
+
+## v0.9.2
+
+- Fixed field column name conflict on record deletion ([#1220](https://github.com/pocketbase/pocketbase/discussions/1220)).
+
+
+## v0.9.1
+
+- Moved the record file upload and delete out of the db transaction to minimize the locking times.
+
+- Added `Dao` query semaphore and base fail/retry handling to improve the concurrent writes throughput ([#1187](https://github.com/pocketbase/pocketbase/issues/1187)).
+
+- Fixed records cascade deletion when there are "A<->B" relation references.
+
+- Replaced `c.QueryString()` with `c.QueryParams().Encode()` to allow loading middleware modified query parameters in the default crud actions ([#1210](https://github.com/pocketbase/pocketbase/discussions/1210)).
+
+- Fixed the datetime field not triggering the `onChange` event on manual field edit and added a "Clear" button ([#1219](https://github.com/pocketbase/pocketbase/issues/1219)).
+
+- Updated the GitHub goreleaser action to use go 1.19.4 since it comes with [some security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.19.4+label%3ACherryPickApproved).
+
+
+## v0.9.0
+
+- Fixed concurrent multi-relation cascade update/delete ([#1138](https://github.com/pocketbase/pocketbase/issues/1138)).
+
+- Added the raw OAuth2 user data (`meta.rawUser`) and OAuth2 access token (`meta.accessToken`) to the auth response ([#654](https://github.com/pocketbase/pocketbase/discussions/654)).
+
+- `BaseModel.UnmarkAsNew()` method was renamed to `BaseModel.MarkAsNotNew()`.
+  Additionally, to simplify the insert model queries with custom IDs, it is no longer required to call `MarkAsNew()` for manually initialized models with set ID since now this is the default state.
+  When the model is populated with values from the database (eg. after row `Scan`) it will be marked automatically as "not new".
+
+- Added `Record.OriginalCopy()` method that returns a new `Record` copy populated with the initially loaded record data (useful if you want to compare old and new field values).
+
+- Added new event hooks:
+  ```go
+  app.OnBeforeBootstrap()
+  app.OnAfterBootstrap()
+  app.OnBeforeApiError()
+  app.OnAfterApiError()
+  app.OnRealtimeDisconnectRequest()
+  app.OnRealtimeBeforeMessageSend()
+  app.OnRealtimeAfterMessageSend()
+  app.OnRecordBeforeRequestPasswordResetRequest()
+  app.OnRecordAfterRequestPasswordResetRequest()
+  app.OnRecordBeforeConfirmPasswordResetRequest()
+  app.OnRecordAfterConfirmPasswordResetRequest()
+  app.OnRecordBeforeRequestVerificationRequest()
+  app.OnRecordAfterRequestVerificationRequest()
+  app.OnRecordBeforeConfirmVerificationRequest()
+  app.OnRecordAfterConfirmVerificationRequest()
+  app.OnRecordBeforeRequestEmailChangeRequest()
+  app.OnRecordAfterRequestEmailChangeRequest()
+  app.OnRecordBeforeConfirmEmailChangeRequest()
+  app.OnRecordAfterConfirmEmailChangeRequest()
+  ```
+
+- The original uploaded file name is now stored as metadata under the `original_filename` key. It could be accessed via:
+  ```go
+  fs, _ := app.NewFilesystem()
+  defer fs.Close()
+
+  attrs, _ := fs.Attributes(fikeKey)
+  attrs.Metadata["original_name"]
+  ```
+
+- Added support for `Partial/Range` file requests ([#1125](https://github.com/pocketbase/pocketbase/issues/1125)).
+  This is a minor breaking change if you are using `filesystem.Serve` (eg. as part of a custom `OnFileDownloadRequest` hook):
+  ```go
+  // old
+  filesystem.Serve(res, e.ServedPath, e.ServedName)
+
+  // new
+  filesystem.Serve(res, req, e.ServedPath, e.ServedName)
+  ```
+
+- Refactored the `migrate` command to support **external JavaScript migration files** using an embedded JS interpreter ([goja](https://github.com/dop251/goja)).
+  This allow writing custom migration scripts such as programmatically creating collections,
+  initializing default settings, running data imports, etc., with a JavaScript API very similar to the Go one (_more documentation will be available soon_).
+
+  The `migrate` command is available by default for the prebuilt executable,
+  but if you use PocketBase as framework you need register it manually:
+  ```go
+  migrationsDir := "" // default to "pb_migrations" (for js) and "migrations" (for go)
+
+  // load js files if you want to allow loading external JavaScript migrations
+  jsvm.MustRegisterMigrations(app, &jsvm.MigrationsOptions{
+    Dir: migrationsDir,
+  })
+
+  // register the `migrate` command
+  migratecmd.MustRegister(app, app.RootCmd, &migratecmd.Options{
+    TemplateLang: migratecmd.TemplateLangJS, // or migratecmd.TemplateLangGo (default)
+    Dir:          migrationsDir,
+    Automigrate:  true,
+  })
+  ```
+
+  **The refactoring also comes with automigrations support.**
+
+  If `Automigrate` is enabled (`true` by default for the prebuilt executable; can be disabled with `--automigrate=0`),
+  PocketBase will generate seamlessly in the background JS (or Go) migration file with your collection changes.
+  **The directory with the JS migrations can be committed to your git repo.**
+  All migrations (Go and JS) are automatically executed on server start.
+  Also note that the auto generated migrations are granural (in contrast to the `migrate collections` snapshot command)
+  and allow multiple developers to do changes on the collections independently (even editing the same collection) miniziming the eventual merge conflicts.
+  Here is a sample JS migration file that will be generated if you for example edit a single collection name:
+  ```js
+  // pb_migrations/1669663597_updated_posts_old.js
+  migrate((db) => {
+    // up
+    const dao = new Dao(db)
+    const collection = dao.findCollectionByNameOrId("lngf8rb3dqu86r3")
+    collection.name = "posts_new"
+    return dao.saveCollection(collection)
+  }, (db) => {
+    // down
+    const dao = new Dao(db)
+    const collection = dao.findCollectionByNameOrId("lngf8rb3dqu86r3")
+    collection.name = "posts_old"
+    return dao.saveCollection(collection)
+  })
+  ```
+
+- Added new `Dao` helpers to make it easier fetching and updating the app settings from a migration:
+  ```go
+  dao.FindSettings([optEncryptionKey])
+  dao.SaveSettings(newSettings, [optEncryptionKey])
+  ```
+
+- Moved `core.Settings` to `models/settings.Settings`:
+  ```
+  core.Settings{}           -> settings.Settings{}
+  core.NewSettings()        -> settings.New()
+  core.MetaConfig{}         -> settings.MetaConfig{}
+  core.LogsConfig{}         -> settings.LogsConfig{}
+  core.SmtpConfig{}         -> settings.SmtpConfig{}
+  core.S3Config{}           -> settings.S3Config{}
+  core.TokenConfig{}        -> settings.TokenConfig{}
+  core.AuthProviderConfig{} -> settings.AuthProviderConfig{}
+  ```
+
+- Changed the `mailer.Mailer` interface (**minor breaking if you are sending custom emails**):
+  ```go
+  // Old:
+  app.NewMailClient().Send(from, to, subject, html, attachments?)
+
+  // New:
+  app.NewMailClient().Send(&mailer.Message{
+    From: from,
+    To: to,
+    Subject: subject,
+    HTML: html,
+    Attachments: attachments,
+    // new configurable fields
+    Bcc: []string{"bcc1@example.com", "bcc2@example.com"},
+    Cc: []string{"cc1@example.com", "cc2@example.com"},
+    Headers: map[string]string{"Custom-Header": "test"},
+    Text: "custom plain text version",
+  })
+  ```
+  The new `*mailer.Message` struct is also now a member of the `MailerRecordEvent` and `MailerAdminEvent` events.
+
+- Other minor UI fixes and improvements
+
+
 ## v0.8.0
 
 **⚠️ This release contains breaking changes and requires some manual migration steps!**
@@ -12,7 +246,7 @@ In addition to the `Users` and `profiles` merge, this release comes with several
 
 - The `json` field type now supports filtering and sorting [#423](https://github.com/pocketbase/pocketbase/issues/423#issuecomment-1258302125).
 
-- The `relation` field now allows unlimitted `maxSelect` (aka. without upper limit).
+- The `relation` field now allows unlimited `maxSelect` (aka. without upper limit).
 
 - Added support for combined email/username + password authentication (see below `authWithPassword()`).
 
@@ -648,7 +882,7 @@ Please check the individual SDK package changelog and apply the necessary change
     </tr>
   </table>
 
-- Marked as "Deprecated" and will be removed in v0.9:
+- Marked as "Deprecated" and will be removed in v0.9+:
     ```
     core.Settings.EmailAuth{}
     core.EmailAuthConfig{}

README.md

@@ -110,7 +110,7 @@ Check also the [Testing guide](http://pocketbase.io/docs/testing) to learn how t
 
 If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
 
-All reports will be promptly addressed and you'll be credited accordingly.
+All reports will be promptly addressed, and you'll be credited accordingly.
 
 
 ## Contributing

apis/admin.go

@@ -120,7 +120,7 @@ func (api *adminApi) list(c echo.Context) error {
 
 	result, err := search.NewProvider(fieldResolver).
 		Query(api.app.Dao().AdminQuery()).
-		ParseAndExec(c.QueryString(), &admins)
+		ParseAndExec(c.QueryParams().Encode(), &admins)
 
 	if err != nil {
 		return NewBadRequestError("", err)

apis/base.go

@@ -64,19 +64,27 @@ func InitApi(app core.App) (*echo.Echo, error) {
 			apiErr = NewBadRequestError("", err)
 		}
 
-		// Send response
-		var cErr error
-		if c.Request().Method == http.MethodHead {
-			// @see https://github.com/labstack/echo/issues/608
-			cErr = c.NoContent(apiErr.Code)
-		} else {
-			cErr = c.JSON(apiErr.Code, apiErr)
+		event := &core.ApiErrorEvent{
+			HttpContext: c,
+			Error:       apiErr,
 		}
 
+		// send error response
+		hookErr := app.OnBeforeApiError().Trigger(event, func(e *core.ApiErrorEvent) error {
+			// @see https://github.com/labstack/echo/issues/608
+			if e.HttpContext.Request().Method == http.MethodHead {
+				return e.HttpContext.NoContent(apiErr.Code)
+			}
+
+			return e.HttpContext.JSON(apiErr.Code, apiErr)
+		})
+
 		// truly rare case; eg. client already disconnected
-		if cErr != nil && app.IsDebug() {
-			log.Println(cErr)
+		if hookErr != nil && app.IsDebug() {
+			log.Println(hookErr)
 		}
+
+		app.OnAfterApiError().Trigger(event)
 	}
 
 	// admin ui routes
@@ -92,6 +100,7 @@ func InitApi(app core.App) (*echo.Echo, error) {
 	bindFileApi(app, api)
 	bindRealtimeApi(app, api)
 	bindLogsApi(app, api)
+	bindHealthApi(app, api)
 
 	// trigger the custom BeforeServe hook for the created api router
 	// allowing users to further adjust its options or register new routes

apis/collection.go

@@ -36,7 +36,7 @@ func (api *collectionApi) list(c echo.Context) error {
 
 	result, err := search.NewProvider(fieldResolver).
 		Query(api.app.Dao().CollectionQuery()).
-		ParseAndExec(c.QueryString(), &collections)
+		ParseAndExec(c.QueryParams().Encode(), &collections)
 
 	if err != nil {
 		return NewBadRequestError("", err)

apis/file.go

@@ -94,7 +94,9 @@ func (api *fileApi) download(c echo.Context) error {
 	}
 
 	return api.app.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadEvent) error {
-		if err := fs.Serve(e.HttpContext.Response(), e.ServedPath, e.ServedName); err != nil {
+		res := e.HttpContext.Response()
+		req := e.HttpContext.Request()
+		if err := fs.Serve(res, req, e.ServedPath, e.ServedName); err != nil {
 			return NewNotFoundError("", err)
 		}
 

apis/health.go

@@ -0,0 +1,30 @@
+package apis
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v5"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// bindHealthApi registers the health api endpoint.
+func bindHealthApi(app core.App, rg *echo.Group) {
+	api := healthApi{app: app}
+
+	subGroup := rg.Group("/health")
+	subGroup.GET("", api.healthCheck)
+}
+
+type healthApi struct {
+	app core.App
+}
+
+// healthCheck returns a 200 OK response if the server is healthy.
+func (api *healthApi) healthCheck(c echo.Context) error {
+	payload := map[string]any{
+		"code":    http.StatusOK,
+		"message": "API is healthy.",
+	}
+
+	return c.JSON(http.StatusOK, payload)
+}

apis/health_test.go

@@ -0,0 +1,26 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestHealthAPI(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "health status returns 200",
+			Method:         http.MethodGet,
+			Url:            "/api/health",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"code":200`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

apis/logs.go

@@ -35,7 +35,7 @@ func (api *logsApi) requestsList(c echo.Context) error {
 
 	result, err := search.NewProvider(fieldResolver).
 		Query(api.app.LogsDao().RequestQuery()).
-		ParseAndExec(c.QueryString(), &[]*models.Request{})
+		ParseAndExec(c.QueryParams().Encode(), &[]*models.Request{})
 
 	if err != nil {
 		return NewBadRequestError("", err)

apis/middlewares.go

@@ -333,19 +333,8 @@ func ActivityLogger(app core.App) echo.MiddlewareFunc {
 			model.RefreshUpdated()
 
 			routine.FireAndForget(func() {
-				attempts := 1
-
-			BeginSave:
-				logErr := app.LogsDao().SaveRequest(model)
-				if logErr != nil {
-					// try one more time after 10s in case of SQLITE_BUSY or "database is locked" error
-					if attempts <= 2 {
-						attempts++
-						time.Sleep(10 * time.Second)
-						goto BeginSave
-					} else if app.IsDebug() {
-						log.Println("Log save failed:", logErr)
-					}
+				if err := app.LogsDao().SaveRequest(model); err != nil && app.IsDebug() {
+					log.Println("Log save failed:", err)
 				}
 
 				// Delete old request logs

apis/realtime.go

@@ -42,7 +42,14 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	// register new subscription client
 	client := subscriptions.NewDefaultClient()
 	api.app.SubscriptionsBroker().Register(client)
-	defer api.app.SubscriptionsBroker().Unregister(client.Id())
+	defer func() {
+		api.app.OnRealtimeDisconnectRequest().Trigger(&core.RealtimeDisconnectEvent{
+			HttpContext: c,
+			Client:      client,
+		})
+
+		api.app.SubscriptionsBroker().Unregister(client.Id())
+	}()
 
 	c.Response().Header().Set("Content-Type", "text/event-stream; charset=UTF-8")
 	c.Response().Header().Set("Cache-Control", "no-store")
@@ -51,12 +58,12 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
 	c.Response().Header().Set("X-Accel-Buffering", "no")
 
-	event := &core.RealtimeConnectEvent{
+	connectEvent := &core.RealtimeConnectEvent{
 		HttpContext: c,
 		Client:      client,
 	}
 
-	if err := api.app.OnRealtimeConnectRequest().Trigger(event); err != nil {
+	if err := api.app.OnRealtimeConnectRequest().Trigger(connectEvent); err != nil {
 		return err
 	}
 
@@ -65,10 +72,31 @@ func (api *realtimeApi) connect(c echo.Context) error {
 	}
 
 	// signalize established connection (aka. fire "connect" message)
-	fmt.Fprint(c.Response(), "id:"+client.Id()+"\n")
-	fmt.Fprint(c.Response(), "event:PB_CONNECT\n")
-	fmt.Fprint(c.Response(), "data:{\"clientId\":\""+client.Id()+"\"}\n\n")
-	c.Response().Flush()
+	connectMsgEvent := &core.RealtimeMessageEvent{
+		HttpContext: c,
+		Client:      client,
+		Message: &subscriptions.Message{
+			Name: "PB_CONNECT",
+			Data: `{"clientId":"` + client.Id() + `"}`,
+		},
+	}
+	connectMsgErr := api.app.OnRealtimeBeforeMessageSend().Trigger(connectMsgEvent, func(e *core.RealtimeMessageEvent) error {
+		w := e.HttpContext.Response()
+		fmt.Fprint(w, "id:"+client.Id()+"\n")
+		fmt.Fprint(w, "event:"+e.Message.Name+"\n")
+		fmt.Fprint(w, "data:"+e.Message.Data+"\n\n")
+		w.Flush()
+		return nil
+	})
+	if connectMsgErr != nil {
+		if api.app.IsDebug() {
+			log.Println("Realtime connection closed (failed to deliver PB_CONNECT):", client.Id(), connectMsgErr)
+		}
+		return nil
+	}
+	if err := api.app.OnRealtimeAfterMessageSend().Trigger(connectMsgEvent); err != nil && api.app.IsDebug() {
+		log.Println("OnRealtimeAfterMessageSend PB_CONNECT error:", err)
+	}
 
 	// start an idle timer to keep track of inactive/forgotten connections
 	idleDuration := 5 * time.Minute
@@ -88,11 +116,29 @@ func (api *realtimeApi) connect(c echo.Context) error {
 				return nil
 			}
 
-			w := c.Response()
-			fmt.Fprint(w, "id:"+client.Id()+"\n")
-			fmt.Fprint(w, "event:"+msg.Name+"\n")
-			fmt.Fprint(w, "data:"+msg.Data+"\n\n")
-			w.Flush()
+			msgEvent := &core.RealtimeMessageEvent{
+				HttpContext: c,
+				Client:      client,
+				Message:     &msg,
+			}
+			msgErr := api.app.OnRealtimeBeforeMessageSend().Trigger(msgEvent, func(e *core.RealtimeMessageEvent) error {
+				w := e.HttpContext.Response()
+				fmt.Fprint(w, "id:"+e.Client.Id()+"\n")
+				fmt.Fprint(w, "event:"+e.Message.Name+"\n")
+				fmt.Fprint(w, "data:"+e.Message.Data+"\n\n")
+				w.Flush()
+				return nil
+			})
+			if msgErr != nil {
+				if api.app.IsDebug() {
+					log.Println("Realtime connection closed (failed to deliver message):", client.Id(), msgErr)
+				}
+				return nil
+			}
+
+			if err := api.app.OnRealtimeAfterMessageSend().Trigger(msgEvent); err != nil && api.app.IsDebug() {
+				log.Println("OnRealtimeAfterMessageSend error:", err)
+			}
 
 			idleTimer.Stop()
 			idleTimer.Reset(idleDuration)

apis/realtime_test.go

@@ -1,6 +1,7 @@
 package apis_test
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 	"testing"
@@ -10,6 +11,7 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )
 
@@ -25,7 +27,56 @@ func TestRealtimeConnect(t *testing.T) {
 				`data:{"clientId":`,
 			},
 			ExpectedEvents: map[string]int{
-				"OnRealtimeConnectRequest": 1,
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeAfterMessageSend":  1,
+				"OnRealtimeDisconnectRequest": 1,
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "PB_CONNECT interrupt",
+			Method:         http.MethodGet,
+			Url:            "/api/realtime",
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeDisconnectRequest": 1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnRealtimeBeforeMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+					if e.Message.Name == "PB_CONNECT" {
+						return errors.New("PB_CONNECT error")
+					}
+					return nil
+				})
+			},
+			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "Skipping/ignoring messages",
+			Method:         http.MethodGet,
+			Url:            "/api/realtime",
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"OnRealtimeConnectRequest":    1,
+				"OnRealtimeBeforeMessageSend": 1,
+				"OnRealtimeAfterMessageSend":  1,
+				"OnRealtimeDisconnectRequest": 1,
+			},
+			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
+				app.OnRealtimeBeforeMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+					return hook.StopPropagation
+				})
 			},
 			AfterTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				if len(app.SubscriptionsBroker().Clients()) != 0 {

apis/record_auth.go

@@ -231,7 +231,7 @@ func (api *recordAuthApi) authWithOAuth2(c echo.Context) error {
 			}
 
 			if _, err := txDao.FindRecordById(collection.Id, createForm.Id, createRuleFunc); err != nil {
-				return fmt.Errorf("Failed create rule constraint: %v", err)
+				return fmt.Errorf("Failed create rule constraint: %w", err)
 			}
 
 			return nil
@@ -283,15 +283,39 @@ func (api *recordAuthApi) requestPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	// run in background because we don't need to show
-	// the result to the user (prevents users enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
+	event := &core.RecordRequestPasswordResetEvent{
+		HttpContext: c,
+	}
+
+	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil && api.app.IsDebug() {
+						log.Println(err)
+					}
+				})
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
 		}
 	})
 
-	return c.NoContent(http.StatusNoContent)
+	if submitErr == nil {
+		api.app.OnRecordAfterRequestPasswordResetRequest().Trigger(event)
+	} else if api.app.IsDebug() {
+		log.Println(submitErr)
+	}
+
+	// don't return the response error to prevent emails enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return nil
 }
 
 func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
@@ -305,12 +329,29 @@ func (api *recordAuthApi) confirmPasswordReset(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	_, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("Failed to set new password.", submitErr)
+	event := &core.RecordConfirmPasswordResetEvent{
+		HttpContext: c,
 	}
 
-	return c.NoContent(http.StatusNoContent)
+	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to set new password.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		api.app.OnRecordAfterConfirmPasswordResetRequest().Trigger(event)
+	}
+
+	return submitErr
 }
 
 func (api *recordAuthApi) requestVerification(c echo.Context) error {
@@ -328,15 +369,39 @@ func (api *recordAuthApi) requestVerification(c echo.Context) error {
 		return NewBadRequestError("An error occurred while validating the form.", err)
 	}
 
-	// run in background because we don't need to show
-	// the result to the user (prevents users enumeration)
-	routine.FireAndForget(func() {
-		if err := form.Submit(); err != nil && api.app.IsDebug() {
-			log.Println(err)
+	event := &core.RecordRequestVerificationEvent{
+		HttpContext: c,
+	}
+
+	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationEvent) error {
+				// run in background because we don't need to show the result to the client
+				routine.FireAndForget(func() {
+					if err := next(e.Record); err != nil && api.app.IsDebug() {
+						log.Println(err)
+					}
+				})
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
 		}
 	})
 
-	return c.NoContent(http.StatusNoContent)
+	if submitErr == nil {
+		api.app.OnRecordAfterRequestVerificationRequest().Trigger(event)
+	} else if api.app.IsDebug() {
+		log.Println(submitErr)
+	}
+
+	// don't return the response error to prevent emails enumeration
+	if !c.Response().Committed {
+		c.NoContent(http.StatusNoContent)
+	}
+
+	return nil
 }
 
 func (api *recordAuthApi) confirmVerification(c echo.Context) error {
@@ -350,12 +415,29 @@ func (api *recordAuthApi) confirmVerification(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	_, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("An error occurred while submitting the form.", submitErr)
+	event := &core.RecordConfirmVerificationEvent{
+		HttpContext: c,
 	}
 
-	return c.NoContent(http.StatusNoContent)
+	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("An error occurred while submitting the form.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		api.app.OnRecordAfterConfirmVerificationRequest().Trigger(event)
+	}
+
+	return submitErr
 }
 
 func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
@@ -369,11 +451,28 @@ func (api *recordAuthApi) requestEmailChange(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", err)
 	}
 
-	if err := form.Submit(); err != nil {
-		return NewBadRequestError("Failed to request email change.", err)
+	event := &core.RecordRequestEmailChangeEvent{
+		HttpContext: c,
+		Record:      record,
 	}
 
-	return c.NoContent(http.StatusNoContent)
+	submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			return api.app.OnRecordBeforeRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to request email change.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		api.app.OnRecordAfterRequestEmailChangeRequest().Trigger(event)
+	}
+
+	return submitErr
 }
 
 func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
@@ -387,12 +486,29 @@ func (api *recordAuthApi) confirmEmailChange(c echo.Context) error {
 		return NewBadRequestError("An error occurred while loading the submitted data.", readErr)
 	}
 
-	_, submitErr := form.Submit()
-	if submitErr != nil {
-		return NewBadRequestError("Failed to confirm email change.", submitErr)
+	event := &core.RecordConfirmEmailChangeEvent{
+		HttpContext: c,
 	}
 
-	return c.NoContent(http.StatusNoContent)
+	_, submitErr := form.Submit(func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			event.Record = record
+
+			return api.app.OnRecordBeforeConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeEvent) error {
+				if err := next(e.Record); err != nil {
+					return NewBadRequestError("Failed to confirm email change.", err)
+				}
+
+				return e.HttpContext.NoContent(http.StatusNoContent)
+			})
+		}
+	})
+
+	if submitErr == nil {
+		api.app.OnRecordAfterConfirmEmailChangeRequest().Trigger(event)
+	}
+
+	return submitErr
 }
 
 func (api *recordAuthApi) listExternalAuths(c echo.Context) error {

apis/record_auth_test.go

@@ -346,10 +346,12 @@ func TestRecordAuthRequestPasswordReset(t *testing.T) {
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                   1,
-				"OnModelAfterUpdate":                    1,
-				"OnMailerBeforeRecordResetPasswordSend": 1,
-				"OnMailerAfterRecordResetPasswordSend":  1,
+				"OnModelBeforeUpdate":                       1,
+				"OnModelAfterUpdate":                        1,
+				"OnRecordBeforeRequestPasswordResetRequest": 1,
+				"OnRecordAfterRequestPasswordResetRequest":  1,
+				"OnMailerBeforeRecordResetPasswordSend":     1,
+				"OnMailerAfterRecordResetPasswordSend":      1,
 			},
 		},
 		{
@@ -466,8 +468,10 @@ func TestRecordAuthConfirmPasswordReset(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":  1,
-				"OnModelBeforeUpdate": 1,
+				"OnModelAfterUpdate":                        1,
+				"OnModelBeforeUpdate":                       1,
+				"OnRecordBeforeConfirmPasswordResetRequest": 1,
+				"OnRecordAfterConfirmPasswordResetRequest":  1,
 			},
 		},
 	}
@@ -518,6 +522,10 @@ func TestRecordAuthRequestVerification(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeRequestVerificationRequest": 1,
+				"OnRecordAfterRequestVerificationRequest":  1,
+			},
 		},
 		{
 			Name:           "existing auth record",
@@ -527,10 +535,12 @@ func TestRecordAuthRequestVerification(t *testing.T) {
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelBeforeUpdate":                  1,
-				"OnModelAfterUpdate":                   1,
-				"OnMailerBeforeRecordVerificationSend": 1,
-				"OnMailerAfterRecordVerificationSend":  1,
+				"OnModelBeforeUpdate":                      1,
+				"OnModelAfterUpdate":                       1,
+				"OnRecordBeforeRequestVerificationRequest": 1,
+				"OnRecordAfterRequestVerificationRequest":  1,
+				"OnMailerBeforeRecordVerificationSend":     1,
+				"OnMailerAfterRecordVerificationSend":      1,
 			},
 		},
 		{
@@ -540,6 +550,10 @@ func TestRecordAuthRequestVerification(t *testing.T) {
 			Body:           strings.NewReader(`{"email":"test@example.com"}`),
 			Delay:          100 * time.Millisecond,
 			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				// "OnRecordBeforeRequestVerificationRequest": 1,
+				// "OnRecordAfterRequestVerificationRequest":  1,
+			},
 			BeforeTestFunc: func(t *testing.T, app *tests.TestApp, e *echo.Echo) {
 				// simulate recent verification sent
 				authRecord, err := app.Dao().FindFirstRecordByData("users", "email", "test@example.com")
@@ -627,8 +641,10 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":  1,
-				"OnModelBeforeUpdate": 1,
+				"OnModelAfterUpdate":                       1,
+				"OnModelBeforeUpdate":                      1,
+				"OnRecordBeforeConfirmVerificationRequest": 1,
+				"OnRecordAfterConfirmVerificationRequest":  1,
 			},
 		},
 		{
@@ -639,7 +655,10 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsImVtYWlsIjoidGVzdDJAZXhhbXBsZS5jb20iLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJ0eXBlIjoiYXV0aFJlY29yZCIsImV4cCI6MjIwODk4NTI2MX0.PsOABmYUzGbd088g8iIBL4-pf7DUZm0W5Ju6lL5JVRg"
 			}`),
 			ExpectedStatus: 204,
-			ExpectedEvents: map[string]int{},
+			ExpectedEvents: map[string]int{
+				"OnRecordBeforeConfirmVerificationRequest": 1,
+				"OnRecordAfterConfirmVerificationRequest":  1,
+			},
 		},
 		{
 			Name:   "valid verification token from a collection without allowed login",
@@ -651,8 +670,10 @@ func TestRecordAuthConfirmVerification(t *testing.T) {
 			ExpectedStatus:  204,
 			ExpectedContent: []string{},
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":  1,
-				"OnModelBeforeUpdate": 1,
+				"OnModelAfterUpdate":                       1,
+				"OnModelBeforeUpdate":                      1,
+				"OnRecordBeforeConfirmVerificationRequest": 1,
+				"OnRecordAfterConfirmVerificationRequest":  1,
 			},
 		},
 	}
@@ -751,8 +772,10 @@ func TestRecordAuthRequestEmailChange(t *testing.T) {
 			},
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnMailerBeforeRecordChangeEmailSend": 1,
-				"OnMailerAfterRecordChangeEmailSend":  1,
+				"OnMailerBeforeRecordChangeEmailSend":     1,
+				"OnMailerAfterRecordChangeEmailSend":      1,
+				"OnRecordBeforeRequestEmailChangeRequest": 1,
+				"OnRecordAfterRequestEmailChangeRequest":  1,
 			},
 		},
 	}
@@ -833,8 +856,10 @@ func TestRecordAuthConfirmEmailChange(t *testing.T) {
 			}`),
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterUpdate":  1,
-				"OnModelBeforeUpdate": 1,
+				"OnModelAfterUpdate":                      1,
+				"OnModelBeforeUpdate":                     1,
+				"OnRecordBeforeConfirmEmailChangeRequest": 1,
+				"OnRecordAfterConfirmEmailChangeRequest":  1,
 			},
 		},
 		{

apis/record_crud.go

@@ -74,7 +74,7 @@ func (api *recordApi) list(c echo.Context) error {
 	}
 
 	var rawRecords = []dbx.NullStringMap{}
-	result, err := searchProvider.ParseAndExec(c.QueryString(), &rawRecords)
+	result, err := searchProvider.ParseAndExec(c.QueryParams().Encode(), &rawRecords)
 	if err != nil {
 		return NewBadRequestError("Invalid filter parameters.", err)
 	}
@@ -191,7 +191,7 @@ func (api *recordApi) create(c echo.Context) error {
 		testErr := testForm.DrySubmit(func(txDao *daos.Dao) error {
 			foundRecord, err := txDao.FindRecordById(collection.Id, testRecord.Id, createRuleFunc)
 			if err != nil {
-				return fmt.Errorf("DrySubmit create rule failure: %v", err)
+				return fmt.Errorf("DrySubmit create rule failure: %w", err)
 			}
 			hasFullManageAccess = hasAuthManageAccess(txDao, foundRecord, requestData)
 			return nil

apis/record_crud_test.go

@@ -684,7 +684,7 @@ func TestRecordCrudDelete(t *testing.T) {
 			},
 		},
 		{
-			Name:   "authenticated record that does match the collection delete rule",
+			Name:   "authenticated record that match the collection delete rule",
 			Method: http.MethodDelete,
 			Url:    "/api/collections/users/records/4q1xlclmfloku33",
 			RequestHeaders: map[string]string{
@@ -693,9 +693,9 @@ func TestRecordCrudDelete(t *testing.T) {
 			},
 			ExpectedStatus: 204,
 			ExpectedEvents: map[string]int{
-				"OnModelAfterDelete":          1,
+				"OnModelAfterDelete":          3, // +2 because of the external auths
+				"OnModelBeforeDelete":         3, // +2 because of the external auths
 				"OnModelAfterUpdate":          1,
-				"OnModelBeforeDelete":         1,
 				"OnModelBeforeUpdate":         1,
 				"OnRecordAfterDeleteRequest":  1,
 				"OnRecordBeforeDeleteRequest": 1,
@@ -731,7 +731,7 @@ func TestRecordCrudDelete(t *testing.T) {
 			ExpectedEvents: map[string]int{
 				"OnRecordBeforeDeleteRequest": 1,
 				"OnModelBeforeUpdate":         1, // self_rel_many update of test1 record
-				"OnModelBeforeDelete":         1, // rel_one_cascade of test1 record
+				"OnModelBeforeDelete":         2, // the record itself + rel_one_cascade of test1 record
 			},
 		},
 		{

apis/record_helpers.go

@@ -62,7 +62,7 @@ func EnrichRecords(c echo.Context, dao *daos.Dao, records []*models.Record, defa
 	requestData := RequestData(c)
 
 	if err := autoIgnoreAuthRecordsEmailVisibility(dao, records, requestData); err != nil {
-		return fmt.Errorf("Failed to resolve email visibility: %v", err)
+		return fmt.Errorf("Failed to resolve email visibility: %w", err)
 	}
 
 	expands := defaultExpands
@@ -138,10 +138,10 @@ func autoIgnoreAuthRecordsEmailVisibility(
 	collection := records[0].Collection()
 
 	mappedRecords := make(map[string]*models.Record, len(records))
-	recordIds := make([]any, 0, len(records))
-	for _, rec := range records {
+	recordIds := make([]any, len(records))
+	for i, rec := range records {
 		mappedRecords[rec.Id] = rec
-		recordIds = append(recordIds, rec.Id)
+		recordIds[i] = rec.Id
 	}
 
 	if requestData != nil && requestData.AuthRecord != nil && mappedRecords[requestData.AuthRecord.Id] != nil {

apis/settings_test.go

@@ -127,7 +127,7 @@ func TestSettingsSet(t *testing.T) {
 				`"twitchAuth":{`,
 				`"secret":"******"`,
 				`"clientSecret":"******"`,
-				`"appName":"Acme"`,
+				`"appName":"acme_test"`,
 			},
 			ExpectedEvents: map[string]int{
 				"OnModelBeforeUpdate":           1,
@@ -303,12 +303,12 @@ func TestSettingsTestEmail(t *testing.T) {
 					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if app.TestMailer.LastToAddress.Address != "test@example.com" {
-					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				if app.TestMailer.LastMessage.To.Address != "test@example.com" {
+					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To.Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastHtmlBody, "Verify") {
-					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Verify") {
+					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,
@@ -334,12 +334,12 @@ func TestSettingsTestEmail(t *testing.T) {
 					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if app.TestMailer.LastToAddress.Address != "test@example.com" {
-					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				if app.TestMailer.LastMessage.To.Address != "test@example.com" {
+					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To.Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastHtmlBody, "Reset password") {
-					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Reset password") {
+					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,
@@ -365,12 +365,12 @@ func TestSettingsTestEmail(t *testing.T) {
 					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend)
 				}
 
-				if app.TestMailer.LastToAddress.Address != "test@example.com" {
-					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastToAddress.Address)
+				if app.TestMailer.LastMessage.To.Address != "test@example.com" {
+					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage.To.Address)
 				}
 
-				if !strings.Contains(app.TestMailer.LastHtmlBody, "Confirm new email") {
-					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastHtmlSubject, app.TestMailer.LastHtmlBody)
+				if !strings.Contains(app.TestMailer.LastMessage.HTML, "Confirm new email") {
+					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastMessage.Subject, app.TestMailer.LastMessage.HTML)
 				}
 			},
 			ExpectedStatus:  204,

cmd/migrate.go

@@ -1,241 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"path"
-	"time"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/daos"
-	"github.com/pocketbase/pocketbase/migrations"
-	"github.com/pocketbase/pocketbase/migrations/logs"
-	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/tools/inflector"
-	"github.com/pocketbase/pocketbase/tools/migrate"
-	"github.com/spf13/cobra"
-)
-
-// NewMigrateCommand creates and returns new command for handling DB migrations.
-func NewMigrateCommand(app core.App) *cobra.Command {
-	desc := `
-Supported arguments are:
-- up                   - runs all available migrations.
-- down [number]        - reverts the last [number] applied migrations.
-- create name [folder] - creates new migration template file.
-- collections [folder] - (Experimental) creates new migration file with the most recent local collections configuration.
-`
-	var databaseFlag string
-
-	command := &cobra.Command{
-		Use:       "migrate",
-		Short:     "Executes DB migration scripts",
-		ValidArgs: []string{"up", "down", "create", "collections"},
-		Long:      desc,
-		Run: func(command *cobra.Command, args []string) {
-			cmd := ""
-			if len(args) > 0 {
-				cmd = args[0]
-			}
-
-			// additional commands
-			// ---
-			if cmd == "create" {
-				if err := migrateCreateHandler(defaultMigrateCreateTemplate, args[1:]); err != nil {
-					log.Fatal(err)
-				}
-				return
-			}
-			if cmd == "collections" {
-				if err := migrateCollectionsHandler(app, args[1:]); err != nil {
-					log.Fatal(err)
-				}
-				return
-			}
-			// ---
-
-			// normalize
-			if databaseFlag != "logs" {
-				databaseFlag = "db"
-			}
-
-			connections := migrationsConnectionsMap(app)
-
-			runner, err := migrate.NewRunner(
-				connections[databaseFlag].DB,
-				connections[databaseFlag].MigrationsList,
-			)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			if err := runner.Run(args...); err != nil {
-				log.Fatal(err)
-			}
-		},
-	}
-
-	command.PersistentFlags().StringVar(
-		&databaseFlag,
-		"database",
-		"db",
-		"specify the database connection to use (db or logs)",
-	)
-
-	return command
-}
-
-type migrationsConnection struct {
-	DB             *dbx.DB
-	MigrationsList migrate.MigrationsList
-}
-
-func migrationsConnectionsMap(app core.App) map[string]migrationsConnection {
-	return map[string]migrationsConnection{
-		"db": {
-			DB:             app.DB(),
-			MigrationsList: migrations.AppMigrations,
-		},
-		"logs": {
-			DB:             app.LogsDB(),
-			MigrationsList: logs.LogsMigrations,
-		},
-	}
-}
-
-// -------------------------------------------------------------------
-// migrate create
-// -------------------------------------------------------------------
-
-const defaultMigrateCreateTemplate = `package migrations
-
-import (
-	"github.com/pocketbase/dbx"
-	m "github.com/pocketbase/pocketbase/migrations"
-)
-
-func init() {
-	m.Register(func(db dbx.Builder) error {
-		// add up queries...
-
-		return nil
-	}, func(db dbx.Builder) error {
-		// add down queries...
-
-		return nil
-	})
-}
-`
-
-func migrateCreateHandler(template string, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("Missing migration file name")
-	}
-
-	name := args[0]
-
-	var dir string
-	if len(args) == 2 {
-		dir = args[1]
-	}
-	if dir == "" {
-		// If not specified, auto point to the default migrations folder.
-		//
-		// NB!
-		// Since the create command makes sense only during development,
-		// it is expected the user to be in the app working directory
-		// and to be using `go run`
-		wd, err := os.Getwd()
-		if err != nil {
-			return err
-		}
-		dir = path.Join(wd, "migrations")
-	}
-
-	resultFilePath := path.Join(
-		dir,
-		fmt.Sprintf("%d_%s.go", time.Now().Unix(), inflector.Snakecase(name)),
-	)
-
-	confirm := false
-	prompt := &survey.Confirm{
-		Message: fmt.Sprintf("Do you really want to create migration %q?", resultFilePath),
-	}
-	survey.AskOne(prompt, &confirm)
-	if !confirm {
-		fmt.Println("The command has been cancelled")
-		return nil
-	}
-
-	// ensure that migrations dir exist
-	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
-		return err
-	}
-
-	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
-		return fmt.Errorf("Failed to save migration file %q\n", resultFilePath)
-	}
-
-	fmt.Printf("Successfully created file %q\n", resultFilePath)
-	return nil
-}
-
-// -------------------------------------------------------------------
-// migrate collections
-// -------------------------------------------------------------------
-
-const collectionsMigrateCreateTemplate = `package migrations
-
-import (
-	"encoding/json"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/daos"
-	m "github.com/pocketbase/pocketbase/migrations"
-	"github.com/pocketbase/pocketbase/models"
-)
-
-// Auto generated migration with the most recent collections configuration.
-func init() {
-	m.Register(func(db dbx.Builder) error {
-		jsonData := ` + "`" + `%s` + "`" + `
-
-		collections := []*models.Collection{}
-		if err := json.Unmarshal([]byte(jsonData), &collections); err != nil {
-			return err
-		}
-
-		return daos.New(db).ImportCollections(collections, true, nil)
-	}, func(db dbx.Builder) error {
-		// no revert since the configuration on the environment, on which
-		// the migration was executed, could have changed via the UI/API
-		return nil
-	})
-}
-`
-
-func migrateCollectionsHandler(app core.App, args []string) error {
-	createArgs := []string{"collections_snapshot"}
-	createArgs = append(createArgs, args...)
-
-	dao := daos.New(app.DB())
-
-	collections := []*models.Collection{}
-	if err := dao.CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
-		return fmt.Errorf("Failed to fetch migrations list: %v", err)
-	}
-
-	serialized, err := json.MarshalIndent(collections, "\t\t", "\t")
-	if err != nil {
-		return fmt.Errorf("Failed to serialize collections list: %v", err)
-	}
-
-	return migrateCreateHandler(
-		fmt.Sprintf(collectionsMigrateCreateTemplate, string(serialized)),
-		createArgs,
-	)
-}

cmd/serve.go

@@ -10,8 +10,11 @@ import (
 
 	"github.com/fatih/color"
 	"github.com/labstack/echo/v5/middleware"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/migrations/logs"
 	"github.com/pocketbase/pocketbase/tools/migrate"
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/acme"
@@ -38,7 +41,7 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 			// (or if this is the first time the init migration was executed)
 			if err := app.RefreshSettings(); err != nil {
 				color.Yellow("=====================================")
-				color.Yellow("WARNING - Settings load error! \n%v", err)
+				color.Yellow("WARNING: Settings load error! \n%v", err)
 				color.Yellow("Fallback to the application defaults.")
 				color.Yellow("=====================================")
 			}
@@ -137,8 +140,22 @@ func NewServeCommand(app core.App, showStartBanner bool) *cobra.Command {
 	return command
 }
 
+type migrationsConnection struct {
+	DB             *dbx.DB
+	MigrationsList migrate.MigrationsList
+}
+
 func runMigrations(app core.App) error {
-	connections := migrationsConnectionsMap(app)
+	connections := []migrationsConnection{
+		{
+			DB:             app.DB(),
+			MigrationsList: migrations.AppMigrations,
+		},
+		{
+			DB:             app.LogsDB(),
+			MigrationsList: logs.LogsMigrations,
+		},
+	}
 
 	for _, c := range connections {
 		runner, err := migrate.NewRunner(c.DB, c.MigrationsList)

cmd/temp_upgrade.go

@@ -18,7 +18,7 @@ import (
 
 // Temporary console command to update the pb_data structure to be compatible with the v0.8.0 changes.
 //
-// NB! It will be removed in v0.9.0!
+// NB! It will be removed in v0.9+
 func NewTempUpgradeCommand(app core.App) *cobra.Command {
 	command := &cobra.Command{
 		Use:   "upgrade",

core/app.go

@@ -6,6 +6,7 @@ package core
 import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
@@ -15,6 +16,11 @@ import (
 
 // App defines the main PocketBase app interface.
 type App interface {
+	// Deprecated:
+	// This method may get removed in the near future.
+	// It is recommended to access the logs db instance from app.Dao().DB() or
+	// if you want more flexibility - app.Dao().ConcurrentDB() and app.Dao().NonconcurrentDB().
+	//
 	// DB returns the default app database instance.
 	DB() *dbx.DB
 
@@ -25,6 +31,11 @@ type App interface {
 	// trying to access the request logs table will result in error.
 	Dao() *daos.Dao
 
+	// Deprecated:
+	// This method may get removed in the near future.
+	// It is recommended to access the logs db instance from app.LogsDao().DB() or
+	// if you want more flexibility - app.LogsDao().ConcurrentDB() and app.LogsDao().NonconcurrentDB().
+	//
 	// LogsDB returns the app logs database instance.
 	LogsDB() *dbx.DB
 
@@ -47,7 +58,7 @@ type App interface {
 	IsDebug() bool
 
 	// Settings returns the loaded app settings.
-	Settings() *Settings
+	Settings() *settings.Settings
 
 	// Cache returns the app internal cache store.
 	Cache() *store.Store[any]
@@ -67,8 +78,14 @@ type App interface {
 	// RefreshSettings reinitializes and reloads the stored application settings.
 	RefreshSettings() error
 
+	// IsBootstrapped checks if the application was initialized
+	// (aka. whether Bootstrap() was called).
+	IsBootstrapped() bool
+
 	// Bootstrap takes care for initializing the application
-	// (open db connections, load settings, etc.)
+	// (open db connections, load settings, etc.).
+	//
+	// It will call ResetBootstrapState() if the application was already bootstrapped.
 	Bootstrap() error
 
 	// ResetBootstrapState takes care for releasing initialized app resources
@@ -79,10 +96,28 @@ type App interface {
 	// App event hooks
 	// ---------------------------------------------------------------
 
+	// OnBeforeBootstrap hook is triggered before initializing the base
+	// application resources (eg. before db open and initial settings load).
+	OnBeforeBootstrap() *hook.Hook[*BootstrapEvent]
+
+	// OnAfterBootstrap hook is triggered after initializing the base
+	// application resources (eg. after db open and initial settings load).
+	OnAfterBootstrap() *hook.Hook[*BootstrapEvent]
+
 	// OnBeforeServe hook is triggered before serving the internal router (echo),
 	// allowing you to adjust its options and attach new routes.
 	OnBeforeServe() *hook.Hook[*ServeEvent]
 
+	// OnBeforeApiError hook is triggered right before sending an error API
+	// response to the client, allowing you to further modify the error data
+	// or to return a completely different API response (using [hook.StopPropagation]).
+	OnBeforeApiError() *hook.Hook[*ApiErrorEvent]
+
+	// OnAfterApiError hook is triggered right after sending an error API
+	// response to the client.
+	// It could be used to log the final API error in external services.
+	OnAfterApiError() *hook.Hook[*ApiErrorEvent]
+
 	// ---------------------------------------------------------------
 	// Dao event hooks
 	// ---------------------------------------------------------------
@@ -167,6 +202,21 @@ type App interface {
 	// the SSE client connection.
 	OnRealtimeConnectRequest() *hook.Hook[*RealtimeConnectEvent]
 
+	// OnRealtimeDisconnectRequest hook is triggered on disconnected/interrupted
+	// SSE client connection.
+	OnRealtimeDisconnectRequest() *hook.Hook[*RealtimeDisconnectEvent]
+
+	// OnRealtimeBeforeMessage hook is triggered right before sending
+	// an SSE message to a client.
+	//
+	// Returning [hook.StopPropagation] will prevent sending the message.
+	// Returning any other non-nil error will close the realtime connection.
+	OnRealtimeBeforeMessageSend() *hook.Hook[*RealtimeMessageEvent]
+
+	// OnRealtimeBeforeMessage hook is triggered right after sending
+	// an SSE message to a client.
+	OnRealtimeAfterMessageSend() *hook.Hook[*RealtimeMessageEvent]
+
 	// OnRealtimeBeforeSubscribeRequest hook is triggered before changing
 	// the client subscriptions, allowing you to further validate and
 	// modify the submitted change.
@@ -264,7 +314,7 @@ type App interface {
 	OnAdminAuthRequest() *hook.Hook[*AdminAuthEvent]
 
 	// ---------------------------------------------------------------
-	// Auth Record API event hooks
+	// Record Auth API event hooks
 	// ---------------------------------------------------------------
 
 	// OnRecordAuthRequest hook is triggered on each successful API
@@ -274,6 +324,72 @@ type App interface {
 	// record data and token.
 	OnRecordAuthRequest() *hook.Hook[*RecordAuthEvent]
 
+	// OnRecordBeforeRequestPasswordResetRequest hook is triggered before each Record
+	// request password reset API request (after request data load and before sending the reset email).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different password reset behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent]
+
+	// OnRecordAfterRequestPasswordResetRequest hook is triggered after each
+	// successful request password reset API request.
+	OnRecordAfterRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent]
+
+	// OnRecordBeforeConfirmPasswordResetRequest hook is triggered before each Record
+	// confirm password reset API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent]
+
+	// OnRecordAfterConfirmPasswordResetRequest hook is triggered after each
+	// successful confirm password reset API request.
+	OnRecordAfterConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent]
+
+	// OnRecordBeforeRequestVerificationRequest hook is triggered before each Record
+	// request verification API request (after request data load and before sending the verification email).
+	//
+	// Could be used to additionally validate the loaded request data or implement
+	// completely different verification behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent]
+
+	// OnRecordAfterRequestVerificationRequest hook is triggered after each
+	// successful request verification API request.
+	OnRecordAfterRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent]
+
+	// OnRecordBeforeConfirmVerificationRequest hook is triggered before each Record
+	// confirm verification API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent]
+
+	// OnRecordAfterConfirmVerificationRequest hook is triggered after each
+	// successful confirm verification API request.
+	OnRecordAfterConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent]
+
+	// OnRecordBeforeRequestEmailChangeRequest hook is triggered before each Record request email change API request
+	// (after request data load and before sending the email link to confirm the change).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different request email change behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent]
+
+	// OnRecordAfterRequestEmailChangeRequest hook is triggered after each
+	// successful request email change API request.
+	OnRecordAfterRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent]
+
+	// OnRecordBeforeConfirmEmailChangeRequest hook is triggered before each Record
+	// confirm email change API request (after request data load and before persistence).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior (returning [hook.StopPropagation]).
+	OnRecordBeforeConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent]
+
+	// OnRecordAfterConfirmEmailChangeRequest hook is triggered after each
+	// successful confirm email change API request.
+	OnRecordAfterConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent]
+
 	// OnRecordListExternalAuthsRequest hook is triggered on each API record external auths list request.
 	//
 	// Could be used to validate or modify the response before returning it to the client.
@@ -291,7 +407,7 @@ type App interface {
 	OnRecordAfterUnlinkExternalAuthRequest() *hook.Hook[*RecordUnlinkExternalAuthEvent]
 
 	// ---------------------------------------------------------------
-	// Record API event hooks
+	// Record CRUD API event hooks
 	// ---------------------------------------------------------------
 
 	// OnRecordsListRequest hook is triggered on each API Records list request.

core/base.go

@@ -1,10 +1,8 @@
 package core
 
 import (
-	"bytes"
 	"context"
 	"database/sql"
-	"encoding/json"
 	"errors"
 	"log"
 	"os"
@@ -15,34 +13,47 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/hook"
 	"github.com/pocketbase/pocketbase/tools/mailer"
-	"github.com/pocketbase/pocketbase/tools/security"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
 )
 
+const (
+	DefaultDataMaxOpenConns int = 100
+	DefaultDataMaxIdleConns int = 20
+	DefaultLogsMaxOpenConns int = 10
+	DefaultLogsMaxIdleConns int = 2
+)
+
 var _ App = (*BaseApp)(nil)
 
 // BaseApp implements core.App and defines the base PocketBase app structure.
 type BaseApp struct {
 	// configurable parameters
-	isDebug       bool
-	dataDir       string
-	encryptionEnv string
+	isDebug          bool
+	dataDir          string
+	encryptionEnv    string
+	dataMaxOpenConns int
+	dataMaxIdleConns int
+	logsMaxOpenConns int
+	logsMaxIdleConns int
 
 	// internals
 	cache               *store.Store[any]
-	settings            *Settings
-	db                  *dbx.DB
+	settings            *settings.Settings
 	dao                 *daos.Dao
-	logsDB              *dbx.DB
 	logsDao             *daos.Dao
 	subscriptionsBroker *subscriptions.Broker
 
-	// serve event hooks
-	onBeforeServe *hook.Hook[*ServeEvent]
+	// app event hooks
+	onBeforeBootstrap *hook.Hook[*BootstrapEvent]
+	onAfterBootstrap  *hook.Hook[*BootstrapEvent]
+	onBeforeServe     *hook.Hook[*ServeEvent]
+	onBeforeApiError  *hook.Hook[*ApiErrorEvent]
+	onAfterApiError   *hook.Hook[*ApiErrorEvent]
 
 	// dao event hooks
 	onModelBeforeCreate *hook.Hook[*ModelEvent]
@@ -64,6 +75,9 @@ type BaseApp struct {
 
 	// realtime api event hooks
 	onRealtimeConnectRequest         *hook.Hook[*RealtimeConnectEvent]
+	onRealtimeDisconnectRequest      *hook.Hook[*RealtimeDisconnectEvent]
+	onRealtimeBeforeMessageSend      *hook.Hook[*RealtimeMessageEvent]
+	onRealtimeAfterMessageSend       *hook.Hook[*RealtimeMessageEvent]
 	onRealtimeBeforeSubscribeRequest *hook.Hook[*RealtimeSubscribeEvent]
 	onRealtimeAfterSubscribeRequest  *hook.Hook[*RealtimeSubscribeEvent]
 
@@ -86,13 +100,25 @@ type BaseApp struct {
 	onAdminAfterDeleteRequest  *hook.Hook[*AdminDeleteEvent]
 	onAdminAuthRequest         *hook.Hook[*AdminAuthEvent]
 
-	// user api event hooks
-	onRecordAuthRequest                     *hook.Hook[*RecordAuthEvent]
-	onRecordListExternalAuthsRequest        *hook.Hook[*RecordListExternalAuthsEvent]
-	onRecordBeforeUnlinkExternalAuthRequest *hook.Hook[*RecordUnlinkExternalAuthEvent]
-	onRecordAfterUnlinkExternalAuthRequest  *hook.Hook[*RecordUnlinkExternalAuthEvent]
+	// record auth API event hooks
+	onRecordAuthRequest                       *hook.Hook[*RecordAuthEvent]
+	onRecordBeforeRequestPasswordResetRequest *hook.Hook[*RecordRequestPasswordResetEvent]
+	onRecordAfterRequestPasswordResetRequest  *hook.Hook[*RecordRequestPasswordResetEvent]
+	onRecordBeforeConfirmPasswordResetRequest *hook.Hook[*RecordConfirmPasswordResetEvent]
+	onRecordAfterConfirmPasswordResetRequest  *hook.Hook[*RecordConfirmPasswordResetEvent]
+	onRecordBeforeRequestVerificationRequest  *hook.Hook[*RecordRequestVerificationEvent]
+	onRecordAfterRequestVerificationRequest   *hook.Hook[*RecordRequestVerificationEvent]
+	onRecordBeforeConfirmVerificationRequest  *hook.Hook[*RecordConfirmVerificationEvent]
+	onRecordAfterConfirmVerificationRequest   *hook.Hook[*RecordConfirmVerificationEvent]
+	onRecordBeforeRequestEmailChangeRequest   *hook.Hook[*RecordRequestEmailChangeEvent]
+	onRecordAfterRequestEmailChangeRequest    *hook.Hook[*RecordRequestEmailChangeEvent]
+	onRecordBeforeConfirmEmailChangeRequest   *hook.Hook[*RecordConfirmEmailChangeEvent]
+	onRecordAfterConfirmEmailChangeRequest    *hook.Hook[*RecordConfirmEmailChangeEvent]
+	onRecordListExternalAuthsRequest          *hook.Hook[*RecordListExternalAuthsEvent]
+	onRecordBeforeUnlinkExternalAuthRequest   *hook.Hook[*RecordUnlinkExternalAuthEvent]
+	onRecordAfterUnlinkExternalAuthRequest    *hook.Hook[*RecordUnlinkExternalAuthEvent]
 
-	// record api event hooks
+	// record crud API event hooks
 	onRecordsListRequest        *hook.Hook[*RecordsListEvent]
 	onRecordViewRequest         *hook.Hook[*RecordViewEvent]
 	onRecordBeforeCreateRequest *hook.Hook[*RecordCreateEvent]
@@ -102,7 +128,7 @@ type BaseApp struct {
 	onRecordBeforeDeleteRequest *hook.Hook[*RecordDeleteEvent]
 	onRecordAfterDeleteRequest  *hook.Hook[*RecordDeleteEvent]
 
-	// collection api event hooks
+	// collection API event hooks
 	onCollectionsListRequest         *hook.Hook[*CollectionsListEvent]
 	onCollectionViewRequest          *hook.Hook[*CollectionViewEvent]
 	onCollectionBeforeCreateRequest  *hook.Hook[*CollectionCreateEvent]
@@ -115,21 +141,40 @@ type BaseApp struct {
 	onCollectionsAfterImportRequest  *hook.Hook[*CollectionsImportEvent]
 }
 
+// BaseAppConfig defines a BaseApp configuration option
+type BaseAppConfig struct {
+	DataDir          string
+	EncryptionEnv    string
+	IsDebug          bool
+	DataMaxOpenConns int // default to 500
+	DataMaxIdleConns int // default 20
+	LogsMaxOpenConns int // default to 100
+	LogsMaxIdleConns int // default to 5
+}
+
 // NewBaseApp creates and returns a new BaseApp instance
 // configured with the provided arguments.
 //
 // To initialize the app, you need to call `app.Bootstrap()`.
-func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
+func NewBaseApp(config *BaseAppConfig) *BaseApp {
 	app := &BaseApp{
-		dataDir:             dataDir,
-		isDebug:             isDebug,
-		encryptionEnv:       encryptionEnv,
+		dataDir:             config.DataDir,
+		isDebug:             config.IsDebug,
+		encryptionEnv:       config.EncryptionEnv,
+		dataMaxOpenConns:    config.DataMaxOpenConns,
+		dataMaxIdleConns:    config.DataMaxIdleConns,
+		logsMaxOpenConns:    config.LogsMaxOpenConns,
+		logsMaxIdleConns:    config.LogsMaxIdleConns,
 		cache:               store.New[any](nil),
-		settings:            NewSettings(),
+		settings:            settings.New(),
 		subscriptionsBroker: subscriptions.NewBroker(),
 
-		// serve event hooks
-		onBeforeServe: &hook.Hook[*ServeEvent]{},
+		// app event hooks
+		onBeforeBootstrap: &hook.Hook[*BootstrapEvent]{},
+		onAfterBootstrap:  &hook.Hook[*BootstrapEvent]{},
+		onBeforeServe:     &hook.Hook[*ServeEvent]{},
+		onBeforeApiError:  &hook.Hook[*ApiErrorEvent]{},
+		onAfterApiError:   &hook.Hook[*ApiErrorEvent]{},
 
 		// dao event hooks
 		onModelBeforeCreate: &hook.Hook[*ModelEvent]{},
@@ -151,6 +196,9 @@ func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
 
 		// realtime API event hooks
 		onRealtimeConnectRequest:         &hook.Hook[*RealtimeConnectEvent]{},
+		onRealtimeDisconnectRequest:      &hook.Hook[*RealtimeDisconnectEvent]{},
+		onRealtimeBeforeMessageSend:      &hook.Hook[*RealtimeMessageEvent]{},
+		onRealtimeAfterMessageSend:       &hook.Hook[*RealtimeMessageEvent]{},
 		onRealtimeBeforeSubscribeRequest: &hook.Hook[*RealtimeSubscribeEvent]{},
 		onRealtimeAfterSubscribeRequest:  &hook.Hook[*RealtimeSubscribeEvent]{},
 
@@ -173,13 +221,25 @@ func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
 		onAdminAfterDeleteRequest:  &hook.Hook[*AdminDeleteEvent]{},
 		onAdminAuthRequest:         &hook.Hook[*AdminAuthEvent]{},
 
-		// user API event hooks
-		onRecordAuthRequest:                     &hook.Hook[*RecordAuthEvent]{},
-		onRecordListExternalAuthsRequest:        &hook.Hook[*RecordListExternalAuthsEvent]{},
-		onRecordBeforeUnlinkExternalAuthRequest: &hook.Hook[*RecordUnlinkExternalAuthEvent]{},
-		onRecordAfterUnlinkExternalAuthRequest:  &hook.Hook[*RecordUnlinkExternalAuthEvent]{},
+		// record auth API event hooks
+		onRecordAuthRequest:                       &hook.Hook[*RecordAuthEvent]{},
+		onRecordBeforeRequestPasswordResetRequest: &hook.Hook[*RecordRequestPasswordResetEvent]{},
+		onRecordAfterRequestPasswordResetRequest:  &hook.Hook[*RecordRequestPasswordResetEvent]{},
+		onRecordBeforeConfirmPasswordResetRequest: &hook.Hook[*RecordConfirmPasswordResetEvent]{},
+		onRecordAfterConfirmPasswordResetRequest:  &hook.Hook[*RecordConfirmPasswordResetEvent]{},
+		onRecordBeforeRequestVerificationRequest:  &hook.Hook[*RecordRequestVerificationEvent]{},
+		onRecordAfterRequestVerificationRequest:   &hook.Hook[*RecordRequestVerificationEvent]{},
+		onRecordBeforeConfirmVerificationRequest:  &hook.Hook[*RecordConfirmVerificationEvent]{},
+		onRecordAfterConfirmVerificationRequest:   &hook.Hook[*RecordConfirmVerificationEvent]{},
+		onRecordBeforeRequestEmailChangeRequest:   &hook.Hook[*RecordRequestEmailChangeEvent]{},
+		onRecordAfterRequestEmailChangeRequest:    &hook.Hook[*RecordRequestEmailChangeEvent]{},
+		onRecordBeforeConfirmEmailChangeRequest:   &hook.Hook[*RecordConfirmEmailChangeEvent]{},
+		onRecordAfterConfirmEmailChangeRequest:    &hook.Hook[*RecordConfirmEmailChangeEvent]{},
+		onRecordListExternalAuthsRequest:          &hook.Hook[*RecordListExternalAuthsEvent]{},
+		onRecordBeforeUnlinkExternalAuthRequest:   &hook.Hook[*RecordUnlinkExternalAuthEvent]{},
+		onRecordAfterUnlinkExternalAuthRequest:    &hook.Hook[*RecordUnlinkExternalAuthEvent]{},
 
-		// record API event hooks
+		// record crud API event hooks
 		onRecordsListRequest:        &hook.Hook[*RecordsListEvent]{},
 		onRecordViewRequest:         &hook.Hook[*RecordViewEvent]{},
 		onRecordBeforeCreateRequest: &hook.Hook[*RecordCreateEvent]{},
@@ -207,9 +267,23 @@ func NewBaseApp(dataDir string, encryptionEnv string, isDebug bool) *BaseApp {
 	return app
 }
 
+// IsBootstrapped checks if the application was initialized
+// (aka. whether Bootstrap() was called).
+func (app *BaseApp) IsBootstrapped() bool {
+	return app.dao != nil && app.logsDao != nil && app.settings != nil
+}
+
 // Bootstrap initializes the application
-// (aka. create data dir, open db connections, load settings, etc.)
+// (aka. create data dir, open db connections, load settings, etc.).
+//
+// It will call ResetBootstrapState() if the application was already bootstrapped.
 func (app *BaseApp) Bootstrap() error {
+	event := &BootstrapEvent{app}
+
+	if err := app.OnBeforeBootstrap().Trigger(event); err != nil {
+		return err
+	}
+
 	// clear resources of previous core state (if any)
 	if err := app.ResetBootstrapState(); err != nil {
 		return err
@@ -228,24 +302,33 @@ func (app *BaseApp) Bootstrap() error {
 		return err
 	}
 
-	// we don't check for an error because the db migrations may
-	// have not been executed yet.
+	// we don't check for an error because the db migrations may have not been executed yet
 	app.RefreshSettings()
 
+	if err := app.OnAfterBootstrap().Trigger(event); err != nil && app.IsDebug() {
+		log.Println(err)
+	}
+
 	return nil
 }
 
 // ResetBootstrapState takes care for releasing initialized app resources
 // (eg. closing db connections).
 func (app *BaseApp) ResetBootstrapState() error {
-	if app.db != nil {
-		if err := app.db.Close(); err != nil {
+	if app.Dao() != nil {
+		if err := app.Dao().ConcurrentDB().(*dbx.DB).Close(); err != nil {
+			return err
+		}
+		if err := app.Dao().NonconcurrentDB().(*dbx.DB).Close(); err != nil {
 			return err
 		}
 	}
 
-	if app.logsDB != nil {
-		if err := app.logsDB.Close(); err != nil {
+	if app.LogsDao() != nil {
+		if err := app.LogsDao().ConcurrentDB().(*dbx.DB).Close(); err != nil {
+			return err
+		}
+		if err := app.LogsDao().NonconcurrentDB().(*dbx.DB).Close(); err != nil {
 			return err
 		}
 	}
@@ -257,9 +340,23 @@ func (app *BaseApp) ResetBootstrapState() error {
 	return nil
 }
 
+// Deprecated:
+// This method may get removed in the near future.
+// It is recommended to access the db instance from app.Dao().DB() or
+// if you want more flexibility - app.Dao().ConcurrentDB() and app.Dao().NonconcurrentDB().
+//
 // DB returns the default app database instance.
 func (app *BaseApp) DB() *dbx.DB {
-	return app.db
+	if app.Dao() == nil {
+		return nil
+	}
+
+	db, ok := app.Dao().DB().(*dbx.DB)
+	if !ok {
+		return nil
+	}
+
+	return db
 }
 
 // Dao returns the default app Dao instance.
@@ -267,9 +364,23 @@ func (app *BaseApp) Dao() *daos.Dao {
 	return app.dao
 }
 
+// Deprecated:
+// This method may get removed in the near future.
+// It is recommended to access the logs db instance from app.LogsDao().DB() or
+// if you want more flexibility - app.LogsDao().ConcurrentDB() and app.LogsDao().NonconcurrentDB().
+//
 // LogsDB returns the app logs database instance.
 func (app *BaseApp) LogsDB() *dbx.DB {
-	return app.logsDB
+	if app.LogsDao() == nil {
+		return nil
+	}
+
+	db, ok := app.LogsDao().DB().(*dbx.DB)
+	if !ok {
+		return nil
+	}
+
+	return db
 }
 
 // LogsDao returns the app logs Dao instance.
@@ -295,7 +406,7 @@ func (app *BaseApp) IsDebug() bool {
 }
 
 // Settings returns the loaded app settings.
-func (app *BaseApp) Settings() *Settings {
+func (app *BaseApp) Settings() *settings.Settings {
 	return app.settings
 }
 
@@ -313,13 +424,14 @@ func (app *BaseApp) SubscriptionsBroker() *subscriptions.Broker {
 // based on the current app settings.
 func (app *BaseApp) NewMailClient() mailer.Mailer {
 	if app.Settings().Smtp.Enabled {
-		return mailer.NewSmtpClient(
-			app.Settings().Smtp.Host,
-			app.Settings().Smtp.Port,
-			app.Settings().Smtp.Username,
-			app.Settings().Smtp.Password,
-			app.Settings().Smtp.Tls,
-		)
+		return &mailer.SmtpClient{
+			Host:       app.Settings().Smtp.Host,
+			Port:       app.Settings().Smtp.Port,
+			Username:   app.Settings().Smtp.Username,
+			Password:   app.Settings().Smtp.Password,
+			Tls:        app.Settings().Smtp.Tls,
+			AuthMethod: app.Settings().Smtp.AuthMethod,
+		}
 	}
 
 	return &mailer.Sendmail{}
@@ -349,79 +461,53 @@ func (app *BaseApp) NewFilesystem() (*filesystem.System, error) {
 // RefreshSettings reinitializes and reloads the stored application settings.
 func (app *BaseApp) RefreshSettings() error {
 	if app.settings == nil {
-		app.settings = NewSettings()
+		app.settings = settings.New()
 	}
 
 	encryptionKey := os.Getenv(app.EncryptionEnv())
 
-	param, err := app.Dao().FindParamByKey(models.ParamAppSettings)
+	storedSettings, err := app.Dao().FindSettings(encryptionKey)
 	if err != nil && err != sql.ErrNoRows {
 		return err
 	}
 
 	// no settings were previously stored
-	if param == nil {
-		return app.Dao().SaveParam(models.ParamAppSettings, app.settings, encryptionKey)
+	if storedSettings == nil {
+		return app.Dao().SaveSettings(app.settings, encryptionKey)
 	}
 
 	// load the settings from the stored param into the app ones
-	// ---
-	newSettings := NewSettings()
-
-	// try first without decryption
-	plainDecodeErr := json.Unmarshal(param.Value, newSettings)
-
-	// failed, try to decrypt
-	if plainDecodeErr != nil {
-		// load without decrypt has failed and there is no encryption key to use for decrypt
-		if encryptionKey == "" {
-			return errors.New("Failed to load the stored app settings (missing or invalid encryption key).")
-		}
-
-		// decrypt
-		decrypted, decryptErr := security.Decrypt(string(param.Value), encryptionKey)
-		if decryptErr != nil {
-			return decryptErr
-		}
-
-		// decode again
-		decryptedDecodeErr := json.Unmarshal(decrypted, newSettings)
-		if decryptedDecodeErr != nil {
-			return decryptedDecodeErr
-		}
-	}
-
-	if err := app.settings.Merge(newSettings); err != nil {
+	if err := app.settings.Merge(storedSettings); err != nil {
 		return err
 	}
 
-	afterMergeRaw, err := json.Marshal(app.settings)
-	if err != nil {
-		return err
-	}
-
-	if
-	// save because previously the settings weren't stored encrypted
-	(plainDecodeErr == nil && encryptionKey != "") ||
-		// or save because there are new fields after the merge
-		!bytes.Equal(param.Value, afterMergeRaw) {
-		saveErr := app.Dao().SaveParam(models.ParamAppSettings, app.settings, encryptionKey)
-		if saveErr != nil {
-			return saveErr
-		}
-	}
-
 	return nil
 }
 
 // -------------------------------------------------------------------
-// Serve event hooks
+// App event hooks
 // -------------------------------------------------------------------
 
+func (app *BaseApp) OnBeforeBootstrap() *hook.Hook[*BootstrapEvent] {
+	return app.onBeforeBootstrap
+}
+
+func (app *BaseApp) OnAfterBootstrap() *hook.Hook[*BootstrapEvent] {
+	return app.onAfterBootstrap
+}
+
 func (app *BaseApp) OnBeforeServe() *hook.Hook[*ServeEvent] {
 	return app.onBeforeServe
 }
 
+func (app *BaseApp) OnBeforeApiError() *hook.Hook[*ApiErrorEvent] {
+	return app.onBeforeApiError
+}
+
+func (app *BaseApp) OnAfterApiError() *hook.Hook[*ApiErrorEvent] {
+	return app.onAfterApiError
+}
+
 // -------------------------------------------------------------------
 // Dao event hooks
 // -------------------------------------------------------------------
@@ -494,6 +580,18 @@ func (app *BaseApp) OnRealtimeConnectRequest() *hook.Hook[*RealtimeConnectEvent]
 	return app.onRealtimeConnectRequest
 }
 
+func (app *BaseApp) OnRealtimeDisconnectRequest() *hook.Hook[*RealtimeDisconnectEvent] {
+	return app.onRealtimeDisconnectRequest
+}
+
+func (app *BaseApp) OnRealtimeBeforeMessageSend() *hook.Hook[*RealtimeMessageEvent] {
+	return app.onRealtimeBeforeMessageSend
+}
+
+func (app *BaseApp) OnRealtimeAfterMessageSend() *hook.Hook[*RealtimeMessageEvent] {
+	return app.onRealtimeAfterMessageSend
+}
+
 func (app *BaseApp) OnRealtimeBeforeSubscribeRequest() *hook.Hook[*RealtimeSubscribeEvent] {
 	return app.onRealtimeBeforeSubscribeRequest
 }
@@ -567,13 +665,61 @@ func (app *BaseApp) OnAdminAuthRequest() *hook.Hook[*AdminAuthEvent] {
 }
 
 // -------------------------------------------------------------------
-// Auth Record API event hooks
+// Record auth API event hooks
 // -------------------------------------------------------------------
 
 func (app *BaseApp) OnRecordAuthRequest() *hook.Hook[*RecordAuthEvent] {
 	return app.onRecordAuthRequest
 }
 
+func (app *BaseApp) OnRecordBeforeRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent] {
+	return app.onRecordBeforeRequestPasswordResetRequest
+}
+
+func (app *BaseApp) OnRecordAfterRequestPasswordResetRequest() *hook.Hook[*RecordRequestPasswordResetEvent] {
+	return app.onRecordAfterRequestPasswordResetRequest
+}
+
+func (app *BaseApp) OnRecordBeforeConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent] {
+	return app.onRecordBeforeConfirmPasswordResetRequest
+}
+
+func (app *BaseApp) OnRecordAfterConfirmPasswordResetRequest() *hook.Hook[*RecordConfirmPasswordResetEvent] {
+	return app.onRecordAfterConfirmPasswordResetRequest
+}
+
+func (app *BaseApp) OnRecordBeforeRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent] {
+	return app.onRecordBeforeRequestVerificationRequest
+}
+
+func (app *BaseApp) OnRecordAfterRequestVerificationRequest() *hook.Hook[*RecordRequestVerificationEvent] {
+	return app.onRecordAfterRequestVerificationRequest
+}
+
+func (app *BaseApp) OnRecordBeforeConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent] {
+	return app.onRecordBeforeConfirmVerificationRequest
+}
+
+func (app *BaseApp) OnRecordAfterConfirmVerificationRequest() *hook.Hook[*RecordConfirmVerificationEvent] {
+	return app.onRecordAfterConfirmVerificationRequest
+}
+
+func (app *BaseApp) OnRecordBeforeRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent] {
+	return app.onRecordBeforeRequestEmailChangeRequest
+}
+
+func (app *BaseApp) OnRecordAfterRequestEmailChangeRequest() *hook.Hook[*RecordRequestEmailChangeEvent] {
+	return app.onRecordAfterRequestEmailChangeRequest
+}
+
+func (app *BaseApp) OnRecordBeforeConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent] {
+	return app.onRecordBeforeConfirmEmailChangeRequest
+}
+
+func (app *BaseApp) OnRecordAfterConfirmEmailChangeRequest() *hook.Hook[*RecordConfirmEmailChangeEvent] {
+	return app.onRecordAfterConfirmEmailChangeRequest
+}
+
 func (app *BaseApp) OnRecordListExternalAuthsRequest() *hook.Hook[*RecordListExternalAuthsEvent] {
 	return app.onRecordListExternalAuthsRequest
 }
@@ -587,7 +733,7 @@ func (app *BaseApp) OnRecordAfterUnlinkExternalAuthRequest() *hook.Hook[*RecordU
 }
 
 // -------------------------------------------------------------------
-// Record API event hooks
+// Record CRUD API event hooks
 // -------------------------------------------------------------------
 
 func (app *BaseApp) OnRecordsListRequest() *hook.Hook[*RecordsListEvent] {
@@ -671,50 +817,91 @@ func (app *BaseApp) OnCollectionsAfterImportRequest() *hook.Hook[*CollectionsImp
 // -------------------------------------------------------------------
 
 func (app *BaseApp) initLogsDB() error {
-	var connectErr error
-	app.logsDB, connectErr = connectDB(filepath.Join(app.DataDir(), "logs.db"))
-	if connectErr != nil {
-		return connectErr
+	maxOpenConns := DefaultLogsMaxOpenConns
+	maxIdleConns := DefaultLogsMaxIdleConns
+	if app.logsMaxOpenConns > 0 {
+		maxOpenConns = app.logsMaxOpenConns
+	}
+	if app.logsMaxIdleConns > 0 {
+		maxIdleConns = app.logsMaxIdleConns
 	}
 
-	app.logsDao = daos.New(app.logsDB)
+	concurrentDB, err := connectDB(filepath.Join(app.DataDir(), "logs.db"))
+	if err != nil {
+		return err
+	}
+	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
+	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
+	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+
+	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "logs.db"))
+	if err != nil {
+		return err
+	}
+	nonconcurrentDB.DB().SetMaxOpenConns(1)
+	nonconcurrentDB.DB().SetMaxIdleConns(1)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+
+	app.logsDao = daos.NewMultiDB(concurrentDB, nonconcurrentDB)
 
 	return nil
 }
 
 func (app *BaseApp) initDataDB() error {
-	var connectErr error
-	app.db, connectErr = connectDB(filepath.Join(app.DataDir(), "data.db"))
-	if connectErr != nil {
-		return connectErr
+	maxOpenConns := DefaultDataMaxOpenConns
+	maxIdleConns := DefaultDataMaxIdleConns
+	if app.dataMaxOpenConns > 0 {
+		maxOpenConns = app.dataMaxOpenConns
+	}
+	if app.dataMaxIdleConns > 0 {
+		maxIdleConns = app.dataMaxIdleConns
 	}
 
-	app.db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
-		if app.IsDebug() {
+	concurrentDB, err := connectDB(filepath.Join(app.DataDir(), "data.db"))
+	if err != nil {
+		return err
+	}
+	concurrentDB.DB().SetMaxOpenConns(maxOpenConns)
+	concurrentDB.DB().SetMaxIdleConns(maxIdleConns)
+	concurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+
+	nonconcurrentDB, err := connectDB(filepath.Join(app.DataDir(), "data.db"))
+	if err != nil {
+		return err
+	}
+	nonconcurrentDB.DB().SetMaxOpenConns(1)
+	nonconcurrentDB.DB().SetMaxIdleConns(1)
+	nonconcurrentDB.DB().SetConnMaxIdleTime(5 * time.Minute)
+
+	if app.IsDebug() {
+		nonconcurrentDB.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
-	}
+		concurrentDB.QueryLogFunc = nonconcurrentDB.QueryLogFunc
 
-	app.db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
-		if app.IsDebug() {
+		nonconcurrentDB.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
 			color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), sql)
 		}
+		concurrentDB.ExecLogFunc = nonconcurrentDB.ExecLogFunc
 	}
 
-	app.dao = app.createDaoWithHooks(app.db)
+	app.dao = app.createDaoWithHooks(concurrentDB, nonconcurrentDB)
 
 	return nil
 }
 
-func (app *BaseApp) createDaoWithHooks(db dbx.Builder) *daos.Dao {
-	dao := daos.New(db)
+func (app *BaseApp) createDaoWithHooks(concurrentDB, nonconcurrentDB dbx.Builder) *daos.Dao {
+	dao := daos.NewMultiDB(concurrentDB, nonconcurrentDB)
 
 	dao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
 		return app.OnModelBeforeCreate().Trigger(&ModelEvent{eventDao, m})
 	}
 
 	dao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
-		app.OnModelAfterCreate().Trigger(&ModelEvent{eventDao, m})
+		err := app.OnModelAfterCreate().Trigger(&ModelEvent{eventDao, m})
+		if err != nil && app.isDebug {
+			log.Println(err)
+		}
 	}
 
 	dao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
@@ -722,7 +909,10 @@ func (app *BaseApp) createDaoWithHooks(db dbx.Builder) *daos.Dao {
 	}
 
 	dao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
-		app.OnModelAfterUpdate().Trigger(&ModelEvent{eventDao, m})
+		err := app.OnModelAfterUpdate().Trigger(&ModelEvent{eventDao, m})
+		if err != nil && app.isDebug {
+			log.Println(err)
+		}
 	}
 
 	dao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
@@ -730,7 +920,10 @@ func (app *BaseApp) createDaoWithHooks(db dbx.Builder) *daos.Dao {
 	}
 
 	dao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
-		app.OnModelAfterDelete().Trigger(&ModelEvent{eventDao, m})
+		err := app.OnModelAfterDelete().Trigger(&ModelEvent{eventDao, m})
+		if err != nil && app.isDebug {
+			log.Println(err)
+		}
 	}
 
 	return dao

core/base_settings_test.go

@@ -1,7 +1,6 @@
 package core_test
 
 import (
-	"bytes"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/models"
@@ -32,7 +31,7 @@ func TestBaseAppRefreshSettings(t *testing.T) {
 		t.Fatalf("Expected new settings to be persisted, got %v", err)
 	}
 
-	// change the db entry and refresh the app settings
+	// change the db entry and refresh the app settings (ensure that there was no db update)
 	param.Value = types.JsonRaw([]byte(`{"example": 123}`))
 	if err := app.Dao().SaveParam(param.Key, param.Value); err != nil {
 		t.Fatalf("Failed to update the test settings: %v", err)
@@ -41,21 +40,9 @@ func TestBaseAppRefreshSettings(t *testing.T) {
 	if err := app.RefreshSettings(); err != nil {
 		t.Fatalf("Failed to refresh the app settings: %v", err)
 	}
-	testEventCalls(t, app, map[string]int{
-		"OnModelBeforeUpdate": 1,
-		"OnModelAfterUpdate":  1,
-	})
+	testEventCalls(t, app, nil)
 
-	// make sure that the newly merged settings were actually saved
-	newParam, err := app.Dao().FindParamByKey(models.ParamAppSettings)
-	if err != nil {
-		t.Fatalf("Failed to fetch new settings param: %v", err)
-	}
-	if bytes.Equal(param.Value, newParam.Value) {
-		t.Fatalf("Expected the new refreshed settings to be different, got: \n%v", string(newParam.Value))
-	}
-
-	// try to refresh again and ensure that there was no db update
+	// try to refresh again without doing any changes
 	app.ResetEventCalls()
 	if err := app.RefreshSettings(); err != nil {
 		t.Fatalf("Failed to refresh the app settings without change: %v", err)

core/base_test.go

@@ -11,7 +11,11 @@ func TestNewBaseApp(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "test_env", true)
+	app := NewBaseApp(&BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "test_env",
+		IsDebug:       true,
+	})
 
 	if app.dataDir != testDataDir {
 		t.Fatalf("expected dataDir %q, got %q", testDataDir, app.dataDir)
@@ -42,14 +46,26 @@ func TestBaseAppBootstrap(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(&BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		IsDebug:       false,
+	})
 	defer app.ResetBootstrapState()
 
+	if app.IsBootstrapped() {
+		t.Fatal("Didn't expect the application to be bootstrapped.")
+	}
+
 	// bootstrap
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
 
+	if !app.IsBootstrapped() {
+		t.Fatal("Expected the application to be bootstrapped.")
+	}
+
 	if stat, err := os.Stat(testDataDir); err != nil || !stat.IsDir() {
 		t.Fatal("Expected test data directory to be created.")
 	}
@@ -112,29 +128,33 @@ func TestBaseAppGetters(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(&BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		IsDebug:       false,
+	})
 	defer app.ResetBootstrapState()
 
 	if err := app.Bootstrap(); err != nil {
 		t.Fatal(err)
 	}
 
-	if app.db != app.DB() {
-		t.Fatalf("Expected app.DB %v, got %v", app.DB(), app.db)
-	}
-
 	if app.dao != app.Dao() {
 		t.Fatalf("Expected app.Dao %v, got %v", app.Dao(), app.dao)
 	}
 
-	if app.logsDB != app.LogsDB() {
-		t.Fatalf("Expected app.LogsDB %v, got %v", app.LogsDB(), app.logsDB)
+	if app.dao.ConcurrentDB() != app.DB() {
+		t.Fatalf("Expected app.DB %v, got %v", app.DB(), app.dao.ConcurrentDB())
 	}
 
 	if app.logsDao != app.LogsDao() {
 		t.Fatalf("Expected app.LogsDao %v, got %v", app.LogsDao(), app.logsDao)
 	}
 
+	if app.logsDao.ConcurrentDB() != app.LogsDB() {
+		t.Fatalf("Expected app.LogsDB %v, got %v", app.LogsDB(), app.logsDao.ConcurrentDB())
+	}
+
 	if app.dataDir != app.DataDir() {
 		t.Fatalf("Expected app.DataDir %v, got %v", app.DataDir(), app.dataDir)
 	}
@@ -400,7 +420,11 @@ func TestBaseAppNewMailClient(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(&BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		IsDebug:       false,
+	})
 
 	client1 := app.NewMailClient()
 	if val, ok := client1.(*mailer.Sendmail); !ok {
@@ -419,7 +443,11 @@ func TestBaseAppNewFilesystem(t *testing.T) {
 	const testDataDir = "./pb_base_app_test_data_dir/"
 	defer os.RemoveAll(testDataDir)
 
-	app := NewBaseApp(testDataDir, "pb_test_env", false)
+	app := NewBaseApp(&BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		IsDebug:       false,
+	})
 
 	// local
 	local, localErr := app.NewFilesystem()

core/db.go

@@ -0,0 +1,20 @@
+package core
+
+import (
+	"github.com/pocketbase/dbx"
+)
+
+func initPragmas(db *dbx.DB) error {
+	// note: the busy_timeout pragma must be first because
+	// the connection needs to be set to block on busy before WAL mode
+	// is set in case it hasn't been already set by another connection
+	_, err := db.NewQuery(`
+		PRAGMA busy_timeout       = 10000;
+		PRAGMA journal_mode       = WAL;
+		PRAGMA journal_size_limit = 100000000;
+		PRAGMA synchronous        = NORMAL;
+		PRAGMA foreign_keys       = TRUE;
+	`).Execute()
+
+	return err
+}

core/db_cgo.go

@@ -3,35 +3,20 @@
 package core
 
 import (
-	"fmt"
-	"time"
-
 	"github.com/pocketbase/dbx"
 	_ "github.com/mattn/go-sqlite3"
 )
 
 func connectDB(dbPath string) (*dbx.DB, error) {
-	// note: the busy_timeout pragma must be first because
-	// the connection needs to be set to block on busy before WAL mode
-	// is set in case it hasn't been already set by another connection
-	pragmas := "_busy_timeout=10000&_journal_mode=WAL&_foreign_keys=1&_synchronous=NORMAL"
-
-	db, openErr := dbx.MustOpen("sqlite3", fmt.Sprintf("%s?%s", dbPath, pragmas))
-	if openErr != nil {
-		return nil, openErr
+	db, err := dbx.Open("sqlite3", dbPath)
+	if err != nil {
+		return nil, err
 	}
 
-	// use a fixed connection pool to limit the SQLITE_BUSY errors
-	// and reduce the open file descriptors
-	// (the limits are arbitrary and may change in the future)
-	db.DB().SetMaxOpenConns(1000)
-	db.DB().SetMaxIdleConns(30)
-	db.DB().SetConnMaxIdleTime(5 * time.Minute)
+	if err := initPragmas(db); err != nil {
+		db.Close()
+		return nil, err
+	}
 
-	// additional pragmas not supported through the dsn string
-	_, err := db.NewQuery(`
-		pragma journal_size_limit = 100000000;
-	`).Execute()
-
-	return db, err
+	return db, nil
 }

core/db_nocgo.go

@@ -3,32 +3,20 @@
 package core
 
 import (
-	"fmt"
-	"time"
-
 	"github.com/pocketbase/dbx"
 	_ "modernc.org/sqlite"
 )
 
 func connectDB(dbPath string) (*dbx.DB, error) {
-	// note: the busy_timeout pragma must be first because
-	// the connection needs to be set to block on busy before WAL mode
-	// is set in case it hasn't been already set by another connection
-	pragmas := "_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)&_pragma=synchronous(NORMAL)&_pragma=journal_size_limit(100000000)"
-
-	db, err := dbx.MustOpen("sqlite", fmt.Sprintf("%s?%s", dbPath, pragmas))
+	db, err := dbx.Open("sqlite", dbPath)
 	if err != nil {
 		return nil, err
 	}
 
-	// use a fixed connection pool to limit the SQLITE_BUSY errors and
-	// reduce the open file descriptors
-	// (the limits are arbitrary and may change in the future)
-	//
-	// @see https://gitlab.com/cznic/sqlite/-/issues/115
-	db.DB().SetMaxOpenConns(1000)
-	db.DB().SetMaxIdleConns(30)
-	db.DB().SetConnMaxIdleTime(5 * time.Minute)
+	if err := initPragmas(db); err != nil {
+		db.Close()
+		return nil, err
+	}
 
 	return db, nil
 }

core/events.go

@@ -4,6 +4,7 @@ import (
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/search"
 	"github.com/pocketbase/pocketbase/tools/subscriptions"
@@ -15,11 +16,20 @@ import (
 // Serve events data
 // -------------------------------------------------------------------
 
+type BootstrapEvent struct {
+	App App
+}
+
 type ServeEvent struct {
 	App    App
 	Router *echo.Echo
 }
 
+type ApiErrorEvent struct {
+	HttpContext echo.Context
+	Error       error
+}
+
 // -------------------------------------------------------------------
 // Model DAO events data
 // -------------------------------------------------------------------
@@ -35,12 +45,14 @@ type ModelEvent struct {
 
 type MailerRecordEvent struct {
 	MailClient mailer.Mailer
+	Message    *mailer.Message
 	Record     *models.Record
 	Meta       map[string]any
 }
 
 type MailerAdminEvent struct {
 	MailClient mailer.Mailer
+	Message    *mailer.Message
 	Admin      *models.Admin
 	Meta       map[string]any
 }
@@ -54,6 +66,17 @@ type RealtimeConnectEvent struct {
 	Client      subscriptions.Client
 }
 
+type RealtimeDisconnectEvent struct {
+	HttpContext echo.Context
+	Client      subscriptions.Client
+}
+
+type RealtimeMessageEvent struct {
+	HttpContext echo.Context
+	Client      subscriptions.Client
+	Message     *subscriptions.Message
+}
+
 type RealtimeSubscribeEvent struct {
 	HttpContext   echo.Context
 	Client        subscriptions.Client
@@ -66,17 +89,17 @@ type RealtimeSubscribeEvent struct {
 
 type SettingsListEvent struct {
 	HttpContext      echo.Context
-	RedactedSettings *Settings
+	RedactedSettings *settings.Settings
 }
 
 type SettingsUpdateEvent struct {
 	HttpContext echo.Context
-	OldSettings *Settings
-	NewSettings *Settings
+	OldSettings *settings.Settings
+	NewSettings *settings.Settings
 }
 
 // -------------------------------------------------------------------
-// Record API events data
+// Record CRUD API events data
 // -------------------------------------------------------------------
 
 type RecordsListEvent struct {
@@ -106,6 +129,59 @@ type RecordDeleteEvent struct {
 	Record      *models.Record
 }
 
+// -------------------------------------------------------------------
+// Auth Record API events data
+// -------------------------------------------------------------------
+
+type RecordAuthEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+	Token       string
+	Meta        any
+}
+
+type RecordRequestPasswordResetEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmPasswordResetEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordRequestVerificationEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmVerificationEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordRequestEmailChangeEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordConfirmEmailChangeEvent struct {
+	HttpContext echo.Context
+	Record      *models.Record
+}
+
+type RecordListExternalAuthsEvent struct {
+	HttpContext   echo.Context
+	Record        *models.Record
+	ExternalAuths []*models.ExternalAuth
+}
+
+type RecordUnlinkExternalAuthEvent struct {
+	HttpContext  echo.Context
+	Record       *models.Record
+	ExternalAuth *models.ExternalAuth
+}
+
 // -------------------------------------------------------------------
 // Admin API events data
 // -------------------------------------------------------------------
@@ -142,29 +218,6 @@ type AdminAuthEvent struct {
 	Token       string
 }
 
-// -------------------------------------------------------------------
-// Auth Record API events data
-// -------------------------------------------------------------------
-
-type RecordAuthEvent struct {
-	HttpContext echo.Context
-	Record      *models.Record
-	Token       string
-	Meta        any
-}
-
-type RecordListExternalAuthsEvent struct {
-	HttpContext   echo.Context
-	Record        *models.Record
-	ExternalAuths []*models.ExternalAuth
-}
-
-type RecordUnlinkExternalAuthEvent struct {
-	HttpContext  echo.Context
-	Record       *models.Record
-	ExternalAuth *models.ExternalAuth
-}
-
 // -------------------------------------------------------------------
 // Collection API events data
 // -------------------------------------------------------------------

daos/base.go

@@ -4,24 +4,44 @@
 package daos
 
 import (
+	"context"
 	"errors"
-	"fmt"
+	"strings"
+	"sync"
+	"time"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/models"
+	"golang.org/x/sync/semaphore"
 )
 
-// New creates a new Dao instance with the provided db builder.
+const DefaultMaxFailRetries = 5
+
+// New creates a new Dao instance with the provided db builder
+// (for both async and sync db operations).
 func New(db dbx.Builder) *Dao {
+	return NewMultiDB(db, db)
+}
+
+// New creates a new Dao instance with the provided dedicated
+// async and sync db builders.
+func NewMultiDB(concurrentDB, nonconcurrentDB dbx.Builder) *Dao {
 	return &Dao{
-		db: db,
+		concurrentDB:    concurrentDB,
+		nonconcurrentDB: nonconcurrentDB,
 	}
 }
 
 // Dao handles various db operations.
 // Think of Dao as a repository and service layer in one.
 type Dao struct {
-	db dbx.Builder
+	// in a transaction both refer to the same *dbx.TX instance
+	concurrentDB    dbx.Builder
+	nonconcurrentDB dbx.Builder
+
+	// @todo delete after removing Block and Continue
+	sem *semaphore.Weighted
+	mux sync.RWMutex
 
 	BeforeCreateFunc func(eventDao *Dao, m models.Model) error
 	AfterCreateFunc  func(eventDao *Dao, m models.Model)
@@ -31,16 +51,78 @@ type Dao struct {
 	AfterDeleteFunc  func(eventDao *Dao, m models.Model)
 }
 
-// DB returns the internal db builder (*dbx.DB or *dbx.TX).
+// DB returns the default dao db builder (*dbx.DB or *dbx.TX).
+//
+// Currently the default db builder is dao.concurrentDB but that may change in the future.
 func (dao *Dao) DB() dbx.Builder {
-	return dao.db
+	return dao.ConcurrentDB()
+}
+
+// ConcurrentDB returns the dao concurrent (aka. multiple open connections)
+// db builder (*dbx.DB or *dbx.TX).
+//
+// In a transaction the concurrentDB and nonconcurrentDB refer to the same *dbx.TX instance.
+func (dao *Dao) ConcurrentDB() dbx.Builder {
+	return dao.concurrentDB
+}
+
+// NonconcurrentDB returns the dao nonconcurrent (aka. single open connection)
+// db builder (*dbx.DB or *dbx.TX).
+//
+// In a transaction the concurrentDB and nonconcurrentDB refer to the same *dbx.TX instance.
+func (dao *Dao) NonconcurrentDB() dbx.Builder {
+	return dao.nonconcurrentDB
+}
+
+// Deprecated: Will be removed in the next releases. Use [Dao.NonconcurrentDB()] instead.
+//
+// Block acquires a lock and blocks all other go routines that uses
+// the Dao instance until dao.Continue() is called, effectively making
+// the concurrent requests to perform synchronous db operations.
+//
+// This method should be used only as a last resort and as a workaround
+// for the SQLITE_BUSY error when mixing read&write in a transaction.
+//
+// Example:
+//
+// 	func someLongRunningTransaction() error {
+// 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+// 		defer cancel()
+// 		if err := app.Dao().Block(ctx); err != nil {
+// 			return err
+// 		}
+// 		defer app.Dao().Continue()
+//
+// 		return app.Dao().RunInTransaction(func (txDao *daos.Dao) error {
+// 			// some long running read&write transaction...
+// 		})
+// 	}
+func (dao *Dao) Block(ctx context.Context) error {
+	if dao.sem == nil {
+		dao.mux.Lock()
+		dao.sem = semaphore.NewWeighted(1)
+		dao.mux.Unlock()
+	}
+
+	return dao.sem.Acquire(ctx, 1)
+}
+
+// Deprecated: Will be removed in the next releases. Use [Dao.NonconcurrentDB()] instead.
+//
+// Continue releases the previously acquired Block() lock.
+func (dao *Dao) Continue() {
+	if dao.sem == nil {
+		return
+	}
+
+	dao.sem.Release(1)
 }
 
 // ModelQuery creates a new query with preset Select and From fields
 // based on the provided model argument.
 func (dao *Dao) ModelQuery(m models.Model) *dbx.SelectQuery {
 	tableName := m.TableName()
-	return dao.db.Select(fmt.Sprintf("{{%s}}.*", tableName)).From(tableName)
+	return dao.DB().Select("{{" + tableName + "}}.*").From(tableName)
 }
 
 // FindById finds a single db record with the specified id and
@@ -57,13 +139,23 @@ type afterCallGroup struct {
 
 // RunInTransaction wraps fn into a transaction.
 //
-// It is safe to nest RunInTransaction calls.
+// It is safe to nest RunInTransaction calls as long as you use the txDao.
 func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
-	switch txOrDB := dao.db.(type) {
+	switch txOrDB := dao.NonconcurrentDB().(type) {
 	case *dbx.Tx:
 		// nested transactions are not supported by default
 		// so execute the function within the current transaction
-		return fn(dao)
+		// ---
+		// create a new dao with the same hooks to avoid semaphore deadlock when nesting
+		txDao := New(txOrDB)
+		txDao.BeforeCreateFunc = dao.BeforeCreateFunc
+		txDao.BeforeUpdateFunc = dao.BeforeUpdateFunc
+		txDao.BeforeDeleteFunc = dao.BeforeDeleteFunc
+		txDao.AfterCreateFunc = dao.AfterCreateFunc
+		txDao.AfterUpdateFunc = dao.AfterUpdateFunc
+		txDao.AfterDeleteFunc = dao.AfterDeleteFunc
+
+		return fn(txDao)
 	case *dbx.DB:
 		afterCalls := []afterCallGroup{}
 
@@ -107,14 +199,15 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 
 		if txError == nil {
 			// execute after event calls on successful transaction
+			// (note: using the non-transaction dao to allow following queries in the after hooks)
 			for _, call := range afterCalls {
 				switch call.Action {
 				case "create":
-					dao.AfterCreateFunc(call.EventDao, call.Model)
+					dao.AfterCreateFunc(dao, call.Model)
 				case "update":
-					dao.AfterUpdateFunc(call.EventDao, call.Model)
+					dao.AfterUpdateFunc(dao, call.Model)
 				case "delete":
-					dao.AfterDeleteFunc(call.EventDao, call.Model)
+					dao.AfterDeleteFunc(dao, call.Model)
 				}
 			}
 		}
@@ -122,7 +215,7 @@ func (dao *Dao) RunInTransaction(fn func(txDao *Dao) error) error {
 		return txError
 	}
 
-	return errors.New("Failed to start transaction (unknown dao.db)")
+	return errors.New("failed to start transaction (unknown dao.NonconcurrentDB() instance)")
 }
 
 // Delete deletes the provided model.
@@ -131,30 +224,36 @@ func (dao *Dao) Delete(m models.Model) error {
 		return errors.New("ID is not set")
 	}
 
-	if dao.BeforeDeleteFunc != nil {
-		if err := dao.BeforeDeleteFunc(dao, m); err != nil {
+	return dao.failRetry(func(retryDao *Dao) error {
+		if retryDao.BeforeDeleteFunc != nil {
+			if err := retryDao.BeforeDeleteFunc(retryDao, m); err != nil {
+				return err
+			}
+		}
+
+		if err := retryDao.NonconcurrentDB().Model(m).Delete(); err != nil {
 			return err
 		}
-	}
 
-	if err := dao.db.Model(m).Delete(); err != nil {
-		return err
-	}
+		if retryDao.AfterDeleteFunc != nil {
+			retryDao.AfterDeleteFunc(retryDao, m)
+		}
 
-	if dao.AfterDeleteFunc != nil {
-		dao.AfterDeleteFunc(dao, m)
-	}
-
-	return nil
+		return nil
+	}, DefaultMaxFailRetries)
 }
 
 // Save upserts (update or create if primary key is not set) the provided model.
 func (dao *Dao) Save(m models.Model) error {
 	if m.IsNew() {
-		return dao.create(m)
+		return dao.failRetry(func(retryDao *Dao) error {
+			return retryDao.create(m)
+		}, DefaultMaxFailRetries)
 	}
 
-	return dao.update(m)
+	return dao.failRetry(func(retryDao *Dao) error {
+		return retryDao.update(m)
+	}, DefaultMaxFailRetries)
 }
 
 func (dao *Dao) update(m models.Model) error {
@@ -177,7 +276,7 @@ func (dao *Dao) update(m models.Model) error {
 	if v, ok := any(m).(models.ColumnValueMapper); ok {
 		dataMap := v.ColumnValueMap()
 
-		_, err := dao.db.Update(
+		_, err := dao.NonconcurrentDB().Update(
 			m.TableName(),
 			dataMap,
 			dbx.HashExp{"id": m.GetId()},
@@ -187,7 +286,7 @@ func (dao *Dao) update(m models.Model) error {
 			return err
 		}
 	} else {
-		if err := dao.db.Model(m).Update(); err != nil {
+		if err := dao.NonconcurrentDB().Model(m).Update(); err != nil {
 			return err
 		}
 	}
@@ -228,18 +327,18 @@ func (dao *Dao) create(m models.Model) error {
 			dataMap["id"] = m.GetId()
 		}
 
-		_, err := dao.db.Insert(m.TableName(), dataMap).Execute()
+		_, err := dao.NonconcurrentDB().Insert(m.TableName(), dataMap).Execute()
 		if err != nil {
 			return err
 		}
 	} else {
-		if err := dao.db.Model(m).Insert(); err != nil {
+		if err := dao.NonconcurrentDB().Model(m).Insert(); err != nil {
 			return err
 		}
 	}
 
 	// clears the "new" model flag
-	m.UnmarkAsNew()
+	m.MarkAsNotNew()
 
 	if dao.AfterCreateFunc != nil {
 		dao.AfterCreateFunc(dao, m)
@@ -247,3 +346,33 @@ func (dao *Dao) create(m models.Model) error {
 
 	return nil
 }
+
+func (dao *Dao) failRetry(op func(retryDao *Dao) error, maxRetries int) error {
+	retryDao := dao
+	attempts := 1
+
+Retry:
+	if attempts == 2 {
+		// assign new Dao without the before hooks to avoid triggering
+		// the already fired before callbacks multiple times
+		retryDao = NewMultiDB(dao.concurrentDB, dao.nonconcurrentDB)
+		retryDao.AfterCreateFunc = dao.AfterCreateFunc
+		retryDao.AfterUpdateFunc = dao.AfterUpdateFunc
+		retryDao.AfterDeleteFunc = dao.AfterDeleteFunc
+	}
+
+	// execute
+	err := op(retryDao)
+
+	if err != nil &&
+		attempts < maxRetries &&
+		// note: we are checking the err message so that we can handle both the cgo and noncgo errors
+		strings.Contains(err.Error(), "database is locked") {
+		// wait and retry
+		time.Sleep(time.Duration(200*attempts) * time.Millisecond)
+		attempts++
+		goto Retry
+	}
+
+	return err
+}

daos/base_test.go

@@ -20,6 +20,25 @@ func TestNew(t *testing.T) {
 	}
 }
 
+func TestNewMultiDB(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	dao := daos.NewMultiDB(testApp.Dao().ConcurrentDB(), testApp.Dao().NonconcurrentDB())
+
+	if dao.DB() != testApp.Dao().ConcurrentDB() {
+		t.Fatal("[db-concurrentDB] The 2 db instances are different")
+	}
+
+	if dao.ConcurrentDB() != testApp.Dao().ConcurrentDB() {
+		t.Fatal("[concurrentDB-concurrentDB] The 2 db instances are different")
+	}
+
+	if dao.NonconcurrentDB() != testApp.Dao().NonconcurrentDB() {
+		t.Fatal("[nonconcurrentDB-nonconcurrentDB] The 2 db instances are different")
+	}
+}
+
 func TestDaoModelQuery(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()
@@ -289,6 +308,170 @@ func TestDaoDelete(t *testing.T) {
 	}
 }
 
+func TestDaoRetryCreate(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init mock retry dao
+	retryBeforeCreateHookCalls := 0
+	retryAfterCreateHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeCreateHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterCreateFunc = func(eventDao *daos.Dao, m models.Model) {
+		retryAfterCreateHookCalls++
+	}
+
+	model := &models.Admin{Email: "new@example.com"}
+	if err := retryDao.Save(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeCreateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeCreateHookCalls)
+	}
+
+	if retryAfterCreateHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterCreateHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeCreateHookCalls = 0
+	retryAfterCreateHookCalls = 0
+	retryDao.BeforeCreateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeCreateHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	dummy := &models.Admin{Email: "test@example.com"}
+	if err := retryDao.Save(dummy); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeCreateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeCreateHookCalls)
+	}
+
+	if retryAfterCreateHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterCreateHookCalls)
+	}
+}
+
+func TestDaoRetryUpdate(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	model, err := testApp.Dao().FindAdminByEmail("test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// init mock retry dao
+	retryBeforeUpdateHookCalls := 0
+	retryAfterUpdateHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeUpdateHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterUpdateFunc = func(eventDao *daos.Dao, m models.Model) {
+		retryAfterUpdateHookCalls++
+	}
+
+	if err := retryDao.Save(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeUpdateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeUpdateHookCalls)
+	}
+
+	if retryAfterUpdateHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterUpdateHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeUpdateHookCalls = 0
+	retryAfterUpdateHookCalls = 0
+	retryDao.BeforeUpdateFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeUpdateHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	if err := retryDao.Save(model); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeUpdateHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeUpdateHookCalls)
+	}
+
+	if retryAfterUpdateHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterUpdateHookCalls)
+	}
+}
+
+func TestDaoRetryDelete(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init mock retry dao
+	retryBeforeDeleteHookCalls := 0
+	retryAfterDeleteHookCalls := 0
+	retryDao := daos.New(testApp.DB())
+	retryDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeDeleteHookCalls++
+		return errors.New("database is locked")
+	}
+	retryDao.AfterDeleteFunc = func(eventDao *daos.Dao, m models.Model) {
+		retryAfterDeleteHookCalls++
+	}
+
+	model, _ := retryDao.FindAdminByEmail("test@example.com")
+	if err := retryDao.Delete(model); err != nil {
+		t.Fatalf("Expected nil after retry, got error: %v", err)
+	}
+
+	// the before hook is expected to be called only once because
+	// it is ignored after the first "database is locked" error
+	if retryBeforeDeleteHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeDeleteHookCalls)
+	}
+
+	if retryAfterDeleteHookCalls != 1 {
+		t.Fatalf("Expected after hook calls to be 1, got %d", retryAfterDeleteHookCalls)
+	}
+
+	// with non-locking error
+	retryBeforeDeleteHookCalls = 0
+	retryAfterDeleteHookCalls = 0
+	retryDao.BeforeDeleteFunc = func(eventDao *daos.Dao, m models.Model) error {
+		retryBeforeDeleteHookCalls++
+		return errors.New("non-locking error")
+	}
+
+	dummy := &models.Admin{}
+	dummy.RefreshId()
+	dummy.MarkAsNotNew()
+	if err := retryDao.Delete(dummy); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	if retryBeforeDeleteHookCalls != 1 {
+		t.Fatalf("Expected before hook calls to be 1, got %d", retryBeforeDeleteHookCalls)
+	}
+
+	if retryAfterDeleteHookCalls != 0 {
+		t.Fatalf("Expected after hook calls to be 0, got %d", retryAfterDeleteHookCalls)
+	}
+}
+
 func TestDaoBeforeHooksError(t *testing.T) {
 	testApp, _ := tests.NewTestApp()
 	defer testApp.Cleanup()

daos/collection.go

@@ -212,6 +212,8 @@ func (dao *Dao) ImportCollections(
 			}
 
 			if existing, ok := mappedExisting[imported.GetId()]; ok {
+				imported.MarkAsNotNew()
+
 				// preserve original created date
 				if !existing.Created.IsZero() {
 					imported.Created = existing.Created

daos/record.go

@@ -3,6 +3,7 @@ package daos
 import (
 	"errors"
 	"fmt"
+	"math"
 	"strings"
 
 	"github.com/pocketbase/dbx"
@@ -214,7 +215,7 @@ func (dao *Dao) FindAuthRecordByToken(token string, baseTokenKey string) (*model
 	id, _ := unverifiedClaims["id"].(string)
 	collectionId, _ := unverifiedClaims["collectionId"].(string)
 	if id == "" || collectionId == "" {
-		return nil, errors.New("Missing or invalid token claims.")
+		return nil, errors.New("missing or invalid token claims")
 	}
 
 	record, err := dao.FindRecordById(collectionId, id)
@@ -241,8 +242,11 @@ func (dao *Dao) FindAuthRecordByToken(token string, baseTokenKey string) (*model
 // Returns an error if it is not an auth collection or the record is not found.
 func (dao *Dao) FindAuthRecordByEmail(collectionNameOrId string, email string) (*models.Record, error) {
 	collection, err := dao.FindCollectionByNameOrId(collectionNameOrId)
-	if err != nil || !collection.IsAuth() {
-		return nil, errors.New("Missing or not an auth collection.")
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth collection %q (%w)", collectionNameOrId, err)
+	}
+	if !collection.IsAuth() {
+		return nil, fmt.Errorf("%q is not an auth collection", collectionNameOrId)
 	}
 
 	row := dbx.NullStringMap{}
@@ -264,8 +268,11 @@ func (dao *Dao) FindAuthRecordByEmail(collectionNameOrId string, email string) (
 // Returns an error if it is not an auth collection or the record is not found.
 func (dao *Dao) FindAuthRecordByUsername(collectionNameOrId string, username string) (*models.Record, error) {
 	collection, err := dao.FindCollectionByNameOrId(collectionNameOrId)
-	if err != nil || !collection.IsAuth() {
-		return nil, errors.New("Missing or not an auth collection.")
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth collection %q (%w)", collectionNameOrId, err)
+	}
+	if !collection.IsAuth() {
+		return nil, fmt.Errorf("%q is not an auth collection", collectionNameOrId)
 	}
 
 	row := dbx.NullStringMap{}
@@ -316,14 +323,14 @@ func (dao *Dao) SuggestUniqueAuthRecordUsername(
 func (dao *Dao) SaveRecord(record *models.Record) error {
 	if record.Collection().IsAuth() {
 		if record.Username() == "" {
-			return errors.New("Unable to save auth record without username.")
+			return errors.New("unable to save auth record without username")
 		}
 
 		// Cross-check that the auth record id is unique for all auth collections.
 		// This is to make sure that the filter `@request.auth.id` always returns a unique id.
 		authCollections, err := dao.FindCollectionsByType(models.CollectionTypeAuth)
 		if err != nil {
-			return fmt.Errorf("Unable to fetch the auth collections for cross-id unique check: %v", err)
+			return fmt.Errorf("unable to fetch the auth collections for cross-id unique check: %w", err)
 		}
 		for _, collection := range authCollections {
 			if record.Collection().Id == collection.Id {
@@ -331,7 +338,7 @@ func (dao *Dao) SaveRecord(record *models.Record) error {
 			}
 			isUnique := dao.IsRecordValueUnique(collection.Id, schema.FieldNameId, record.Id)
 			if !isUnique {
-				return errors.New("The auth record ID must be unique across all auth collections.")
+				return errors.New("the auth record ID must be unique across all auth collections")
 			}
 		}
 	}
@@ -342,222 +349,169 @@ func (dao *Dao) SaveRecord(record *models.Record) error {
 // DeleteRecord deletes the provided Record model.
 //
 // This method will also cascade the delete operation to all linked
-// relational records (delete or set to NULL, depending on the rel settings).
+// relational records (delete or unset, depending on the rel settings).
 //
 // The delete operation may fail if the record is part of a required
-// reference in another record (aka. cannot be deleted or set to NULL).
+// reference in another record (aka. cannot be deleted or unset).
 func (dao *Dao) DeleteRecord(record *models.Record) error {
-	// check for references
-	// note: the select is outside of the transaction to prevent SQLITE_LOCKED error when mixing read&write in a single transaction.
+	// fetch rel references (if any)
+	//
+	// note: the select is outside of the transaction to minimize
+	// SQLITE_BUSY errors when mixing read&write in a single transaction
 	refs, err := dao.FindCollectionReferences(record.Collection())
 	if err != nil {
 		return err
 	}
 
-	// check if related records has to be deleted (if `CascadeDelete` is set)
-	// OR
-	// just unset the record id from any relation field values (if they are not required)
-	// -----------------------------------------------------------
 	return dao.RunInTransaction(func(txDao *Dao) error {
-		// delete/update references
-		for refCollection, fields := range refs {
-			for _, field := range fields {
-				options, _ := field.Options.(*schema.RelationOptions)
+		// manually trigger delete on any linked external auth to ensure
+		// that the `OnModel*` hooks are triggered
+		if record.Collection().IsAuth() {
+			// note: the select is outside of the transaction to minimize
+			// SQLITE_BUSY errors when mixing read&write in a single transaction
+			externalAuths, err := dao.FindAllExternalAuthsByRecord(record)
+			if err != nil {
+				return err
+			}
+			for _, auth := range externalAuths {
+				if err := txDao.DeleteExternalAuth(auth); err != nil {
+					return err
+				}
+			}
+		}
 
-				rows := []dbx.NullStringMap{}
+		// delete the record before the relation references to ensure that there
+		// will be no "A<->B" relations to prevent deadlock when calling DeleteRecord recursively
+		if err := txDao.Delete(record); err != nil {
+			return err
+		}
 
-				// note: the select is not using the transaction dao to prevent SQLITE_LOCKED error when mixing read&write in a single transaction
-				err := dao.RecordQuery(refCollection).
-					AndWhere(dbx.Not(dbx.HashExp{"id": record.Id})).
-					AndWhere(dbx.Like(field.Name, record.Id).Match(true, true)).
-					All(&rows)
-				if err != nil {
+		return txDao.cascadeRecordDelete(record, refs)
+	})
+}
+
+// cascadeRecordDelete triggers cascade deletion for the provided references
+// and split the work to a batched set of go routines.
+//
+// NB! This method is expected to be called inside a transaction.
+func (dao *Dao) cascadeRecordDelete(mainRecord *models.Record, refs map[*models.Collection][]*schema.SchemaField) error {
+	uniqueJsonEachAlias := "__je__" + security.PseudorandomString(4)
+
+	for refCollection, fields := range refs {
+		for _, field := range fields {
+			recordTableName := inflector.Columnify(refCollection.Name)
+			prefixedFieldName := recordTableName + "." + inflector.Columnify(field.Name)
+			query := dao.RecordQuery(refCollection).
+				Distinct(true).
+				LeftJoin(fmt.Sprintf(
+					// note: the case is used to normalize value access for single and multiple relations.
+					`json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) as {{%s}}`,
+					prefixedFieldName, prefixedFieldName, prefixedFieldName, uniqueJsonEachAlias,
+				), nil).
+				AndWhere(dbx.Not(dbx.HashExp{recordTableName + ".id": mainRecord.Id})).
+				AndWhere(dbx.HashExp{uniqueJsonEachAlias + ".value": mainRecord.Id})
+
+			// trigger cascade for each 1000 rel items until there is none
+			batchSize := 1000
+			for {
+				rows := make([]dbx.NullStringMap, 0, batchSize)
+				if err := query.Limit(int64(batchSize)).All(&rows); err != nil {
 					return err
 				}
 
-				refRecords := models.NewRecordsFromNullStringMaps(refCollection, rows)
-				for _, refRecord := range refRecords {
-					ids := refRecord.GetStringSlice(field.Name)
+				total := len(rows)
+				if total == 0 {
+					break
+				}
 
-					// unset the record id
-					for i := len(ids) - 1; i >= 0; i-- {
-						if ids[i] == record.Id {
-							ids = append(ids[:i], ids[i+1:]...)
-							break
+				perWorker := 50
+				workers := int(math.Ceil(float64(total) / float64(perWorker)))
+
+				batchErr := func() error {
+					ch := make(chan error)
+					defer close(ch)
+
+					for i := 0; i < workers; i++ {
+						var chunks []dbx.NullStringMap
+						if len(rows) <= perWorker {
+							chunks = rows
+							rows = nil
+						} else {
+							chunks = rows[:perWorker]
+							rows = rows[perWorker:]
 						}
+
+						go func() {
+							refRecords := models.NewRecordsFromNullStringMaps(refCollection, chunks)
+							ch <- dao.deleteRefRecords(mainRecord, refRecords, field)
+						}()
 					}
 
-					// cascade delete the reference
-					// (only if there are no other active references in case of multiple select)
-					if options.CascadeDelete && len(ids) == 0 {
-						if err := txDao.DeleteRecord(refRecord); err != nil {
+					for i := 0; i < workers; i++ {
+						if err := <-ch; err != nil {
 							return err
 						}
-						// no further action are needed (the reference is deleted)
-						continue
 					}
 
-					if field.Required && len(ids) == 0 {
-						return fmt.Errorf("The record cannot be deleted because it is part of a required reference in record %s (%s collection).", refRecord.Id, refCollection.Name)
-					}
+					return nil
+				}()
 
-					// save the reference changes
-					refRecord.Set(field.Name, field.PrepareValue(ids))
-					if err := txDao.SaveRecord(refRecord); err != nil {
-						return err
-					}
+				if batchErr != nil {
+					return batchErr
+				}
+
+				if total < batchSize {
+					break // no more items
 				}
 			}
 		}
-
-		// delete linked external auths
-		if record.Collection().IsAuth() {
-			_, err = txDao.DB().Delete((&models.ExternalAuth{}).TableName(), dbx.HashExp{
-				"collectionId": record.Collection().Id,
-				"recordId":     record.Id,
-			}).Execute()
-			if err != nil {
-				return err
-			}
-		}
-
-		return txDao.Delete(record)
-	})
-}
-
-// SyncRecordTableSchema compares the two provided collections
-// and applies the necessary related record table changes.
-//
-// If `oldCollection` is null, then only `newCollection` is used to create the record table.
-func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldCollection *models.Collection) error {
-	// create
-	if oldCollection == nil {
-		cols := map[string]string{
-			schema.FieldNameId:      "TEXT PRIMARY KEY",
-			schema.FieldNameCreated: "TEXT DEFAULT '' NOT NULL",
-			schema.FieldNameUpdated: "TEXT DEFAULT '' NOT NULL",
-		}
-
-		if newCollection.IsAuth() {
-			cols[schema.FieldNameUsername] = "TEXT NOT NULL"
-			cols[schema.FieldNameEmail] = "TEXT DEFAULT '' NOT NULL"
-			cols[schema.FieldNameEmailVisibility] = "BOOLEAN DEFAULT FALSE NOT NULL"
-			cols[schema.FieldNameVerified] = "BOOLEAN DEFAULT FALSE NOT NULL"
-			cols[schema.FieldNameTokenKey] = "TEXT NOT NULL"
-			cols[schema.FieldNamePasswordHash] = "TEXT NOT NULL"
-			cols[schema.FieldNameLastResetSentAt] = "TEXT DEFAULT '' NOT NULL"
-			cols[schema.FieldNameLastVerificationSentAt] = "TEXT DEFAULT '' NOT NULL"
-		}
-
-		// ensure that the new collection has an id
-		if !newCollection.HasId() {
-			newCollection.RefreshId()
-			newCollection.MarkAsNew()
-		}
-
-		tableName := newCollection.Name
-
-		// add schema field definitions
-		for _, field := range newCollection.Schema.Fields() {
-			cols[field.Name] = field.ColDefinition()
-		}
-
-		// create table
-		if _, err := dao.DB().CreateTable(tableName, cols).Execute(); err != nil {
-			return err
-		}
-
-		// add named index on the base `created` column
-		if _, err := dao.DB().CreateIndex(tableName, "_"+newCollection.Id+"_created_idx", "created").Execute(); err != nil {
-			return err
-		}
-
-		// add named unique index on the email and tokenKey columns
-		if newCollection.IsAuth() {
-			_, err := dao.DB().NewQuery(fmt.Sprintf(
-				`
-				CREATE UNIQUE INDEX _%s_username_idx ON {{%s}} ([[username]]);
-				CREATE UNIQUE INDEX _%s_email_idx ON {{%s}} ([[email]]) WHERE [[email]] != '';
-				CREATE UNIQUE INDEX _%s_tokenKey_idx ON {{%s}} ([[tokenKey]]);
-				`,
-				newCollection.Id, tableName,
-				newCollection.Id, tableName,
-				newCollection.Id, tableName,
-			)).Execute()
-			if err != nil {
-				return err
-			}
-		}
-
-		return nil
 	}
 
-	// update
-	return dao.RunInTransaction(func(txDao *Dao) error {
-		oldTableName := oldCollection.Name
-		newTableName := newCollection.Name
-		oldSchema := oldCollection.Schema
-		newSchema := newCollection.Schema
-
-		// check for renamed table
-		if !strings.EqualFold(oldTableName, newTableName) {
-			_, err := txDao.DB().RenameTable(oldTableName, newTableName).Execute()
-			if err != nil {
-				return err
+	return nil
+}
+
+// deleteRefRecords checks if related records has to be deleted (if `CascadeDelete` is set)
+// OR
+// just unset the record id from any relation field values (if they are not required).
+//
+// NB! This method is expected to be called inside a transaction.
+func (dao *Dao) deleteRefRecords(mainRecord *models.Record, refRecords []*models.Record, field *schema.SchemaField) error {
+	options, _ := field.Options.(*schema.RelationOptions)
+	if options == nil {
+		return errors.New("relation field options are not initialized")
+	}
+
+	for _, refRecord := range refRecords {
+		ids := refRecord.GetStringSlice(field.Name)
+
+		// unset the record id
+		for i := len(ids) - 1; i >= 0; i-- {
+			if ids[i] == mainRecord.Id {
+				ids = append(ids[:i], ids[i+1:]...)
+				break
 			}
 		}
 
-		// check for deleted columns
-		for _, oldField := range oldSchema.Fields() {
-			if f := newSchema.GetFieldById(oldField.Id); f != nil {
-				continue // exist
-			}
-
-			_, err := txDao.DB().DropColumn(newTableName, oldField.Name).Execute()
-			if err != nil {
+		// cascade delete the reference
+		// (only if there are no other active references in case of multiple select)
+		if options.CascadeDelete && len(ids) == 0 {
+			if err := dao.DeleteRecord(refRecord); err != nil {
 				return err
 			}
+			// no further actions are needed (the reference is deleted)
+			continue
 		}
-
-		// check for new or renamed columns
-		toRename := map[string]string{}
-		for _, field := range newSchema.Fields() {
-			oldField := oldSchema.GetFieldById(field.Id)
-			// Note:
-			// We are using a temporary column name when adding or renaming columns
-			// to ensure that there are no name collisions in case there is
-			// names switch/reuse of existing columns (eg. name, title -> title, name).
-			// This way we are always doing 1 more rename operation but it provides better dev experience.
 
-			if oldField == nil {
-				tempName := field.Name + security.PseudorandomString(5)
-				toRename[tempName] = field.Name
-
-				// add
-				_, err := txDao.DB().AddColumn(newTableName, tempName, field.ColDefinition()).Execute()
-				if err != nil {
-					return err
-				}
-			} else if oldField.Name != field.Name {
-				tempName := field.Name + security.PseudorandomString(5)
-				toRename[tempName] = field.Name
-
-				// rename
-				_, err := txDao.DB().RenameColumn(newTableName, oldField.Name, tempName).Execute()
-				if err != nil {
-					return err
-				}
-			}
+		if field.Required && len(ids) == 0 {
+			return fmt.Errorf("the record cannot be deleted because it is part of a required reference in record %s (%s collection)", refRecord.Id, refRecord.Collection().Name)
 		}
 
-		// set the actual columns name
-		for tempName, actualName := range toRename {
-			_, err := txDao.DB().RenameColumn(newTableName, tempName, actualName).Execute()
-			if err != nil {
-				return err
-			}
+		// save the reference changes
+		refRecord.Set(field.Name, field.PrepareValue(ids))
+		if err := dao.SaveRecord(refRecord); err != nil {
+			return err
 		}
+	}
 
-		return nil
-	})
+	return nil
 }

daos/record_expand.go

@@ -93,8 +93,8 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 		}
 
 		recordIds := make([]any, len(records))
-		for _, record := range records {
-			recordIds = append(recordIds, record.Id)
+		for i, record := range records {
+			recordIds[i] = record.Id
 		}
 
 		indirectRecords, err := dao.FindRecordsByExpr(
@@ -176,7 +176,7 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 	}
 
 	// reindex with the rel id
-	indexedRels := map[string]*models.Record{}
+	indexedRels := make(map[string]*models.Record, len(rels))
 	for _, rel := range rels {
 		indexedRels[rel.GetId()] = rel
 	}
@@ -216,12 +216,7 @@ func (dao *Dao) expandRecords(records []*models.Record, expandPath string, fetch
 					continue
 				}
 
-				oldRelExpand := oldExpandedRel.Expand()
-				newRelExpand := rel.Expand()
-				for k, v := range oldRelExpand {
-					newRelExpand[k] = v
-				}
-				rel.SetExpand(newRelExpand)
+				rel.MergeExpand(oldExpandedRel.Expand())
 			}
 		}
 

daos/record_expand_test.go

@@ -167,6 +167,22 @@ func TestExpandRecords(t *testing.T) {
 			5,
 			0,
 		},
+		{
+			"expand multiple relations sharing a common path",
+			"demo4",
+			[]string{"qzaqccwrmva4o1n"},
+			[]string{
+				"rel_one_no_cascade",
+				"rel_many_no_cascade",
+				"self_rel_many.self_rel_one.rel_many_cascade",
+				"self_rel_many.self_rel_one.rel_many_no_cascade_required",
+			},
+			func(c *models.Collection, ids []string) ([]*models.Record, error) {
+				return app.Dao().FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
 	}
 
 	for _, s := range scenarios {

daos/record_table_sync.go

@@ -0,0 +1,147 @@
+package daos
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// SyncRecordTableSchema compares the two provided collections
+// and applies the necessary related record table changes.
+//
+// If `oldCollection` is null, then only `newCollection` is used to create the record table.
+func (dao *Dao) SyncRecordTableSchema(newCollection *models.Collection, oldCollection *models.Collection) error {
+	// create
+	if oldCollection == nil {
+		cols := map[string]string{
+			schema.FieldNameId:      "TEXT PRIMARY KEY NOT NULL",
+			schema.FieldNameCreated: "TEXT DEFAULT '' NOT NULL",
+			schema.FieldNameUpdated: "TEXT DEFAULT '' NOT NULL",
+		}
+
+		if newCollection.IsAuth() {
+			cols[schema.FieldNameUsername] = "TEXT NOT NULL"
+			cols[schema.FieldNameEmail] = "TEXT DEFAULT '' NOT NULL"
+			cols[schema.FieldNameEmailVisibility] = "BOOLEAN DEFAULT FALSE NOT NULL"
+			cols[schema.FieldNameVerified] = "BOOLEAN DEFAULT FALSE NOT NULL"
+			cols[schema.FieldNameTokenKey] = "TEXT NOT NULL"
+			cols[schema.FieldNamePasswordHash] = "TEXT NOT NULL"
+			cols[schema.FieldNameLastResetSentAt] = "TEXT DEFAULT '' NOT NULL"
+			cols[schema.FieldNameLastVerificationSentAt] = "TEXT DEFAULT '' NOT NULL"
+		}
+
+		// ensure that the new collection has an id
+		if !newCollection.HasId() {
+			newCollection.RefreshId()
+			newCollection.MarkAsNew()
+		}
+
+		tableName := newCollection.Name
+
+		// add schema field definitions
+		for _, field := range newCollection.Schema.Fields() {
+			cols[field.Name] = field.ColDefinition()
+		}
+
+		// create table
+		if _, err := dao.DB().CreateTable(tableName, cols).Execute(); err != nil {
+			return err
+		}
+
+		// add named index on the base `created` column
+		if _, err := dao.DB().CreateIndex(tableName, "_"+newCollection.Id+"_created_idx", "created").Execute(); err != nil {
+			return err
+		}
+
+		// add named unique index on the email and tokenKey columns
+		if newCollection.IsAuth() {
+			_, err := dao.DB().NewQuery(fmt.Sprintf(
+				`
+				CREATE UNIQUE INDEX _%s_username_idx ON {{%s}} ([[username]]);
+				CREATE UNIQUE INDEX _%s_email_idx ON {{%s}} ([[email]]) WHERE [[email]] != '';
+				CREATE UNIQUE INDEX _%s_tokenKey_idx ON {{%s}} ([[tokenKey]]);
+				`,
+				newCollection.Id, tableName,
+				newCollection.Id, tableName,
+				newCollection.Id, tableName,
+			)).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+
+	// update
+	return dao.RunInTransaction(func(txDao *Dao) error {
+		oldTableName := oldCollection.Name
+		newTableName := newCollection.Name
+		oldSchema := oldCollection.Schema
+		newSchema := newCollection.Schema
+
+		// check for renamed table
+		if !strings.EqualFold(oldTableName, newTableName) {
+			_, err := txDao.DB().RenameTable(oldTableName, newTableName).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		// check for deleted columns
+		for _, oldField := range oldSchema.Fields() {
+			if f := newSchema.GetFieldById(oldField.Id); f != nil {
+				continue // exist
+			}
+
+			_, err := txDao.DB().DropColumn(newTableName, oldField.Name).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		// check for new or renamed columns
+		toRename := map[string]string{}
+		for _, field := range newSchema.Fields() {
+			oldField := oldSchema.GetFieldById(field.Id)
+			// Note:
+			// We are using a temporary column name when adding or renaming columns
+			// to ensure that there are no name collisions in case there is
+			// names switch/reuse of existing columns (eg. name, title -> title, name).
+			// This way we are always doing 1 more rename operation but it provides better dev experience.
+
+			if oldField == nil {
+				tempName := field.Name + security.PseudorandomString(5)
+				toRename[tempName] = field.Name
+
+				// add
+				_, err := txDao.DB().AddColumn(newTableName, tempName, field.ColDefinition()).Execute()
+				if err != nil {
+					return err
+				}
+			} else if oldField.Name != field.Name {
+				tempName := field.Name + security.PseudorandomString(5)
+				toRename[tempName] = field.Name
+
+				// rename
+				_, err := txDao.DB().RenameColumn(newTableName, oldField.Name, tempName).Execute()
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		// set the actual columns name
+		for tempName, actualName := range toRename {
+			_, err := txDao.DB().RenameColumn(newTableName, tempName, actualName).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}

daos/record_table_sync_test.go

@@ -0,0 +1,119 @@
+package daos_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestSyncRecordTableSchema(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	oldCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection.Name = "demo_renamed"
+	updatedCollection.Schema.RemoveField(updatedCollection.Schema.GetFieldByName("active").Id)
+	updatedCollection.Schema.AddField(
+		&schema.SchemaField{
+			Name: "new_field",
+			Type: schema.FieldTypeEmail,
+		},
+	)
+	updatedCollection.Schema.AddField(
+		&schema.SchemaField{
+			Id:   updatedCollection.Schema.GetFieldByName("title").Id,
+			Name: "title_renamed",
+			Type: schema.FieldTypeEmail,
+		},
+	)
+
+	scenarios := []struct {
+		newCollection     *models.Collection
+		oldCollection     *models.Collection
+		expectedTableName string
+		expectedColumns   []string
+	}{
+		// new base collection
+		{
+			&models.Collection{
+				Name: "new_table",
+				Schema: schema.NewSchema(
+					&schema.SchemaField{
+						Name: "test",
+						Type: schema.FieldTypeText,
+					},
+				),
+			},
+			nil,
+			"new_table",
+			[]string{"id", "created", "updated", "test"},
+		},
+		// new auth collection
+		{
+			&models.Collection{
+				Name: "new_table_auth",
+				Type: models.CollectionTypeAuth,
+				Schema: schema.NewSchema(
+					&schema.SchemaField{
+						Name: "test",
+						Type: schema.FieldTypeText,
+					},
+				),
+			},
+			nil,
+			"new_table_auth",
+			[]string{
+				"id", "created", "updated", "test",
+				"username", "email", "verified", "emailVisibility",
+				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt",
+			},
+		},
+		// no changes
+		{
+			oldCollection,
+			oldCollection,
+			"demo3",
+			[]string{"id", "created", "updated", "title", "active"},
+		},
+		// renamed table, deleted column, renamed columnd and new column
+		{
+			updatedCollection,
+			oldCollection,
+			"demo_renamed",
+			[]string{"id", "created", "updated", "title_renamed", "new_field"},
+		},
+	}
+
+	for i, scenario := range scenarios {
+		err := app.Dao().SyncRecordTableSchema(scenario.newCollection, scenario.oldCollection)
+		if err != nil {
+			t.Errorf("(%d) %v", i, err)
+			continue
+		}
+
+		if !app.Dao().HasTable(scenario.newCollection.Name) {
+			t.Errorf("(%d) Expected table %s to exist", i, scenario.newCollection.Name)
+		}
+
+		cols, _ := app.Dao().GetTableColumns(scenario.newCollection.Name)
+		if len(cols) != len(scenario.expectedColumns) {
+			t.Errorf("(%d) Expected columns %v, got %v", i, scenario.expectedColumns, cols)
+		}
+
+		for _, c := range cols {
+			if !list.ExistInSlice(c, scenario.expectedColumns) {
+				t.Errorf("(%d) Couldn't find column %s in %v", i, c, scenario.expectedColumns)
+			}
+		}
+	}
+}

daos/record_test.go

@@ -1,17 +1,22 @@
 package daos_test
 
 import (
+	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"regexp"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 func TestRecordQuery(t *testing.T) {
@@ -628,7 +633,21 @@ func TestDeleteRecord(t *testing.T) {
 
 	// delete existing record + cascade
 	// ---
+	calledQueries := []string{}
+	app.Dao().NonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.Dao().ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.Dao().NonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.Dao().ConcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
 	rec3, _ := app.Dao().FindRecordById("users", "oap640cot4yru2s")
+	// delete
 	if err := app.Dao().DeleteRecord(rec3); err != nil {
 		t.Fatalf("(rec3) Expected nil, got error %v", err)
 	}
@@ -642,113 +661,137 @@ func TestDeleteRecord(t *testing.T) {
 	if rel != nil {
 		t.Fatalf("(rec3) Expected the delete to cascade, found relation %v", rel)
 	}
+	// ensure that the json rel fields were prefixed
+	joinedQueries := strings.Join(calledQueries, " ")
+	expectedRelManyJoin := "`demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_many]]) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END)"
+	if !strings.Contains(joinedQueries, expectedRelManyJoin) {
+		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelManyJoin, calledQueries)
+	}
+	expectedRelOneJoin := "`demo1` LEFT JOIN json_each(CASE WHEN json_valid([[demo1.rel_one]]) THEN [[demo1.rel_one]] ELSE json_array([[demo1.rel_one]]) END)"
+	if !strings.Contains(joinedQueries, expectedRelOneJoin) {
+		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelOneJoin, calledQueries)
+	}
 }
 
-func TestSyncRecordTableSchema(t *testing.T) {
+func TestDeleteRecordBatchProcessing(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
 
-	oldCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
-	if err != nil {
+	if err := createMockBatchProcessingData(app.Dao()); err != nil {
 		t.Fatal(err)
 	}
-	updatedCollection, err := app.Dao().FindCollectionByNameOrId("demo2")
-	if err != nil {
+
+	// find and delete the first c1 record to trigger cascade
+	mainRecord, _ := app.Dao().FindRecordById("c1", "a")
+	if err := app.Dao().DeleteRecord(mainRecord); err != nil {
 		t.Fatal(err)
 	}
-	updatedCollection.Name = "demo_renamed"
-	updatedCollection.Schema.RemoveField(updatedCollection.Schema.GetFieldByName("active").Id)
-	updatedCollection.Schema.AddField(
-		&schema.SchemaField{
-			Name: "new_field",
-			Type: schema.FieldTypeEmail,
-		},
-	)
-	updatedCollection.Schema.AddField(
-		&schema.SchemaField{
-			Id:   updatedCollection.Schema.GetFieldByName("title").Id,
-			Name: "title_renamed",
-			Type: schema.FieldTypeEmail,
-		},
-	)
 
-	scenarios := []struct {
-		newCollection     *models.Collection
-		oldCollection     *models.Collection
-		expectedTableName string
-		expectedColumns   []string
-	}{
-		// new base collection
-		{
-			&models.Collection{
-				Name: "new_table",
-				Schema: schema.NewSchema(
-					&schema.SchemaField{
-						Name: "test",
-						Type: schema.FieldTypeText,
-					},
-				),
-			},
-			nil,
-			"new_table",
-			[]string{"id", "created", "updated", "test"},
-		},
-		// new auth collection
-		{
-			&models.Collection{
-				Name: "new_table_auth",
-				Type: models.CollectionTypeAuth,
-				Schema: schema.NewSchema(
-					&schema.SchemaField{
-						Name: "test",
-						Type: schema.FieldTypeText,
-					},
-				),
-			},
-			nil,
-			"new_table_auth",
-			[]string{
-				"id", "created", "updated", "test",
-				"username", "email", "verified", "emailVisibility",
-				"tokenKey", "passwordHash", "lastResetSentAt", "lastVerificationSentAt",
-			},
-		},
-		// no changes
-		{
-			oldCollection,
-			oldCollection,
-			"demo3",
-			[]string{"id", "created", "updated", "title", "active"},
-		},
-		// renamed table, deleted column, renamed columnd and new column
-		{
-			updatedCollection,
-			oldCollection,
-			"demo_renamed",
-			[]string{"id", "created", "updated", "title_renamed", "new_field"},
-		},
+	// check if the main record was deleted
+	_, err := app.Dao().FindRecordById(mainRecord.Collection().Id, mainRecord.Id)
+	if err == nil {
+		t.Fatal("The main record wasn't deleted")
 	}
 
-	for i, scenario := range scenarios {
-		err := app.Dao().SyncRecordTableSchema(scenario.newCollection, scenario.oldCollection)
-		if err != nil {
-			t.Errorf("(%d) %v", i, err)
-			continue
+	// check if the c2 rel fields were updated
+	c2Records, err := app.Dao().FindRecordsByExpr("c2", nil)
+	if err != nil || len(c2Records) == 0 {
+		t.Fatalf("Failed to fetch c2 records: %v", err)
+	}
+	for _, r := range c2Records {
+		ids := r.GetStringSlice("rel")
+		if len(ids) != 1 || ids[0] != "b" {
+			t.Fatalf("Expected only 'b' rel id, got %v", ids)
 		}
+	}
 
-		if !app.Dao().HasTable(scenario.newCollection.Name) {
-			t.Errorf("(%d) Expected table %s to exist", i, scenario.newCollection.Name)
-		}
-
-		cols, _ := app.Dao().GetTableColumns(scenario.newCollection.Name)
-		if len(cols) != len(scenario.expectedColumns) {
-			t.Errorf("(%d) Expected columns %v, got %v", i, scenario.expectedColumns, cols)
-		}
-
-		for _, c := range cols {
-			if !list.ExistInSlice(c, scenario.expectedColumns) {
-				t.Errorf("(%d) Couldn't find column %s in %v", i, c, scenario.expectedColumns)
-			}
-		}
+	// check if all c3 relations were deleted
+	c3Records, err := app.Dao().FindRecordsByExpr("c3", nil)
+	if err != nil {
+		t.Fatalf("Failed to fetch c3 records: %v", err)
+	}
+	if total := len(c3Records); total != 0 {
+		t.Fatalf("Expected c3 records to be deleted, found %d", total)
 	}
 }
+
+func createMockBatchProcessingData(dao *daos.Dao) error {
+	// create mock collection without relation
+	c1 := &models.Collection{}
+	c1.Id = "c1"
+	c1.Name = c1.Id
+	c1.Schema = schema.NewSchema(
+		&schema.SchemaField{
+			Name: "text",
+			Type: schema.FieldTypeText,
+		},
+	)
+	if err := dao.SaveCollection(c1); err != nil {
+		return err
+	}
+
+	// create mock collection with a multi-rel field
+	c2 := &models.Collection{}
+	c2.Id = "c2"
+	c2.Name = c2.Id
+	c2.Schema = schema.NewSchema(
+		&schema.SchemaField{
+			Name: "rel",
+			Type: schema.FieldTypeRelation,
+			Options: &schema.RelationOptions{
+				MaxSelect:     types.Pointer(10),
+				CollectionId:  "c1",
+				CascadeDelete: false, // should unset all rel fields
+			},
+		},
+	)
+	if err := dao.SaveCollection(c2); err != nil {
+		return err
+	}
+
+	// create mock collection with a single-rel field
+	c3 := &models.Collection{}
+	c3.Id = "c3"
+	c3.Name = c3.Id
+	c3.Schema = schema.NewSchema(
+		&schema.SchemaField{
+			Name: "rel",
+			Type: schema.FieldTypeRelation,
+			Options: &schema.RelationOptions{
+				MaxSelect:     types.Pointer(1),
+				CollectionId:  "c1",
+				CascadeDelete: true, // should delete all c3 records
+			},
+		},
+	)
+	if err := dao.SaveCollection(c3); err != nil {
+		return err
+	}
+
+	// insert mock records
+	c1RecordA := models.NewRecord(c1)
+	c1RecordA.Id = "a"
+	if err := dao.Save(c1RecordA); err != nil {
+		return err
+	}
+	c1RecordB := models.NewRecord(c1)
+	c1RecordB.Id = "b"
+	if err := dao.Save(c1RecordB); err != nil {
+		return err
+	}
+	for i := 0; i < 2400; i++ {
+		c2Record := models.NewRecord(c2)
+		c2Record.Set("rel", []string{c1RecordA.Id, c1RecordB.Id})
+		if err := dao.Save(c2Record); err != nil {
+			return err
+		}
+
+		c3Record := models.NewRecord(c3)
+		c3Record.Set("rel", c1RecordA.Id)
+		if err := dao.Save(c3Record); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

daos/settings.go

@@ -0,0 +1,63 @@
+package daos
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/settings"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// FindSettings returns and decode the serialized app settings param value.
+//
+// The method will first try to decode the param value without decryption.
+// If it fails and optEncryptionKey is set, it will try again by first
+// decrypting the value and then decode it again.
+//
+// Returns an error if it fails to decode the stored serialized param value.
+func (dao *Dao) FindSettings(optEncryptionKey ...string) (*settings.Settings, error) {
+	param, err := dao.FindParamByKey(models.ParamAppSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	result := settings.New()
+
+	// try first without decryption
+	plainDecodeErr := json.Unmarshal(param.Value, result)
+
+	// failed, try to decrypt
+	if plainDecodeErr != nil {
+		var encryptionKey string
+		if len(optEncryptionKey) > 0 && optEncryptionKey[0] != "" {
+			encryptionKey = optEncryptionKey[0]
+		}
+
+		// load without decrypt has failed and there is no encryption key to use for decrypt
+		if encryptionKey == "" {
+			return nil, errors.New("failed to load the stored app settings - missing or invalid encryption key")
+		}
+
+		// decrypt
+		decrypted, decryptErr := security.Decrypt(string(param.Value), encryptionKey)
+		if decryptErr != nil {
+			return nil, decryptErr
+		}
+
+		// decode again
+		decryptedDecodeErr := json.Unmarshal(decrypted, result)
+		if decryptedDecodeErr != nil {
+			return nil, decryptedDecodeErr
+		}
+	}
+
+	return result, nil
+}
+
+// SaveSettings persists the specified settings configuration.
+//
+// If optEncryptionKey is set, then the stored serialized value will be encrypted with it.
+func (dao *Dao) SaveSettings(newSettings *settings.Settings, optEncryptionKey ...string) error {
+	return dao.SaveParam(models.ParamAppSettings, newSettings, optEncryptionKey...)
+}

daos/settings_test.go

@@ -0,0 +1,50 @@
+package daos_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestSaveAndFindSettings(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	encryptionKey := security.PseudorandomString(32)
+
+	// change unencrypted app settings
+	app.Settings().Meta.AppName = "save_unencrypted"
+	if err := app.Dao().SaveSettings(app.Settings()); err != nil {
+		t.Fatal(err)
+	}
+
+	// check if the change was persisted
+	s1, err := app.Dao().FindSettings()
+	if err != nil {
+		t.Fatalf("Failed to fetch settings: %v", err)
+	}
+	if s1.Meta.AppName != "save_unencrypted" {
+		t.Fatalf("Expected settings to be changed with app name %q, got \n%v", "save_unencrypted", s1)
+	}
+
+	// make another change but this time provide an encryption key
+	app.Settings().Meta.AppName = "save_encrypted"
+	if err := app.Dao().SaveSettings(app.Settings(), encryptionKey); err != nil {
+		t.Fatal(err)
+	}
+
+	// try to fetch the settings without encryption key (should fail)
+	if s2, err := app.Dao().FindSettings(); err == nil {
+		t.Fatalf("Expected FindSettings to fail without an encryption key, got \n%v", s2)
+	}
+
+	// try again but this time with an encryption key
+	s3, err := app.Dao().FindSettings(encryptionKey)
+	if err != nil {
+		t.Fatalf("Failed to fetch settings with an encryption key %s: %v", encryptionKey, err)
+	}
+	if s3.Meta.AppName != "save_encrypted" {
+		t.Fatalf("Expected settings to be changed with app name %q, got \n%v", "save_encrypted", s3)
+	}
+}

examples/base/.gitignore

@@ -0,0 +1,6 @@
+# ignore everything
+/*
+
+# exclude from the ignore filter
+!.gitignore
+!main.go

examples/base/main.go

@@ -9,34 +9,70 @@ import (
 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
 )
 
-func defaultPublicDir() string {
-	if strings.HasPrefix(os.Args[0], os.TempDir()) {
-		// most likely ran with go run
-		return "./pb_public"
-	}
-
-	return filepath.Join(os.Args[0], "../pb_public")
-}
-
 func main() {
 	app := pocketbase.New()
 
-	var publicDirFlag string
+	// ---------------------------------------------------------------
+	// Optional plugin flags:
+	// ---------------------------------------------------------------
 
-	// add "--publicDir" option flag
+	var migrationsDir string
 	app.RootCmd.PersistentFlags().StringVar(
-		&publicDirFlag,
+		&migrationsDir,
+		"migrationsDir",
+		"",
+		"the directory with the user defined migrations",
+	)
+
+	var automigrate bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&automigrate,
+		"automigrate",
+		true,
+		"enable/disable auto migrations",
+	)
+
+	var publicDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&publicDir,
 		"publicDir",
 		defaultPublicDir(),
 		"the directory to serve static files",
 	)
 
+	var indexFallback bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&indexFallback,
+		"indexFallback",
+		true,
+		"fallback the request to index.html on missing static path (eg. when pretty urls are used with SPA)",
+	)
+
+	app.RootCmd.ParseFlags(os.Args[1:])
+
+	// ---------------------------------------------------------------
+	// Plugins and hooks:
+	// ---------------------------------------------------------------
+
+	// load js pb_migrations
+	jsvm.MustRegisterMigrations(app, &jsvm.MigrationsOptions{
+		Dir: migrationsDir,
+	})
+
+	// migrate command (with js templates)
+	migratecmd.MustRegister(app, app.RootCmd, &migratecmd.Options{
+		TemplateLang: migratecmd.TemplateLangJS,
+		Automigrate:  automigrate,
+		Dir:          migrationsDir,
+	})
+
 	app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
 		// serves static files from the provided public dir (if exists)
-		e.Router.GET("/*", apis.StaticDirectoryHandler(os.DirFS(publicDirFlag), true))
-
+		e.Router.GET("/*", apis.StaticDirectoryHandler(os.DirFS(publicDir), indexFallback))
 		return nil
 	})
 
@@ -44,3 +80,12 @@ func main() {
 		log.Fatal(err)
 	}
 }
+
+// the default pb_public dir location is relative to the executable
+func defaultPublicDir() string {
+	if strings.HasPrefix(os.Args[0], os.TempDir()) {
+		// most likely ran with go run
+		return "./pb_public"
+	}
+	return filepath.Join(os.Args[0], "../pb_public")
+}

forms/base.go

@@ -4,6 +4,8 @@ package forms
 
 import (
 	"regexp"
+
+	"github.com/pocketbase/pocketbase/models"
 )
 
 // base ID value regex pattern
@@ -13,7 +15,8 @@ var idRegex = regexp.MustCompile(`^[^\@\#\$\&\|\.\,\'\"\\\/\s]+$`)
 // Usually used in combination with InterceptorFunc.
 type InterceptorNextFunc = func() error
 
-// InterceptorFunc defines a single interceptor function that will execute the provided next func handler.
+// InterceptorFunc defines a single interceptor function that
+// will execute the provided next func handler.
 type InterceptorFunc func(next InterceptorNextFunc) InterceptorNextFunc
 
 // runInterceptors executes the provided list of interceptors.
@@ -21,6 +24,21 @@ func runInterceptors(next InterceptorNextFunc, interceptors ...InterceptorFunc)
 	for i := len(interceptors) - 1; i >= 0; i-- {
 		next = interceptors[i](next)
 	}
-
 	return next()
 }
+
+// InterceptorWithRecordNextFunc is a Record interceptor handler function.
+// Usually used in combination with InterceptorWithRecordFunc.
+type InterceptorWithRecordNextFunc = func(record *models.Record) error
+
+// InterceptorWithRecordFunc defines a single Record interceptor function
+// that will execute the provided next func handler.
+type InterceptorWithRecordFunc func(next InterceptorWithRecordNextFunc) InterceptorWithRecordNextFunc
+
+// runInterceptorsWithRecord executes the provided list of Record interceptors.
+func runInterceptorsWithRecord(record *models.Record, next InterceptorWithRecordNextFunc, interceptors ...InterceptorWithRecordFunc) error {
+	for i := len(interceptors) - 1; i >= 0; i-- {
+		next = interceptors[i](next)
+	}
+	return next(record)
+}

forms/collection_upsert_test.go

@@ -367,12 +367,12 @@ func TestCollectionUpsertValidateAndSubmit(t *testing.T) {
 		}
 
 		// check interceptor calls
-		expectInterceptorCall := 1
+		expectInterceptorCalls := 1
 		if len(s.expectedErrors) > 0 {
-			expectInterceptorCall = 0
+			expectInterceptorCalls = 0
 		}
-		if interceptorCalls != expectInterceptorCall {
-			t.Errorf("[%s] Expected interceptor to be called %d, got %d", s.testName, expectInterceptorCall, interceptorCalls)
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%s] Expected interceptor to be called %d, got %d", s.testName, expectInterceptorCalls, interceptorCalls)
 		}
 
 		// check errors

forms/collections_import.go

@@ -103,6 +103,7 @@ func (form *CollectionsImport) beforeRecordsSync(txDao *daos.Dao, mappedNew, map
 		if upsertModel == nil {
 			upsertModel = collection
 		}
+		upsertModel.MarkAsNotNew()
 
 		upsertForm := NewCollectionUpsert(form.app, upsertModel)
 		upsertForm.SetDao(txDao)

forms/record_email_change_confirm.go

@@ -113,7 +113,10 @@ func (form *RecordEmailChangeConfirm) parseToken(token string) (*models.Record,
 
 // Submit validates and submits the auth record email change confirmation form.
 // On success returns the updated auth record associated to `form.Token`.
-func (form *RecordEmailChangeConfirm) Submit() (*models.Record, error) {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordEmailChangeConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -127,8 +130,12 @@ func (form *RecordEmailChangeConfirm) Submit() (*models.Record, error) {
 	authRecord.SetVerified(true)
 	authRecord.RefreshTokenKey() // invalidate old tokens
 
-	if err := form.dao.SaveRecord(authRecord); err != nil {
-		return nil, err
+	interceptorsErr := runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+		return form.dao.SaveRecord(m)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
 	return authRecord, nil

forms/record_email_change_confirm_test.go

@@ -2,10 +2,12 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -82,7 +84,24 @@ func TestRecordEmailChangeConfirmValidateAndSubmit(t *testing.T) {
 			continue
 		}
 
-		record, err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		record, err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if len(s.expectedErrors) > 0 {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		// parse errors
 		errs, ok := err.(validation.Errors)
@@ -124,3 +143,58 @@ func TestRecordEmailChangeConfirmValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordEmailChangeConfirmInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordEmailChangeConfirm(testApp, authCollection)
+	form.Token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZW1haWwiOiJ0ZXN0QGV4YW1wbGUuY29tIiwibmV3RW1haWwiOiJ0ZXN0X25ld0BleGFtcGxlLmNvbSIsImV4cCI6MjIwODk4NTI2MX0.hmR7Ye23C68tS1LgHgYgT7NBJczTad34kzcT4sqW3FY"
+	form.Password = "1234567890"
+	interceptorEmail := authRecord.Email()
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptorEmail = record.Email()
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorEmail == authRecord.Email() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/record_email_change_request.go

@@ -61,10 +61,15 @@ func (form *RecordEmailChangeRequest) checkUniqueEmail(value any) error {
 }
 
 // Submit validates and sends the change email request.
-func (form *RecordEmailChangeRequest) Submit() error {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordEmailChangeRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	return mails.SendRecordChangeEmail(form.app, form.record, form.NewEmail)
+	return runInterceptorsWithRecord(form.record, func(m *models.Record) error {
+		return mails.SendRecordChangeEmail(form.app, m, form.NewEmail)
+	}, interceptors...)
 }

forms/record_email_change_request_test.go

@@ -2,10 +2,12 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 )
 
@@ -57,7 +59,24 @@ func TestRecordEmailChangeRequestValidateAndSubmit(t *testing.T) {
 			continue
 		}
 
-		err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if len(s.expectedErrors) > 0 {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		// parse errors
 		errs, ok := err.(validation.Errors)
@@ -85,3 +104,46 @@ func TestRecordEmailChangeRequestValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordEmailChangeRequestInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordEmailChangeRequest(testApp, authRecord)
+	form.NewEmail = "test_new@example.com"
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+}

forms/record_password_reset_confirm.go

@@ -71,7 +71,10 @@ func (form *RecordPasswordResetConfirm) checkToken(value any) error {
 
 // Submit validates and submits the form.
 // On success returns the updated auth record associated to `form.Token`.
-func (form *RecordPasswordResetConfirm) Submit() (*models.Record, error) {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordPasswordResetConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -88,8 +91,12 @@ func (form *RecordPasswordResetConfirm) Submit() (*models.Record, error) {
 		return nil, err
 	}
 
-	if err := form.dao.SaveRecord(authRecord); err != nil {
-		return nil, err
+	interceptorsErr := runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+		return form.dao.SaveRecord(m)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
 	return authRecord, nil

forms/record_password_reset_confirm_test.go

@@ -2,10 +2,12 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -76,7 +78,15 @@ func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 			continue
 		}
 
-		record, submitErr := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		record, submitErr := form.Submit(interceptor)
 
 		// parse errors
 		errs, ok := submitErr.(validation.Errors)
@@ -85,6 +95,15 @@ func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 			continue
 		}
 
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if len(s.expectedErrors) > 0 {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
+
 		// check errors
 		if len(errs) > len(s.expectedErrors) {
 			t.Errorf("(%d) Expected error keys %v, got %v", i, s.expectedErrors, errs)
@@ -115,3 +134,59 @@ func TestRecordPasswordResetConfirmValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordPasswordResetConfirmInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordPasswordResetConfirm(testApp, authCollection)
+	form.Token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.R_4FOSUHIuJQ5Crl3PpIPCXMsoHzuTaNlccpXg_3FOg"
+	form.Password = "1234567890"
+	form.PasswordConfirm = "1234567890"
+	interceptorTokenKey := authRecord.TokenKey()
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptorTokenKey = record.TokenKey()
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorTokenKey == authRecord.TokenKey() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/record_password_reset_request.go

@@ -59,12 +59,15 @@ func (form *RecordPasswordResetRequest) Validate() error {
 
 // Submit validates and submits the form.
 // On success, sends a password reset email to the `form.Email` auth record.
-func (form *RecordPasswordResetRequest) Submit() error {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordPasswordResetRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
 
-	authRecord, err := form.dao.FindFirstRecordByData(form.collection.Id, schema.FieldNameEmail, form.Email)
+	authRecord, err := form.dao.FindAuthRecordByEmail(form.collection.Id, form.Email)
 	if err != nil {
 		return err
 	}
@@ -75,12 +78,14 @@ func (form *RecordPasswordResetRequest) Submit() error {
 		return errors.New("You've already requested a password reset.")
 	}
 
-	if err := mails.SendRecordPasswordReset(form.app, authRecord); err != nil {
-		return err
-	}
-
 	// update last sent timestamp
 	authRecord.Set(schema.FieldNameLastResetSentAt, types.NowDateTime())
 
-	return form.dao.SaveRecord(authRecord)
+	return runInterceptorsWithRecord(authRecord, func(m *models.Record) error {
+		if err := mails.SendRecordPasswordReset(form.app, m); err != nil {
+			return err
+		}
+
+		return form.dao.SaveRecord(m)
+	}, interceptors...)
 }

forms/record_password_reset_request_test.go

@@ -2,10 +2,12 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 	"time"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
@@ -64,7 +66,24 @@ func TestRecordPasswordResetRequestSubmit(t *testing.T) {
 			continue
 		}
 
-		err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -95,3 +114,57 @@ func TestRecordPasswordResetRequestSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordPasswordResetRequestInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordPasswordResetRequest(testApp, authCollection)
+	form.Email = authRecord.Email()
+	interceptorLastResetSentAt := authRecord.LastResetSentAt()
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptorLastResetSentAt = record.LastResetSentAt()
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorLastResetSentAt.String() == authRecord.LastResetSentAt().String() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/record_upsert.go

@@ -18,6 +18,7 @@ import (
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/security"
@@ -34,8 +35,8 @@ type RecordUpsert struct {
 	manageAccess bool
 	record       *models.Record
 
+	filesToUpload map[string][]*filesystem.File
 	filesToDelete []string // names list
-	filesToUpload map[string][]*rest.UploadedFile
 
 	// base model fields
 	Id string `json:"id"`
@@ -51,7 +52,7 @@ type RecordUpsert struct {
 	OldPassword     string `json:"oldPassword"`
 	// ---
 
-	Data map[string]any `json:"data"`
+	data map[string]any
 }
 
 // NewRecordUpsert creates a new [RecordUpsert] form with initializer
@@ -66,7 +67,7 @@ func NewRecordUpsert(app core.App, record *models.Record) *RecordUpsert {
 		dao:           app.Dao(),
 		record:        record,
 		filesToDelete: []string{},
-		filesToUpload: map[string][]*rest.UploadedFile{},
+		filesToUpload: map[string][]*filesystem.File{},
 	}
 
 	form.loadFormDefaults()
@@ -74,6 +75,11 @@ func NewRecordUpsert(app core.App, record *models.Record) *RecordUpsert {
 	return form
 }
 
+// Data returns the loaded form's data.
+func (form *RecordUpsert) Data() map[string]any {
+	return form.data
+}
+
 // SetFullManageAccess sets the manageAccess bool flag of the current
 // form to enable/disable directly changing some system record fields
 // (often used with auth collection records).
@@ -96,9 +102,9 @@ func (form *RecordUpsert) loadFormDefaults() {
 		form.Verified = form.record.Verified()
 	}
 
-	form.Data = map[string]any{}
+	form.data = map[string]any{}
 	for _, field := range form.record.Collection().Schema.Fields() {
-		form.Data[field.Name] = form.record.Get(field.Name)
+		form.data[field.Name] = form.record.Get(field.Name)
 	}
 }
 
@@ -112,49 +118,56 @@ func (form *RecordUpsert) getContentType(r *http.Request) string {
 	return t
 }
 
-func (form *RecordUpsert) extractRequestData(r *http.Request, keyPrefix string) (map[string]any, error) {
+func (form *RecordUpsert) extractRequestData(
+	r *http.Request,
+	keyPrefix string,
+) (map[string]any, map[string][]*filesystem.File, error) {
 	switch form.getContentType(r) {
 	case "application/json":
 		return form.extractJsonData(r, keyPrefix)
 	case "multipart/form-data":
 		return form.extractMultipartFormData(r, keyPrefix)
 	default:
-		return nil, errors.New("Unsupported request Content-Type.")
+		return nil, nil, errors.New("unsupported request content-type")
 	}
 }
 
-func (form *RecordUpsert) extractJsonData(r *http.Request, keyPrefix string) (map[string]any, error) {
-	result := map[string]any{}
+func (form *RecordUpsert) extractJsonData(
+	r *http.Request,
+	keyPrefix string,
+) (map[string]any, map[string][]*filesystem.File, error) {
+	data := map[string]any{}
 
-	err := rest.CopyJsonBody(r, &result)
+	err := rest.CopyJsonBody(r, &data)
 
 	if keyPrefix != "" {
 		parts := strings.Split(keyPrefix, ".")
 		for _, part := range parts {
-			if result[part] == nil {
+			if data[part] == nil {
 				break
 			}
-			if v, ok := result[part].(map[string]any); ok {
-				result = v
+			if v, ok := data[part].(map[string]any); ok {
+				data = v
 			}
 		}
 	}
 
-	return result, err
+	return data, nil, err
 }
 
-func (form *RecordUpsert) extractMultipartFormData(r *http.Request, keyPrefix string) (map[string]any, error) {
-	result := map[string]any{}
-
+func (form *RecordUpsert) extractMultipartFormData(
+	r *http.Request,
+	keyPrefix string,
+) (map[string]any, map[string][]*filesystem.File, error) {
 	// parse form data (if not already)
 	if err := r.ParseMultipartForm(rest.DefaultMaxMemory); err != nil {
-		return result, err
+		return nil, nil, err
 	}
 
+	data := map[string]any{}
+	filesToUpload := map[string][]*filesystem.File{}
 	arrayValueSupportTypes := schema.ArraybleFieldTypes()
 
-	form.filesToUpload = map[string][]*rest.UploadedFile{}
-
 	for fullKey, values := range r.PostForm {
 		key := fullKey
 		if keyPrefix != "" {
@@ -162,15 +175,15 @@ func (form *RecordUpsert) extractMultipartFormData(r *http.Request, keyPrefix st
 		}
 
 		if len(values) == 0 {
-			result[key] = nil
+			data[key] = nil
 			continue
 		}
 
 		field := form.record.Collection().Schema.GetFieldByName(key)
 		if field != nil && list.ExistInSlice(field.Type, arrayValueSupportTypes) {
-			result[key] = values
+			data[key] = values
 		} else {
-			result[key] = values[0]
+			data[key] = values[0]
 		}
 	}
 
@@ -196,32 +209,10 @@ func (form *RecordUpsert) extractMultipartFormData(r *http.Request, keyPrefix st
 			continue
 		}
 
-		options, ok := field.Options.(*schema.FileOptions)
-		if !ok {
-			continue
-		}
-
-		if form.filesToUpload[key] == nil {
-			form.filesToUpload[key] = []*rest.UploadedFile{}
-		}
-
-		if options.MaxSelect == 1 {
-			form.filesToUpload[key] = append(form.filesToUpload[key], files[0])
-		} else if options.MaxSelect > 1 {
-			form.filesToUpload[key] = append(form.filesToUpload[key], files...)
-		}
+		filesToUpload[key] = append(filesToUpload[key], files...)
 	}
 
-	return result, nil
-}
-
-func (form *RecordUpsert) normalizeData() error {
-	for _, field := range form.record.Collection().Schema.Fields() {
-		if v, ok := form.Data[field.Name]; ok {
-			form.Data[field.Name] = field.PrepareValue(v)
-		}
-	}
-	return nil
+	return data, filesToUpload, nil
 }
 
 // LoadRequest extracts the json or multipart/form-data request data
@@ -234,15 +225,126 @@ func (form *RecordUpsert) normalizeData() error {
 // For single file upload fields, you can skip the index and directly
 // reset the field using its field name (eg. `myfile = null`).
 func (form *RecordUpsert) LoadRequest(r *http.Request, keyPrefix string) error {
-	requestData, err := form.extractRequestData(r, keyPrefix)
+	requestData, uploadedFiles, err := form.extractRequestData(r, keyPrefix)
 	if err != nil {
 		return err
 	}
 
-	return form.LoadData(requestData)
+	if err := form.LoadData(requestData); err != nil {
+		return err
+	}
+
+	for key, files := range uploadedFiles {
+		form.AddFiles(key, files...)
+	}
+
+	return nil
 }
 
-// LoadData loads and normalizes the provided data into the form.
+// AddFiles adds the provided file(s) to the specified file field.
+//
+// If the file field is a SINGLE-value file field (aka. "Max Select = 1"),
+// then the newly added file will REPLACE the existing one.
+// In this case if you pass more than 1 files only the first one will be assigned.
+//
+// If the file field is a MULTI-value file field (aka. "Max Select > 1"),
+// then the newly added file(s) will be APPENDED to the existing one(s).
+//
+// Example
+//
+// 	f1, _ := filesystem.NewFileFromPath("/path/to/file1.txt")
+// 	f2, _ := filesystem.NewFileFromPath("/path/to/file2.txt")
+// 	form.AddFiles("documents", f1, f2)
+func (form *RecordUpsert) AddFiles(key string, files ...*filesystem.File) error {
+	field := form.record.Collection().Schema.GetFieldByName(key)
+	if field == nil || field.Type != schema.FieldTypeFile {
+		return errors.New("invalid field key")
+	}
+
+	options, ok := field.Options.(*schema.FileOptions)
+	if !ok {
+		return errors.New("failed to initilize field options")
+	}
+
+	if len(files) == 0 {
+		return nil // nothing to upload
+	}
+
+	if form.filesToUpload == nil {
+		form.filesToUpload = map[string][]*filesystem.File{}
+	}
+
+	oldNames := list.ToUniqueStringSlice(form.data[key])
+
+	if options.MaxSelect == 1 {
+		// mark previous file(s) for deletion before replacing
+		if len(oldNames) > 0 {
+			form.filesToDelete = list.ToUniqueStringSlice(append(form.filesToDelete, oldNames...))
+		}
+
+		// replace
+		form.filesToUpload[key] = []*filesystem.File{files[0]}
+		form.data[key] = field.PrepareValue(files[0].Name)
+	} else {
+		// append
+		form.filesToUpload[key] = append(form.filesToUpload[key], files...)
+		for _, f := range files {
+			oldNames = append(oldNames, f.Name)
+		}
+		form.data[key] = field.PrepareValue(oldNames)
+	}
+
+	return nil
+}
+
+// RemoveFiles removes a single or multiple file from the specified file field.
+//
+// NB! If filesToDelete is not set it will remove all existing files
+// assigned to the file field (including those assigned with AddFiles)!
+//
+// Example
+//
+//  // mark only only 2 files for removal
+// 	form.AddFiles("documents", "file1_aw4bdrvws6.txt", "file2_xwbs36bafv.txt")
+//
+// 	// mark all "documents" files for removal
+// 	form.AddFiles("documents")
+func (form *RecordUpsert) RemoveFiles(key string, toDelete ...string) error {
+	field := form.record.Collection().Schema.GetFieldByName(key)
+	if field == nil || field.Type != schema.FieldTypeFile {
+		return errors.New("invalid field key")
+	}
+
+	existing := list.ToUniqueStringSlice(form.data[key])
+
+	// mark all files for deletion
+	if len(toDelete) == 0 {
+		toDelete = make([]string, len(existing))
+		copy(toDelete, existing)
+	}
+
+	// check for existing files
+	for i := len(existing) - 1; i >= 0; i-- {
+		if list.ExistInSlice(existing[i], toDelete) {
+			form.filesToDelete = append(form.filesToDelete, existing[i])
+			existing = append(existing[:i], existing[i+1:]...)
+		}
+	}
+
+	// check for newly uploaded files
+	for i := len(form.filesToUpload[key]) - 1; i >= 0; i-- {
+		f := form.filesToUpload[key][i]
+		if list.ExistInSlice(f.Name, toDelete) {
+			form.filesToUpload[key] = append(form.filesToUpload[key][:i], form.filesToUpload[key][i+1:]...)
+		}
+	}
+
+	form.data[key] = field.PrepareValue(existing)
+
+	return nil
+}
+
+// LoadData loads and normalizes the provided regular record data fields into the form.
 //
 // To DELETE previously uploaded file(s) you can suffix the field name
 // with the file index or filename (eg. `myfile.0`) and set it to null or empty string.
@@ -295,28 +397,26 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 		value = field.PrepareValue(value)
 
 		if field.Type != schema.FieldTypeFile {
-			form.Data[key] = value
+			form.data[key] = value
 			continue
 		}
 
-		options, _ := field.Options.(*schema.FileOptions)
-		oldNames := list.ToUniqueStringSlice(form.Data[key])
-
 		// -----------------------------------------------------------
 		// Delete previously uploaded file(s)
 		// -----------------------------------------------------------
 
+		oldNames := list.ToUniqueStringSlice(form.data[key])
+
 		// if empty value was set, mark all previously uploaded files for deletion
 		if len(list.ToUniqueStringSlice(value)) == 0 && len(oldNames) > 0 {
-			form.filesToDelete = append(form.filesToDelete, oldNames...)
-			form.Data[key] = []string{}
+			form.RemoveFiles(key)
 		} else if len(oldNames) > 0 {
-			indexesToDelete := make([]int, 0, len(extendedData))
+			toDelete := []string{}
 
 			// search for individual file name to delete (eg. "file.test.png = null")
-			for i, name := range oldNames {
+			for _, name := range oldNames {
 				if v, ok := extendedData[key+"."+name]; ok && cast.ToString(v) == "" {
-					indexesToDelete = append(indexesToDelete, i)
+					toDelete = append(toDelete, name)
 				}
 			}
 
@@ -328,52 +428,17 @@ func (form *RecordUpsert) LoadData(requestData map[string]any) error {
 					if indexErr != nil || index >= len(oldNames) {
 						continue
 					}
-					indexesToDelete = append(indexesToDelete, index)
+					toDelete = append(toDelete, oldNames[index])
 				}
 			}
 
-			// slice to fill only with the non-deleted indexes
-			nonDeleted := make([]string, 0, len(oldNames))
-			for i, name := range oldNames {
-				// not marked for deletion
-				if !list.ExistInSlice(i, indexesToDelete) {
-					nonDeleted = append(nonDeleted, name)
-					continue
-				}
-
-				// store the id to actually delete the file later
-				form.filesToDelete = append(form.filesToDelete, name)
+			if len(toDelete) > 0 {
+				form.RemoveFiles(key, toDelete...)
 			}
-			form.Data[key] = nonDeleted
-		}
-
-		// -----------------------------------------------------------
-		// Check for new uploaded file
-		// -----------------------------------------------------------
-
-		if len(form.filesToUpload[key]) == 0 {
-			continue
-		}
-
-		// refresh oldNames list
-		oldNames = list.ToUniqueStringSlice(form.Data[key])
-
-		if options.MaxSelect == 1 {
-			// delete previous file(s) before replacing
-			if len(oldNames) > 0 {
-				form.filesToDelete = list.ToUniqueStringSlice(append(form.filesToDelete, oldNames...))
-			}
-			form.Data[key] = form.filesToUpload[key][0].Name()
-		} else if options.MaxSelect > 1 {
-			// append the id of each uploaded file instance
-			for _, file := range form.filesToUpload[key] {
-				oldNames = append(oldNames, file.Name())
-			}
-			form.Data[key] = oldNames
 		}
 	}
 
-	return form.normalizeData()
+	return nil
 }
 
 // Validate makes the form validatable by implementing [validation.Validatable] interface.
@@ -429,13 +494,16 @@ func (form *RecordUpsert) Validate() error {
 			),
 			validation.Field(
 				&form.Password,
-				validation.When(form.record.IsNew(), validation.Required),
+				validation.When(
+					(form.record.IsNew() || form.PasswordConfirm != "" || form.OldPassword != ""),
+					validation.Required,
+				),
 				validation.Length(form.record.Collection().AuthOptions().MinPasswordLength, 72),
 			),
 			validation.Field(
 				&form.PasswordConfirm,
 				validation.When(
-					(form.record.IsNew() || form.Password != ""),
+					(form.record.IsNew() || form.Password != "" || form.OldPassword != ""),
 					validation.Required,
 				),
 				validation.By(validators.Compare(form.Password)),
@@ -446,7 +514,7 @@ func (form *RecordUpsert) Validate() error {
 				// - form.manageAccess is not set
 				// - changing the existing password
 				validation.When(
-					!form.record.IsNew() && !form.manageAccess && form.Password != "",
+					!form.record.IsNew() && !form.manageAccess && (form.Password != "" || form.PasswordConfirm != ""),
 					validation.Required,
 					validation.By(form.checkOldPassword),
 				),
@@ -463,7 +531,7 @@ func (form *RecordUpsert) Validate() error {
 		form.dao,
 		form.record,
 		form.filesToUpload,
-	).Validate(form.Data)
+	).Validate(form.data)
 }
 
 func (form *RecordUpsert) checkUniqueUsername(value any) error {
@@ -583,7 +651,7 @@ func (form *RecordUpsert) ValidateAndFill() error {
 			}
 		}
 
-		if form.Password != "" {
+		if form.Password != "" && form.Password == form.PasswordConfirm {
 			if err := form.record.SetPassword(form.Password); err != nil {
 				return err
 			}
@@ -591,7 +659,7 @@ func (form *RecordUpsert) ValidateAndFill() error {
 	}
 
 	// bulk load the remaining form data
-	form.record.Load(form.Data)
+	form.record.Load(form.data)
 
 	return nil
 }
@@ -607,20 +675,23 @@ func (form *RecordUpsert) DrySubmit(callback func(txDao *daos.Dao) error) error
 		return err
 	}
 
-	// use the default app.Dao to prevent changing the transaction form.Dao
-	// and causing "transaction has already been committed or rolled back" error
-	return form.app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+	var dryDao *daos.Dao
+	if form.dao.ConcurrentDB() == form.dao.NonconcurrentDB() {
+		// it is already in a transaction and therefore use the app concurrent db pool
+		// to prevent "transaction has already been committed or rolled back" error
+		dryDao = daos.New(form.app.Dao().ConcurrentDB())
+	} else {
+		// otherwise use the form noncurrent dao db pool
+		dryDao = daos.New(form.dao.NonconcurrentDB())
+	}
+
+	return dryDao.RunInTransaction(func(txDao *daos.Dao) error {
 		tx, ok := txDao.DB().(*dbx.Tx)
 		if !ok {
 			return errors.New("failed to get transaction db")
 		}
 		defer tx.Rollback()
 
-		txDao.BeforeCreateFunc = nil
-		txDao.AfterCreateFunc = nil
-		txDao.BeforeUpdateFunc = nil
-		txDao.AfterUpdateFunc = nil
-
 		if err := txDao.SaveRecord(form.record); err != nil {
 			return err
 		}
@@ -648,35 +719,57 @@ func (form *RecordUpsert) Submit(interceptors ...InterceptorFunc) error {
 	}
 
 	return runInterceptors(func() error {
-		return form.dao.RunInTransaction(func(txDao *daos.Dao) error {
-			// persist record model
-			if err := txDao.SaveRecord(form.record); err != nil {
-				return fmt.Errorf("Failed to save the record: %v", err)
+		if !form.record.HasId() {
+			form.record.RefreshId()
+			form.record.MarkAsNew()
+		}
+
+		// upload new files (if any)
+		if err := form.processFilesToUpload(); err != nil {
+			return fmt.Errorf("failed to process the uploaded files: %w", err)
+		}
+
+		// persist the record model
+		if saveErr := form.dao.SaveRecord(form.record); saveErr != nil {
+			// try to cleanup the successfully uploaded files
+			if _, err := form.deleteFilesByNamesList(form.getFilesToUploadNames()); err != nil && form.app.IsDebug() {
+				log.Println(err)
 			}
 
-			// upload new files (if any)
-			if err := form.processFilesToUpload(); err != nil {
-				return fmt.Errorf("Failed to process the upload files: %v", err)
-			}
+			return fmt.Errorf("failed to save the record: %w", saveErr)
+		}
 
-			// delete old files (if any)
-			if err := form.processFilesToDelete(); err != nil { //nolint:staticcheck
-				// for now fail silently to avoid reupload when `form.Submit()`
-				// is called manually (aka. not from an api request)...
-			}
+		// delete old files (if any)
+		//
+		// for now fail silently to avoid reupload when `form.Submit()`
+		// is called manually (aka. not from an api request)...
+		if err := form.processFilesToDelete(); err != nil && form.app.IsDebug() {
+			log.Println(err)
+		}
 
-			return nil
-		})
+		return nil
 	}, interceptors...)
 }
 
+func (form *RecordUpsert) getFilesToUploadNames() []string {
+	names := []string{}
+
+	for fieldKey := range form.filesToUpload {
+		for _, file := range form.filesToUpload[fieldKey] {
+			names = append(names, file.Name)
+		}
+	}
+
+	return names
+}
+
 func (form *RecordUpsert) processFilesToUpload() error {
 	if len(form.filesToUpload) == 0 {
 		return nil // no parsed file fields
 	}
 
 	if !form.record.HasId() {
-		return errors.New("The record is not persisted yet.")
+		return errors.New("the record is not persisted yet")
 	}
 
 	fs, err := form.app.NewFilesystem()
@@ -685,65 +778,75 @@ func (form *RecordUpsert) processFilesToUpload() error {
 	}
 	defer fs.Close()
 
-	var uploadErrors []error
+	var uploadErrors []error // list of upload errors
+	var uploaded []string    // list of uploaded file paths
 
 	for fieldKey := range form.filesToUpload {
-		for i := len(form.filesToUpload[fieldKey]) - 1; i >= 0; i-- {
-			file := form.filesToUpload[fieldKey][i]
-			path := form.record.BaseFilesPath() + "/" + file.Name()
-
-			if err := fs.UploadMultipart(file.Header(), path); err == nil {
-				// remove the uploaded file from the list
-				form.filesToUpload[fieldKey] = append(form.filesToUpload[fieldKey][:i], form.filesToUpload[fieldKey][i+1:]...)
+		for i, file := range form.filesToUpload[fieldKey] {
+			path := form.record.BaseFilesPath() + "/" + file.Name
+			if err := fs.UploadFile(file, path); err == nil {
+				// keep track of the already uploaded file
+				uploaded = append(uploaded, path)
 			} else {
 				// store the upload error
-				uploadErrors = append(uploadErrors, fmt.Errorf("File %d: %v", i, err))
+				uploadErrors = append(uploadErrors, fmt.Errorf("file %d: %v", i, err))
 			}
 		}
 	}
 
 	if len(uploadErrors) > 0 {
-		return fmt.Errorf("Failed to upload all files: %v", uploadErrors)
+		// cleanup - try to delete the successfully uploaded files (if any)
+		form.deleteFilesByNamesList(uploaded)
+
+		return fmt.Errorf("failed to upload all files: %v", uploadErrors)
 	}
 
 	return nil
 }
 
-func (form *RecordUpsert) processFilesToDelete() error {
-	if len(form.filesToDelete) == 0 {
-		return nil // nothing to delete
+func (form *RecordUpsert) processFilesToDelete() (err error) {
+	form.filesToDelete, err = form.deleteFilesByNamesList(form.filesToDelete)
+	return
+}
+
+// deleteFiles deletes a list of record files by their names.
+// Returns the failed/remaining files.
+func (form *RecordUpsert) deleteFilesByNamesList(filenames []string) ([]string, error) {
+	if len(filenames) == 0 {
+		return filenames, nil // nothing to delete
 	}
 
 	if !form.record.HasId() {
-		return errors.New("The record is not persisted yet.")
+		return filenames, errors.New("the record doesn't have a unique ID")
 	}
 
 	fs, err := form.app.NewFilesystem()
 	if err != nil {
-		return err
+		return filenames, err
 	}
 	defer fs.Close()
 
 	var deleteErrors []error
-	for i := len(form.filesToDelete) - 1; i >= 0; i-- {
-		filename := form.filesToDelete[i]
+
+	for i := len(filenames) - 1; i >= 0; i-- {
+		filename := filenames[i]
 		path := form.record.BaseFilesPath() + "/" + filename
 
 		if err := fs.Delete(path); err == nil {
 			// remove the deleted file from the list
-			form.filesToDelete = append(form.filesToDelete[:i], form.filesToDelete[i+1:]...)
+			filenames = append(filenames[:i], filenames[i+1:]...)
+
+			// try to delete the related file thumbs (if any)
+			fs.DeletePrefix(form.record.BaseFilesPath() + "/thumbs_" + filename + "/")
 		} else {
 			// store the delete error
-			deleteErrors = append(deleteErrors, fmt.Errorf("File %d: %v", i, err))
+			deleteErrors = append(deleteErrors, fmt.Errorf("file %d: %v", i, err))
 		}
-
-		// try to delete the related file thumbs (if any)
-		fs.DeletePrefix(form.record.BaseFilesPath() + "/thumbs_" + filename + "/")
 	}
 
 	if len(deleteErrors) > 0 {
-		return fmt.Errorf("Failed to delete all files: %v", deleteErrors)
+		return filenames, fmt.Errorf("failed to delete all files: %v", deleteErrors)
 	}
 
-	return nil
+	return filenames, nil
 }

forms/record_upsert_test.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -16,6 +17,7 @@ import (
 	"github.com/pocketbase/pocketbase/forms"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
 )
 
@@ -44,9 +46,9 @@ func TestNewRecordUpsert(t *testing.T) {
 
 	form := forms.NewRecordUpsert(app, record)
 
-	val := form.Data["title"]
+	val := form.Data()["title"]
 	if val != "test_value" {
-		t.Errorf("Expected record data to be loaded, got %v", form.Data)
+		t.Errorf("Expected record data to be loaded, got %v", form.Data())
 	}
 }
 
@@ -107,15 +109,15 @@ func TestRecordUpsertLoadRequestJson(t *testing.T) {
 		t.Fatalf("Expect id field to be %q, got %q", "test_id", form.Id)
 	}
 
-	if v, ok := form.Data["text"]; !ok || v != "test123" {
+	if v, ok := form.Data()["text"]; !ok || v != "test123" {
 		t.Fatalf("Expect title field to be %q, got %q", "test123", v)
 	}
 
-	if v, ok := form.Data["unknown"]; ok {
+	if v, ok := form.Data()["unknown"]; ok {
 		t.Fatalf("Didn't expect unknown field to be set, got %v", v)
 	}
 
-	fileOne, ok := form.Data["file_one"]
+	fileOne, ok := form.Data()["file_one"]
 	if !ok {
 		t.Fatal("Expect file_one field to be set")
 	}
@@ -123,7 +125,7 @@ func TestRecordUpsertLoadRequestJson(t *testing.T) {
 		t.Fatalf("Expect file_one field to be empty string, got %v", fileOne)
 	}
 
-	fileMany, ok := form.Data["file_many"]
+	fileMany, ok := form.Data()["file_many"]
 	if !ok || fileMany == nil {
 		t.Fatal("Expect file_many field to be set")
 	}
@@ -168,15 +170,15 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 		t.Fatalf("Expect id field to be %q, got %q", "test_id", form.Id)
 	}
 
-	if v, ok := form.Data["text"]; !ok || v != "test123" {
+	if v, ok := form.Data()["text"]; !ok || v != "test123" {
 		t.Fatalf("Expect text field to be %q, got %q", "test123", v)
 	}
 
-	if v, ok := form.Data["unknown"]; ok {
+	if v, ok := form.Data()["unknown"]; ok {
 		t.Fatalf("Didn't expect unknown field to be set, got %v", v)
 	}
 
-	fileOne, ok := form.Data["file_one"]
+	fileOne, ok := form.Data()["file_one"]
 	if !ok {
 		t.Fatal("Expect file_one field to be set")
 	}
@@ -184,7 +186,7 @@ func TestRecordUpsertLoadRequestMultipart(t *testing.T) {
 		t.Fatalf("Expect file_one field to be empty string, got %v", fileOne)
 	}
 
-	fileMany, ok := form.Data["file_many"]
+	fileMany, ok := form.Data()["file_many"]
 	if !ok || fileMany == nil {
 		t.Fatal("Expect file_many field to be set")
 	}
@@ -214,11 +216,11 @@ func TestRecordUpsertLoadData(t *testing.T) {
 		t.Fatal(loadErr)
 	}
 
-	if v, ok := form.Data["title"]; !ok || v != "test_new" {
+	if v, ok := form.Data()["title"]; !ok || v != "test_new" {
 		t.Fatalf("Expect title field to be %v, got %v", "test_new", v)
 	}
 
-	if v, ok := form.Data["active"]; !ok || v != true {
+	if v, ok := form.Data()["active"]; !ok || v != true {
 		t.Fatalf("Expect active field to be %v, got %v", true, v)
 	}
 }
@@ -316,12 +318,10 @@ func TestRecordUpsertDrySubmitSuccess(t *testing.T) {
 	}
 
 	// ensure that the record changes weren't persisted
-	// ---
 	recordAfter, err := app.Dao().FindRecordById(collection.Id, recordBefore.Id)
 	if err != nil {
 		t.Fatal(err)
 	}
-
 	if recordAfter.GetString("title") == "dry_test" {
 		t.Fatalf("Expected record.title to be %v, got %v", recordAfter.GetString("title"), "dry_test")
 	}
@@ -335,6 +335,66 @@ func TestRecordUpsertDrySubmitSuccess(t *testing.T) {
 	}
 }
 
+func TestRecordUpsertDrySubmitWithNestedTx(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, _ := app.Dao().FindCollectionByNameOrId("demo1")
+	recordBefore, err := app.Dao().FindRecordById(collection.Id, "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"title": "dry_test",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	txErr := app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+		form := forms.NewRecordUpsert(app, recordBefore)
+		form.SetDao(txDao)
+		req := httptest.NewRequest(http.MethodGet, "/", formData)
+		req.Header.Set(echo.HeaderContentType, mp.FormDataContentType())
+		form.LoadRequest(req, "")
+
+		callbackCalls := 0
+
+		result := form.DrySubmit(func(innerTxDao *daos.Dao) error {
+			callbackCalls++
+			return nil
+		})
+		if result != nil {
+			t.Fatalf("Expected nil, got error %v", result)
+		}
+
+		// ensure callback was called
+		if callbackCalls != 1 {
+			t.Fatalf("Expected callbackCalls to be 1, got %d", callbackCalls)
+		}
+
+		// ensure that the original txDao can still be used after the DrySubmit rollback
+		if _, err := txDao.FindRecordById(collection.Id, recordBefore.Id); err != nil {
+			t.Fatalf("Expected the dry submit rollback to not affect the outer tx context, got %v", err)
+		}
+
+		// ensure that the record changes weren't persisted
+		recordAfter, err := app.Dao().FindRecordById(collection.Id, recordBefore.Id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if recordAfter.GetString("title") == "dry_test" {
+			t.Fatalf("Expected record.title to be %v, got %v", recordBefore.GetString("title"), "dry_test")
+		}
+
+		return nil
+	})
+	if txErr != nil {
+		t.Fatalf("Nested transactions failure: %v", txErr)
+	}
+}
+
 func TestRecordUpsertSubmitFailure(t *testing.T) {
 	app, _ := tests.NewTestApp()
 	defer app.Cleanup()
@@ -498,7 +558,7 @@ func TestRecordUpsertSubmitInterceptors(t *testing.T) {
 	}
 
 	form := forms.NewRecordUpsert(app, record)
-	form.Data["title"] = "test_new"
+	form.Data()["title"] = "test_new"
 
 	testErr := errors.New("test_error")
 	interceptorRecordTitle := ""
@@ -533,7 +593,7 @@ func TestRecordUpsertSubmitInterceptors(t *testing.T) {
 		t.Fatalf("Expected interceptor2 to be called")
 	}
 
-	if interceptorRecordTitle != form.Data["title"].(string) {
+	if interceptorRecordTitle != form.Data()["title"].(string) {
 		t.Fatalf("Expected the form model to be filled before calling the interceptors")
 	}
 }
@@ -792,6 +852,24 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 		},
 
 		// password
+		{
+			"trigger the password validations if only oldPassword is set",
+			"4q1xlclmfloku33",
+			map[string]any{
+				"oldPassword": "1234567890",
+			},
+			false,
+			true,
+		},
+		{
+			"trigger the password validations if only passwordConfirm is set",
+			"4q1xlclmfloku33",
+			map[string]any{
+				"passwordConfirm": "1234567890",
+			},
+			false,
+			true,
+		},
 		{
 			"try to update password without managed access",
 			"4q1xlclmfloku33",
@@ -863,3 +941,75 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordUpsertAddAndRemoveFiles(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	recordBefore, err := app.Dao().FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// create test temp files
+	tempDir := filepath.Join(app.DataDir(), "temp")
+	if err := os.MkdirAll(app.DataDir(), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tempDir)
+	tmpFile, _ := os.CreateTemp(os.TempDir(), "tmpfile1-*.txt")
+	tmpFile.Close()
+
+	form := forms.NewRecordUpsert(app, recordBefore)
+
+	f1, err := filesystem.NewFileFromPath(tmpFile.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromPath(tmpFile.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f3, err := filesystem.NewFileFromPath(tmpFile.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form.AddFiles("file_one", f1) // should replace the existin file
+
+	form.AddFiles("file_many", f2, f3) // should append
+
+	form.RemoveFiles("file_many", "300_WlbFWSGmW9.png", "logo_vcfJJG5TAh.svg") // should remove
+
+	if err := form.Submit(); err != nil {
+		t.Fatalf("Failed to submit the RecordUpsert form, got %v", err)
+	}
+
+	recordAfter, err := app.Dao().FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// ensure files deletion
+	if hasRecordFile(app, recordAfter, "test_d61b33QdDU.txt") {
+		t.Fatalf("Expected the old file_one file to be deleted")
+	}
+	if hasRecordFile(app, recordAfter, "300_WlbFWSGmW9.png") {
+		t.Fatalf("Expected 300_WlbFWSGmW9.png to be deleted")
+	}
+	if hasRecordFile(app, recordAfter, "logo_vcfJJG5TAh.svg") {
+		t.Fatalf("Expected logo_vcfJJG5TAh.svg to be deleted")
+	}
+
+	fileOne := recordAfter.GetStringSlice("file_one")
+	if len(fileOne) == 0 {
+		t.Fatalf("Expected new file_one file to be uploaded")
+	}
+
+	fileMany := recordAfter.GetStringSlice("file_many")
+	if len(fileMany) != 3 {
+		t.Fatalf("Expected file_many to be 3, got %v", fileMany)
+	}
+}

forms/record_verification_confirm.go

@@ -76,7 +76,10 @@ func (form *RecordVerificationConfirm) checkToken(value any) error {
 
 // Submit validates and submits the form.
 // On success returns the verified auth record associated to `form.Token`.
-func (form *RecordVerificationConfirm) Submit() (*models.Record, error) {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordVerificationConfirm) Submit(interceptors ...InterceptorWithRecordFunc) (*models.Record, error) {
 	if err := form.Validate(); err != nil {
 		return nil, err
 	}
@@ -89,14 +92,22 @@ func (form *RecordVerificationConfirm) Submit() (*models.Record, error) {
 		return nil, err
 	}
 
-	if record.Verified() {
-		return record, nil // already verified
+	wasVerified := record.Verified()
+
+	if !wasVerified {
+		record.SetVerified(true)
 	}
 
-	record.SetVerified(true)
+	interceptorsErr := runInterceptorsWithRecord(record, func(m *models.Record) error {
+		if wasVerified {
+			return nil // already verified
+		}
 
-	if err := form.dao.SaveRecord(record); err != nil {
-		return nil, err
+		return form.dao.SaveRecord(m)
+	}, interceptors...)
+
+	if interceptorsErr != nil {
+		return nil, interceptorsErr
 	}
 
 	return record, nil

forms/record_verification_confirm_test.go

@@ -2,9 +2,11 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -54,7 +56,24 @@ func TestRecordVerificationConfirmValidateAndSubmit(t *testing.T) {
 			continue
 		}
 
-		record, err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		record, err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
@@ -77,3 +96,57 @@ func TestRecordVerificationConfirmValidateAndSubmit(t *testing.T) {
 		}
 	}
 }
+
+func TestRecordVerificationConfirmInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordVerificationConfirm(testApp, authCollection)
+	form.Token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJhdXRoUmVjb3JkIiwiZXhwIjoyMjA4OTg1MjYxfQ.hL16TVmStHFdHLc4a860bRqJ3sFfzjv0_NRNzwsvsrc"
+	interceptorVerified := authRecord.Verified()
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptorVerified = record.Verified()
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	_, submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorVerified == authRecord.Verified() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/record_verification_request.go

@@ -59,7 +59,10 @@ func (form *RecordVerificationRequest) Validate() error {
 
 // Submit validates and sends a verification request email
 // to the `form.Email` auth record.
-func (form *RecordVerificationRequest) Submit() error {
+//
+// You can optionally provide a list of InterceptorWithRecordFunc to
+// further modify the form behavior before persisting it.
+func (form *RecordVerificationRequest) Submit(interceptors ...InterceptorWithRecordFunc) error {
 	if err := form.Validate(); err != nil {
 		return err
 	}
@@ -73,22 +76,26 @@ func (form *RecordVerificationRequest) Submit() error {
 		return err
 	}
 
-	if record.GetBool(schema.FieldNameVerified) {
-		return nil // already verified
+	if !record.Verified() {
+		now := time.Now().UTC()
+		lastVerificationSentAt := record.LastVerificationSentAt().Time()
+		if (now.Sub(lastVerificationSentAt)).Seconds() < form.resendThreshold {
+			return errors.New("A verification email was already sent.")
+		}
+
+		// update last sent timestamp
+		record.SetLastVerificationSentAt(types.NowDateTime())
 	}
 
-	now := time.Now().UTC()
-	lastVerificationSentAt := record.LastVerificationSentAt().Time()
-	if (now.Sub(lastVerificationSentAt)).Seconds() < form.resendThreshold {
-		return errors.New("A verification email was already sent.")
-	}
+	return runInterceptorsWithRecord(record, func(m *models.Record) error {
+		if m.Verified() {
+			return nil // already verified
+		}
 
-	if err := mails.SendRecordVerification(form.app, record); err != nil {
-		return err
-	}
+		if err := mails.SendRecordVerification(form.app, m); err != nil {
+			return err
+		}
 
-	// update last sent timestamp
-	record.Set(schema.FieldNameLastVerificationSentAt, types.NowDateTime())
-
-	return form.dao.SaveRecord(record)
+		return form.dao.SaveRecord(m)
+	}, interceptors...)
 }

forms/record_verification_request_test.go

@@ -2,10 +2,12 @@ package forms_test
 
 import (
 	"encoding/json"
+	"errors"
 	"testing"
 	"time"
 
 	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tests"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
@@ -78,15 +80,32 @@ func TestRecordVerificationRequestSubmit(t *testing.T) {
 		// load data
 		loadErr := json.Unmarshal([]byte(s.jsonData), form)
 		if loadErr != nil {
-			t.Errorf("(%d) Failed to load form data: %v", i, loadErr)
+			t.Errorf("[%d] Failed to load form data: %v", i, loadErr)
 			continue
 		}
 
-		err := form.Submit()
+		interceptorCalls := 0
+		interceptor := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+			return func(r *models.Record) error {
+				interceptorCalls++
+				return next(r)
+			}
+		}
+
+		err := form.Submit(interceptor)
+
+		// check interceptor calls
+		expectInterceptorCalls := 1
+		if s.expectError {
+			expectInterceptorCalls = 0
+		}
+		if interceptorCalls != expectInterceptorCalls {
+			t.Errorf("[%d] Expected interceptor to be called %d, got %d", i, expectInterceptorCalls, interceptorCalls)
+		}
 
 		hasErr := err != nil
 		if hasErr != s.expectError {
-			t.Errorf("(%d) Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
+			t.Errorf("[%d] Expected hasErr to be %v, got %v (%v)", i, s.expectError, hasErr, err)
 		}
 
 		expectedMails := 0
@@ -94,7 +113,7 @@ func TestRecordVerificationRequestSubmit(t *testing.T) {
 			expectedMails = 1
 		}
 		if testApp.TestMailer.TotalSend != expectedMails {
-			t.Errorf("(%d) Expected %d mail(s) to be sent, got %d", i, expectedMails, testApp.TestMailer.TotalSend)
+			t.Errorf("[%d] Expected %d mail(s) to be sent, got %d", i, expectedMails, testApp.TestMailer.TotalSend)
 		}
 
 		if s.expectError {
@@ -103,13 +122,67 @@ func TestRecordVerificationRequestSubmit(t *testing.T) {
 
 		user, err := testApp.Dao().FindAuthRecordByEmail(authCollection.Id, form.Email)
 		if err != nil {
-			t.Errorf("(%d) Expected user with email %q to exist, got nil", i, form.Email)
+			t.Errorf("[%d] Expected user with email %q to exist, got nil", i, form.Email)
 			continue
 		}
 
 		// check whether LastVerificationSentAt was updated
 		if !user.Verified() && user.LastVerificationSentAt().Time().Sub(now.Time()) < 0 {
-			t.Errorf("(%d) Expected LastVerificationSentAt to be after %v, got %v", i, now, user.LastVerificationSentAt())
+			t.Errorf("[%d] Expected LastVerificationSentAt to be after %v, got %v", i, now, user.LastVerificationSentAt())
 		}
 	}
 }
+
+func TestRecordVerificationRequestInterceptors(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	authCollection, err := testApp.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := testApp.Dao().FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordVerificationRequest(testApp, authCollection)
+	form.Email = authRecord.Email()
+	interceptorLastVerificationSentAt := authRecord.LastVerificationSentAt()
+	testErr := errors.New("test_error")
+
+	interceptor1Called := false
+	interceptor1 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptor1Called = true
+			return next(record)
+		}
+	}
+
+	interceptor2Called := false
+	interceptor2 := func(next forms.InterceptorWithRecordNextFunc) forms.InterceptorWithRecordNextFunc {
+		return func(record *models.Record) error {
+			interceptorLastVerificationSentAt = record.LastVerificationSentAt()
+			interceptor2Called = true
+			return testErr
+		}
+	}
+
+	submitErr := form.Submit(interceptor1, interceptor2)
+	if submitErr != testErr {
+		t.Fatalf("Expected submitError %v, got %v", testErr, submitErr)
+	}
+
+	if !interceptor1Called {
+		t.Fatalf("Expected interceptor1 to be called")
+	}
+
+	if !interceptor2Called {
+		t.Fatalf("Expected interceptor2 to be called")
+	}
+
+	if interceptorLastVerificationSentAt.String() == authRecord.LastVerificationSentAt().String() {
+		t.Fatalf("Expected the form model to be filled before calling the interceptors")
+	}
+}

forms/settings_upsert.go

@@ -6,12 +6,12 @@ import (
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/daos"
-	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/settings"
 )
 
-// SettingsUpsert is a [core.Settings] upsert (create/update) form.
+// SettingsUpsert is a [settings.Settings] upsert (create/update) form.
 type SettingsUpsert struct {
-	*core.Settings
+	*settings.Settings
 
 	app core.App
 	dao *daos.Dao
@@ -55,16 +55,10 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc) error {
 		return err
 	}
 
-	encryptionKey := os.Getenv(form.app.EncryptionEnv())
-
 	return runInterceptors(func() error {
-		saveErr := form.dao.SaveParam(
-			models.ParamAppSettings,
-			form.Settings,
-			encryptionKey,
-		)
-		if saveErr != nil {
-			return saveErr
+		encryptionKey := os.Getenv(form.app.EncryptionEnv())
+		if err := form.dao.SaveSettings(form.Settings, encryptionKey); err != nil {
+			return err
 		}
 
 		// explicitly trigger old logs deletion
@@ -73,7 +67,7 @@ func (form *SettingsUpsert) Submit(interceptors ...InterceptorFunc) error {
 		)
 
 		if form.Settings.Logs.MaxDays == 0 {
-			// reclaim deleted logs disk space
+			// no logs are allowed -> reclaim preserved disk space after the previous delete operation
 			form.app.LogsDao().Vacuum()
 		}
 

forms/test_email_send_test.go

@@ -72,8 +72,8 @@ func TestEmailSendValidateAndSubmit(t *testing.T) {
 			expectedContent = "Confirm new email"
 		}
 
-		if !strings.Contains(app.TestMailer.LastHtmlBody, expectedContent) {
-			t.Errorf("(%d) Expected the email to contains %s, got \n%v", i, expectedContent, app.TestMailer.LastHtmlBody)
+		if !strings.Contains(app.TestMailer.LastMessage.HTML, expectedContent) {
+			t.Errorf("(%d) Expected the email to contains %s, got \n%v", i, expectedContent, app.TestMailer.LastMessage.HTML)
 		}
 	}
 }

forms/validators/file.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gabriel-vasile/mimetype"
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 )
 
 // UploadedFileSize checks whether the validated `rest.UploadedFile`
@@ -16,12 +16,12 @@ import (
 //	validation.Field(&form.File, validation.By(validators.UploadedFileSize(1000)))
 func UploadedFileSize(maxBytes int) validation.RuleFunc {
 	return func(value any) error {
-		v, _ := value.(*rest.UploadedFile)
+		v, _ := value.(*filesystem.File)
 		if v == nil {
 			return nil // nothing to validate
 		}
 
-		if int(v.Header().Size) > maxBytes {
+		if int(v.Size) > maxBytes {
 			return validation.NewError("validation_file_size_limit", fmt.Sprintf("Maximum allowed file size is %v bytes.", maxBytes))
 		}
 
@@ -37,7 +37,7 @@ func UploadedFileSize(maxBytes int) validation.RuleFunc {
 //	validation.Field(&form.File, validation.By(validators.UploadedFileMimeType(validMimeTypes)))
 func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
 	return func(value any) error {
-		v, _ := value.(*rest.UploadedFile)
+		v, _ := value.(*filesystem.File)
 		if v == nil {
 			return nil // nothing to validate
 		}
@@ -46,7 +46,7 @@ func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
 			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
 		}
 
-		f, err := v.Header().Open()
+		f, err := v.Reader.Open()
 		if err != nil {
 			return validation.NewError("validation_invalid_mime_type", "Unsupported file type.")
 		}

forms/validators/file_test.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/pocketbase/pocketbase/forms/validators"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/rest"
 )
 
@@ -30,7 +31,7 @@ func TestUploadedFileSize(t *testing.T) {
 
 	scenarios := []struct {
 		maxBytes    int
-		file        *rest.UploadedFile
+		file        *filesystem.File
 		expectError bool
 	}{
 		{0, nil, false},
@@ -70,7 +71,7 @@ func TestUploadedFileMimeType(t *testing.T) {
 
 	scenarios := []struct {
 		types       []string
-		file        *rest.UploadedFile
+		file        *filesystem.File
 		expectError bool
 	}{
 		{nil, nil, false},

forms/validators/record_data.go

@@ -12,8 +12,8 @@ import (
 	"github.com/pocketbase/pocketbase/daos"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/list"
-	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
@@ -28,7 +28,7 @@ var requiredErr = validation.NewError("validation_required", "Missing required v
 func NewRecordDataValidator(
 	dao *daos.Dao,
 	record *models.Record,
-	uploadedFiles map[string][]*rest.UploadedFile,
+	uploadedFiles map[string][]*filesystem.File,
 ) *RecordDataValidator {
 	return &RecordDataValidator{
 		dao:           dao,
@@ -42,7 +42,7 @@ func NewRecordDataValidator(
 type RecordDataValidator struct {
 	dao           *daos.Dao
 	record        *models.Record
-	uploadedFiles map[string][]*rest.UploadedFile
+	uploadedFiles map[string][]*filesystem.File
 }
 
 // Validate validates the provided `data` by checking it against
@@ -314,9 +314,9 @@ func (validator *RecordDataValidator) checkFileValue(field *schema.SchemaField,
 	}
 
 	// extract the uploaded files
-	files := make([]*rest.UploadedFile, 0, len(validator.uploadedFiles[field.Name]))
+	files := make([]*filesystem.File, 0, len(validator.uploadedFiles[field.Name]))
 	for _, file := range validator.uploadedFiles[field.Name] {
-		if list.ExistInSlice(file.Name(), names) {
+		if list.ExistInSlice(file.Name, names) {
 			files = append(files, file)
 		}
 	}

forms/validators/record_data_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/models/schema"
 	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/types"
 )
@@ -20,7 +21,7 @@ import (
 type testDataFieldScenario struct {
 	name           string
 	data           map[string]any
-	files          map[string][]*rest.UploadedFile
+	files          map[string][]*filesystem.File
 	expectedErrors []string
 }
 
@@ -1086,10 +1087,10 @@ func TestRecordDataValidatorValidateFile(t *testing.T) {
 			"check MaxSelect constraint",
 			map[string]any{
 				"field1": "test1",
-				"field2": []string{"test1", testFiles[0].Name(), testFiles[3].Name()},
+				"field2": []string{"test1", testFiles[0].Name, testFiles[3].Name},
 				"field3": []string{"test1", "test2", "test3", "test4"},
 			},
-			map[string][]*rest.UploadedFile{
+			map[string][]*filesystem.File{
 				"field2": {testFiles[0], testFiles[3]},
 			},
 			[]string{"field2", "field3"},
@@ -1097,11 +1098,11 @@ func TestRecordDataValidatorValidateFile(t *testing.T) {
 		{
 			"check MaxSize constraint",
 			map[string]any{
-				"field1": testFiles[0].Name(),
-				"field2": []string{"test1", testFiles[0].Name()},
+				"field1": testFiles[0].Name,
+				"field2": []string{"test1", testFiles[0].Name},
 				"field3": []string{"test1", "test2", "test3"},
 			},
-			map[string][]*rest.UploadedFile{
+			map[string][]*filesystem.File{
 				"field1": {testFiles[0]},
 				"field2": {testFiles[0]},
 			},
@@ -1111,10 +1112,10 @@ func TestRecordDataValidatorValidateFile(t *testing.T) {
 			"check MimeTypes constraint",
 			map[string]any{
 				"field1": "test1",
-				"field2": []string{"test1", testFiles[0].Name()},
-				"field3": []string{testFiles[1].Name(), testFiles[2].Name()},
+				"field2": []string{"test1", testFiles[0].Name},
+				"field3": []string{testFiles[1].Name, testFiles[2].Name},
 			},
-			map[string][]*rest.UploadedFile{
+			map[string][]*filesystem.File{
 				"field2": {testFiles[0], testFiles[1], testFiles[2]},
 				"field3": {testFiles[1], testFiles[2]},
 			},
@@ -1134,10 +1135,10 @@ func TestRecordDataValidatorValidateFile(t *testing.T) {
 			"valid data - just new files",
 			map[string]any{
 				"field1": nil,
-				"field2": []string{testFiles[0].Name(), testFiles[1].Name()},
+				"field2": []string{testFiles[0].Name, testFiles[1].Name},
 				"field3": nil,
 			},
-			map[string][]*rest.UploadedFile{
+			map[string][]*filesystem.File{
 				"field2": {testFiles[0], testFiles[1]},
 			},
 			[]string{},
@@ -1146,10 +1147,10 @@ func TestRecordDataValidatorValidateFile(t *testing.T) {
 			"valid data - mixed existing and new files",
 			map[string]any{
 				"field1": "test1",
-				"field2": []string{"test1", testFiles[0].Name()},
+				"field2": []string{"test1", testFiles[0].Name},
 				"field3": "test1", // will be casted
 			},
-			map[string][]*rest.UploadedFile{
+			map[string][]*filesystem.File{
 				"field2": {testFiles[0], testFiles[1], testFiles[2]},
 			},
 			[]string{},

go.mod

@@ -4,53 +4,59 @@ go 1.18
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.6
-	github.com/aws/aws-sdk-go v1.44.141
+	github.com/aws/aws-sdk-go v1.44.165
 	github.com/disintegration/imaging v1.6.2
 	github.com/domodwyer/mailyak/v3 v3.3.4
+	github.com/dop251/goja v0.0.0-20221118162653-d4bf6fde1b86
+	github.com/dop251/goja_nodejs v0.0.0-20221009164102-3aa5028e57f6
 	github.com/fatih/color v1.13.0
 	github.com/gabriel-vasile/mimetype v1.4.1
 	github.com/ganigeorgiev/fexpr v0.1.1
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
-	github.com/golang-jwt/jwt/v4 v4.4.2
+	github.com/golang-jwt/jwt/v4 v4.4.3
 	github.com/labstack/echo/v5 v5.0.0-20220201181537-ed2888cfa198
 	github.com/mattn/go-sqlite3 v1.14.16
-	github.com/pocketbase/dbx v1.7.0
+	github.com/pocketbase/dbx v1.8.0
 	github.com/spf13/cast v1.5.0
 	github.com/spf13/cobra v1.6.1
 	gocloud.dev v0.27.0
-	golang.org/x/crypto v0.3.0
-	golang.org/x/net v0.2.0
-	golang.org/x/oauth2 v0.2.0
-	modernc.org/sqlite v1.19.4
+	golang.org/x/crypto v0.4.0
+	golang.org/x/net v0.4.0
+	golang.org/x/oauth2 v0.3.0
+	golang.org/x/sync v0.1.0
+	modernc.org/sqlite v1.20.0
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.17.1 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.2 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.2 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.41 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.17.4 // indirect
-	github.com/aws/smithy-go v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.17.3 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.7 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.46 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.29.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.17.7 // indirect
+	github.com/aws/smithy-go v1.13.5 // indirect
+	github.com/dlclark/regexp2 v1.7.0 // indirect
+	github.com/dustin/go-humanize v1.0.0 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
@@ -61,25 +67,25 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/image v0.1.0 // indirect
+	golang.org/x/image v0.2.0 // indirect
 	golang.org/x/mod v0.7.0 // indirect
-	golang.org/x/sys v0.2.0 // indirect
-	golang.org/x/term v0.2.0 // indirect
-	golang.org/x/text v0.4.0 // indirect
-	golang.org/x/time v0.2.0 // indirect
-	golang.org/x/tools v0.3.0 // indirect
+	golang.org/x/sys v0.3.0 // indirect
+	golang.org/x/term v0.3.0 // indirect
+	golang.org/x/text v0.5.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.4.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.103.0 // indirect
+	google.golang.org/api v0.105.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 // indirect
+	google.golang.org/genproto v0.0.0-20221207170731-23e4bf6bdc37 // indirect
 	google.golang.org/grpc v1.51.0 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	lukechampine.com/uint128 v1.2.0 // indirect
 	modernc.org/cc/v3 v3.40.0 // indirect
 	modernc.org/ccgo/v3 v3.16.13 // indirect
-	modernc.org/libc v1.21.4 // indirect
+	modernc.org/libc v1.22.2 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.4.0 // indirect
+	modernc.org/memory v1.5.0 // indirect
 	modernc.org/opt v0.1.3 // indirect
 	modernc.org/strutil v1.1.3 // indirect
 	modernc.org/token v1.1.0 // indirect

go.sum

@@ -47,18 +47,16 @@ cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6m
 cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
-cloud.google.com/go/compute v1.10.0 h1:aoLIYaA1fX3ywihqpBk2APQKOo20nXsp1GEZQbx5Jk4=
-cloud.google.com/go/compute v1.12.1 h1:gKVJMEyqV5c/UnpzjjQbo3Rjvvqpr9B1DFSbJC4OXr0=
+cloud.google.com/go/compute v1.13.0 h1:AYrLkB8NPdDRslNp4Jxmzrhdr03fUAIDbiGFjLWowoU=
+cloud.google.com/go/compute/metadata v0.2.2 h1:aWKAjYaBaOSrpKl57+jnS/3fJRQnxL7TvR/u1VVbt6k=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
 cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
 cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
-cloud.google.com/go/iam v0.6.0 h1:nsqQC88kT5Iwlm4MeNGTpfMWddp6NB/UOLFTH6m1QfQ=
-cloud.google.com/go/iam v0.7.0 h1:k4MuwOsS7zGJJ+QfZ5vBK8SgHBAvYN/23BWsiihJ1vs=
+cloud.google.com/go/iam v0.8.0 h1:E2osAkZzxI/+8pZcxVLcDtAQx/u+hZXVryUaYQ5O0Kk=
 cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
-cloud.google.com/go/longrunning v0.1.1 h1:y50CXG4j0+qvEukslYFBCrzaXX0qpFbBzc3PchSu/LE=
 cloud.google.com/go/longrunning v0.3.0 h1:NjljC+FYPV3uh5/OwWT6pVU+doBqMg2x/rZlE+CamDs=
 cloud.google.com/go/monitoring v1.1.0/go.mod h1:L81pzz7HKn14QCMaCs6NTQkdBnE87TElyanS95vIcl4=
 cloud.google.com/go/monitoring v1.5.0/go.mod h1:/o9y8NYX5j91JjD/JvGLYbi86kL11OjyJXq2XziLJu4=
@@ -208,86 +206,70 @@ github.com/aws/aws-sdk-go v1.43.11/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4
 github.com/aws/aws-sdk-go v1.43.31/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.44.45/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.44.68/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.126 h1:7HQJw2DNiwpxqMe2H7odGNT2rhO4SRrUe5/8dYXl0Jk=
-github.com/aws/aws-sdk-go v1.44.126/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.127 h1:IoO2VfuIQg1aMXnl8l6OpNUKT4Qq5CnJMOyIWoTYXj0=
-github.com/aws/aws-sdk-go v1.44.127/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.130 h1:a/qwOxmYJF47xTZvTjECSJXnfRbjegb3YxvCXfETtnY=
-github.com/aws/aws-sdk-go v1.44.130/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.44.141 h1:kT/YIH9GUaKZa3yi8TEsZmVgvphwEzINJu19hYUzfGY=
-github.com/aws/aws-sdk-go v1.44.141/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.44.165 h1:yaeKEU28EiSCp1T5XXinVA/qx9JFGbVZGUmj5COAMXI=
+github.com/aws/aws-sdk-go v1.44.165/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/aws/aws-sdk-go-v2 v1.16.8/go.mod h1:6CpKuLXg2w7If3ABZCl/qZ6rEgwtjZTn4eAf4RcEyuw=
-github.com/aws/aws-sdk-go-v2 v1.17.1 h1:02c72fDJr87N8RAC2s3Qu0YuvMRZKNZJ9F+lAehCazk=
-github.com/aws/aws-sdk-go-v2 v1.17.1/go.mod h1:JLnGeGONAyi2lWXI1p0PCIOIy333JMVK1U7Hf0aRFLw=
+github.com/aws/aws-sdk-go-v2 v1.17.3 h1:shN7NlnVzvDUgPQ+1rLMSxY8OWRNDRYtiqe0p/PgrhY=
+github.com/aws/aws-sdk-go-v2 v1.17.3/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.3/go.mod h1:gNsR5CaXKmQSSzrmGxmwmct/r+ZBfbxorAuXYsj/M5Y=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 h1:RKci2D7tMwpvGpDNZnGQw9wk6v7o/xSwFcUAuNPoB8k=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9/go.mod h1:vCmV1q1VK8eoQJ5+aYE7PkK1K6v41qJ5pJdK3ggCDvg=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
 github.com/aws/aws-sdk-go-v2/config v1.15.15/go.mod h1:A1Lzyy/o21I5/s2FbyX5AevQfSVXpvvIDCoVFD0BC4E=
-github.com/aws/aws-sdk-go-v2/config v1.17.10 h1:zBy5QQ/mkvHElM1rygHPAzuH+sl8nsdSaxSWj0+rpdE=
-github.com/aws/aws-sdk-go-v2/config v1.17.10/go.mod h1:/4np+UiJJKpWHN7Q+LZvqXYgyjgeXm5+lLfDI6TPZao=
-github.com/aws/aws-sdk-go-v2/config v1.18.2 h1:tRhTb3xMZsB0gW0sXWpqs9FeIP8iQp5SvnvwiPXzHwo=
-github.com/aws/aws-sdk-go-v2/config v1.18.2/go.mod h1:9XVoZTdD8ICjrgI5ddb8j918q6lEZkFYpb7uohgvU6c=
+github.com/aws/aws-sdk-go-v2/config v1.18.7 h1:V94lTcix6jouwmAsgQMAEBozVAGJMFhVj+6/++xfe3E=
+github.com/aws/aws-sdk-go-v2/config v1.18.7/go.mod h1:OZYsyHFL5PB9UpyS78NElgKs11qI/B5KJau2XOJDXHA=
 github.com/aws/aws-sdk-go-v2/credentials v1.12.10/go.mod h1:g5eIM5XRs/OzIIK81QMBl+dAuDyoLN0VYaLP+tBqEOk=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.23 h1:LctvcJMIb8pxvk5hQhChpCu0WlU6oKQmcYb1HA4IZSA=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.23/go.mod h1:0awX9iRr/+UO7OwRQFpV1hNtXxOVuehpjVEzrIAYNcA=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.2 h1:F/v1w0XcFDZjL0bCdi9XWJenoPKjGbzljBhDKcryzEQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.2/go.mod h1:eAT5aj/WJ2UDIA0IVNFc2byQLeD89SDEi4cjzH/MKoQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.7 h1:qUUcNS5Z1092XBFT66IJM7mYkMwgZ8fcC8YDIbEwXck=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.7/go.mod h1:AdCcbZXHQCjJh6NaH3pFaw8LUeBFn5+88BZGMVGuBT8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.9/go.mod h1:KDCCm4ONIdHtUloDcFvK2+vshZvx4Zmj7UMDfusuz5s=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19 h1:E3PXZSI3F2bzyj6XxUXdTIfvp425HHhwKsFvmzBwHgs=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19/go.mod h1:VihW95zQpeKQWVPGkwT+2+WJNQV8UXFfMTWdU6VErL8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21 h1:j9wi1kQ8b+e0FBVHxCqCGo4kxDU175hoDHcWAi0sauU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21/go.mod h1:ugwW57Z5Z48bpvUyZuaPy4Kv+vEfJWnIrky7RmkBvJg=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.21/go.mod h1:iIYPrQ2rYfZiB/iADYlhj9HHZ9TTi6PqKQPAqygohbE=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.37 h1:e1VtTBo+cLNjres0wTlMkmwCGGRjDEkkrz3frxxcaCs=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.37/go.mod h1:kdAV1UMnCkyG6tZJUC4mHbPoRjPA3dIK0L8mnsHERiM=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.41 h1:ssgdsNm11dvFtO7F/AeiW4dAO3eGsDeg5fwpag/JP/I=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.41/go.mod h1:CS+AbDFAaPU9TQOo7U6mVV23YvqCOElnqmh0XQjgJ1g=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.46 h1:OCX1pQ4pcqhsDV7B92HzdLWjHWOQsILvjLinpaUWhcc=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.46/go.mod h1:MxCBOcyNXGJRvfpPiH+L6n/BF9zbowthGSUZdDvQF/c=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.15/go.mod h1:pWrr2OoHlT7M/Pd2y4HV3gJyPb3qj5qMmnPkKSNPYK4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25 h1:nBO/RFxeq/IS5G9Of+ZrgucRciie2qpLy++3UGZ+q2E=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25/go.mod h1:Zb29PYkf42vVYQY6pvSyJCJcFHlPIiY+YKdPtwnvMkY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27 h1:I3cakv2Uy1vNmmhRQmFptYDxOvBnwCdNwyw63N0RaRU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27/go.mod h1:a1/UpzeyBBerajpnP5nGZa9mGzsBn5cOKxm6NWQsvoI=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.9/go.mod h1:08tUpeSGN33QKSO7fwxXczNfiwCpbj+GxK6XKwqWVv0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19 h1:oRHDrwCTVT8ZXi4sr9Ld+EXk7N/KGssOr2ygNeojEhw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19/go.mod h1:6Q0546uHDp421okhmmGfbxzq2hBqbXFNpi4k+Q1JnQA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21 h1:5NbbMrIzmUn/TXFqAle6mgrH5m9cOvMLRGL7pnG8tRE=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21/go.mod h1:+Gxn8jYn5k9ebfHEqlhrMirFjSW0v0C9fI+KN5vk2kE=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.16/go.mod h1:CYmI+7x03jjJih8kBEEFKRQc40UjUokT0k7GbvrhhTc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26 h1:Mza+vlnZr+fPKFKRq/lKGVvM6B/8ZZmNdEopOwSQLms=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26/go.mod h1:Y2OJ+P+MC1u1VKnavT+PshiEuGPyh/7DqxoDNij4/bg=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.28 h1:KeTxcGdNnQudb46oOl4d90f2I33DF/c6q3RnZAmvQdQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.28/go.mod h1:yRZVr/iT0AqyHeep00SZ4YfBAKojXz08w3XMBscdi0c=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.6/go.mod h1:O7Oc4peGZDEKlddivslfYFvAbgzvl/GH3J8j3JIGBXc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16 h1:2EXB7dtGwRYIN3XQ9qwIW504DVbKIw3r89xQnonGdsQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16/go.mod h1:XH+3h395e3WVdd6T2Z3mPxuI+x/HVtdqVOREkTiyubs=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.18 h1:H/mF2LNWwX00lD6FlYfKpLLZgUW7oIzCBkig78x4Xok=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.18/go.mod h1:T2Ku+STrYQ1zIkL1wMvj8P3wWQaaCMKNdz70MT2FLfE=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.3/go.mod h1:gkb2qADY+OHaGLKNTYxMaQNacfeyQpZ4csDTQMeFmcw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10 h1:dpiPHgmFstgkLG07KaYAewvuptq5kvo52xn7tVSrtrQ=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10/go.mod h1:9cBNUHI2aW4ho0A5T87O294iPDuuUOSIEDjnd1Lq/z0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 h1:y2+VQzC6Zh2ojtV2LoC0MNwHWc6qXv/j2vrQtlftkdA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11/go.mod h1:iV4q2hsqtNECrfmlXyord9u4zyuFEJX9eLgLpSPzWA8=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.10/go.mod h1:Qks+dxK3O+Z2deAhNo6cJ8ls1bam3tUGUAcgxQP1c70=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20 h1:KSvtm1+fPXE0swe9GPjc6msyrdTT0LB/BP8eLugL1FI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20/go.mod h1:Mp4XI/CkWGD79AQxZ5lIFlgvC0A+gl+4BmyG1F+SfNc=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.22 h1:kv5vRAl00tozRxSnI0IszPWGXsJOyA7hmEUHFYqsyvw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.22/go.mod h1:Od+GU5+Yx41gryN/ZGZzAJMZ9R1yn6lgA0fD5Lo5SkQ=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.9/go.mod h1:yQowTpvdZkFVuHrLBXmczat4W+WJKg/PafBZnGBLga0=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19 h1:GE25AWCdNUPh9AOJzI9KIJnja7IwUc1WyUqz/JTyJ/I=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19/go.mod h1:02CP6iuYP+IVnBX5HULVdSAku/85eHB2Y9EsFhrkEwU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21 h1:5C6XgTViSb0bunmU57b3CT+MhxULqHH2721FVA+/kDM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21/go.mod h1:lRToEJsn+DRA9lW4O9L9+/3hjTkUzlzyzHqn8MTds5k=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.9/go.mod h1:Rc5+wn2k8gFSi3V1Ch4mhxOzjMh+bYSXVFfVaqowQOY=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19 h1:piDBAaWkaxkkVV3xJJbTehXCZRXYs49kvpi/LG6LR2o=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19/go.mod h1:BmQWRVkLTmyNzYPFAZgon53qKLWBNSvonugD1MrSWUs=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21 h1:vY5siRXvW5TrOKm2qKEf9tliBfdLxdfy0i02LOcmqUo=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21/go.mod h1:WZvNXT1XuH8dnJM0HvOlvk+RNn7NbAPvA/ACO0QarSc=
 github.com/aws/aws-sdk-go-v2/service/kms v1.18.1/go.mod h1:4PZMUkc9rXHWGVB5J9vKaZy3D7Nai79ORworQ3ASMiM=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.27.2/go.mod h1:u+566cosFI+d+motIz3USXEh6sN8Nq4GrNXSg2RXVMo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.1 h1:/EMdFPW/Ppieh0WUtQf1+qCGNLdsq5UWUyevBQ6vMVc=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.1/go.mod h1:/NHbqPRiwxSPVOB2Xr+StDEH+GWV/64WwnUjv4KYzV0=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 h1:F6wgg8aHGNyhaAy2ONnWBThiPdLa386qNA0j33FIuSM=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3/go.mod h1:/NHbqPRiwxSPVOB2Xr+StDEH+GWV/64WwnUjv4KYzV0=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.29.6 h1:W8pLcSn6Uy0eXgDBUUl8M8Kxv7JCoP68ZKTD04OXLEA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.29.6/go.mod h1:L2l2/q76teehcW7YEsgsDjqdsDTERJeX3nOMIFlgGUE=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.15.14/go.mod h1:xakbH8KMsQQKqzX87uyyzTHshc/0/Df8bsTneTS5pFU=
 github.com/aws/aws-sdk-go-v2/service/sns v1.17.10/go.mod h1:uITsRNVMeCB3MkWpXxXw0eDz8pW4TYLzj+eyQtbhSxM=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.19.1/go.mod h1:A94o564Gj+Yn+7QO1eLFeI7UVv3riy/YBFOfICVqFvU=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.27.6/go.mod h1:fiFzQgj4xNOg4/wqmAiPvzgDMXPD+cUEplX/CYn+0j0=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.13/go.mod h1:d7ptRksDDgvXaUvxyHZ9SYh+iMDymm94JbVcgvSYSzU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.25 h1:GFZitO48N/7EsFDt8fMa5iYdmWqkUDDB3Eje6z3kbG0=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.25/go.mod h1:IARHuzTXmj1C0KS35vboR0FeJ89OkEy1M9mWbK2ifCI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8 h1:jcw6kKZrtNfBPJkaHrscDOZoe5gvi9wjudnxvozYFJo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8/go.mod h1:er2JHN+kBY6FcMfcBBKNGCT3CarImmdFzishsqBmSRI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.11.28 h1:gItLq3zBYyRDPmqAClgzTH8PBjDQGeyptYGHIwtYYNA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.11.28/go.mod h1:wo/B7uUm/7zw/dWhBJ4FXuw1sySU5lyIhVg1Bu2yL9A=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.11 h1:KCacyVSs/wlcPGx37hcbT3IGYO8P8Jx+TgSDhAXtQMY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.11/go.mod h1:TZSH7xLO7+phDtViY/KUp9WGCJMQkLJ/VpgkTFd5gh8=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.10/go.mod h1:cftkHYN6tCDNfkSasAmclSfl4l7cySoay8vz7p/ce0E=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.1 h1:KRAix/KHvjGODaHAMXnxRk9t0D+4IJVUuS/uwXxngXk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.1/go.mod h1:bXcN3koeVYiJcdDU89n3kCYILob7Y34AeLopUbZgLT4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.4 h1:YNncBj5dVYd05i4ZQ+YicOotSXo0ufc9P8kTioi13EM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.4/go.mod h1:bXcN3koeVYiJcdDU89n3kCYILob7Y34AeLopUbZgLT4=
+github.com/aws/aws-sdk-go-v2/service/sts v1.17.7 h1:9Mtq1KM6nD8/+HStvWcvYnixJ5N85DX+P+OY3kI3W2k=
+github.com/aws/aws-sdk-go-v2/service/sts v1.17.7/go.mod h1:+lGbb3+1ugwKrNTWcf2RT05Xmp543B06zDFTwiTLp7I=
 github.com/aws/smithy-go v1.12.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aws/smithy-go v1.13.4 h1:/RN2z1txIJWeXeOkzX+Hk/4Uuvv7dWtCjbmVJcrskyk=
-github.com/aws/smithy-go v1.13.4/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -498,6 +480,9 @@ github.com/digitalocean/godo v1.81.0/go.mod h1:BPCqvwbjbGqxuUnIKB4EvS/AX7IDnNmt5
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/dlclark/regexp2 v1.4.1-0.20201116162257-a2a8dda75c91/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
+github.com/dlclark/regexp2 v1.7.0 h1:7lJfhqlPssTb1WQx4yvTHN0uElPEv52sbaECrAQxjAo=
+github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/yU9ko=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
@@ -521,6 +506,14 @@ github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZ
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/domodwyer/mailyak/v3 v3.3.4 h1:AG/pvcz2/ocFqZkPEG7lPAa0MhCq1warfUEKJt6Fagk=
 github.com/domodwyer/mailyak/v3 v3.3.4/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
+github.com/dop251/goja v0.0.0-20211022113120-dc8c55024d06/go.mod h1:R9ET47fwRVRPZnOGvHxxhuZcbrMCuiqOz3Rlrh4KSnk=
+github.com/dop251/goja v0.0.0-20220815083517-0c74f9139fd6/go.mod h1:yRkwfj0CBpOGre+TwBsqPV0IH0Pk73e4PXJOeNDboGs=
+github.com/dop251/goja v0.0.0-20221118162653-d4bf6fde1b86 h1:E2wycakfddWJ26v+ZyEY91Lb/HEZyaiZhbMX+KQcdmc=
+github.com/dop251/goja v0.0.0-20221118162653-d4bf6fde1b86/go.mod h1:yRkwfj0CBpOGre+TwBsqPV0IH0Pk73e4PXJOeNDboGs=
+github.com/dop251/goja_nodejs v0.0.0-20210225215109-d91c329300e7/go.mod h1:hn7BA7c8pLvoGndExHudxTDKZ84Pyvv+90pbBjbTz0Y=
+github.com/dop251/goja_nodejs v0.0.0-20211022123610-8dd9abb0616d/go.mod h1:DngW8aVqWbuLRMHItjPUyqdj+HWPvnQe8V8y1nDpIbM=
+github.com/dop251/goja_nodejs v0.0.0-20221009164102-3aa5028e57f6 h1:p3QZwRRfCN7Qr3GNBTMKBkLFjEm3DHR4MaJABvsiqgk=
+github.com/dop251/goja_nodejs v0.0.0-20221009164102-3aa5028e57f6/go.mod h1:+CJy9V5cGycP5qwp6RM5jLg+TFEMyGtD7A9xUbU/BOQ=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
@@ -640,6 +633,8 @@ github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+
 github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
 github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
@@ -698,8 +693,9 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69
 github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.4.3 h1:Hxl6lhQFj4AnOX6MLrsCb/+7tCj7DxP7VA+2rDIq5AU=
+github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -796,6 +792,7 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20220318212150-b2ab0324ddda/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20220608213341-c488b8fa1db3/go.mod h1:gSuNB+gJaOiQKLEZ+q+PK9Mq3SOzhRcw2GsGS/FhYDk=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -816,8 +813,6 @@ github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0
 github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
 github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
-github.com/googleapis/gax-go/v2 v2.6.0 h1:SXk3ABtQYDT/OH8jAyvEOQ58mgawq5C4o/4/89qN2ZU=
-github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
 github.com/googleapis/gax-go/v2 v2.7.0 h1:IcsPKeInNvYi7eqSaDjiZqDDKu5rsmunY0Y1YupQSSQ=
 github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
 github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
@@ -915,8 +910,9 @@ github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
 github.com/ionos-cloud/sdk-go/v6 v6.1.0/go.mod h1:Ox3W0iiEz0GHnfY9e5LmAxwklsxguuNFEUSu0gVRTME=
@@ -1224,8 +1220,8 @@ github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6J
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocketbase/dbx v1.7.0 h1:MY6/up//aIeH6WA8VqYt3EeQt082bEdKcUDcEF4UrWw=
-github.com/pocketbase/dbx v1.7.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/pocketbase/dbx v1.8.0 h1:kjf3mgmmE12t8IG48kJOeIyBmRi0A1sl6Hsezv4PoiA=
+github.com/pocketbase/dbx v1.8.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
@@ -1379,7 +1375,6 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
@@ -1464,7 +1459,6 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
@@ -1567,10 +1561,8 @@ golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220511200225-c6db032c6c88/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
-golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.4.0 h1:UVQgzMY87xqpKNgb+kDsll2Igd33HszWHFLmpaRMq/8=
+golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1584,8 +1576,8 @@ golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMk
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.1.0 h1:r8Oj8ZA2Xy12/b5KZYj3tuv7NG/fBz3TwQVvpJ9l8Rk=
-golang.org/x/image v0.1.0/go.mod h1:iyPr49SD/G/TBxYVB/9RRtGUT5eNbo2u4NamWeQcD5c=
+golang.org/x/image v0.2.0 h1:/DcQ0w3VHKCC5p0/P2B0JpAZ9Z++V2KOo2fyU89CXBQ=
+golang.org/x/image v0.2.0/go.mod h1:la7oBXb9w3YFjBqaAwtynVioc1ZvOnNteUNrifGNmAI=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1613,8 +1605,6 @@ golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0 h1:b9gGHsz9/HhJ3HF5DHQytPpuwocVTChQJK3AvoLRD5I=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1694,10 +1684,9 @@ golang.org/x/net v0.0.0-20220617184016-355a448f1bc9/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220802222814-0bcc04d9c69b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU=
+golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1723,10 +1712,8 @@ golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7Lm
 golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
 golang.org/x/oauth2 v0.0.0-20220628200809-02e64fa58f26/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
 golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.1.0 h1:isLCZuhj4v+tYv7eskaN4v/TM+A1begWWgyVJDdl1+Y=
-golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
-golang.org/x/oauth2 v0.2.0 h1:GtQkldQ9m7yvzCL1V+LrYow3Khe0eJH0w7RbX/VbaIU=
-golang.org/x/oauth2 v0.2.0/go.mod h1:Cwn6afJ8jrQwYMxQDTpISoXmXW9I6qF6vDeuuoX3Ibs=
+golang.org/x/oauth2 v0.3.0 h1:6l90koy8/LaBLmLu8jpHeHexzMwEita0zFfYlggy2F8=
+golang.org/x/oauth2 v0.3.0/go.mod h1:rQrIauxkUhJ6CuwEXwymO2/eh4xz2ZWF1nBkcxS+tGk=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1741,6 +1728,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1883,20 +1872,18 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220731174439-a90be440212d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0 h1:z85xZCsEl7bi/KwbNADeBYoOP0++7W1ipu+aGnpwzRM=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1906,8 +1893,9 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
+golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1920,10 +1908,8 @@ golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220609170525-579cf78fd858/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.2.0 h1:52I/1L54xyEQAYdtcSuxtiT84KGYTBGXwayxmIpNJhE=
-golang.org/x/time v0.2.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2007,10 +1993,8 @@ golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.11/go.mod h1:SgwaegtQh8clINPpECJMqnxLv9I09HLqnW3RMqW0CA4=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0 h1:G6AHpWxTMGY1KyEYoAQ5WTtIekUUvDNjan3ugu60JvE=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
-golang.org/x/tools v0.3.0 h1:SrNbZl6ECOS1qFzgTdQfWXZM9XBkiA6tkFrH9YSTPHM=
-golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
+golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4=
+golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2070,12 +2054,8 @@ google.golang.org/api v0.85.0/go.mod h1:AqZf8Ep9uZ2pyTvgL+x0D3Zt0eoT9b5E8fmzfu6F
 google.golang.org/api v0.86.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
 google.golang.org/api v0.90.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
 google.golang.org/api v0.91.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
-google.golang.org/api v0.101.0 h1:lJPPeEBIRxGpGLwnBTam1NPEM8Z2BmmXEd3z812pjwM=
-google.golang.org/api v0.101.0/go.mod h1:CjxAAWWt3A3VrUE2IGDY2bgK5qhoG/OkyWVlYcP05MY=
-google.golang.org/api v0.102.0 h1:JxJl2qQ85fRMPNvlZY/enexbxpCjLwGhZUtgfGeQ51I=
-google.golang.org/api v0.102.0/go.mod h1:3VFl6/fzoA+qNuS1N1/VfXY4LjoXN/wzeIp7TweWwGo=
-google.golang.org/api v0.103.0 h1:9yuVqlu2JCvcLg9p8S3fcFLZij8EPSyvODIY1rkMizQ=
-google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
+google.golang.org/api v0.105.0 h1:t6P9Jj+6XTn4U9I2wycQai6Q/Kz7iOT+QzjJ3G2V4x8=
+google.golang.org/api v0.105.0/go.mod h1:qh7eD5FJks5+BcE+cjBIm6Gz8vioK7EHvnlniqXBnqI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2184,10 +2164,8 @@ google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad/go.mod h1:KEWEmljW
 google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220802133213-ce4fa296bf78/go.mod h1:iHe1svFLAZg9VWz891+QbRMwUv9O/1Ww+/mngYeThbc=
-google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c h1:QgY/XxIAIeccR+Ca/rDdKubLIU9rcJ3xfy1DC/Wd2Oo=
-google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo=
-google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 h1:a2S6M0+660BgMNl++4JPlcAO/CjkqYItDEZwkoDQK7c=
-google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
+google.golang.org/genproto v0.0.0-20221207170731-23e4bf6bdc37 h1:jmIfw8+gSvXcZSgaFAGyInDXeWzUhvYH57G/5GKMn70=
+google.golang.org/genproto v0.0.0-20221207170731-23e4bf6bdc37/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -2229,8 +2207,6 @@ google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
-google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.51.0 h1:E1eGv1FTqoLIdnBCZufiSHgKjlqG6fKFf6pPWtMTh8U=
 google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
@@ -2365,29 +2341,23 @@ lukechampine.com/uint128 v1.2.0 h1:mBi/5l91vocEN8otkC5bDLhi2KdCticRiwbdB0O+rjI=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.40.0 h1:P3g79IUS/93SYhtoeaHW+kRCIrYaxJ27MFPv+7kaTOw=
 modernc.org/cc/v3 v3.40.0/go.mod h1:/bTg4dnWkSXowUO6ssQKnOV0yMVxDYNIsIrzqTFDGH0=
-modernc.org/ccgo/v3 v3.16.13-0.20221017192402-261537637ce8 h1:0+dsXf0zeLx9ixj4nilg6jKe5Bg1ilzBwSFq4kJmIUc=
-modernc.org/ccgo/v3 v3.16.13-0.20221017192402-261537637ce8/go.mod h1:fUB3Vn0nVPReA+7IG7yZDfjv1TMWjhQP8gCxrFAtL5g=
 modernc.org/ccgo/v3 v3.16.13 h1:Mkgdzl46i5F/CNR/Kj80Ri59hC8TKAhZrYSaqvkwzUw=
 modernc.org/ccgo/v3 v3.16.13/go.mod h1:2Quk+5YgpImhPjv2Qsob1DnZ/4som1lJTodubIcoUkY=
 modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
 modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
-modernc.org/libc v1.21.4 h1:CzTlumWeIbPV5/HVIMzYHNPCRP8uiU/CWiN2gtd/Qu8=
-modernc.org/libc v1.21.4/go.mod h1:przBsL5RDOZajTVslkugzLBj1evTue36jEomFQOoYuI=
+modernc.org/libc v1.22.2 h1:4U7v51GyhlWqQmwCHj28Rdq2Yzwk55ovjFrdPjs8Hb0=
+modernc.org/libc v1.22.2/go.mod h1:uvQavJ1pZ0hIoC/jfqNoMLURIMhKzINIWypNM17puug=
 modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ=
 modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/memory v1.4.0 h1:crykUfNSnMAXaOJnnxcSzbUGMqkLWjklJKkBK2nwZwk=
-modernc.org/memory v1.4.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
+modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
+modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.19.3 h1:dIoagx6yIQT3V/zOSeAyZ8OqQyEr17YTgETOXTZNJMA=
-modernc.org/sqlite v1.19.3/go.mod h1:xiyJD7FY8mTZXnQwE/gEL1STtFrrnDx03V8KhVQmcr8=
-modernc.org/sqlite v1.19.4 h1:nlPIDqumn6/mSvs7T5C8MNYEuN73sISzPdKtMdURpUI=
-modernc.org/sqlite v1.19.4/go.mod h1:x/yZNb3h5+I3zGQSlwIv4REL5eJhiRkUH5MReogAeIc=
+modernc.org/sqlite v1.20.0 h1:80zmD3BGkm8BZ5fUi/4lwJQHiO3GXgIUvZRXpoIfROY=
+modernc.org/sqlite v1.20.0/go.mod h1:EsYz8rfOvLCiYTy5ZFsOYzoCcRMu98YYkwAcCw5YIYw=
 modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.15.0 h1:oY+JeD11qVVSgVvodMJsu7Edf8tr5E/7tuhF5cNYz34=
-modernc.org/token v1.0.1 h1:A3qvTqOwexpfZZeyI0FeGPDlSWX5pjZu9hF4lU+EKWg=
-modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.7.0 h1:xkDw/KepgEjeizO2sNco+hqYkU12taxQFqPEmgm1GWE=

golangci.yml

@@ -7,10 +7,8 @@ linters:
   disable-all: true
   enable:
     - asciicheck
-    - deadcode
     - depguard
     - exportloopref
-    - gocritic
     - gofmt
     - goimports
     - gomodguard
@@ -26,5 +24,4 @@ linters:
     - typecheck
     - unconvert
     - unused
-    - varcheck
     - whitespace

mails/admin.go

@@ -2,12 +2,14 @@ package mails
 
 import (
 	"fmt"
+	"log"
 	"net/mail"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails/templates"
 	"github.com/pocketbase/pocketbase/models"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/rest"
 )
 
@@ -43,33 +45,37 @@ func SendAdminPasswordReset(app core.App, admin *models.Admin) error {
 
 	mailClient := app.NewMailClient()
 
+	// resolve body template
+	body, renderErr := resolveTemplateContent(params, templates.Layout, templates.AdminPasswordResetBody)
+	if renderErr != nil {
+		return renderErr
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      mail.Address{Address: admin.Email},
+		Subject: "Reset admin password",
+		HTML:    body,
+	}
+
 	event := &core.MailerAdminEvent{
 		MailClient: mailClient,
+		Message:    message,
 		Admin:      admin,
 		Meta:       map[string]any{"token": token},
 	}
 
 	sendErr := app.OnMailerBeforeAdminResetPasswordSend().Trigger(event, func(e *core.MailerAdminEvent) error {
-		// resolve body template
-		body, renderErr := resolveTemplateContent(params, templates.Layout, templates.AdminPasswordResetBody)
-		if renderErr != nil {
-			return renderErr
-		}
-
-		return e.MailClient.Send(
-			mail.Address{
-				Name:    app.Settings().Meta.SenderName,
-				Address: app.Settings().Meta.SenderAddress,
-			},
-			mail.Address{Address: e.Admin.Email},
-			"Reset admin password",
-			body,
-			nil,
-		)
+		return e.MailClient.Send(e.Message)
 	})
 
 	if sendErr == nil {
-		app.OnMailerAfterAdminResetPasswordSend().Trigger(event)
+		if err := app.OnMailerAfterAdminResetPasswordSend().Trigger(event); err != nil && app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return sendErr

mails/admin_test.go

@@ -30,8 +30,8 @@ func TestSendAdminPasswordReset(t *testing.T) {
 		"http://localhost:8090/_/#/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
-		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
-			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastHtmlBody)
+		if !strings.Contains(testApp.TestMailer.LastMessage.HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage.HTML)
 		}
 	}
 }

mails/record.go

@@ -2,13 +2,15 @@ package mails
 
 import (
 	"html/template"
+	"log"
 	"net/mail"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/mails/templates"
 	"github.com/pocketbase/pocketbase/models"
-	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tokens"
+	"github.com/pocketbase/pocketbase/tools/mailer"
 )
 
 // SendRecordPasswordReset sends a password reset request email to the specified user.
@@ -20,34 +22,36 @@ func SendRecordPasswordReset(app core.App, authRecord *models.Record) error {
 
 	mailClient := app.NewMailClient()
 
+	subject, body, err := resolveEmailTemplate(app, token, app.Settings().Meta.ResetPasswordTemplate)
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      mail.Address{Address: authRecord.Email()},
+		Subject: subject,
+		HTML:    body,
+	}
+
 	event := &core.MailerRecordEvent{
 		MailClient: mailClient,
+		Message:    message,
 		Record:     authRecord,
 		Meta:       map[string]any{"token": token},
 	}
 
 	sendErr := app.OnMailerBeforeRecordResetPasswordSend().Trigger(event, func(e *core.MailerRecordEvent) error {
-		settings := app.Settings()
-
-		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.ResetPasswordTemplate)
-		if err != nil {
-			return err
-		}
-
-		return e.MailClient.Send(
-			mail.Address{
-				Name:    settings.Meta.SenderName,
-				Address: settings.Meta.SenderAddress,
-			},
-			mail.Address{Address: e.Record.GetString(schema.FieldNameEmail)},
-			subject,
-			body,
-			nil,
-		)
+		return e.MailClient.Send(e.Message)
 	})
 
 	if sendErr == nil {
-		app.OnMailerAfterRecordResetPasswordSend().Trigger(event)
+		if err := app.OnMailerAfterRecordResetPasswordSend().Trigger(event); err != nil && app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return sendErr
@@ -62,34 +66,36 @@ func SendRecordVerification(app core.App, authRecord *models.Record) error {
 
 	mailClient := app.NewMailClient()
 
+	subject, body, err := resolveEmailTemplate(app, token, app.Settings().Meta.VerificationTemplate)
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      mail.Address{Address: authRecord.Email()},
+		Subject: subject,
+		HTML:    body,
+	}
+
 	event := &core.MailerRecordEvent{
 		MailClient: mailClient,
+		Message:    message,
 		Record:     authRecord,
 		Meta:       map[string]any{"token": token},
 	}
 
 	sendErr := app.OnMailerBeforeRecordVerificationSend().Trigger(event, func(e *core.MailerRecordEvent) error {
-		settings := app.Settings()
-
-		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.VerificationTemplate)
-		if err != nil {
-			return err
-		}
-
-		return e.MailClient.Send(
-			mail.Address{
-				Name:    settings.Meta.SenderName,
-				Address: settings.Meta.SenderAddress,
-			},
-			mail.Address{Address: e.Record.GetString(schema.FieldNameEmail)},
-			subject,
-			body,
-			nil,
-		)
+		return e.MailClient.Send(e.Message)
 	})
 
 	if sendErr == nil {
-		app.OnMailerAfterRecordVerificationSend().Trigger(event)
+		if err := app.OnMailerAfterRecordVerificationSend().Trigger(event); err != nil && app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return sendErr
@@ -104,8 +110,24 @@ func SendRecordChangeEmail(app core.App, record *models.Record, newEmail string)
 
 	mailClient := app.NewMailClient()
 
+	subject, body, err := resolveEmailTemplate(app, token, app.Settings().Meta.ConfirmEmailChangeTemplate)
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      mail.Address{Address: newEmail},
+		Subject: subject,
+		HTML:    body,
+	}
+
 	event := &core.MailerRecordEvent{
 		MailClient: mailClient,
+		Message:    message,
 		Record:     record,
 		Meta: map[string]any{
 			"token":    token,
@@ -114,27 +136,13 @@ func SendRecordChangeEmail(app core.App, record *models.Record, newEmail string)
 	}
 
 	sendErr := app.OnMailerBeforeRecordChangeEmailSend().Trigger(event, func(e *core.MailerRecordEvent) error {
-		settings := app.Settings()
-
-		subject, body, err := resolveEmailTemplate(app, token, settings.Meta.ConfirmEmailChangeTemplate)
-		if err != nil {
-			return err
-		}
-
-		return e.MailClient.Send(
-			mail.Address{
-				Name:    settings.Meta.SenderName,
-				Address: settings.Meta.SenderAddress,
-			},
-			mail.Address{Address: newEmail},
-			subject,
-			body,
-			nil,
-		)
+		return e.MailClient.Send(e.Message)
 	})
 
 	if sendErr == nil {
-		app.OnMailerAfterRecordChangeEmailSend().Trigger(event)
+		if err := app.OnMailerAfterRecordChangeEmailSend().Trigger(event); err != nil && app.IsDebug() {
+			log.Println(err)
+		}
 	}
 
 	return sendErr
@@ -143,13 +151,11 @@ func SendRecordChangeEmail(app core.App, record *models.Record, newEmail string)
 func resolveEmailTemplate(
 	app core.App,
 	token string,
-	emailTemplate core.EmailTemplate,
+	emailTemplate settings.EmailTemplate,
 ) (subject string, body string, err error) {
-	settings := app.Settings()
-
 	subject, rawBody, _ := emailTemplate.Resolve(
-		settings.Meta.AppName,
-		settings.Meta.AppUrl,
+		app.Settings().Meta.AppName,
+		app.Settings().Meta.AppUrl,
 		token,
 	)
 

mails/record_test.go

@@ -30,8 +30,8 @@ func TestSendRecordPasswordReset(t *testing.T) {
 		"http://localhost:8090/_/#/auth/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
-		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
-			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastHtmlBody)
+		if !strings.Contains(testApp.TestMailer.LastMessage.HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage.HTML)
 		}
 	}
 }
@@ -55,8 +55,8 @@ func TestSendRecordVerification(t *testing.T) {
 		"http://localhost:8090/_/#/auth/confirm-verification/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
-		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
-			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastHtmlBody)
+		if !strings.Contains(testApp.TestMailer.LastMessage.HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage.HTML)
 		}
 	}
 }
@@ -80,8 +80,8 @@ func TestSendRecordChangeEmail(t *testing.T) {
 		"http://localhost:8090/_/#/auth/confirm-email-change/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
 	}
 	for _, part := range expectedParts {
-		if !strings.Contains(testApp.TestMailer.LastHtmlBody, part) {
-			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastHtmlBody)
+		if !strings.Contains(testApp.TestMailer.LastMessage.HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage.HTML)
 		}
 	}
 }

mails/templates/admin_password_reset.go

@@ -12,13 +12,10 @@ package templates
 const AdminPasswordResetBody = `
 {{define "content"}}
 	<p>Hello,</p>
-
 	<p>Follow this link to reset your admin password for {{.AppName}}.</p>
-
 	<p>
 		<a class="btn" href="{{.ActionUrl}}" target="_blank" rel="noopener">Reset password</a>
 	</p>
-
 	<p><i>If you did not request to reset your password, please ignore this email and the link will expire on its own.</i></p>
 {{end}}
 `

migrations/1640988000_init.go

@@ -36,7 +36,7 @@ func init() {
 	AppMigrations.Register(func(db dbx.Builder) error {
 		_, tablesErr := db.NewQuery(`
 			CREATE TABLE {{_admins}} (
-				[[id]]              TEXT PRIMARY KEY,
+				[[id]]              TEXT PRIMARY KEY NOT NULL,
 				[[avatar]]          INTEGER DEFAULT 0 NOT NULL,
 				[[email]]           TEXT UNIQUE NOT NULL,
 				[[tokenKey]]        TEXT UNIQUE NOT NULL,
@@ -47,7 +47,7 @@ func init() {
 			);
 
 			CREATE TABLE {{_collections}} (
-				[[id]]         TEXT PRIMARY KEY,
+				[[id]]         TEXT PRIMARY KEY NOT NULL,
 				[[system]]     BOOLEAN DEFAULT FALSE NOT NULL,
 				[[type]]       TEXT DEFAULT "base" NOT NULL,
 				[[name]]       TEXT UNIQUE NOT NULL,
@@ -63,7 +63,7 @@ func init() {
 			);
 
 			CREATE TABLE {{_params}} (
-				[[id]]      TEXT PRIMARY KEY,
+				[[id]]      TEXT PRIMARY KEY NOT NULL,
 				[[key]]     TEXT UNIQUE NOT NULL,
 				[[value]]   JSON DEFAULT NULL,
 				[[created]] TEXT DEFAULT "" NOT NULL,
@@ -71,7 +71,7 @@ func init() {
 			);
 
 			CREATE TABLE {{_externalAuths}} (
-				[[id]]           TEXT PRIMARY KEY,
+				[[id]]           TEXT PRIMARY KEY NOT NULL,
 				[[collectionId]] TEXT NOT NULL,
 				[[recordId]]     TEXT NOT NULL,
 				[[provider]]     TEXT NOT NULL,

migrations/logs/1640988000_init.go

@@ -11,7 +11,7 @@ func init() {
 	LogsMigrations.Register(func(db dbx.Builder) (err error) {
 		_, err = db.NewQuery(`
 			CREATE TABLE {{_requests}} (
-				[[id]]        TEXT PRIMARY KEY,
+				[[id]]        TEXT PRIMARY KEY NOT NULL,
 				[[url]]       TEXT DEFAULT "" NOT NULL,
 				[[method]]    TEXT DEFAULT "get" NOT NULL,
 				[[status]]    INTEGER DEFAULT 200 NOT NULL,

models/base.go

@@ -31,7 +31,7 @@ type Model interface {
 	TableName() string
 	IsNew() bool
 	MarkAsNew()
-	UnmarkAsNew()
+	MarkAsNotNew()
 	HasId() bool
 	GetId() string
 	SetId(id string)
@@ -48,7 +48,7 @@ type Model interface {
 
 // BaseModel defines common fields and methods used by all other models.
 type BaseModel struct {
-	isNewFlag bool
+	isNotNew bool
 
 	Id      string         `db:"id" json:"id"`
 	Created types.DateTime `db:"created" json:"created"`
@@ -70,20 +70,20 @@ func (m *BaseModel) SetId(id string) {
 	m.Id = id
 }
 
-// MarkAsNew sets the model isNewFlag enforcing [m.IsNew()] to be true.
+// MarkAsNew marks the model as "new" (aka. enforces m.IsNew() to be true).
 func (m *BaseModel) MarkAsNew() {
-	m.isNewFlag = true
+	m.isNotNew = false
 }
 
-// UnmarkAsNew resets the model isNewFlag.
-func (m *BaseModel) UnmarkAsNew() {
-	m.isNewFlag = false
+// MarkAsNotNew marks the model as "not new" (aka. enforces m.IsNew() to be false)
+func (m *BaseModel) MarkAsNotNew() {
+	m.isNotNew = true
 }
 
 // IsNew indicates what type of db query (insert or update)
 // should be used with the model instance.
 func (m *BaseModel) IsNew() bool {
-	return m.isNewFlag || !m.HasId()
+	return !m.isNotNew
 }
 
 // GetCreated returns the model Created datetime.
@@ -100,9 +100,6 @@ func (m *BaseModel) GetUpdated() types.DateTime {
 //
 // The generated id is a cryptographically random 15 characters length string.
 func (m *BaseModel) RefreshId() {
-	if m.Id == "" { // no previous id
-		m.MarkAsNew()
-	}
 	m.Id = security.RandomStringWithAlphabet(DefaultIdLength, DefaultIdAlphabet)
 }
 
@@ -115,3 +112,11 @@ func (m *BaseModel) RefreshCreated() {
 func (m *BaseModel) RefreshUpdated() {
 	m.Updated = types.NowDateTime()
 }
+
+// PostScan implements the [dbx.PostScanner] interface.
+//
+// It is executed right after the model was populated with the db row values.
+func (m *BaseModel) PostScan() error {
+	m.MarkAsNotNew()
+	return nil
+}

models/base_test.go

@@ -58,15 +58,19 @@ func TestBaseModelIsNew(t *testing.T) {
 	m1 := models.BaseModel{Id: ""}
 	m2 := models.BaseModel{Id: "test"}
 	m3 := models.BaseModel{}
-	m3.MarkAsNew()
+	m3.MarkAsNotNew()
 	m4 := models.BaseModel{Id: "test"}
-	m4.MarkAsNew()
+	m4.MarkAsNotNew()
 	m5 := models.BaseModel{Id: "test"}
 	m5.MarkAsNew()
-	m5.UnmarkAsNew()
-	// check if MarkAsNew will be called on initial RefreshId()
+	m5.MarkAsNotNew()
 	m6 := models.BaseModel{}
 	m6.RefreshId()
+	m7 := models.BaseModel{}
+	m7.MarkAsNotNew()
+	m7.RefreshId()
+	m8 := models.BaseModel{}
+	m8.PostScan()
 
 	scenarios := []struct {
 		model    models.BaseModel
@@ -74,11 +78,13 @@ func TestBaseModelIsNew(t *testing.T) {
 	}{
 		{m0, true},
 		{m1, true},
-		{m2, false},
-		{m3, true},
-		{m4, true},
+		{m2, true},
+		{m3, false},
+		{m4, false},
 		{m5, false},
 		{m6, true},
+		{m7, false},
+		{m8, false},
 	}
 
 	for i, s := range scenarios {

models/record.go

@@ -30,6 +30,8 @@ type Record struct {
 	ignoreEmailVisibility bool           // whether to ignore the emailVisibility flag for auth collections
 	data                  map[string]any // any custom data in addition to the base model fields
 	expand                map[string]any // expanded relations
+	loaded                bool
+	originalData          map[string]any // the original (aka. first loaded) model data
 }
 
 // NewRecord initializes a new empty Record model.
@@ -77,6 +79,7 @@ func NewRecordFromNullStringMap(collection *Collection, data dbx.NullStringMap)
 	record := NewRecord(collection)
 
 	record.Load(resultMap)
+	record.PostScan()
 
 	return record
 }
@@ -103,6 +106,21 @@ func (m *Record) Collection() *Collection {
 	return m.collection
 }
 
+// OriginalCopy returns a copy of the current record model populated
+// with its original (aka. the initially loaded) data state.
+func (m *Record) OriginalCopy() *Record {
+	newRecord := NewRecord(m.collection)
+	newRecord.Load(m.originalData)
+
+	if m.IsNew() {
+		newRecord.MarkAsNew()
+	} else {
+		newRecord.MarkAsNotNew()
+	}
+
+	return newRecord
+}
+
 // Expand returns a shallow copy of  the record.expand data
 // attached to the current Record model.
 func (m *Record) Expand() map[string]any {
@@ -114,6 +132,72 @@ func (m *Record) SetExpand(expand map[string]any) {
 	m.expand = shallowCopy(expand)
 }
 
+// MergeExpand merges recursively the provided expand data into
+// the current model's expand (if any).
+//
+// Note that if an expanded prop with the same key is a slice (old or new expand)
+// then both old and new records will be merged into a new slice (aka. a :merge: [b,c] => [a,b,c]).
+// Otherwise the "old" expanded record will be replace with the "new" one (aka. a :merge: aNew => aNew).
+func (m *Record) MergeExpand(expand map[string]any) {
+	for key, new := range expand {
+		old, ok := m.expand[key]
+		if !ok {
+			m.expand[key] = new
+			continue
+		}
+
+		var wasOldSlice bool
+		var oldSlice []*Record
+		switch v := old.(type) {
+		case *Record:
+			oldSlice = []*Record{v}
+		case []*Record:
+			wasOldSlice = true
+			oldSlice = v
+		default:
+			// invalid old expand data -> assign directly the new
+			// (no matter whether new is valid or not)
+			m.expand[key] = new
+			continue
+		}
+
+		var wasNewSlice bool
+		var newSlice []*Record
+		switch v := new.(type) {
+		case *Record:
+			newSlice = []*Record{v}
+		case []*Record:
+			wasNewSlice = true
+			newSlice = v
+		default:
+			// invalid new expand data -> skip
+			continue
+		}
+
+		oldIndexed := make(map[string]*Record, len(oldSlice))
+		for _, oldRecord := range oldSlice {
+			oldIndexed[oldRecord.Id] = oldRecord
+		}
+
+		for _, newRecord := range newSlice {
+			oldRecord := oldIndexed[newRecord.Id]
+			if oldRecord != nil {
+				// note: there is no need to update oldSlice since oldRecord is a reference
+				oldRecord.MergeExpand(newRecord.Expand())
+			} else {
+				// missing new entry
+				oldSlice = append(oldSlice, newRecord)
+			}
+		}
+
+		if wasOldSlice || wasNewSlice {
+			m.expand[key] = oldSlice
+		} else {
+			m.expand[key] = oldSlice[0]
+		}
+	}
+}
+
 // SchemaData returns a shallow copy ONLY of the defined record schema fields data.
 func (m *Record) SchemaData() map[string]any {
 	result := map[string]any{}
@@ -270,6 +354,11 @@ func (m *Record) FindFileFieldByFile(filename string) *schema.SchemaField {
 
 // Load bulk loads the provided data into the current Record model.
 func (m *Record) Load(data map[string]any) {
+	if !m.loaded {
+		m.loaded = true
+		m.originalData = data
+	}
+
 	for k, v := range data {
 		m.Set(k, v)
 	}
@@ -403,7 +492,7 @@ func (m *Record) getNormalizeDataValueForDB(key string) any {
 
 // shallowCopy shallow copy data into a new map.
 func shallowCopy(data map[string]any) map[string]any {
-	result := map[string]any{}
+	result := make(map[string]any, len(data))
 
 	for k, v := range data {
 		result[k] = v

models/record_test.go

@@ -331,7 +331,34 @@ func TestRecordCollection(t *testing.T) {
 	}
 }
 
-func TestRecordExpand(t *testing.T) {
+func TestRecordOriginalCopy(t *testing.T) {
+	m := models.NewRecord(&models.Collection{})
+	m.Load(map[string]any{"f": "123"})
+
+	// change the field
+	m.Set("f", "456")
+
+	if v := m.GetString("f"); v != "456" {
+		t.Fatalf("Expected f to be %q, got %q", "456", v)
+	}
+
+	if v := m.OriginalCopy().GetString("f"); v != "123" {
+		t.Fatalf("Expected the initial/original f to be %q, got %q", "123", v)
+	}
+
+	// Loading new data shouldn't affect the original state
+	m.Load(map[string]any{"f": "789"})
+
+	if v := m.GetString("f"); v != "789" {
+		t.Fatalf("Expected f to be %q, got %q", "789", v)
+	}
+
+	if v := m.OriginalCopy().GetString("f"); v != "123" {
+		t.Fatalf("Expected the initial/original f still to be %q, got %q", "123", v)
+	}
+}
+
+func TestRecordSetAndGetExpand(t *testing.T) {
 	collection := &models.Collection{}
 	m := models.NewRecord(collection)
 
@@ -348,6 +375,98 @@ func TestRecordExpand(t *testing.T) {
 	}
 }
 
+func TestRecordMergeExpandDirect(t *testing.T) {
+	collection := &models.Collection{}
+	m := models.NewRecord(collection)
+	m.Id = "m"
+
+	// a
+	a := models.NewRecord(collection)
+	a.Id = "a"
+	a1 := models.NewRecord(collection)
+	a1.Id = "a1"
+	a2 := models.NewRecord(collection)
+	a2.Id = "a2"
+	a3 := models.NewRecord(collection)
+	a3.Id = "a3"
+	a31 := models.NewRecord(collection)
+	a31.Id = "a31"
+	a32 := models.NewRecord(collection)
+	a32.Id = "a32"
+	a.SetExpand(map[string]any{
+		"a1":  a1,
+		"a23": []*models.Record{a2, a3},
+	})
+	a3.SetExpand(map[string]any{
+		"a31": a31,
+		"a32": []*models.Record{a32},
+	})
+
+	// b
+	b := models.NewRecord(collection)
+	b.Id = "b"
+	b1 := models.NewRecord(collection)
+	b1.Id = "b1"
+	b.SetExpand(map[string]any{
+		"b1": b1,
+	})
+
+	// c
+	c := models.NewRecord(collection)
+	c.Id = "c"
+
+	// load initial expand
+	m.SetExpand(map[string]any{
+		"a": a,
+		"b": b,
+		"c": []*models.Record{c},
+	})
+
+	// a (new)
+	aNew := models.NewRecord(collection)
+	aNew.Id = a.Id
+	a3New := models.NewRecord(collection)
+	a3New.Id = a3.Id
+	a32New := models.NewRecord(collection)
+	a32New.Id = "a32New"
+	a33New := models.NewRecord(collection)
+	a33New.Id = "a33New"
+	a3New.SetExpand(map[string]any{
+		"a32":    []*models.Record{a32New},
+		"a33New": a33New,
+	})
+	aNew.SetExpand(map[string]any{
+		"a23": []*models.Record{a2, a3New},
+	})
+
+	// b (new)
+	bNew := models.NewRecord(collection)
+	bNew.Id = "bNew"
+	dNew := models.NewRecord(collection)
+	dNew.Id = "dNew"
+
+	// merge expands
+	m.MergeExpand(map[string]any{
+		"a":    aNew,
+		"b":    []*models.Record{bNew},
+		"dNew": dNew,
+	})
+
+	result := m.Expand()
+
+	raw, err := json.Marshal(result)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"a":{"collectionId":"","collectionName":"","created":"","expand":{"a1":{"collectionId":"","collectionName":"","created":"","id":"a1","updated":""},"a23":[{"collectionId":"","collectionName":"","created":"","id":"a2","updated":""},{"collectionId":"","collectionName":"","created":"","expand":{"a31":{"collectionId":"","collectionName":"","created":"","id":"a31","updated":""},"a32":[{"collectionId":"","collectionName":"","created":"","id":"a32","updated":""},{"collectionId":"","collectionName":"","created":"","id":"a32New","updated":""}],"a33New":{"collectionId":"","collectionName":"","created":"","id":"a33New","updated":""}},"id":"a3","updated":""}]},"id":"a","updated":""},"b":[{"collectionId":"","collectionName":"","created":"","expand":{"b1":{"collectionId":"","collectionName":"","created":"","id":"b1","updated":""}},"id":"b","updated":""},{"collectionId":"","collectionName":"","created":"","id":"bNew","updated":""}],"c":[{"collectionId":"","collectionName":"","created":"","id":"c","updated":""}],"dNew":{"collectionId":"","collectionName":"","created":"","id":"dNew","updated":""}}`
+
+	if expected != rawStr {
+		t.Fatalf("Expected \n%v, \ngot \n%v", expected, rawStr)
+	}
+}
+
 func TestRecordSchemaData(t *testing.T) {
 	collection := &models.Collection{
 		Type: models.CollectionTypeAuth,

models/schema/schema.go

@@ -195,7 +195,14 @@ func (s *Schema) UnmarshalJSON(data []byte) error {
 		s.AddField(f)
 	}
 
-	return s.InitFieldsOptions()
+	for _, field := range s.fields {
+		if err := field.InitOptions(); err != nil {
+			// ignore the error and remove the invalid field
+			s.RemoveField(field.Id)
+		}
+	}
+
+	return nil
 }
 
 // Value implements the [driver.Valuer] interface.

models/schema/schema_field.go

@@ -78,7 +78,7 @@ const (
 	FieldTypeFile     string = "file"
 	FieldTypeRelation string = "relation"
 
-	// Deprecated: Will be removed in v0.9!
+	// Deprecated: Will be removed in v0.9+
 	FieldTypeUser string = "user"
 )
 
@@ -235,7 +235,7 @@ func (f *SchemaField) InitOptions() error {
 	case FieldTypeRelation:
 		options = &RelationOptions{}
 
-	// Deprecated: Will be removed in v0.9!
+	// Deprecated: Will be removed in v0.9+
 	case FieldTypeUser:
 		options = &UserOptions{}
 
@@ -515,13 +515,13 @@ func (o RelationOptions) Validate() error {
 
 // -------------------------------------------------------------------
 
-// Deprecated: Will be removed in v0.9!
+// Deprecated: Will be removed in v0.9+
 type UserOptions struct {
 	MaxSelect     int  `form:"maxSelect" json:"maxSelect"`
 	CascadeDelete bool `form:"cascadeDelete" json:"cascadeDelete"`
 }
 
-// Deprecated: Will be removed in v0.9!
+// Deprecated: Will be removed in v0.9+
 func (o UserOptions) Validate() error {
 	return nil
 }

models/settings/settings.go

@@ -1,4 +1,4 @@
-package core
+package settings
 
 import (
 	"encoding/json"
@@ -10,6 +10,7 @@ import (
 	validation "github.com/go-ozzo/ozzo-validation/v4"
 	"github.com/go-ozzo/ozzo-validation/v4/is"
 	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/mailer"
 	"github.com/pocketbase/pocketbase/tools/rest"
 	"github.com/pocketbase/pocketbase/tools/security"
 )
@@ -30,7 +31,7 @@ type Settings struct {
 	RecordEmailChangeToken   TokenConfig `form:"recordEmailChangeToken" json:"recordEmailChangeToken"`
 	RecordVerificationToken  TokenConfig `form:"recordVerificationToken" json:"recordVerificationToken"`
 
-	// Deprecated: Will be removed in v0.9!
+	// Deprecated: Will be removed in v0.9+
 	EmailAuth EmailAuthConfig `form:"emailAuth" json:"emailAuth"`
 
 	GoogleAuth    AuthProviderConfig `form:"googleAuth" json:"googleAuth"`
@@ -45,8 +46,8 @@ type Settings struct {
 	TwitchAuth    AuthProviderConfig `form:"twitchAuth" json:"twitchAuth"`
 }
 
-// NewSettings creates and returns a new default Settings instance.
-func NewSettings() *Settings {
+// New creates and returns a new default Settings instance.
+func New() *Settings {
 	return &Settings{
 		Meta: MetaConfig{
 			AppName:                    "Acme",
@@ -170,11 +171,11 @@ func (s *Settings) Merge(other *Settings) error {
 
 // Clone creates a new deep copy of the current settings.
 func (s *Settings) Clone() (*Settings, error) {
-	settings := &Settings{}
-	if err := settings.Merge(s); err != nil {
+	clone := &Settings{}
+	if err := clone.Merge(s); err != nil {
 		return nil, err
 	}
-	return settings, nil
+	return clone, nil
 }
 
 // RedactClone creates a new deep copy of the current settings,
@@ -262,6 +263,9 @@ type SmtpConfig struct {
 	Username string `form:"username" json:"username"`
 	Password string `form:"password" json:"password"`
 
+	// SMTP AUTH - PLAIN (default) or LOGIN
+	AuthMethod string `form:"authMethod" json:"authMethod"`
+
 	// Whether to enforce TLS encryption for the mail server connection.
 	//
 	// When set to false StartTLS command is send, leaving the server
@@ -272,8 +276,23 @@ type SmtpConfig struct {
 // Validate makes SmtpConfig validatable by implementing [validation.Validatable] interface.
 func (c SmtpConfig) Validate() error {
 	return validation.ValidateStruct(&c,
-		validation.Field(&c.Host, is.Host, validation.When(c.Enabled, validation.Required)),
-		validation.Field(&c.Port, validation.When(c.Enabled, validation.Required), validation.Min(0)),
+		validation.Field(
+			&c.Host,
+			validation.When(c.Enabled, validation.Required),
+			is.Host,
+		),
+		validation.Field(
+			&c.Port,
+			validation.When(c.Enabled, validation.Required),
+			validation.Min(0),
+		),
+		validation.Field(
+			&c.AuthMethod,
+			// don't require it for backward compatibility
+			// (fallback internally to PLAIN)
+			// validation.When(c.Enabled, validation.Required),
+			validation.In(mailer.SmtpAuthLogin, mailer.SmtpAuthPlain),
+		),
 	)
 }
 
@@ -476,7 +495,7 @@ func (c AuthProviderConfig) SetupProvider(provider auth.Provider) error {
 
 // -------------------------------------------------------------------
 
-// Deprecated: Will be removed in v0.9!
+// Deprecated: Will be removed in v0.9+
 type EmailAuthConfig struct {
 	Enabled           bool     `form:"enabled" json:"enabled"`
 	ExceptDomains     []string `form:"exceptDomains" json:"exceptDomains"`
@@ -484,7 +503,7 @@ type EmailAuthConfig struct {
 	MinPasswordLength int      `form:"minPasswordLength" json:"minPasswordLength"`
 }
 
-// Deprecated: Will be removed in v0.9!
+// Deprecated: Will be removed in v0.9+
 func (c EmailAuthConfig) Validate() error {
 	return nil
 }

models/settings/settings_templates.go

@@ -1,4 +1,4 @@
-package core
+package settings
 
 // Common settings placeholder tokens
 const (

models/settings/settings_test.go

@@ -1,4 +1,4 @@
-package core_test
+package settings_test
 
 import (
 	"encoding/json"
@@ -7,12 +7,13 @@ import (
 	"testing"
 
 	validation "github.com/go-ozzo/ozzo-validation/v4"
-	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/models/settings"
 	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/mailer"
 )
 
 func TestSettingsValidate(t *testing.T) {
-	s := core.NewSettings()
+	s := settings.New()
 
 	// set invalid settings data
 	s.Meta.AppName = ""
@@ -87,10 +88,10 @@ func TestSettingsValidate(t *testing.T) {
 }
 
 func TestSettingsMerge(t *testing.T) {
-	s1 := core.NewSettings()
+	s1 := settings.New()
 	s1.Meta.AppUrl = "old_app_url"
 
-	s2 := core.NewSettings()
+	s2 := settings.New()
 	s2.Meta.AppName = "test"
 	s2.Logs.MaxDays = 123
 	s2.Smtp.Host = "test"
@@ -144,7 +145,7 @@ func TestSettingsMerge(t *testing.T) {
 }
 
 func TestSettingsClone(t *testing.T) {
-	s1 := core.NewSettings()
+	s1 := settings.New()
 
 	s2, err := s1.Clone()
 	if err != nil {
@@ -173,7 +174,7 @@ func TestSettingsClone(t *testing.T) {
 }
 
 func TestSettingsRedactClone(t *testing.T) {
-	s1 := core.NewSettings()
+	s1 := settings.New()
 	s1.Meta.AppName = "test123" // control field
 	s1.Smtp.Password = "test123"
 	s1.Smtp.Tls = true
@@ -205,7 +206,7 @@ func TestSettingsRedactClone(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","hideControls":false,"senderName":"Support","senderAddress":"support@example.com","verificationTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Verify your {APP_NAME} email","actionUrl":"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}"},"resetPasswordTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Reset your {APP_NAME} password","actionUrl":"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}"},"confirmEmailChangeTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Confirm your {APP_NAME} new email address","actionUrl":"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}"}},"logs":{"maxDays":5},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"recordAuthToken":{"secret":"******","duration":1209600},"recordPasswordResetToken":{"secret":"******","duration":1800},"recordEmailChangeToken":{"secret":"******","duration":1800},"recordVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":false,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":0},"googleAuth":{"enabled":false,"clientSecret":"******"},"facebookAuth":{"enabled":false,"clientSecret":"******"},"githubAuth":{"enabled":false,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"clientSecret":"******"},"discordAuth":{"enabled":false,"clientSecret":"******"},"twitterAuth":{"enabled":false,"clientSecret":"******"},"microsoftAuth":{"enabled":false,"clientSecret":"******"},"spotifyAuth":{"enabled":false,"clientSecret":"******"},"kakaoAuth":{"enabled":false,"clientSecret":"******"},"twitchAuth":{"enabled":false,"clientSecret":"******"}}`
+	expected := `{"meta":{"appName":"test123","appUrl":"http://localhost:8090","hideControls":false,"senderName":"Support","senderAddress":"support@example.com","verificationTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Verify your {APP_NAME} email","actionUrl":"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}"},"resetPasswordTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Reset your {APP_NAME} password","actionUrl":"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}"},"confirmEmailChangeTemplate":{"body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{ACTION_URL}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn't ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e","subject":"Confirm your {APP_NAME} new email address","actionUrl":"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}"}},"logs":{"maxDays":5},"smtp":{"enabled":false,"host":"smtp.example.com","port":587,"username":"","password":"******","authMethod":"","tls":true},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","secret":"******","forcePathStyle":false},"adminAuthToken":{"secret":"******","duration":1209600},"adminPasswordResetToken":{"secret":"******","duration":1800},"recordAuthToken":{"secret":"******","duration":1209600},"recordPasswordResetToken":{"secret":"******","duration":1800},"recordEmailChangeToken":{"secret":"******","duration":1800},"recordVerificationToken":{"secret":"******","duration":604800},"emailAuth":{"enabled":false,"exceptDomains":null,"onlyDomains":null,"minPasswordLength":0},"googleAuth":{"enabled":false,"clientSecret":"******"},"facebookAuth":{"enabled":false,"clientSecret":"******"},"githubAuth":{"enabled":false,"clientSecret":"******"},"gitlabAuth":{"enabled":false,"clientSecret":"******"},"discordAuth":{"enabled":false,"clientSecret":"******"},"twitterAuth":{"enabled":false,"clientSecret":"******"},"microsoftAuth":{"enabled":false,"clientSecret":"******"},"spotifyAuth":{"enabled":false,"clientSecret":"******"},"kakaoAuth":{"enabled":false,"clientSecret":"******"},"twitchAuth":{"enabled":false,"clientSecret":"******"}}`
 
 	if encodedStr := string(encoded); encodedStr != expected {
 		t.Fatalf("Expected\n%v\ngot\n%v", expected, encodedStr)
@@ -213,7 +214,7 @@ func TestSettingsRedactClone(t *testing.T) {
 }
 
 func TestNamedAuthProviderConfigs(t *testing.T) {
-	s := core.NewSettings()
+	s := settings.New()
 
 	s.GoogleAuth.ClientId = "google_test"
 	s.FacebookAuth.ClientId = "facebook_test"
@@ -256,17 +257,17 @@ func TestNamedAuthProviderConfigs(t *testing.T) {
 
 func TestTokenConfigValidate(t *testing.T) {
 	scenarios := []struct {
-		config      core.TokenConfig
+		config      settings.TokenConfig
 		expectError bool
 	}{
 		// zero values
 		{
-			core.TokenConfig{},
+			settings.TokenConfig{},
 			true,
 		},
 		// invalid data
 		{
-			core.TokenConfig{
+			settings.TokenConfig{
 				Secret:   strings.Repeat("a", 5),
 				Duration: 4,
 			},
@@ -274,7 +275,7 @@ func TestTokenConfigValidate(t *testing.T) {
 		},
 		// valid secret but invalid duration
 		{
-			core.TokenConfig{
+			settings.TokenConfig{
 				Secret:   strings.Repeat("a", 30),
 				Duration: 63072000 + 1,
 			},
@@ -282,7 +283,7 @@ func TestTokenConfigValidate(t *testing.T) {
 		},
 		// valid data
 		{
-			core.TokenConfig{
+			settings.TokenConfig{
 				Secret:   strings.Repeat("a", 30),
 				Duration: 100,
 			},
@@ -305,31 +306,41 @@ func TestTokenConfigValidate(t *testing.T) {
 
 func TestSmtpConfigValidate(t *testing.T) {
 	scenarios := []struct {
-		config      core.SmtpConfig
+		config      settings.SmtpConfig
 		expectError bool
 	}{
 		// zero values (disabled)
 		{
-			core.SmtpConfig{},
+			settings.SmtpConfig{},
 			false,
 		},
 		// zero values (enabled)
 		{
-			core.SmtpConfig{Enabled: true},
+			settings.SmtpConfig{Enabled: true},
 			true,
 		},
 		// invalid data
 		{
-			core.SmtpConfig{
+			settings.SmtpConfig{
 				Enabled: true,
 				Host:    "test:test:test",
 				Port:    -10,
 			},
 			true,
 		},
-		// valid data
+		// invalid auth method
 		{
-			core.SmtpConfig{
+			settings.SmtpConfig{
+				Enabled:    true,
+				Host:       "example.com",
+				Port:       100,
+				AuthMethod: "example",
+			},
+			true,
+		},
+		// valid data (no explicit auth method)
+		{
+			settings.SmtpConfig{
 				Enabled: true,
 				Host:    "example.com",
 				Port:    100,
@@ -337,6 +348,16 @@ func TestSmtpConfigValidate(t *testing.T) {
 			},
 			false,
 		},
+		// valid data (explicit auth method - login)
+		{
+			settings.SmtpConfig{
+				Enabled:    true,
+				Host:       "example.com",
+				Port:       100,
+				AuthMethod: mailer.SmtpAuthLogin,
+			},
+			false,
+		},
 	}
 
 	for i, scenario := range scenarios {
@@ -354,22 +375,22 @@ func TestSmtpConfigValidate(t *testing.T) {
 
 func TestS3ConfigValidate(t *testing.T) {
 	scenarios := []struct {
-		config      core.S3Config
+		config      settings.S3Config
 		expectError bool
 	}{
 		// zero values (disabled)
 		{
-			core.S3Config{},
+			settings.S3Config{},
 			false,
 		},
 		// zero values (enabled)
 		{
-			core.S3Config{Enabled: true},
+			settings.S3Config{Enabled: true},
 			true,
 		},
 		// invalid data
 		{
-			core.S3Config{
+			settings.S3Config{
 				Enabled:  true,
 				Endpoint: "test:test:test",
 			},
@@ -377,7 +398,7 @@ func TestS3ConfigValidate(t *testing.T) {
 		},
 		// valid data (url endpoint)
 		{
-			core.S3Config{
+			settings.S3Config{
 				Enabled:   true,
 				Endpoint:  "https://localhost:8090",
 				Bucket:    "test",
@@ -389,7 +410,7 @@ func TestS3ConfigValidate(t *testing.T) {
 		},
 		// valid data (hostname endpoint)
 		{
-			core.S3Config{
+			settings.S3Config{
 				Enabled:   true,
 				Endpoint:  "example.com",
 				Bucket:    "test",
@@ -415,36 +436,36 @@ func TestS3ConfigValidate(t *testing.T) {
 }
 
 func TestMetaConfigValidate(t *testing.T) {
-	invalidTemplate := core.EmailTemplate{
+	invalidTemplate := settings.EmailTemplate{
 		Subject:   "test",
 		ActionUrl: "test",
 		Body:      "test",
 	}
 
-	noPlaceholdersTemplate := core.EmailTemplate{
+	noPlaceholdersTemplate := settings.EmailTemplate{
 		Subject:   "test",
 		ActionUrl: "http://example.com",
 		Body:      "test",
 	}
 
-	withPlaceholdersTemplate := core.EmailTemplate{
+	withPlaceholdersTemplate := settings.EmailTemplate{
 		Subject:   "test",
-		ActionUrl: "http://example.com" + core.EmailPlaceholderToken,
-		Body:      "test" + core.EmailPlaceholderActionUrl,
+		ActionUrl: "http://example.com" + settings.EmailPlaceholderToken,
+		Body:      "test" + settings.EmailPlaceholderActionUrl,
 	}
 
 	scenarios := []struct {
-		config      core.MetaConfig
+		config      settings.MetaConfig
 		expectError bool
 	}{
 		// zero values
 		{
-			core.MetaConfig{},
+			settings.MetaConfig{},
 			true,
 		},
 		// invalid data
 		{
-			core.MetaConfig{
+			settings.MetaConfig{
 				AppName:                    strings.Repeat("a", 300),
 				AppUrl:                     "test",
 				SenderName:                 strings.Repeat("a", 300),
@@ -457,7 +478,7 @@ func TestMetaConfigValidate(t *testing.T) {
 		},
 		// invalid data (missing required placeholders)
 		{
-			core.MetaConfig{
+			settings.MetaConfig{
 				AppName:                    "test",
 				AppUrl:                     "https://example.com",
 				SenderName:                 "test",
@@ -470,7 +491,7 @@ func TestMetaConfigValidate(t *testing.T) {
 		},
 		// valid data
 		{
-			core.MetaConfig{
+			settings.MetaConfig{
 				AppName:                    "test",
 				AppUrl:                     "https://example.com",
 				SenderName:                 "test",
@@ -498,17 +519,17 @@ func TestMetaConfigValidate(t *testing.T) {
 
 func TestEmailTemplateValidate(t *testing.T) {
 	scenarios := []struct {
-		emailTemplate  core.EmailTemplate
+		emailTemplate  settings.EmailTemplate
 		expectedErrors []string
 	}{
 		// require values
 		{
-			core.EmailTemplate{},
+			settings.EmailTemplate{},
 			[]string{"subject", "actionUrl", "body"},
 		},
 		// missing placeholders
 		{
-			core.EmailTemplate{
+			settings.EmailTemplate{
 				Subject:   "test",
 				ActionUrl: "test",
 				Body:      "test",
@@ -517,10 +538,10 @@ func TestEmailTemplateValidate(t *testing.T) {
 		},
 		// valid data
 		{
-			core.EmailTemplate{
+			settings.EmailTemplate{
 				Subject:   "test",
-				ActionUrl: "test" + core.EmailPlaceholderToken,
-				Body:      "test" + core.EmailPlaceholderActionUrl,
+				ActionUrl: "test" + settings.EmailPlaceholderToken,
+				Body:      "test" + settings.EmailPlaceholderActionUrl,
 			},
 			[]string{},
 		},
@@ -549,17 +570,17 @@ func TestEmailTemplateValidate(t *testing.T) {
 }
 
 func TestEmailTemplateResolve(t *testing.T) {
-	allPlaceholders := core.EmailPlaceholderActionUrl + core.EmailPlaceholderToken + core.EmailPlaceholderAppName + core.EmailPlaceholderAppUrl
+	allPlaceholders := settings.EmailPlaceholderActionUrl + settings.EmailPlaceholderToken + settings.EmailPlaceholderAppName + settings.EmailPlaceholderAppUrl
 
 	scenarios := []struct {
-		emailTemplate     core.EmailTemplate
+		emailTemplate     settings.EmailTemplate
 		expectedSubject   string
 		expectedBody      string
 		expectedActionUrl string
 	}{
 		// no placeholders
 		{
-			emailTemplate: core.EmailTemplate{
+			emailTemplate: settings.EmailTemplate{
 				Subject:   "subject:",
 				Body:      "body:",
 				ActionUrl: "/actionUrl////",
@@ -570,7 +591,7 @@ func TestEmailTemplateResolve(t *testing.T) {
 		},
 		// with placeholders
 		{
-			emailTemplate: core.EmailTemplate{
+			emailTemplate: settings.EmailTemplate{
 				ActionUrl: "/actionUrl////" + allPlaceholders,
 				Subject:   "subject:" + allPlaceholders,
 				Body:      "body:" + allPlaceholders,
@@ -583,8 +604,8 @@ func TestEmailTemplateResolve(t *testing.T) {
 			),
 			expectedSubject: fmt.Sprintf(
 				"subject:%s%s%s%s",
-				core.EmailPlaceholderActionUrl,
-				core.EmailPlaceholderToken,
+				settings.EmailPlaceholderActionUrl,
+				settings.EmailPlaceholderToken,
 				"name_test",
 				"url_test",
 			),
@@ -622,22 +643,22 @@ func TestEmailTemplateResolve(t *testing.T) {
 
 func TestLogsConfigValidate(t *testing.T) {
 	scenarios := []struct {
-		config      core.LogsConfig
+		config      settings.LogsConfig
 		expectError bool
 	}{
 		// zero values
 		{
-			core.LogsConfig{},
+			settings.LogsConfig{},
 			false,
 		},
 		// invalid data
 		{
-			core.LogsConfig{MaxDays: -10},
+			settings.LogsConfig{MaxDays: -10},
 			true,
 		},
 		// valid data
 		{
-			core.LogsConfig{MaxDays: 1},
+			settings.LogsConfig{MaxDays: 1},
 			false,
 		},
 	}
@@ -657,22 +678,22 @@ func TestLogsConfigValidate(t *testing.T) {
 
 func TestAuthProviderConfigValidate(t *testing.T) {
 	scenarios := []struct {
-		config      core.AuthProviderConfig
+		config      settings.AuthProviderConfig
 		expectError bool
 	}{
 		// zero values (disabled)
 		{
-			core.AuthProviderConfig{},
+			settings.AuthProviderConfig{},
 			false,
 		},
 		// zero values (enabled)
 		{
-			core.AuthProviderConfig{Enabled: true},
+			settings.AuthProviderConfig{Enabled: true},
 			true,
 		},
 		// invalid data
 		{
-			core.AuthProviderConfig{
+			settings.AuthProviderConfig{
 				Enabled:      true,
 				ClientId:     "",
 				ClientSecret: "",
@@ -684,7 +705,7 @@ func TestAuthProviderConfigValidate(t *testing.T) {
 		},
 		// valid data (only the required)
 		{
-			core.AuthProviderConfig{
+			settings.AuthProviderConfig{
 				Enabled:      true,
 				ClientId:     "test",
 				ClientSecret: "test",
@@ -693,7 +714,7 @@ func TestAuthProviderConfigValidate(t *testing.T) {
 		},
 		// valid data (fill all fields)
 		{
-			core.AuthProviderConfig{
+			settings.AuthProviderConfig{
 				Enabled:      true,
 				ClientId:     "test",
 				ClientSecret: "test",
@@ -722,12 +743,12 @@ func TestAuthProviderConfigSetupProvider(t *testing.T) {
 	provider := auth.NewGithubProvider()
 
 	// disabled config
-	c1 := core.AuthProviderConfig{Enabled: false}
+	c1 := settings.AuthProviderConfig{Enabled: false}
 	if err := c1.SetupProvider(provider); err == nil {
 		t.Errorf("Expected error, got nil")
 	}
 
-	c2 := core.AuthProviderConfig{
+	c2 := settings.AuthProviderConfig{
 		Enabled:      true,
 		ClientId:     "test_ClientId",
 		ClientSecret: "test_ClientSecret",

plugins/jsvm/migrations.go

@@ -0,0 +1,111 @@
+package jsvm
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/dop251/goja_nodejs/console"
+	"github.com/dop251/goja_nodejs/require"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+// MigrationsOptions defines optional struct to customize the default migrations loader behavior.
+type MigrationsOptions struct {
+	// Dir specifies the directory with the JS migrations.
+	//
+	// If not set it fallbacks to a relative "pb_data/../pb_migrations" directory.
+	Dir string
+}
+
+// migrations is the migrations loader plugin definition.
+// Usually it is instantiated via RegisterMigrations or MustRegisterMigrations.
+type migrations struct {
+	app     core.App
+	options *MigrationsOptions
+}
+
+//
+// MustRegisterMigrations registers the migrations loader plugin to
+// the provided app instance and panics if it fails.
+//
+// Internally it calls RegisterMigrations(app, options).
+//
+// If options is nil, by default the js files from pb_data/migrations are loaded.
+// Set custom options.Dir if you want to change it to some other directory.
+func MustRegisterMigrations(app core.App, options *MigrationsOptions) {
+	if err := RegisterMigrations(app, options); err != nil {
+		panic(err)
+	}
+}
+
+// RegisterMigrations registers the plugin to the provided app instance.
+//
+// If options is nil, by default the js files from pb_data/migrations are loaded.
+// Set custom options.Dir if you want to change it to some other directory.
+func RegisterMigrations(app core.App, options *MigrationsOptions) error {
+	l := &migrations{app: app}
+
+	if options != nil {
+		l.options = options
+	} else {
+		l.options = &MigrationsOptions{}
+	}
+
+	if l.options.Dir == "" {
+		l.options.Dir = filepath.Join(app.DataDir(), "../pb_migrations")
+	}
+
+	files, err := readDirFiles(l.options.Dir)
+	if err != nil {
+		return err
+	}
+
+	registry := new(require.Registry) // this can be shared by multiple runtimes
+
+	for file, content := range files {
+		vm := NewBaseVM()
+		registry.Enable(vm)
+		console.Enable(vm)
+
+		vm.Set("migrate", func(up, down func(db dbx.Builder) error) {
+			m.AppMigrations.Register(up, down, file)
+		})
+
+		_, err := vm.RunString(string(content))
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// readDirFiles returns a map with all directory files and their content.
+//
+// If directory with dirPath is missing, it returns an empty map and no error.
+func readDirFiles(dirPath string) (map[string][]byte, error) {
+	files, err := os.ReadDir(dirPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return map[string][]byte{}, nil
+		}
+		return nil, err
+	}
+
+	result := map[string][]byte{}
+
+	for _, f := range files {
+		if f.IsDir() {
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(dirPath, f.Name()))
+		if err != nil {
+			return nil, err
+		}
+		result[f.Name()] = raw
+	}
+
+	return result, nil
+}

plugins/jsvm/vm.go

@@ -0,0 +1,206 @@
+// Package jsvm implements optional utilities for binding a JS goja runtime
+// to the PocketBase instance (loading migrations, attaching to app hooks, etc.).
+//
+// Currently it provides the following plugins:
+//
+// 1. JS Migrations loader:
+//
+// 	jsvm.MustRegisterMigrations(app, &jsvm.MigrationsOptions{
+// 		Dir: "custom_js_migrations_dir_path", // default to "pb_data/../pb_migrations"
+// 	})
+package jsvm
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"unicode"
+
+	"github.com/dop251/goja"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+)
+
+func NewBaseVM() *goja.Runtime {
+	vm := goja.New()
+	vm.SetFieldNameMapper(FieldMapper{})
+
+	baseBinds(vm)
+	dbxBinds(vm)
+
+	return vm
+}
+
+func baseBinds(vm *goja.Runtime) {
+	vm.Set("unmarshal", func(src map[string]any, dest any) (any, error) {
+		raw, err := json.Marshal(src)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := json.Unmarshal(raw, &dest); err != nil {
+			return nil, err
+		}
+
+		return dest, nil
+	})
+
+	vm.Set("Record", func(call goja.ConstructorCall) *goja.Object {
+		var instance *models.Record
+
+		collection, ok := call.Argument(0).Export().(*models.Collection)
+		if ok {
+			instance = models.NewRecord(collection)
+			data, ok := call.Argument(1).Export().(map[string]any)
+			if ok {
+				if raw, err := json.Marshal(data); err == nil {
+					json.Unmarshal(raw, instance)
+				}
+			}
+		} else {
+			instance = &models.Record{}
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	vm.Set("Collection", func(call goja.ConstructorCall) *goja.Object {
+		instance := &models.Collection{}
+		return defaultConstructor(vm, call, instance)
+	})
+
+	vm.Set("Admin", func(call goja.ConstructorCall) *goja.Object {
+		instance := &models.Admin{}
+		return defaultConstructor(vm, call, instance)
+	})
+
+	vm.Set("Schema", func(call goja.ConstructorCall) *goja.Object {
+		instance := &schema.Schema{}
+		return defaultConstructor(vm, call, instance)
+	})
+
+	vm.Set("SchemaField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &schema.SchemaField{}
+		return defaultConstructor(vm, call, instance)
+	})
+
+	vm.Set("Dao", func(call goja.ConstructorCall) *goja.Object {
+		db, ok := call.Argument(0).Export().(dbx.Builder)
+		if !ok || db == nil {
+			panic("missing required Dao(db) argument")
+		}
+
+		instance := daos.New(db)
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+}
+
+func defaultConstructor(vm *goja.Runtime, call goja.ConstructorCall, instance any) *goja.Object {
+	if data := call.Argument(0).Export(); data != nil {
+		if raw, err := json.Marshal(data); err == nil {
+			json.Unmarshal(raw, instance)
+		}
+	}
+
+	instanceValue := vm.ToValue(instance).(*goja.Object)
+	instanceValue.SetPrototype(call.This.Prototype())
+
+	return instanceValue
+}
+
+func dbxBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$dbx", obj)
+
+	obj.Set("exp", dbx.NewExp)
+	obj.Set("hashExp", func(data map[string]any) dbx.HashExp {
+		exp := dbx.HashExp{}
+		for k, v := range data {
+			exp[k] = v
+		}
+		return exp
+	})
+	obj.Set("not", dbx.Not)
+	obj.Set("and", dbx.And)
+	obj.Set("or", dbx.Or)
+	obj.Set("in", dbx.In)
+	obj.Set("notIn", dbx.NotIn)
+	obj.Set("like", dbx.Like)
+	obj.Set("orLike", dbx.OrLike)
+	obj.Set("notLike", dbx.NotLike)
+	obj.Set("orNotLike", dbx.OrNotLike)
+	obj.Set("exists", dbx.Exists)
+	obj.Set("notExists", dbx.NotExists)
+	obj.Set("between", dbx.Between)
+	obj.Set("notBetween", dbx.NotBetween)
+}
+
+func apisBind(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$apis", obj)
+
+	// middlewares
+	obj.Set("requireRecordAuth", apis.RequireRecordAuth)
+	obj.Set("requireRecordAuth", apis.RequireRecordAuth)
+	obj.Set("requireSameContextRecordAuth", apis.RequireSameContextRecordAuth)
+	obj.Set("requireAdminAuth", apis.RequireAdminAuth)
+	obj.Set("requireAdminAuthOnlyIfAny", apis.RequireAdminAuthOnlyIfAny)
+	obj.Set("requireAdminOrRecordAuth", apis.RequireAdminOrRecordAuth)
+	obj.Set("requireAdminOrOwnerAuth", apis.RequireAdminOrOwnerAuth)
+	obj.Set("activityLogger", apis.ActivityLogger)
+
+	// api errors
+	obj.Set("notFoundError", apis.NewNotFoundError)
+	obj.Set("badRequestError", apis.NewBadRequestError)
+	obj.Set("forbiddenError", apis.NewForbiddenError)
+	obj.Set("unauthorizedError", apis.NewUnauthorizedError)
+
+	// record helpers
+	obj.Set("requestData", apis.RequestData)
+	obj.Set("enrichRecord", apis.EnrichRecord)
+	obj.Set("enrichRecords", apis.EnrichRecords)
+}
+
+// FieldMapper provides custom mapping between Go and JavaScript property names.
+//
+// It is similar to the builtin "uncapFieldNameMapper" but also converts
+// all uppercase identifiers to their lowercase equivalent (eg. "GET" -> "get").
+type FieldMapper struct {
+}
+
+// FieldName implements the [FieldNameMapper.FieldName] interface method.
+func (u FieldMapper) FieldName(_ reflect.Type, f reflect.StructField) string {
+	return convertGoToJSName(f.Name)
+}
+
+// MethodName implements the [FieldNameMapper.MethodName] interface method.
+func (u FieldMapper) MethodName(_ reflect.Type, m reflect.Method) string {
+	return convertGoToJSName(m.Name)
+}
+
+func convertGoToJSName(name string) string {
+	allUppercase := true
+	for _, c := range name {
+		if c != '_' && !unicode.IsUpper(c) {
+			allUppercase = false
+			break
+		}
+	}
+
+	// eg. "JSON" -> "json"
+	if allUppercase {
+		return strings.ToLower(name)
+	}
+
+	// eg. "GetField" -> "getField"
+	return strings.ToLower(name[0:1]) + name[1:]
+}

plugins/jsvm/vm_test.go

@@ -0,0 +1,268 @@
+package jsvm_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestBaseVMUnmarshal(t *testing.T) {
+	vm := jsvm.NewBaseVM()
+
+	v, err := vm.RunString(`unmarshal({ name: "test" }, new Collection())`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*models.Collection)
+	if !ok {
+		t.Fatalf("Expected models.Collection, got %v", m)
+	}
+
+	if m.Name != "test" {
+		t.Fatalf("Expected collection with name %q, got %q", "test", m.Name)
+	}
+}
+
+func TestBaseVMRecordBind(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.Dao().FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	vm := jsvm.NewBaseVM()
+	vm.Set("collection", collection)
+
+	// without record data
+	// ---
+	v1, err := vm.RunString(`new Record(collection)`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m1, ok := v1.Export().(*models.Record)
+	if !ok {
+		t.Fatalf("Expected m1 to be models.Record, got \n%v", m1)
+	}
+
+	// with record data
+	// ---
+	v2, err := vm.RunString(`new Record(collection, { email: "test@example.com" })`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m2, ok := v2.Export().(*models.Record)
+	if !ok {
+		t.Fatalf("Expected m2 to be models.Record, got \n%v", m2)
+	}
+
+	if m2.Collection().Name != "users" {
+		t.Fatalf("Expected record with collection %q, got \n%v", "users", m2.Collection())
+	}
+
+	if m2.Email() != "test@example.com" {
+		t.Fatalf("Expected record with email field set to %q, got \n%v", "test@example.com", m2)
+	}
+}
+
+// @todo enable after https://github.com/dop251/goja/issues/426
+// func TestBaseVMRecordGetAndSetBind(t *testing.T) {
+// 	app, _ := tests.NewTestApp()
+// 	defer app.Cleanup()
+
+// 	collection, err := app.Dao().FindCollectionByNameOrId("users")
+// 	if err != nil {
+// 		t.Fatal(err)
+// 	}
+
+// 	vm := jsvm.NewBaseVM()
+// 	vm.Set("collection", collection)
+// 	vm.Set("getRecord", func() *models.Record {
+// 		return models.NewRecord(collection)
+// 	})
+
+// 	_, runErr := vm.RunString(`
+// 		const jsRecord = new Record(collection);
+// 		jsRecord.email = "test@example.com"; // test js record setter
+// 		const email    = jsRecord.email; // test js record getter
+
+// 		const goRecord = getRecord()
+// 		goRecord.name  = "test" // test go record setter
+// 		const name     = goRecord.name; // test go record getter
+// 	`)
+// 	if runErr != nil {
+// 		t.Fatal(runErr)
+// 	}
+
+// 	expectedEmail := "test@example.com"
+// 	expectedName := "test"
+
+// 	jsRecord, ok := vm.Get("jsRecord").Export().(*models.Record)
+// 	if !ok {
+// 		t.Fatalf("Failed to export jsRecord")
+// 	}
+// 	if v := jsRecord.Email(); v != expectedEmail {
+// 		t.Fatalf("Expected the js created record to have email %q, got %q", expectedEmail, v)
+// 	}
+
+// 	email := vm.Get("email").Export().(string)
+// 	if email != expectedEmail {
+// 		t.Fatalf("Expected exported email %q, got %q", expectedEmail, email)
+// 	}
+
+// 	goRecord, ok := vm.Get("goRecord").Export().(*models.Record)
+// 	if !ok {
+// 		t.Fatalf("Failed to export goRecord")
+// 	}
+// 	if v := goRecord.GetString("name"); v != expectedName {
+// 		t.Fatalf("Expected the go created record to have name %q, got %q", expectedName, v)
+// 	}
+
+// 	name := vm.Get("name").Export().(string)
+// 	if name != expectedName {
+// 		t.Fatalf("Expected exported name %q, got %q", expectedName, name)
+// 	}
+
+// 	// ensure that the two record instances are not mixed
+// 	if v := goRecord.Email(); v != "" {
+// 		t.Fatalf("Expected the go created record to not have an email, got %q", v)
+// 	}
+// 	if v := jsRecord.GetString("name"); v != "" {
+// 		t.Fatalf("Expected the js created record to not have a name, got %q", v)
+// 	}
+// }
+
+func TestBaseVMCollectionBind(t *testing.T) {
+	vm := jsvm.NewBaseVM()
+
+	v, err := vm.RunString(`new Collection({ name: "test", schema: [{name: "title", "type": "text"}] })`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*models.Collection)
+	if !ok {
+		t.Fatalf("Expected models.Collection, got %v", m)
+	}
+
+	if m.Name != "test" {
+		t.Fatalf("Expected collection with name %q, got %q", "test", m.Name)
+	}
+
+	if f := m.Schema.GetFieldByName("title"); f == nil {
+		t.Fatalf("Expected schema to be set, got %v", m.Schema)
+	}
+}
+
+func TestBaseVMAdminBind(t *testing.T) {
+	vm := jsvm.NewBaseVM()
+
+	v, err := vm.RunString(`new Admin({ email: "test@example.com" })`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*models.Admin)
+	if !ok {
+		t.Fatalf("Expected models.Admin, got %v", m)
+	}
+}
+
+func TestBaseVMSchemaBind(t *testing.T) {
+	vm := jsvm.NewBaseVM()
+
+	v, err := vm.RunString(`new Schema([{name: "title", "type": "text"}])`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*schema.Schema)
+	if !ok {
+		t.Fatalf("Expected schema.Schema, got %v", m)
+	}
+
+	if f := m.GetFieldByName("title"); f == nil {
+		t.Fatalf("Expected schema fields to be loaded, got %v", m.Fields())
+	}
+}
+
+func TestBaseVMSchemaFieldBind(t *testing.T) {
+	vm := jsvm.NewBaseVM()
+
+	v, err := vm.RunString(`new SchemaField({name: "title", "type": "text"})`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f, ok := v.Export().(*schema.SchemaField)
+	if !ok {
+		t.Fatalf("Expected schema.SchemaField, got %v", f)
+	}
+
+	if f.Name != "title" {
+		t.Fatalf("Expected field %q, got %v", "title", f)
+	}
+}
+
+func TestBaseVMDaoBind(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := jsvm.NewBaseVM()
+	vm.Set("db", app.DB())
+
+	v, err := vm.RunString(`new Dao(db)`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	d, ok := v.Export().(*daos.Dao)
+	if !ok {
+		t.Fatalf("Expected daos.Dao, got %v", d)
+	}
+
+	if d.DB() != app.DB() {
+		t.Fatalf("The db instances doesn't match")
+	}
+}
+
+func TestFieldMapper(t *testing.T) {
+	mapper := jsvm.FieldMapper{}
+
+	scenarios := []struct {
+		name     string
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{"Test", "test"},
+		{"miXeD", "miXeD"},
+		{"MiXeD", "miXeD"},
+		{"ResolveRequestAsJSON", "resolveRequestAsJSON"},
+		{"Variable_with_underscore", "variable_with_underscore"},
+		{"ALLCAPS", "allcaps"},
+		{"NOTALLCAPs", "nOTALLCAPs"},
+		{"ALL_CAPS_WITH_UNDERSCORE", "all_caps_with_underscore"},
+	}
+
+	for i, s := range scenarios {
+		field := reflect.StructField{Name: s.name}
+		if v := mapper.FieldName(nil, field); v != s.expected {
+			t.Fatalf("[%d] Expected FieldName %q, got %q", i, s.expected, v)
+		}
+
+		method := reflect.Method{Name: s.name}
+		if v := mapper.MethodName(nil, method); v != s.expected {
+			t.Fatalf("[%d] Expected MethodName %q, got %q", i, s.expected, v)
+		}
+	}
+}

plugins/migratecmd/automigrate.go

@@ -0,0 +1,154 @@
+package migratecmd
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/migrate"
+)
+
+const collectionsCacheKey = "migratecmd_collections"
+
+// onCollectionChange handles the automigration snapshot generation on
+// collection change event (create/update/delete).
+func (p *plugin) afterCollectionChange() func(*core.ModelEvent) error {
+	return func(e *core.ModelEvent) error {
+		if e.Model.TableName() != "_collections" {
+			return nil // not a collection
+		}
+
+		// @todo replace with the OldModel when added to the ModelEvent
+		oldCollections, err := p.getCachedCollections()
+		if err != nil {
+			return err
+		}
+
+		old := oldCollections[e.Model.GetId()]
+
+		new, err := p.app.Dao().FindCollectionByNameOrId(e.Model.GetId())
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return err
+		}
+
+		var template string
+		var templateErr error
+		if p.options.TemplateLang == TemplateLangJS {
+			template, templateErr = p.jsDiffTemplate(new, old)
+		} else {
+			template, templateErr = p.goDiffTemplate(new, old)
+		}
+		if templateErr != nil {
+			if errors.Is(templateErr, emptyTemplateErr) {
+				return nil // no changes
+			}
+			return fmt.Errorf("failed to resolve template: %w", templateErr)
+		}
+
+		var action string
+		switch {
+		case new == nil:
+			action = "deleted_" + old.Name
+		case old == nil:
+			action = "created_" + new.Name
+		default:
+			action = "updated_" + old.Name
+		}
+
+		appliedTime := time.Now().Unix()
+		name := fmt.Sprintf("%d_%s.%s", appliedTime, action, p.options.TemplateLang)
+		filePath := filepath.Join(p.options.Dir, name)
+
+		return p.app.Dao().RunInTransaction(func(txDao *daos.Dao) error {
+			// insert the migration entry
+			_, err := txDao.DB().Insert(migrate.DefaultMigrationsTable, dbx.Params{
+				"file":    name,
+				"applied": appliedTime,
+			}).Execute()
+			if err != nil {
+				return err
+			}
+
+			// ensure that the local migrations dir exist
+			if err := os.MkdirAll(p.options.Dir, os.ModePerm); err != nil {
+				return fmt.Errorf("failed to create migration dir: %w", err)
+			}
+
+			if err := os.WriteFile(filePath, []byte(template), 0644); err != nil {
+				return fmt.Errorf("failed to save automigrate file: %w", err)
+			}
+
+			p.updateSingleCachedCollection(new, old)
+
+			return nil
+		})
+	}
+}
+
+func (p *plugin) updateSingleCachedCollection(new, old *models.Collection) {
+	cached, _ := p.app.Cache().Get(collectionsCacheKey).(map[string]*models.Collection)
+
+	switch {
+	case new == nil:
+		delete(cached, old.Id)
+	default:
+		cached[new.Id] = new
+	}
+
+	p.app.Cache().Set(collectionsCacheKey, cached)
+}
+
+func (p *plugin) refreshCachedCollections() error {
+	if p.app.Dao() == nil {
+		return errors.New("app is not initialized yet")
+	}
+
+	var collections []*models.Collection
+	if err := p.app.Dao().CollectionQuery().All(&collections); err != nil {
+		return err
+	}
+
+	cached := map[string]*models.Collection{}
+	for _, c := range collections {
+		cached[c.Id] = c
+	}
+
+	p.app.Cache().Set(collectionsCacheKey, cached)
+
+	return nil
+}
+
+func (p *plugin) getCachedCollections() (map[string]*models.Collection, error) {
+	if !p.app.Cache().Has(collectionsCacheKey) {
+		if err := p.refreshCachedCollections(); err != nil {
+			return nil, err
+		}
+	}
+
+	result, _ := p.app.Cache().Get(collectionsCacheKey).(map[string]*models.Collection)
+
+	return result, nil
+}
+
+func (p *plugin) hasCustomMigrations() bool {
+	files, err := os.ReadDir(p.options.Dir)
+	if err != nil {
+		return false
+	}
+
+	for _, f := range files {
+		if f.IsDir() {
+			continue
+		}
+		return true
+	}
+
+	return false
+}

plugins/migratecmd/migratecmd.go

@@ -0,0 +1,240 @@
+// Package migratecmd adds a new "migrate" command support to a PocketBase instance.
+//
+// It also comes with automigrations support and templates generation
+// (both for JS and GO migration files).
+//
+// Example usage:
+//
+// 	migratecmd.MustRegister(app, app.RootCmd, &migratecmd.Options{
+// 		TemplateLang: migratecmd.TemplateLangJS, // default to migratecmd.TemplateLangGo
+// 		Automigrate:  true,
+// 		Dir:          "migrations_dir_path", // optional template migrations path; default to "pb_migrations" (for JS) and "migrations" (for Go)
+// 	})
+//
+// 	Note: To allow running JS migrations you'll need to enable first
+// 	[jsvm.MustRegisterMigrations].
+package migratecmd
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/migrate"
+	"github.com/spf13/cobra"
+)
+
+// Options defines optional struct to customize the default plugin behavior.
+type Options struct {
+	// Dir specifies the directory with the user defined migrations.
+	//
+	// If not set it fallbacks to a relative "pb_data/../pb_migrations" (for js)
+	// or "pb_data/../migrations" (for go) directory.
+	Dir string
+
+	// Automigrate specifies whether to enable automigrations.
+	Automigrate bool
+
+	// TemplateLang specifies the template language to use when
+	// generating migrations - js or go (default).
+	TemplateLang string
+}
+
+type plugin struct {
+	app     core.App
+	options *Options
+}
+
+func MustRegister(app core.App, rootCmd *cobra.Command, options *Options) {
+	if err := Register(app, rootCmd, options); err != nil {
+		panic(err)
+	}
+}
+
+func Register(app core.App, rootCmd *cobra.Command, options *Options) error {
+	p := &plugin{app: app}
+
+	if options != nil {
+		p.options = options
+	} else {
+		p.options = &Options{}
+	}
+
+	if p.options.TemplateLang == "" {
+		p.options.TemplateLang = TemplateLangGo
+	}
+
+	if p.options.Dir == "" {
+		if p.options.TemplateLang == TemplateLangJS {
+			p.options.Dir = filepath.Join(p.app.DataDir(), "../pb_migrations")
+		} else {
+			p.options.Dir = filepath.Join(p.app.DataDir(), "../migrations")
+		}
+	}
+
+	// attach the migrate command
+	if rootCmd != nil {
+		rootCmd.AddCommand(p.createCommand())
+	}
+
+	// watch for collection changes
+	if p.options.Automigrate {
+		// refresh the cache right after app bootstap
+		p.app.OnAfterBootstrap().Add(func(e *core.BootstrapEvent) error {
+			p.refreshCachedCollections()
+			return nil
+		})
+
+		// refresh the cache to ensure that it constains the latest changes
+		// when migrations are applied on server start
+		p.app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
+			p.refreshCachedCollections()
+
+			cachedCollections, _ := p.getCachedCollections()
+			// create a full initial snapshot, if there are no custom
+			// migrations but there is already at least 1 collection created,
+			// to ensure that the automigrate will work with up-to-date collections data
+			if !p.hasCustomMigrations() && len(cachedCollections) > 1 {
+				p.migrateCollectionsHandler(nil, false)
+			}
+
+			return nil
+		})
+
+		p.app.OnModelAfterCreate().Add(p.afterCollectionChange())
+		p.app.OnModelAfterUpdate().Add(p.afterCollectionChange())
+		p.app.OnModelAfterDelete().Add(p.afterCollectionChange())
+	}
+
+	return nil
+}
+
+func (p *plugin) createCommand() *cobra.Command {
+	const cmdDesc = `Supported arguments are:
+- up            - runs all available migrations
+- down [number] - reverts the last [number] applied migrations
+- create name   - creates new blank migration template file
+- collections   - creates new migration file with snapshot of the local collections configuration
+`
+
+	command := &cobra.Command{
+		Use:       "migrate",
+		Short:     "Executes app DB migration scripts",
+		ValidArgs: []string{"up", "down", "create", "collections"},
+		Long:      cmdDesc,
+		Run: func(command *cobra.Command, args []string) {
+			cmd := ""
+			if len(args) > 0 {
+				cmd = args[0]
+			}
+
+			switch cmd {
+			case "create":
+				if err := p.migrateCreateHandler("", args[1:], true); err != nil {
+					log.Fatal(err)
+				}
+			case "collections":
+				if err := p.migrateCollectionsHandler(args[1:], true); err != nil {
+					log.Fatal(err)
+				}
+			default:
+				runner, err := migrate.NewRunner(p.app.DB(), migrations.AppMigrations)
+				if err != nil {
+					log.Fatal(err)
+				}
+
+				if err := runner.Run(args...); err != nil {
+					log.Fatal(err)
+				}
+			}
+		},
+	}
+
+	return command
+}
+
+func (p *plugin) migrateCreateHandler(template string, args []string, interactive bool) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Missing migration file name")
+	}
+
+	name := args[0]
+	dir := p.options.Dir
+
+	resultFilePath := path.Join(
+		dir,
+		fmt.Sprintf("%d_%s.%s", time.Now().Unix(), inflector.Snakecase(name), p.options.TemplateLang),
+	)
+
+	if interactive {
+		confirm := false
+		prompt := &survey.Confirm{
+			Message: fmt.Sprintf("Do you really want to create migration %q?", resultFilePath),
+		}
+		survey.AskOne(prompt, &confirm)
+		if !confirm {
+			fmt.Println("The command has been cancelled")
+			return nil
+		}
+	}
+
+	// get default create template
+	if template == "" {
+		var templateErr error
+		if p.options.TemplateLang == TemplateLangJS {
+			template, templateErr = p.jsBlankTemplate()
+		} else {
+			template, templateErr = p.goBlankTemplate()
+		}
+		if templateErr != nil {
+			return fmt.Errorf("Failed to resolve create template: %v\n", templateErr)
+		}
+	}
+
+	// ensure that the migrations dir exist
+	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		return err
+	}
+
+	// save the migration file
+	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
+		return fmt.Errorf("Failed to save migration file %q: %v\n", resultFilePath, err)
+	}
+
+	if interactive {
+		fmt.Printf("Successfully created file %q\n", resultFilePath)
+	}
+
+	return nil
+}
+
+func (p *plugin) migrateCollectionsHandler(args []string, interactive bool) error {
+	createArgs := []string{"collections_snapshot"}
+	createArgs = append(createArgs, args...)
+
+	collections := []*models.Collection{}
+	if err := p.app.Dao().CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
+		return fmt.Errorf("Failed to fetch migrations list: %v", err)
+	}
+
+	var template string
+	var templateErr error
+	if p.options.TemplateLang == TemplateLangJS {
+		template, templateErr = p.jsSnapshotTemplate(collections)
+	} else {
+		template, templateErr = p.goSnapshotTemplate(collections)
+	}
+	if templateErr != nil {
+		return fmt.Errorf("Failed to resolve template: %v", templateErr)
+	}
+
+	return p.migrateCreateHandler(template, createArgs, interactive)
+}

plugins/migratecmd/migratecmd_test.go

@@ -0,0 +1,746 @@
+package migratecmd_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/daos"
+	"github.com/pocketbase/pocketbase/models"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestAutomigrateCollectionCreate(t *testing.T) {
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+migrate((db) => {
+  const collection = new Collection({
+    "id": "new_id",
+    "created": "2022-01-01 00:00:00.000Z",
+    "updated": "2022-01-01 00:00:00.000Z",
+    "name": "new_name",
+    "type": "auth",
+    "system": true,
+    "schema": [],
+    "listRule": "@request.auth.id != '' && created > 0 || 'backtick` + "`" + `test' = 0",
+    "viewRule": "id = \"1\"",
+    "createRule": null,
+    "updateRule": null,
+    "deleteRule": null,
+    "options": {
+      "allowEmailAuth": false,
+      "allowOAuth2Auth": false,
+      "allowUsernameAuth": false,
+      "exceptEmailDomains": null,
+      "manageRule": "created > 0",
+      "minPasswordLength": 20,
+      "onlyEmailDomains": null,
+      "requireEmail": false
+    }
+  });
+
+  return Dao(db).saveCollection(collection);
+}, (db) => {
+  const dao = new Dao(db);
+  const collection = dao.findCollectionByNameOrId("new_id");
+
+  return dao.deleteCollection(collection);
+})
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		jsonData := ` + "`" + `{
+			"id": "new_id",
+			"created": "2022-01-01 00:00:00.000Z",
+			"updated": "2022-01-01 00:00:00.000Z",
+			"name": "new_name",
+			"type": "auth",
+			"system": true,
+			"schema": [],
+			"listRule": "@request.auth.id != '' && created > 0 || ` + "'backtick` + \"`\" + `test' = 0" + `",
+			"viewRule": "id = \"1\"",
+			"createRule": null,
+			"updateRule": null,
+			"deleteRule": null,
+			"options": {
+				"allowEmailAuth": false,
+				"allowOAuth2Auth": false,
+				"allowUsernameAuth": false,
+				"exceptEmailDomains": null,
+				"manageRule": "created > 0",
+				"minPasswordLength": 20,
+				"onlyEmailDomains": null,
+				"requireEmail": false
+			}
+		}` + "`" + `
+
+		collection := &models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return daos.New(db).SaveCollection(collection)
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("new_id")
+		if err != nil {
+			return err
+		}
+
+		return dao.DeleteCollection(collection)
+	})
+}
+`,
+		},
+	}
+
+	for i, s := range scenarios {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+		migratecmd.MustRegister(app, nil, &migratecmd.Options{
+			TemplateLang: s.lang,
+			Automigrate:  true,
+			Dir:          migrationsDir,
+		})
+
+		// @todo remove after collections cache is replaced
+		app.Bootstrap()
+
+		collection := &models.Collection{}
+		collection.Id = "new_id"
+		collection.Name = "new_name"
+		collection.Type = models.CollectionTypeAuth
+		collection.System = true
+		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+		collection.Updated = collection.Created
+		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
+		collection.ViewRule = types.Pointer(`id = "1"`)
+		collection.SetOptions(models.CollectionAuthOptions{
+			ManageRule:        types.Pointer("created > 0"),
+			MinPasswordLength: 20,
+		})
+		collection.MarkAsNew()
+
+		if err := app.Dao().SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save collection, got %v", i, err)
+		}
+
+		files, err := os.ReadDir(migrationsDir)
+		if err != nil {
+			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
+		}
+
+		if total := len(files); total != 1 {
+			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
+		}
+
+		expectedName := "_created_new_name." + s.lang
+		if !strings.Contains(files[0].Name(), expectedName) {
+			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
+		}
+
+		fullPath := filepath.Join(migrationsDir, files[0].Name())
+		content, err := os.ReadFile(fullPath)
+		if err != nil {
+			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
+		}
+
+		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
+		}
+	}
+}
+
+func TestAutomigrateCollectionDelete(t *testing.T) {
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+migrate((db) => {
+  const dao = new Dao(db);
+  const collection = dao.findCollectionByNameOrId("test123");
+
+  return dao.deleteCollection(collection);
+}, (db) => {
+  const collection = new Collection({
+    "id": "test123",
+    "created": "2022-01-01 00:00:00.000Z",
+    "updated": "2022-01-01 00:00:00.000Z",
+    "name": "test456",
+    "type": "auth",
+    "system": false,
+    "schema": [],
+    "listRule": "@request.auth.id != '' && created > 0 || 'backtick` + "`" + `test' = 0",
+    "viewRule": "id = \"1\"",
+    "createRule": null,
+    "updateRule": null,
+    "deleteRule": null,
+    "options": {
+      "allowEmailAuth": false,
+      "allowOAuth2Auth": false,
+      "allowUsernameAuth": false,
+      "exceptEmailDomains": null,
+      "manageRule": "created > 0",
+      "minPasswordLength": 20,
+      "onlyEmailDomains": null,
+      "requireEmail": false
+    }
+  });
+
+  return Dao(db).saveCollection(collection);
+})
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("test123")
+		if err != nil {
+			return err
+		}
+
+		return dao.DeleteCollection(collection)
+	}, func(db dbx.Builder) error {
+		jsonData := ` + "`" + `{
+			"id": "test123",
+			"created": "2022-01-01 00:00:00.000Z",
+			"updated": "2022-01-01 00:00:00.000Z",
+			"name": "test456",
+			"type": "auth",
+			"system": false,
+			"schema": [],
+			"listRule": "@request.auth.id != '' && created > 0 || ` + "'backtick` + \"`\" + `test' = 0" + `",
+			"viewRule": "id = \"1\"",
+			"createRule": null,
+			"updateRule": null,
+			"deleteRule": null,
+			"options": {
+				"allowEmailAuth": false,
+				"allowOAuth2Auth": false,
+				"allowUsernameAuth": false,
+				"exceptEmailDomains": null,
+				"manageRule": "created > 0",
+				"minPasswordLength": 20,
+				"onlyEmailDomains": null,
+				"requireEmail": false
+			}
+		}` + "`" + `
+
+		collection := &models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return daos.New(db).SaveCollection(collection)
+	})
+}
+`,
+		},
+	}
+
+	for i, s := range scenarios {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+		migratecmd.MustRegister(app, nil, &migratecmd.Options{
+			TemplateLang: s.lang,
+			Automigrate:  true,
+			Dir:          migrationsDir,
+		})
+
+		// create dummy collection
+		collection := &models.Collection{}
+		collection.Id = "test123"
+		collection.Name = "test456"
+		collection.Type = models.CollectionTypeAuth
+		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+		collection.Updated = collection.Created
+		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0 || 'backtick`test' = 0")
+		collection.ViewRule = types.Pointer(`id = "1"`)
+		collection.SetOptions(models.CollectionAuthOptions{
+			ManageRule:        types.Pointer("created > 0"),
+			MinPasswordLength: 20,
+		})
+		collection.MarkAsNew()
+
+		// use different dao to avoid triggering automigrate while saving the dummy collection
+		if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save dummy collection, got %v", i, err)
+		}
+
+		// @todo remove after collections cache is replaced
+		app.Bootstrap()
+
+		// delete the newly created dummy collection
+		if err := app.Dao().DeleteCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to delete dummy collection, got %v", i, err)
+		}
+
+		files, err := os.ReadDir(migrationsDir)
+		if err != nil {
+			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
+		}
+
+		if total := len(files); total != 1 {
+			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
+		}
+
+		expectedName := "_deleted_test456." + s.lang
+		if !strings.Contains(files[0].Name(), expectedName) {
+			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
+		}
+
+		fullPath := filepath.Join(migrationsDir, files[0].Name())
+		content, err := os.ReadFile(fullPath)
+		if err != nil {
+			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
+		}
+
+		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
+		}
+	}
+}
+
+func TestAutomigrateCollectionUpdate(t *testing.T) {
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+migrate((db) => {
+  const dao = new Dao(db)
+  const collection = dao.findCollectionByNameOrId("test123")
+
+  collection.name = "test456_update"
+  collection.type = "base"
+  collection.listRule = null
+  collection.deleteRule = "updated > 0 && @request.auth.id != ''"
+  collection.options = {}
+
+  // remove
+  collection.schema.removeField("f3_id")
+
+  // add
+  collection.schema.addField(new SchemaField({
+    "system": false,
+    "id": "f4_id",
+    "name": "f4_name",
+    "type": "text",
+    "required": false,
+    "unique": false,
+    "options": {
+      "min": null,
+      "max": null,
+      "pattern": "` + "`" + `test backtick` + "`" + `123"
+    }
+  }))
+
+  // update
+  collection.schema.addField(new SchemaField({
+    "system": false,
+    "id": "f2_id",
+    "name": "f2_name_new",
+    "type": "number",
+    "required": false,
+    "unique": true,
+    "options": {
+      "min": 10,
+      "max": null
+    }
+  }))
+
+  return dao.saveCollection(collection)
+}, (db) => {
+  const dao = new Dao(db)
+  const collection = dao.findCollectionByNameOrId("test123")
+
+  collection.name = "test456"
+  collection.type = "auth"
+  collection.listRule = "@request.auth.id != '' && created > 0"
+  collection.deleteRule = null
+  collection.options = {
+    "allowEmailAuth": false,
+    "allowOAuth2Auth": false,
+    "allowUsernameAuth": false,
+    "exceptEmailDomains": null,
+    "manageRule": "created > 0",
+    "minPasswordLength": 20,
+    "onlyEmailDomains": null,
+    "requireEmail": false
+  }
+
+  // add
+  collection.schema.addField(new SchemaField({
+    "system": false,
+    "id": "f3_id",
+    "name": "f3_name",
+    "type": "bool",
+    "required": false,
+    "unique": false,
+    "options": {}
+  }))
+
+  // remove
+  collection.schema.removeField("f4_id")
+
+  // update
+  collection.schema.addField(new SchemaField({
+    "system": false,
+    "id": "f2_id",
+    "name": "f2_name",
+    "type": "number",
+    "required": false,
+    "unique": true,
+    "options": {
+      "min": 10,
+      "max": null
+    }
+  }))
+
+  return dao.saveCollection(collection)
+})
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models/schema"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("test123")
+		if err != nil {
+			return err
+		}
+
+		collection.Name = "test456_update"
+
+		collection.Type = "base"
+
+		collection.ListRule = nil
+
+		collection.DeleteRule = types.Pointer("updated > 0 && @request.auth.id != ''")
+
+		options := map[string]any{}
+		json.Unmarshal([]byte(` + "`" + `{}` + "`" + `), &options)
+		collection.SetOptions(options)
+
+		// remove
+		collection.Schema.RemoveField("f3_id")
+
+		// add
+		new_f4_name := &schema.SchemaField{}
+		json.Unmarshal([]byte(` + "`" + `{
+			"system": false,
+			"id": "f4_id",
+			"name": "f4_name",
+			"type": "text",
+			"required": false,
+			"unique": false,
+			"options": {
+				"min": null,
+				"max": null,
+				"pattern": ` + "\"` + \"`\" + `test backtick` + \"`\" + `123\"" + `
+			}
+		}` + "`" + `), new_f4_name)
+		collection.Schema.AddField(new_f4_name)
+
+		// update
+		edit_f2_name_new := &schema.SchemaField{}
+		json.Unmarshal([]byte(` + "`" + `{
+			"system": false,
+			"id": "f2_id",
+			"name": "f2_name_new",
+			"type": "number",
+			"required": false,
+			"unique": true,
+			"options": {
+				"min": 10,
+				"max": null
+			}
+		}` + "`" + `), edit_f2_name_new)
+		collection.Schema.AddField(edit_f2_name_new)
+
+		return dao.SaveCollection(collection)
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId("test123")
+		if err != nil {
+			return err
+		}
+
+		collection.Name = "test456"
+
+		collection.Type = "auth"
+
+		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0")
+
+		collection.DeleteRule = nil
+
+		options := map[string]any{}
+		json.Unmarshal([]byte(` + "`" + `{
+			"allowEmailAuth": false,
+			"allowOAuth2Auth": false,
+			"allowUsernameAuth": false,
+			"exceptEmailDomains": null,
+			"manageRule": "created > 0",
+			"minPasswordLength": 20,
+			"onlyEmailDomains": null,
+			"requireEmail": false
+		}` + "`" + `), &options)
+		collection.SetOptions(options)
+
+		// add
+		del_f3_name := &schema.SchemaField{}
+		json.Unmarshal([]byte(` + "`" + `{
+			"system": false,
+			"id": "f3_id",
+			"name": "f3_name",
+			"type": "bool",
+			"required": false,
+			"unique": false,
+			"options": {}
+		}` + "`" + `), del_f3_name)
+		collection.Schema.AddField(del_f3_name)
+
+		// remove
+		collection.Schema.RemoveField("f4_id")
+
+		// update
+		edit_f2_name_new := &schema.SchemaField{}
+		json.Unmarshal([]byte(` + "`" + `{
+			"system": false,
+			"id": "f2_id",
+			"name": "f2_name",
+			"type": "number",
+			"required": false,
+			"unique": true,
+			"options": {
+				"min": 10,
+				"max": null
+			}
+		}` + "`" + `), edit_f2_name_new)
+		collection.Schema.AddField(edit_f2_name_new)
+
+		return dao.SaveCollection(collection)
+	})
+}
+`,
+		},
+	}
+
+	for i, s := range scenarios {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+		migratecmd.MustRegister(app, nil, &migratecmd.Options{
+			TemplateLang: s.lang,
+			Automigrate:  true,
+			Dir:          migrationsDir,
+		})
+
+		// create dummy collection
+		collection := &models.Collection{}
+		collection.Id = "test123"
+		collection.Name = "test456"
+		collection.Type = models.CollectionTypeAuth
+		collection.Created, _ = types.ParseDateTime("2022-01-01 00:00:00.000Z")
+		collection.Updated = collection.Created
+		collection.ListRule = types.Pointer("@request.auth.id != '' && created > 0")
+		collection.ViewRule = types.Pointer(`id = "1"`)
+		collection.SetOptions(models.CollectionAuthOptions{
+			ManageRule:        types.Pointer("created > 0"),
+			MinPasswordLength: 20,
+		})
+		collection.MarkAsNew()
+		collection.Schema.AddField(&schema.SchemaField{
+			Id:       "f1_id",
+			Name:     "f1_name",
+			Type:     schema.FieldTypeText,
+			Required: true,
+		})
+		collection.Schema.AddField(&schema.SchemaField{
+			Id:     "f2_id",
+			Name:   "f2_name",
+			Type:   schema.FieldTypeNumber,
+			Unique: true,
+			Options: &schema.NumberOptions{
+				Min: types.Pointer(10.0),
+			},
+		})
+		collection.Schema.AddField(&schema.SchemaField{
+			Id:   "f3_id",
+			Name: "f3_name",
+			Type: schema.FieldTypeBool,
+		})
+
+		// use different dao to avoid triggering automigrate while saving the dummy collection
+		if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save dummy collection, got %v", i, err)
+		}
+
+		// @todo remove after collections cache is replaced
+		app.Bootstrap()
+
+		collection.Name = "test456_update"
+		collection.Type = models.CollectionTypeBase
+		collection.DeleteRule = types.Pointer(`updated > 0 && @request.auth.id != ''`)
+		collection.ListRule = nil
+		collection.NormalizeOptions()
+		collection.Schema.RemoveField("f3_id")
+		collection.Schema.AddField(&schema.SchemaField{
+			Id:   "f4_id",
+			Name: "f4_name",
+			Type: schema.FieldTypeText,
+			Options: &schema.TextOptions{
+				Pattern: "`test backtick`123",
+			},
+		})
+		f := collection.Schema.GetFieldById("f2_id")
+		f.Name = "f2_name_new"
+
+		// save the changes and trigger automigrate
+		if err := app.Dao().SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save dummy collection changes, got %v", i, err)
+		}
+
+		files, err := os.ReadDir(migrationsDir)
+		if err != nil {
+			t.Fatalf("[%d] Expected migrationsDir to be created, got: %v", i, err)
+		}
+
+		if total := len(files); total != 1 {
+			t.Fatalf("[%d] Expected 1 file to be generated, got %d", i, total)
+		}
+
+		expectedName := "_updated_test456." + s.lang
+		if !strings.Contains(files[0].Name(), expectedName) {
+			t.Fatalf("[%d] Expected filename to contains %q, got %q", i, expectedName, files[0].Name())
+		}
+
+		fullPath := filepath.Join(migrationsDir, files[0].Name())
+		content, err := os.ReadFile(fullPath)
+		if err != nil {
+			t.Fatalf("[%d] Failed to read the generated migration file: %v", i, err)
+		}
+
+		if v := strings.TrimSpace(string(content)); v != strings.TrimSpace(s.expectedTemplate) {
+			t.Fatalf("[%d] Expected template \n%v \ngot \n%v", i, s.expectedTemplate, v)
+		}
+	}
+}
+
+func TestAutomigrateCollectionNoChanges(t *testing.T) {
+	scenarios := []struct {
+		lang string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+		},
+		{
+			migratecmd.TemplateLangGo,
+		},
+	}
+
+	for i, s := range scenarios {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+		migratecmd.MustRegister(app, nil, &migratecmd.Options{
+			TemplateLang: s.lang,
+			Automigrate:  true,
+			Dir:          migrationsDir,
+		})
+
+		// create dummy collection
+		collection := &models.Collection{}
+		collection.Name = "test123"
+		collection.Type = models.CollectionTypeAuth
+
+		// use different dao to avoid triggering automigrate while saving the dummy collection
+		if err := daos.New(app.DB()).SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save dummy collection, got %v", i, err)
+		}
+
+		// @todo remove after collections cache is replaced
+		app.Bootstrap()
+
+		// resave without changes and trigger automigrate
+		if err := app.Dao().SaveCollection(collection); err != nil {
+			t.Fatalf("[%d] Failed to save dummy collection update, got %v", i, err)
+		}
+
+		files, _ := os.ReadDir(migrationsDir)
+		if total := len(files); total != 0 {
+			t.Fatalf("[%d] Expected 0 files to be generated, got %d", i, total)
+		}
+	}
+}

plugins/migratecmd/templates.go

@@ -0,0 +1,743 @@
+package migratecmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/models"
+)
+
+const (
+	TemplateLangJS = "js"
+	TemplateLangGo = "go"
+)
+
+var emptyTemplateErr = errors.New("empty template")
+
+// -------------------------------------------------------------------
+// JavaScript templates
+// -------------------------------------------------------------------
+
+func (p *plugin) jsBlankTemplate() (string, error) {
+	const template = `migrate((db) => {
+  // add up queries...
+}, (db) => {
+  // add down queries...
+})
+`
+
+	return template, nil
+}
+
+func (p *plugin) jsSnapshotTemplate(collections []*models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collections, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `migrate((db) => {
+  const snapshot = %s;
+
+  const collections = snapshot.map((item) => new Collection(item));
+
+  return Dao(db).importCollections(collections, true, null);
+}, (db) => {
+  return null;
+})
+`
+
+	return fmt.Sprintf(template, string(jsonData)), nil
+}
+
+func (p *plugin) jsCreateTemplate(collection *models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collection, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `migrate((db) => {
+  const collection = new Collection(%s);
+
+  return Dao(db).saveCollection(collection);
+}, (db) => {
+  const dao = new Dao(db);
+  const collection = dao.findCollectionByNameOrId(%q);
+
+  return dao.deleteCollection(collection);
+})
+`
+
+	return fmt.Sprintf(template, string(jsonData), collection.Id), nil
+}
+
+func (p *plugin) jsDeleteTemplate(collection *models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collection, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `migrate((db) => {
+  const dao = new Dao(db);
+  const collection = dao.findCollectionByNameOrId(%q);
+
+  return dao.deleteCollection(collection);
+}, (db) => {
+  const collection = new Collection(%s);
+
+  return Dao(db).saveCollection(collection);
+})
+`
+
+	return fmt.Sprintf(template, collection.Id, string(jsonData)), nil
+}
+
+func (p *plugin) jsDiffTemplate(new *models.Collection, old *models.Collection) (string, error) {
+	if new == nil && old == nil {
+		return "", errors.New("the diff template require at least one of the collection to be non-nil")
+	}
+
+	if new == nil {
+		return p.jsDeleteTemplate(old)
+	}
+
+	if old == nil {
+		return p.jsCreateTemplate(new)
+	}
+
+	upParts := []string{}
+	downParts := []string{}
+	varName := "collection"
+
+	if old.Name != new.Name {
+		upParts = append(upParts, fmt.Sprintf("%s.name = %q", varName, new.Name))
+		downParts = append(downParts, fmt.Sprintf("%s.name = %q", varName, old.Name))
+	}
+
+	if old.Type != new.Type {
+		upParts = append(upParts, fmt.Sprintf("%s.type = %q", varName, new.Type))
+		downParts = append(downParts, fmt.Sprintf("%s.type = %q", varName, old.Type))
+	}
+
+	if old.System != new.System {
+		upParts = append(upParts, fmt.Sprintf("%s.system = %t", varName, new.System))
+		downParts = append(downParts, fmt.Sprintf("%s.system = %t", varName, old.System))
+	}
+
+	// ---
+	// note: strconv.Quote is used because %q converts the rule operators in unicode char codes
+	// ---
+
+	if old.ListRule != new.ListRule {
+		if old.ListRule != nil && new.ListRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.listRule = null", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.listRule = %s", varName, strconv.Quote(*old.ListRule)))
+		} else if old.ListRule == nil && new.ListRule != nil || *old.ListRule != *new.ListRule {
+			upParts = append(upParts, fmt.Sprintf("%s.listRule = %s", varName, strconv.Quote(*new.ListRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.listRule = null", varName))
+		}
+	}
+
+	if old.ViewRule != new.ViewRule {
+		if old.ViewRule != nil && new.ViewRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.viewRule = null", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.viewRule = %s", varName, strconv.Quote(*old.ViewRule)))
+		} else if old.ViewRule == nil && new.ViewRule != nil || *old.ViewRule != *new.ViewRule {
+			upParts = append(upParts, fmt.Sprintf("%s.viewRule = %s", varName, strconv.Quote(*new.ViewRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.viewRule = null", varName))
+		}
+	}
+
+	if old.CreateRule != new.CreateRule {
+		if old.CreateRule != nil && new.CreateRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.createRule = null", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.createRule = %s", varName, strconv.Quote(*old.CreateRule)))
+		} else if old.CreateRule == nil && new.CreateRule != nil || *old.CreateRule != *new.CreateRule {
+			upParts = append(upParts, fmt.Sprintf("%s.createRule = %s", varName, strconv.Quote(*new.CreateRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.createRule = null", varName))
+		}
+	}
+
+	if old.UpdateRule != new.UpdateRule {
+		if old.UpdateRule != nil && new.UpdateRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.updateRule = null", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.updateRule = %s", varName, strconv.Quote(*old.UpdateRule)))
+		} else if old.UpdateRule == nil && new.UpdateRule != nil || *old.UpdateRule != *new.UpdateRule {
+			upParts = append(upParts, fmt.Sprintf("%s.updateRule = %s", varName, strconv.Quote(*new.UpdateRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.updateRule = null", varName))
+		}
+	}
+
+	if old.DeleteRule != new.DeleteRule {
+		if old.DeleteRule != nil && new.DeleteRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.deleteRule = null", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.deleteRule = %s", varName, strconv.Quote(*old.DeleteRule)))
+		} else if old.DeleteRule == nil && new.DeleteRule != nil || *old.DeleteRule != *new.DeleteRule {
+			upParts = append(upParts, fmt.Sprintf("%s.deleteRule = %s", varName, strconv.Quote(*new.DeleteRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.deleteRule = null", varName))
+		}
+	}
+
+	// Options
+	rawNewOptions, err := marhshalWithoutEscape(new.Options, "  ", "  ")
+	if err != nil {
+		return "", err
+	}
+	rawOldOptions, err := marhshalWithoutEscape(old.Options, "  ", "  ")
+	if err != nil {
+		return "", err
+	}
+	if !bytes.Equal(rawNewOptions, rawOldOptions) {
+		upParts = append(upParts, fmt.Sprintf("%s.options = %s", varName, rawNewOptions))
+		downParts = append(downParts, fmt.Sprintf("%s.options = %s", varName, rawOldOptions))
+	}
+
+	// ensure new line between regular and collection fields
+	if len(upParts) > 0 {
+		upParts[len(upParts)-1] += "\n"
+	}
+	if len(downParts) > 0 {
+		downParts[len(downParts)-1] += "\n"
+	}
+
+	// Schema
+	// -----------------------------------------------------------------
+
+	// deleted fields
+	for _, oldField := range old.Schema.Fields() {
+		if new.Schema.GetFieldById(oldField.Id) != nil {
+			continue // exist
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldField, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// remove")
+		upParts = append(upParts, fmt.Sprintf("%s.schema.removeField(%q)\n", varName, oldField.Id))
+
+		downParts = append(downParts, "// add")
+		downParts = append(downParts, fmt.Sprintf("%s.schema.addField(new SchemaField(%s))\n", varName, rawOldField))
+	}
+
+	// created fields
+	for _, newField := range new.Schema.Fields() {
+		if old.Schema.GetFieldById(newField.Id) != nil {
+			continue // exist
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newField, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// add")
+		upParts = append(upParts, fmt.Sprintf("%s.schema.addField(new SchemaField(%s))\n", varName, rawNewField))
+
+		downParts = append(downParts, "// remove")
+		downParts = append(downParts, fmt.Sprintf("%s.schema.removeField(%q)\n", varName, newField.Id))
+	}
+
+	// modified fields
+	for _, newField := range new.Schema.Fields() {
+		oldField := old.Schema.GetFieldById(newField.Id)
+		if oldField == nil {
+			continue
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newField, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldField, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		if bytes.Equal(rawNewField, rawOldField) {
+			continue // no change
+		}
+
+		upParts = append(upParts, "// update")
+		upParts = append(upParts, fmt.Sprintf("%s.schema.addField(new SchemaField(%s))\n", varName, rawNewField))
+
+		downParts = append(downParts, "// update")
+		downParts = append(downParts, fmt.Sprintf("%s.schema.addField(new SchemaField(%s))\n", varName, rawOldField))
+	}
+
+	// -----------------------------------------------------------------
+
+	if len(upParts) == 0 && len(downParts) == 0 {
+		return "", emptyTemplateErr
+	}
+
+	up := strings.Join(upParts, "\n  ")
+	down := strings.Join(downParts, "\n  ")
+
+	const template = `migrate((db) => {
+  const dao = new Dao(db)
+  const collection = dao.findCollectionByNameOrId(%q)
+
+  %s
+
+  return dao.saveCollection(collection)
+}, (db) => {
+  const dao = new Dao(db)
+  const collection = dao.findCollectionByNameOrId(%q)
+
+  %s
+
+  return dao.saveCollection(collection)
+})
+`
+
+	return fmt.Sprintf(
+		template,
+		old.Id, strings.TrimSpace(up),
+		new.Id, strings.TrimSpace(down),
+	), nil
+}
+
+// -------------------------------------------------------------------
+// Go templates
+// -------------------------------------------------------------------
+
+func (p *plugin) goBlankTemplate() (string, error) {
+	const template = `package %s
+
+import (
+	"github.com/pocketbase/dbx"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		// add up queries...
+
+		return nil
+	}, func(db dbx.Builder) error {
+		// add down queries...
+
+		return nil
+	})
+}
+`
+
+	return fmt.Sprintf(template, filepath.Base(p.options.Dir)), nil
+}
+
+func (p *plugin) goSnapshotTemplate(collections []*models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collections, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		jsonData := ` + "`%s`" + `
+
+		collections := []*models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collections); err != nil {
+			return err
+		}
+
+		return daos.New(db).ImportCollections(collections, true, nil)
+	}, func(db dbx.Builder) error {
+		return nil
+	})
+}
+`
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.options.Dir),
+		escapeBacktick(string(jsonData)),
+	), nil
+}
+
+func (p *plugin) goCreateTemplate(collection *models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collection, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		jsonData := ` + "`%s`" + `
+
+		collection := &models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return daos.New(db).SaveCollection(collection)
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		return dao.DeleteCollection(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.options.Dir),
+		escapeBacktick(string(jsonData)),
+		collection.Id,
+	), nil
+}
+
+func (p *plugin) goDeleteTemplate(collection *models.Collection) (string, error) {
+	jsonData, err := marhshalWithoutEscape(collection, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/daos"
+	m "github.com/pocketbase/pocketbase/migrations"
+	"github.com/pocketbase/pocketbase/models"
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		return dao.DeleteCollection(collection)
+	}, func(db dbx.Builder) error {
+		jsonData := ` + "`%s`" + `
+
+		collection := &models.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return daos.New(db).SaveCollection(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.options.Dir),
+		collection.Id,
+		escapeBacktick(string(jsonData)),
+	), nil
+}
+
+func (p *plugin) goDiffTemplate(new *models.Collection, old *models.Collection) (string, error) {
+	if new == nil && old == nil {
+		return "", errors.New("the diff template require at least one of the collection to be non-nil")
+	}
+
+	if new == nil {
+		return p.goDeleteTemplate(old)
+	}
+
+	if old == nil {
+		return p.goCreateTemplate(new)
+	}
+
+	upParts := []string{}
+	downParts := []string{}
+	varName := "collection"
+	if old.Name != new.Name {
+		upParts = append(upParts, fmt.Sprintf("%s.Name = %q\n", varName, new.Name))
+		downParts = append(downParts, fmt.Sprintf("%s.Name = %q\n", varName, old.Name))
+	}
+
+	if old.Type != new.Type {
+		upParts = append(upParts, fmt.Sprintf("%s.Type = %q\n", varName, new.Type))
+		downParts = append(downParts, fmt.Sprintf("%s.Type = %q\n", varName, old.Type))
+	}
+
+	if old.System != new.System {
+		upParts = append(upParts, fmt.Sprintf("%s.System = %t\n", varName, new.System))
+		downParts = append(downParts, fmt.Sprintf("%s.System = %t\n", varName, old.System))
+	}
+
+	// ---
+	// note: strconv.Quote is used because %q converts the rule operators in unicode char codes
+	// ---
+
+	if old.ListRule != new.ListRule {
+		if old.ListRule != nil && new.ListRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.ListRule = nil\n", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.ListRule = types.Pointer(%s)\n", varName, strconv.Quote(*old.ListRule)))
+		} else if old.ListRule == nil && new.ListRule != nil || *old.ListRule != *new.ListRule {
+			upParts = append(upParts, fmt.Sprintf("%s.ListRule = types.Pointer(%s)\n", varName, strconv.Quote(*new.ListRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.ListRule = nil\n", varName))
+		}
+	}
+
+	if old.ViewRule != new.ViewRule {
+		if old.ViewRule != nil && new.ViewRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.ViewRule = nil\n", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.ViewRule = types.Pointer(%s)\n", varName, strconv.Quote(*old.ViewRule)))
+		} else if old.ViewRule == nil && new.ViewRule != nil || *old.ViewRule != *new.ViewRule {
+			upParts = append(upParts, fmt.Sprintf("%s.ViewRule = types.Pointer(%s)\n", varName, strconv.Quote(*new.ViewRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.ViewRule = nil\n", varName))
+		}
+	}
+
+	if old.CreateRule != new.CreateRule {
+		if old.CreateRule != nil && new.CreateRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.CreateRule = nil\n", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.CreateRule = types.Pointer(%s)\n", varName, strconv.Quote(*old.CreateRule)))
+		} else if old.CreateRule == nil && new.CreateRule != nil || *old.CreateRule != *new.CreateRule {
+			upParts = append(upParts, fmt.Sprintf("%s.CreateRule = types.Pointer(%s)\n", varName, strconv.Quote(*new.CreateRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.CreateRule = nil\n", varName))
+		}
+	}
+
+	if old.UpdateRule != new.UpdateRule {
+		if old.UpdateRule != nil && new.UpdateRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.UpdateRule = nil\n", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.UpdateRule = types.Pointer(%s)\n", varName, strconv.Quote(*old.UpdateRule)))
+		} else if old.UpdateRule == nil && new.UpdateRule != nil || *old.UpdateRule != *new.UpdateRule {
+			upParts = append(upParts, fmt.Sprintf("%s.UpdateRule = types.Pointer(%s)\n", varName, strconv.Quote(*new.UpdateRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.UpdateRule = nil\n", varName))
+		}
+	}
+
+	if old.DeleteRule != new.DeleteRule {
+		if old.DeleteRule != nil && new.DeleteRule == nil {
+			upParts = append(upParts, fmt.Sprintf("%s.DeleteRule = nil\n", varName))
+			downParts = append(downParts, fmt.Sprintf("%s.DeleteRule = types.Pointer(%s)\n", varName, strconv.Quote(*old.DeleteRule)))
+		} else if old.DeleteRule == nil && new.DeleteRule != nil || *old.DeleteRule != *new.DeleteRule {
+			upParts = append(upParts, fmt.Sprintf("%s.DeleteRule = types.Pointer(%s)\n", varName, strconv.Quote(*new.DeleteRule)))
+			downParts = append(downParts, fmt.Sprintf("%s.DeleteRule = nil\n", varName))
+		}
+	}
+
+	// Options
+	rawNewOptions, err := marhshalWithoutEscape(new.Options, "\t\t", "\t")
+	if err != nil {
+		return "", err
+	}
+	rawOldOptions, err := marhshalWithoutEscape(old.Options, "\t\t", "\t")
+	if err != nil {
+		return "", err
+	}
+	if !bytes.Equal(rawNewOptions, rawOldOptions) {
+		upParts = append(upParts, "options := map[string]any{}")
+		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawNewOptions))))
+		upParts = append(upParts, fmt.Sprintf("%s.SetOptions(options)\n", varName))
+		// ---
+		downParts = append(downParts, "options := map[string]any{}")
+		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), &options)", escapeBacktick(string(rawOldOptions))))
+		downParts = append(downParts, fmt.Sprintf("%s.SetOptions(options)\n", varName))
+	}
+
+	// Schema
+	// ---------------------------------------------------------------
+	// deleted fields
+	for _, oldField := range old.Schema.Fields() {
+		if new.Schema.GetFieldById(oldField.Id) != nil {
+			continue // exist
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldField, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		fieldVar := fmt.Sprintf("del_%s", oldField.Name)
+
+		upParts = append(upParts, "// remove")
+		upParts = append(upParts, fmt.Sprintf("%s.Schema.RemoveField(%q)\n", varName, oldField.Id))
+
+		downParts = append(downParts, "// add")
+		downParts = append(downParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
+		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar))
+		downParts = append(downParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
+	}
+
+	// created fields
+	for _, newField := range new.Schema.Fields() {
+		if old.Schema.GetFieldById(newField.Id) != nil {
+			continue // exist
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newField, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		fieldVar := fmt.Sprintf("new_%s", newField.Name)
+
+		upParts = append(upParts, "// add")
+		upParts = append(upParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
+		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar))
+		upParts = append(upParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
+
+		downParts = append(downParts, "// remove")
+		downParts = append(downParts, fmt.Sprintf("%s.Schema.RemoveField(%q)\n", varName, newField.Id))
+	}
+
+	// modified fields
+	for _, newField := range new.Schema.Fields() {
+		oldField := old.Schema.GetFieldById(newField.Id)
+		if oldField == nil {
+			continue
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newField, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldField, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		if bytes.Equal(rawNewField, rawOldField) {
+			continue // no change
+		}
+
+		fieldVar := fmt.Sprintf("edit_%s", newField.Name)
+
+		upParts = append(upParts, "// update")
+		upParts = append(upParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
+		upParts = append(upParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawNewField)), fieldVar))
+		upParts = append(upParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
+
+		downParts = append(downParts, "// update")
+		downParts = append(downParts, fmt.Sprintf("%s := &schema.SchemaField{}", fieldVar))
+		downParts = append(downParts, fmt.Sprintf("json.Unmarshal([]byte(`%s`), %s)", escapeBacktick(string(rawOldField)), fieldVar))
+		downParts = append(downParts, fmt.Sprintf("%s.Schema.AddField(%s)\n", varName, fieldVar))
+	}
+	// ---------------------------------------------------------------
+
+	if len(upParts) == 0 && len(downParts) == 0 {
+		return "", emptyTemplateErr
+	}
+
+	up := strings.Join(upParts, "\n\t\t")
+	down := strings.Join(downParts, "\n\t\t")
+	combined := up + down
+
+	// generate imports
+	// ---
+	var imports string
+
+	if strings.Contains(combined, "json.Unmarshal(") ||
+		strings.Contains(combined, "json.Marshal(") {
+		imports += "\n\t\"encoding/json\"\n"
+	}
+
+	imports += "\n\t\"github.com/pocketbase/dbx\""
+	imports += "\n\t\"github.com/pocketbase/pocketbase/daos\""
+	imports += "\n\tm \"github.com/pocketbase/pocketbase/migrations\""
+
+	if strings.Contains(combined, "schema.SchemaField{") {
+		imports += "\n\t\"github.com/pocketbase/pocketbase/models/schema\""
+	}
+
+	if strings.Contains(combined, "types.Pointer(") {
+		imports += "\n\t\"github.com/pocketbase/pocketbase/tools/types\""
+	}
+	// ---
+
+	const template = `package %s
+
+import (%s
+)
+
+func init() {
+	m.Register(func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		%s
+
+		return dao.SaveCollection(collection)
+	}, func(db dbx.Builder) error {
+		dao := daos.New(db);
+
+		collection, err := dao.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		%s
+
+		return dao.SaveCollection(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.options.Dir),
+		imports,
+		old.Id, strings.TrimSpace(up),
+		new.Id, strings.TrimSpace(down),
+	), nil
+}
+
+func marhshalWithoutEscape(v any, prefix string, indent string) ([]byte, error) {
+	raw, err := json.MarshalIndent(v, prefix, indent)
+	if err != nil {
+		return nil, err
+	}
+
+	// unescape escaped unicode characters
+	unescaped, err := strconv.Unquote(strings.ReplaceAll(strconv.Quote(string(raw)), `\\u`, `\u`))
+	if err != nil {
+		return nil, err
+	}
+
+	return []byte(unescaped), nil
+}
+
+func escapeBacktick(v string) string {
+	return strings.ReplaceAll(v, "`", "` + \"`\" + `")
+}

pocketbase.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/pocketbase/pocketbase/cmd"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/list"
 	"github.com/spf13/cobra"
 )
 
@@ -49,6 +50,12 @@ type Config struct {
 
 	// hide the default console server info on app startup
 	HideStartBanner bool
+
+	// optional DB configurations
+	DataMaxOpenConns int // default to core.DefaultDataMaxOpenConns
+	DataMaxIdleConns int // default to core.DefaultDataMaxIdleConns
+	LogsMaxOpenConns int // default to core.DefaultLogsMaxOpenConns
+	LogsMaxIdleConns int // default to core.DefaultLogsMaxIdleConns
 }
 
 // New creates a new PocketBase instance with the default configuration.
@@ -62,7 +69,7 @@ type Config struct {
 func New() *PocketBase {
 	_, isUsingGoRun := inspectRuntime()
 
-	return NewWithConfig(Config{
+	return NewWithConfig(&Config{
 		DefaultDebug: isUsingGoRun,
 	})
 }
@@ -74,7 +81,11 @@ func New() *PocketBase {
 // Everything will be initialized when [Start()] is executed.
 // If you want to initialize the application before calling [Start()],
 // then you'll have to manually call [Bootstrap()].
-func NewWithConfig(config Config) *PocketBase {
+func NewWithConfig(config *Config) *PocketBase {
+	if config == nil {
+		panic("missing config")
+	}
+
 	// initialize a default data directory based on the executable baseDir
 	if config.DefaultDataDir == "" {
 		baseDir, _ := inspectRuntime()
@@ -83,7 +94,7 @@ func NewWithConfig(config Config) *PocketBase {
 
 	pb := &PocketBase{
 		RootCmd: &cobra.Command{
-			Use:     "pocketbase",
+			Use:     filepath.Base(os.Args[0]),
 			Short:   "PocketBase CLI",
 			Version: Version,
 			FParseErrWhitelist: cobra.FParseErrWhitelist{
@@ -105,20 +116,19 @@ func NewWithConfig(config Config) *PocketBase {
 	pb.eagerParseFlags(config)
 
 	// initialize the app instance
-	pb.appWrapper = &appWrapper{core.NewBaseApp(
-		pb.dataDirFlag,
-		pb.encryptionEnvFlag,
-		pb.debugFlag,
-	)}
+	pb.appWrapper = &appWrapper{core.NewBaseApp(&core.BaseAppConfig{
+		DataDir:          pb.dataDirFlag,
+		EncryptionEnv:    pb.encryptionEnvFlag,
+		IsDebug:          pb.debugFlag,
+		DataMaxOpenConns: config.DataMaxOpenConns,
+		DataMaxIdleConns: config.DataMaxIdleConns,
+		LogsMaxOpenConns: config.LogsMaxOpenConns,
+		LogsMaxIdleConns: config.LogsMaxIdleConns,
+	})}
 
 	// hide the default help command (allow only `--help` flag)
 	pb.RootCmd.SetHelpCommand(&cobra.Command{Hidden: true})
 
-	// hook the bootstrap process
-	pb.RootCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
-		return pb.Bootstrap()
-	}
-
 	return pb
 }
 
@@ -127,7 +137,6 @@ func NewWithConfig(config Config) *PocketBase {
 func (pb *PocketBase) Start() error {
 	// register system commands
 	pb.RootCmd.AddCommand(cmd.NewServeCommand(pb, !pb.hideStartBanner))
-	pb.RootCmd.AddCommand(cmd.NewMigrateCommand(pb))
 	pb.RootCmd.AddCommand(cmd.NewTempUpgradeCommand(pb))
 
 	return pb.Execute()
@@ -139,6 +148,12 @@ func (pb *PocketBase) Start() error {
 // This method differs from pb.Start() by not registering the default
 // system commands!
 func (pb *PocketBase) Execute() error {
+	if !pb.skipBootstrap() {
+		if err := pb.Bootstrap(); err != nil {
+			return err
+		}
+	}
+
 	var wg sync.WaitGroup
 
 	wg.Add(1)
@@ -172,7 +187,7 @@ func (pb *PocketBase) onTerminate() error {
 
 // eagerParseFlags parses the global app flags before calling pb.RootCmd.Execute().
 // so we can have all PocketBase flags ready for use on initialization.
-func (pb *PocketBase) eagerParseFlags(config Config) error {
+func (pb *PocketBase) eagerParseFlags(config *Config) error {
 	pb.RootCmd.PersistentFlags().StringVar(
 		&pb.dataDirFlag,
 		"dir",
@@ -197,7 +212,50 @@ func (pb *PocketBase) eagerParseFlags(config Config) error {
 	return pb.RootCmd.ParseFlags(os.Args[1:])
 }
 
-// tries to find the base executable directory and how it was run
+// skipBootstrap eagerly checks if the app should skip the bootstap process:
+// - already bootstrapped
+// - is unknown command
+// - is the default help command
+// - is the default version command
+//
+// https://github.com/pocketbase/pocketbase/issues/404
+// https://github.com/pocketbase/pocketbase/discussions/1267
+func (pb *PocketBase) skipBootstrap() bool {
+	flags := []string{
+		"-h",
+		"--help",
+		"-v",
+		"--version",
+	}
+
+	if pb.IsBootstrapped() {
+		return true // already bootstrapped
+	}
+
+	cmd, _, err := pb.RootCmd.Find(os.Args[1:])
+	if err != nil {
+		return true // unknown command
+	}
+
+	for _, arg := range os.Args {
+		if !list.ExistInSlice(arg, flags) {
+			continue
+		}
+
+		// ensure that there is no user defined flag with the same name/shorthand
+		trimmed := strings.TrimLeft(arg, "-")
+		if len(trimmed) > 1 && cmd.Flags().Lookup(trimmed) == nil {
+			return true
+		}
+		if len(trimmed) == 1 && cmd.Flags().ShorthandLookup(trimmed) == nil {
+			return true
+		}
+	}
+
+	return false
+}
+
+// inspectRuntime tries to find the base executable directory and how it was run.
 func inspectRuntime() (baseDir string, withGoRun bool) {
 	if strings.HasPrefix(os.Args[0], os.TempDir()) {
 		// probably ran with go run

pocketbase_test.go

@@ -2,20 +2,23 @@ package pocketbase
 
 import (
 	"os"
+	"path/filepath"
 	"testing"
+
+	"github.com/spf13/cobra"
 )
 
 func TestNew(t *testing.T) {
 	// copy os.Args
-	originalArgs := []string{}
+	originalArgs := make([]string, len(os.Args))
 	copy(originalArgs, os.Args)
 	defer func() {
 		// restore os.Args
-		copy(os.Args, originalArgs)
+		os.Args = originalArgs
 	}()
 
 	// change os.Args
-	os.Args = os.Args[0:1]
+	os.Args = os.Args[:1]
 	os.Args = append(
 		os.Args,
 		"--dir=test_dir",
@@ -51,7 +54,7 @@ func TestNew(t *testing.T) {
 }
 
 func TestNewWithConfig(t *testing.T) {
-	app := NewWithConfig(Config{
+	app := NewWithConfig(&Config{
 		DefaultDebug:         true,
 		DefaultDataDir:       "test_dir",
 		DefaultEncryptionEnv: "test_encryption_env",
@@ -89,15 +92,15 @@ func TestNewWithConfig(t *testing.T) {
 
 func TestNewWithConfigAndFlags(t *testing.T) {
 	// copy os.Args
-	originalArgs := []string{}
+	originalArgs := make([]string, len(os.Args))
 	copy(originalArgs, os.Args)
 	defer func() {
 		// restore os.Args
-		copy(os.Args, originalArgs)
+		os.Args = originalArgs
 	}()
 
 	// change os.Args
-	os.Args = os.Args[0:1]
+	os.Args = os.Args[:1]
 	os.Args = append(
 		os.Args,
 		"--dir=test_dir_flag",
@@ -105,7 +108,7 @@ func TestNewWithConfigAndFlags(t *testing.T) {
 		"--debug=false",
 	)
 
-	app := NewWithConfig(Config{
+	app := NewWithConfig(&Config{
 		DefaultDebug:         true,
 		DefaultDataDir:       "test_dir",
 		DefaultEncryptionEnv: "test_encryption_env",
@@ -140,3 +143,82 @@ func TestNewWithConfigAndFlags(t *testing.T) {
 		t.Fatal("Expected app.IsDebug() false, got true")
 	}
 }
+
+func TestSkipBootstrap(t *testing.T) {
+	// copy os.Args
+	originalArgs := make([]string, len(os.Args))
+	copy(originalArgs, os.Args)
+	defer func() {
+		// restore os.Args
+		os.Args = originalArgs
+	}()
+
+	tempDir := filepath.Join(os.TempDir(), "temp_pb_data")
+	defer os.RemoveAll(tempDir)
+
+	// already bootstrapped
+	app0 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+	app0.Bootstrap()
+	if v := app0.skipBootstrap(); !v {
+		t.Fatal("[bootstrapped] Expected true, got false")
+	}
+
+	// unknown command
+	os.Args = os.Args[:1]
+	os.Args = append(os.Args, "demo")
+	app1 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+	app1.RootCmd.AddCommand(&cobra.Command{Use: "test"})
+	if v := app1.skipBootstrap(); !v {
+		t.Fatal("[unknown] Expected true, got false")
+	}
+
+	// default flags
+	flagScenarios := []struct {
+		name  string
+		short string
+	}{
+		{"help", "h"},
+		{"version", "v"},
+	}
+
+	for _, s := range flagScenarios {
+		// base flag
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "--"+s.name)
+		app1 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+		if v := app1.skipBootstrap(); !v {
+			t.Fatalf("[--%s] Expected true, got false", s.name)
+		}
+
+		// short flag
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "-"+s.short)
+		app2 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+		if v := app2.skipBootstrap(); !v {
+			t.Fatalf("[-%s] Expected true, got false", s.short)
+		}
+
+		customCmd := &cobra.Command{Use: "custom"}
+		customCmd.PersistentFlags().BoolP(s.name, s.short, false, "")
+
+		// base flag in custom command
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "custom")
+		os.Args = append(os.Args, "--"+s.name)
+		app3 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+		app3.RootCmd.AddCommand(customCmd)
+		if v := app3.skipBootstrap(); v {
+			t.Fatalf("[--%s custom] Expected false, got true", s.name)
+		}
+
+		// short flag in custom command
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "custom")
+		os.Args = append(os.Args, "-"+s.short)
+		app4 := NewWithConfig(&Config{DefaultDataDir: tempDir})
+		app4.RootCmd.AddCommand(customCmd)
+		if v := app4.skipBootstrap(); v {
+			t.Fatalf("[-%s custom] Expected false, got true", s.short)
+		}
+	}
+}

resolvers/record_field_resolver.go

@@ -415,7 +415,7 @@ func (r *RecordFieldResolver) loadCollection(collectionNameOrId string) (*models
 }
 
 func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string, on dbx.Expression) {
-	tableExpr := fmt.Sprintf("%s %s", tableName, tableAlias)
+	tableExpr := (tableName + " " + tableAlias)
 
 	join := join{
 		id:    tableAlias,

tests/api.go

@@ -134,6 +134,20 @@ func (scenario *ApiScenario) Test(t *testing.T) {
 		}
 	}
 
+	// to minimize the breaking changes we always expect the error
+	// events to be called on API error
+	if res.StatusCode >= 400 {
+		if scenario.ExpectedEvents == nil {
+			scenario.ExpectedEvents = map[string]int{}
+		}
+		if _, ok := scenario.ExpectedEvents["OnBeforeApiError"]; !ok {
+			scenario.ExpectedEvents["OnBeforeApiError"] = 1
+		}
+		if _, ok := scenario.ExpectedEvents["OnAfterApiError"]; !ok {
+			scenario.ExpectedEvents["OnAfterApiError"] = 1
+		}
+	}
+
 	if len(testApp.EventCalls) > len(scenario.ExpectedEvents) {
 		t.Errorf("[%s] Expected events %v, got %v", prefix, scenario.ExpectedEvents, testApp.EventCalls)
 	}

tests/app.go

@@ -7,6 +7,7 @@ import (
 	"path"
 	"path/filepath"
 	"runtime"
+	"sync"
 
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/mailer"
@@ -16,9 +17,17 @@ import (
 type TestApp struct {
 	*core.BaseApp
 
+	mux sync.Mutex
+
 	// EventCalls defines a map to inspect which app events
 	// (and how many times) were triggered.
+	//
+	// The following events are not counted because they execute always:
+	// - OnBeforeBootstrap
+	// - OnAfterBootstrap
+	// - OnBeforeServe
 	EventCalls map[string]int
+
 	TestMailer *TestMailer
 }
 
@@ -36,15 +45,35 @@ func (t *TestApp) Cleanup() {
 }
 
 func (t *TestApp) NewMailClient() mailer.Mailer {
+	t.mux.Lock()
+	defer t.mux.Unlock()
+
 	t.TestMailer.Reset()
+
 	return t.TestMailer
 }
 
 // ResetEventCalls resets the EventCalls counter.
 func (t *TestApp) ResetEventCalls() {
+	t.mux.Lock()
+	defer t.mux.Unlock()
+
 	t.EventCalls = make(map[string]int)
 }
 
+func (t *TestApp) registerEventCall(name string) error {
+	t.mux.Lock()
+	defer t.mux.Unlock()
+
+	if t.EventCalls == nil {
+		t.EventCalls = make(map[string]int)
+	}
+
+	t.EventCalls[name]++
+
+	return nil
+}
+
 // NewTestApp creates and initializes a test application instance.
 //
 // It is the caller's responsibility to call `app.Cleanup()`
@@ -64,7 +93,11 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 		return nil, err
 	}
 
-	app := core.NewBaseApp(tempDir, "pb_test_env", false)
+	app := core.NewBaseApp(&core.BaseAppConfig{
+		DataDir:       tempDir,
+		EncryptionEnv: "pb_test_env",
+		IsDebug:       false,
+	})
 
 	// load data dir and db connections
 	if err := app.Bootstrap(); err != nil {
@@ -81,270 +114,280 @@ func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
 		TestMailer: &TestMailer{},
 	}
 
-	// no need to count since this is executed always
-	// t.OnBeforeServe().Add(func(e *core.ServeEvent) error {
-	// 	t.EventCalls["OnBeforeServe"]++
-	// 	return nil
-	// })
+	t.OnBeforeApiError().Add(func(e *core.ApiErrorEvent) error {
+		return t.registerEventCall("OnBeforeApiError")
+	})
+
+	t.OnAfterApiError().Add(func(e *core.ApiErrorEvent) error {
+		return t.registerEventCall("OnAfterApiError")
+	})
 
 	t.OnModelBeforeCreate().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelBeforeCreate"]++
-		return nil
+		return t.registerEventCall("OnModelBeforeCreate")
 	})
 
 	t.OnModelAfterCreate().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelAfterCreate"]++
-		return nil
+		return t.registerEventCall("OnModelAfterCreate")
 	})
 
 	t.OnModelBeforeUpdate().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelBeforeUpdate"]++
-		return nil
+		return t.registerEventCall("OnModelBeforeUpdate")
 	})
 
 	t.OnModelAfterUpdate().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelAfterUpdate"]++
-		return nil
+		return t.registerEventCall("OnModelAfterUpdate")
 	})
 
 	t.OnModelBeforeDelete().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelBeforeDelete"]++
-		return nil
+		return t.registerEventCall("OnModelBeforeDelete")
 	})
 
 	t.OnModelAfterDelete().Add(func(e *core.ModelEvent) error {
-		t.EventCalls["OnModelAfterDelete"]++
-		return nil
+		return t.registerEventCall("OnModelAfterDelete")
 	})
 
 	t.OnRecordsListRequest().Add(func(e *core.RecordsListEvent) error {
-		t.EventCalls["OnRecordsListRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordsListRequest")
 	})
 
 	t.OnRecordViewRequest().Add(func(e *core.RecordViewEvent) error {
-		t.EventCalls["OnRecordViewRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordViewRequest")
 	})
 
 	t.OnRecordBeforeCreateRequest().Add(func(e *core.RecordCreateEvent) error {
-		t.EventCalls["OnRecordBeforeCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordBeforeCreateRequest")
 	})
 
 	t.OnRecordAfterCreateRequest().Add(func(e *core.RecordCreateEvent) error {
-		t.EventCalls["OnRecordAfterCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordAfterCreateRequest")
 	})
 
 	t.OnRecordBeforeUpdateRequest().Add(func(e *core.RecordUpdateEvent) error {
-		t.EventCalls["OnRecordBeforeUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordBeforeUpdateRequest")
 	})
 
 	t.OnRecordAfterUpdateRequest().Add(func(e *core.RecordUpdateEvent) error {
-		t.EventCalls["OnRecordAfterUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordAfterUpdateRequest")
 	})
 
 	t.OnRecordBeforeDeleteRequest().Add(func(e *core.RecordDeleteEvent) error {
-		t.EventCalls["OnRecordBeforeDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordBeforeDeleteRequest")
 	})
 
 	t.OnRecordAfterDeleteRequest().Add(func(e *core.RecordDeleteEvent) error {
-		t.EventCalls["OnRecordAfterDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordAfterDeleteRequest")
 	})
 
 	t.OnRecordAuthRequest().Add(func(e *core.RecordAuthEvent) error {
-		t.EventCalls["OnRecordAuthRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordAuthRequest")
+	})
+
+	t.OnRecordBeforeRequestPasswordResetRequest().Add(func(e *core.RecordRequestPasswordResetEvent) error {
+		return t.registerEventCall("OnRecordBeforeRequestPasswordResetRequest")
+	})
+
+	t.OnRecordAfterRequestPasswordResetRequest().Add(func(e *core.RecordRequestPasswordResetEvent) error {
+		return t.registerEventCall("OnRecordAfterRequestPasswordResetRequest")
+	})
+
+	t.OnRecordBeforeConfirmPasswordResetRequest().Add(func(e *core.RecordConfirmPasswordResetEvent) error {
+		return t.registerEventCall("OnRecordBeforeConfirmPasswordResetRequest")
+	})
+
+	t.OnRecordAfterConfirmPasswordResetRequest().Add(func(e *core.RecordConfirmPasswordResetEvent) error {
+		return t.registerEventCall("OnRecordAfterConfirmPasswordResetRequest")
+	})
+
+	t.OnRecordBeforeRequestVerificationRequest().Add(func(e *core.RecordRequestVerificationEvent) error {
+		return t.registerEventCall("OnRecordBeforeRequestVerificationRequest")
+	})
+
+	t.OnRecordAfterRequestVerificationRequest().Add(func(e *core.RecordRequestVerificationEvent) error {
+		return t.registerEventCall("OnRecordAfterRequestVerificationRequest")
+	})
+
+	t.OnRecordBeforeConfirmVerificationRequest().Add(func(e *core.RecordConfirmVerificationEvent) error {
+		return t.registerEventCall("OnRecordBeforeConfirmVerificationRequest")
+	})
+
+	t.OnRecordAfterConfirmVerificationRequest().Add(func(e *core.RecordConfirmVerificationEvent) error {
+		return t.registerEventCall("OnRecordAfterConfirmVerificationRequest")
+	})
+
+	t.OnRecordBeforeRequestEmailChangeRequest().Add(func(e *core.RecordRequestEmailChangeEvent) error {
+		return t.registerEventCall("OnRecordBeforeRequestEmailChangeRequest")
+	})
+
+	t.OnRecordAfterRequestEmailChangeRequest().Add(func(e *core.RecordRequestEmailChangeEvent) error {
+		return t.registerEventCall("OnRecordAfterRequestEmailChangeRequest")
+	})
+
+	t.OnRecordBeforeConfirmEmailChangeRequest().Add(func(e *core.RecordConfirmEmailChangeEvent) error {
+		return t.registerEventCall("OnRecordBeforeConfirmEmailChangeRequest")
+	})
+
+	t.OnRecordAfterConfirmEmailChangeRequest().Add(func(e *core.RecordConfirmEmailChangeEvent) error {
+		return t.registerEventCall("OnRecordAfterConfirmEmailChangeRequest")
 	})
 
 	t.OnRecordListExternalAuthsRequest().Add(func(e *core.RecordListExternalAuthsEvent) error {
-		t.EventCalls["OnRecordListExternalAuthsRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordListExternalAuthsRequest")
 	})
 
 	t.OnRecordBeforeUnlinkExternalAuthRequest().Add(func(e *core.RecordUnlinkExternalAuthEvent) error {
-		t.EventCalls["OnRecordBeforeUnlinkExternalAuthRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordBeforeUnlinkExternalAuthRequest")
 	})
 
 	t.OnRecordAfterUnlinkExternalAuthRequest().Add(func(e *core.RecordUnlinkExternalAuthEvent) error {
-		t.EventCalls["OnRecordAfterUnlinkExternalAuthRequest"]++
-		return nil
+		return t.registerEventCall("OnRecordAfterUnlinkExternalAuthRequest")
 	})
 
 	t.OnMailerBeforeAdminResetPasswordSend().Add(func(e *core.MailerAdminEvent) error {
-		t.EventCalls["OnMailerBeforeAdminResetPasswordSend"]++
-		return nil
+		return t.registerEventCall("OnMailerBeforeAdminResetPasswordSend")
 	})
 
 	t.OnMailerAfterAdminResetPasswordSend().Add(func(e *core.MailerAdminEvent) error {
-		t.EventCalls["OnMailerAfterAdminResetPasswordSend"]++
-		return nil
+		return t.registerEventCall("OnMailerAfterAdminResetPasswordSend")
 	})
 
 	t.OnMailerBeforeRecordResetPasswordSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerBeforeRecordResetPasswordSend"]++
-		return nil
+		return t.registerEventCall("OnMailerBeforeRecordResetPasswordSend")
 	})
 
 	t.OnMailerAfterRecordResetPasswordSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerAfterRecordResetPasswordSend"]++
-		return nil
+		return t.registerEventCall("OnMailerAfterRecordResetPasswordSend")
 	})
 
 	t.OnMailerBeforeRecordVerificationSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerBeforeRecordVerificationSend"]++
-		return nil
+		return t.registerEventCall("OnMailerBeforeRecordVerificationSend")
 	})
 
 	t.OnMailerAfterRecordVerificationSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerAfterRecordVerificationSend"]++
-		return nil
+		return t.registerEventCall("OnMailerAfterRecordVerificationSend")
 	})
 
 	t.OnMailerBeforeRecordChangeEmailSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerBeforeRecordChangeEmailSend"]++
-		return nil
+		return t.registerEventCall("OnMailerBeforeRecordChangeEmailSend")
 	})
 
 	t.OnMailerAfterRecordChangeEmailSend().Add(func(e *core.MailerRecordEvent) error {
-		t.EventCalls["OnMailerAfterRecordChangeEmailSend"]++
-		return nil
+		return t.registerEventCall("OnMailerAfterRecordChangeEmailSend")
 	})
 
 	t.OnRealtimeConnectRequest().Add(func(e *core.RealtimeConnectEvent) error {
-		t.EventCalls["OnRealtimeConnectRequest"]++
-		return nil
+		return t.registerEventCall("OnRealtimeConnectRequest")
+	})
+
+	t.OnRealtimeDisconnectRequest().Add(func(e *core.RealtimeDisconnectEvent) error {
+		return t.registerEventCall("OnRealtimeDisconnectRequest")
+	})
+
+	t.OnRealtimeBeforeMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+		return t.registerEventCall("OnRealtimeBeforeMessageSend")
+	})
+
+	t.OnRealtimeAfterMessageSend().Add(func(e *core.RealtimeMessageEvent) error {
+		return t.registerEventCall("OnRealtimeAfterMessageSend")
 	})
 
 	t.OnRealtimeBeforeSubscribeRequest().Add(func(e *core.RealtimeSubscribeEvent) error {
-		t.EventCalls["OnRealtimeBeforeSubscribeRequest"]++
-		return nil
+		return t.registerEventCall("OnRealtimeBeforeSubscribeRequest")
 	})
 
 	t.OnRealtimeAfterSubscribeRequest().Add(func(e *core.RealtimeSubscribeEvent) error {
-		t.EventCalls["OnRealtimeAfterSubscribeRequest"]++
-		return nil
+		return t.registerEventCall("OnRealtimeAfterSubscribeRequest")
 	})
 
 	t.OnSettingsListRequest().Add(func(e *core.SettingsListEvent) error {
-		t.EventCalls["OnSettingsListRequest"]++
-		return nil
+		return t.registerEventCall("OnSettingsListRequest")
 	})
 
 	t.OnSettingsBeforeUpdateRequest().Add(func(e *core.SettingsUpdateEvent) error {
-		t.EventCalls["OnSettingsBeforeUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnSettingsBeforeUpdateRequest")
 	})
 
 	t.OnSettingsAfterUpdateRequest().Add(func(e *core.SettingsUpdateEvent) error {
-		t.EventCalls["OnSettingsAfterUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnSettingsAfterUpdateRequest")
 	})
 
 	t.OnCollectionsListRequest().Add(func(e *core.CollectionsListEvent) error {
-		t.EventCalls["OnCollectionsListRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionsListRequest")
 	})
 
 	t.OnCollectionViewRequest().Add(func(e *core.CollectionViewEvent) error {
-		t.EventCalls["OnCollectionViewRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionViewRequest")
 	})
 
 	t.OnCollectionBeforeCreateRequest().Add(func(e *core.CollectionCreateEvent) error {
-		t.EventCalls["OnCollectionBeforeCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionBeforeCreateRequest")
 	})
 
 	t.OnCollectionAfterCreateRequest().Add(func(e *core.CollectionCreateEvent) error {
-		t.EventCalls["OnCollectionAfterCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionAfterCreateRequest")
 	})
 
 	t.OnCollectionBeforeUpdateRequest().Add(func(e *core.CollectionUpdateEvent) error {
-		t.EventCalls["OnCollectionBeforeUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionBeforeUpdateRequest")
 	})
 
 	t.OnCollectionAfterUpdateRequest().Add(func(e *core.CollectionUpdateEvent) error {
-		t.EventCalls["OnCollectionAfterUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionAfterUpdateRequest")
 	})
 
 	t.OnCollectionBeforeDeleteRequest().Add(func(e *core.CollectionDeleteEvent) error {
-		t.EventCalls["OnCollectionBeforeDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionBeforeDeleteRequest")
 	})
 
 	t.OnCollectionAfterDeleteRequest().Add(func(e *core.CollectionDeleteEvent) error {
-		t.EventCalls["OnCollectionAfterDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionAfterDeleteRequest")
 	})
 
 	t.OnCollectionsBeforeImportRequest().Add(func(e *core.CollectionsImportEvent) error {
-		t.EventCalls["OnCollectionsBeforeImportRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionsBeforeImportRequest")
 	})
 
 	t.OnCollectionsAfterImportRequest().Add(func(e *core.CollectionsImportEvent) error {
-		t.EventCalls["OnCollectionsAfterImportRequest"]++
-		return nil
+		return t.registerEventCall("OnCollectionsAfterImportRequest")
 	})
 
 	t.OnAdminsListRequest().Add(func(e *core.AdminsListEvent) error {
-		t.EventCalls["OnAdminsListRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminsListRequest")
 	})
 
 	t.OnAdminViewRequest().Add(func(e *core.AdminViewEvent) error {
-		t.EventCalls["OnAdminViewRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminViewRequest")
 	})
 
 	t.OnAdminBeforeCreateRequest().Add(func(e *core.AdminCreateEvent) error {
-		t.EventCalls["OnAdminBeforeCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminBeforeCreateRequest")
 	})
 
 	t.OnAdminAfterCreateRequest().Add(func(e *core.AdminCreateEvent) error {
-		t.EventCalls["OnAdminAfterCreateRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminAfterCreateRequest")
 	})
 
 	t.OnAdminBeforeUpdateRequest().Add(func(e *core.AdminUpdateEvent) error {
-		t.EventCalls["OnAdminBeforeUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminBeforeUpdateRequest")
 	})
 
 	t.OnAdminAfterUpdateRequest().Add(func(e *core.AdminUpdateEvent) error {
-		t.EventCalls["OnAdminAfterUpdateRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminAfterUpdateRequest")
 	})
 
 	t.OnAdminBeforeDeleteRequest().Add(func(e *core.AdminDeleteEvent) error {
-		t.EventCalls["OnAdminBeforeDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminBeforeDeleteRequest")
 	})
 
 	t.OnAdminAfterDeleteRequest().Add(func(e *core.AdminDeleteEvent) error {
-		t.EventCalls["OnAdminAfterDeleteRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminAfterDeleteRequest")
 	})
 
 	t.OnAdminAuthRequest().Add(func(e *core.AdminAuthEvent) error {
-		t.EventCalls["OnAdminAuthRequest"]++
-		return nil
+		return t.registerEventCall("OnAdminAuthRequest")
 	})
 
 	t.OnFileDownloadRequest().Add(func(e *core.FileDownloadEvent) error {
-		t.EventCalls["OnFileDownloadRequest"]++
-		return nil
+		return t.registerEventCall("OnFileDownloadRequest")
 	})
 
 	return t, nil