Merge branch '1.5.x' of github.com:appwrite/appwrite into twoWayKey-2

 Conflicts:

	composer.lock

.env

@@ -79,7 +79,7 @@ _APP_MAINTENANCE_RETENTION_CACHE=2592000
 _APP_MAINTENANCE_RETENTION_EXECUTION=1209600
 _APP_MAINTENANCE_RETENTION_ABUSE=86400
 _APP_MAINTENANCE_RETENTION_AUDIT=1209600
-_APP_USAGE_AGGREGATION_INTERVAL=60000
+_APP_USAGE_AGGREGATION_INTERVAL=30
 _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=8640000
 _APP_MAINTENANCE_RETENTION_SCHEDULES=86400
 _APP_USAGE_STATS=enabled
@@ -102,4 +102,5 @@ _APP_ASSISTANT_OPENAI_API_KEY=
 _APP_MESSAGE_SMS_TEST_DSN=
 _APP_MESSAGE_EMAIL_TEST_DSN=
 _APP_MESSAGE_PUSH_TEST_DSN=
-_APP_WEBHOOK_MAX_FAILED_ATTEMPTS=10
+_APP_WEBHOOK_MAX_FAILED_ATTEMPTS=10
+_APP_PROJECT_REGIONS=default

.github/workflows/tests.yml

@@ -141,7 +141,7 @@ jobs:
         run: |
           docker load --input /tmp/${{ env.IMAGE }}.tar
           docker compose up -d
-          sleep 10
+          sleep 25
 
       - name: Run ${{matrix.service}} Tests
         run: docker compose exec -T appwrite test /usr/src/code/tests/e2e/Services/${{matrix.service}} --debug

Dockerfile

@@ -29,7 +29,7 @@ ENV VITE_APPWRITE_GROWTH_ENDPOINT=$VITE_APPWRITE_GROWTH_ENDPOINT
 RUN npm ci
 RUN npm run build
 
-FROM appwrite/base:0.7.2 as final
+FROM appwrite/base:0.9.0 as final
 
 LABEL maintainer="team@appwrite.io"
 
@@ -105,7 +105,8 @@ RUN chmod +x /usr/local/bin/doctor && \
     chmod +x /usr/local/bin/worker-migrations && \
     chmod +x /usr/local/bin/worker-webhooks && \
     chmod +x /usr/local/bin/worker-hamster && \
-    chmod +x /usr/local/bin/worker-usage
+    chmod +x /usr/local/bin/worker-usage && \
+    chmod +x /usr/local/bin/worker-usage-dump
 
 
 # Cloud Executabless
@@ -132,16 +133,9 @@ RUN mkdir -p /etc/letsencrypt/live/ && chmod -Rf 755 /etc/letsencrypt/live/
 
 # Enable Extensions
 RUN if [ "$DEBUG" == "true" ]; then cp /usr/src/code/dev/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini; fi
-RUN if [ "$DEBUG" == "true" ]; then echo "opcache.enable=0" >> /usr/local/etc/php/conf.d/appwrite.ini; fi
 RUN if [ "$DEBUG" = "false" ]; then rm -rf /usr/src/code/dev; fi
 RUN if [ "$DEBUG" = "false" ]; then rm -f /usr/local/lib/php/extensions/no-debug-non-zts-20220829/xdebug.so; fi
-RUN echo "opcache.preload_user=www-data" >> /usr/local/etc/php/conf.d/appwrite.ini
-RUN echo "opcache.preload=/usr/src/code/app/preload.php" >> /usr/local/etc/php/conf.d/appwrite.ini
-RUN echo "opcache.enable_cli=1" >> /usr/local/etc/php/conf.d/appwrite.ini
-RUN echo "default_socket_timeout=-1" >> /usr/local/etc/php/conf.d/appwrite.ini
-RUN echo "opcache.jit_buffer_size=100M" >> /usr/local/etc/php/conf.d/appwrite.ini
-RUN echo "opcache.jit=1235" >> /usr/local/etc/php/conf.d/appwrite.ini
 
 EXPOSE 80
 
-CMD [ "php", "app/http.php", "-dopcache.preload=opcache.preload=/usr/src/code/app/preload.php" ]
+CMD [ "php", "app/http.php" ]

app/config/collections.php

@@ -34,6 +34,28 @@ $commonCollections = [
                 'array' => false,
                 'filters' => [],
             ],
+            [
+                '$id' => 'resourceType',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 255,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('mimeType'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 255, // https://tools.ietf.org/html/rfc4288#section-4.2
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
             [
                 '$id' => 'accessedAt',
                 'type' => Database::VAR_DATETIME,
@@ -1507,10 +1529,10 @@ $commonCollections = [
         ]
     ],
 
-    'stats_v2' => [
+    'stats' => [
         '$collection' => ID::custom(Database::METADATA),
-        '$id' => ID::custom('stats_v2'),
-        'name' => 'stats_v2',
+        '$id' => ID::custom('stats'),
+        'name' => 'Stats',
         'attributes' => [
             [
                 '$id' => ID::custom('metric'),
@@ -1892,7 +1914,40 @@ $commonCollections = [
                 'filters' => [],
             ],
             [
-                '$id' => ID::custom('total'),
+                '$id' => ID::custom('subscribe'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 128,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => true,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('emailTotal'),
+                'type' => Database::VAR_INTEGER,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => 0,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('smsTotal'),
+                'type' => Database::VAR_INTEGER,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => 0,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('pushTotal'),
                 'type' => Database::VAR_INTEGER,
                 'format' => '',
                 'size' => 0,
@@ -2080,6 +2135,13 @@ $commonCollections = [
                 'lengths' => [],
                 'orders' => [],
             ],
+            [
+                '$id' => ID::custom('_unique_target_topic'),
+                'type' => Database::INDEX_UNIQUE,
+                'attributes' => ['targetInternalId', 'topicInternalId'],
+                'lengths' => [],
+                'orders' => [],
+            ],
             [
                 '$id' => ID::custom('_fulltext_search'),
                 'type' => Database::INDEX_FULLTEXT,
@@ -4329,17 +4391,6 @@ $consoleCollections = array_merge([
                 'array' => false,
                 'filters' => [],
             ],
-            [
-                '$id' => ID::custom('resourceCollection'),
-                'type' => Database::VAR_STRING,
-                'format' => '',
-                'size' => Database::LENGTH_KEY,
-                'signed' => true,
-                'required' => true,
-                'default' => null,
-                'array' => false,
-                'filters' => [],
-            ],
             [
                 '$id' => ID::custom('resourceInternalId'),
                 'type' => Database::VAR_STRING,

app/config/errors.php

@@ -245,7 +245,7 @@ return [
     Exception::USER_MORE_FACTORS_REQUIRED => [
         'name' => Exception::USER_MORE_FACTORS_REQUIRED,
         'description' => 'More factors are required to complete the sign in process.',
-        'code' => 400,
+        'code' => 401,
     ],
     Exception::USER_OAUTH2_BAD_REQUEST => [
         'name' => Exception::USER_OAUTH2_BAD_REQUEST,
@@ -272,6 +272,11 @@ return [
         'description' => 'User phone is already verified',
         'code' => 409
     ],
+    Exception::USER_DELETION_PROHIBITED => [
+        'name' => Exception::USER_DELETION_PROHIBITED,
+        'description' => 'User deletion is not allowed for users with active memberships. Please delete all confirmed memberships before deleting the account.',
+        'code' => 400
+    ],
     Exception::USER_TARGET_NOT_FOUND => [
         'name' => Exception::USER_TARGET_NOT_FOUND,
         'description' => 'The target could not be found.',
@@ -282,6 +287,11 @@ return [
         'description' => 'A target with the same ID already exists.',
         'code' => 409,
     ],
+    Exception::USER_API_KEY_AND_SESSION_SET => [
+        'name' => Exception::USER_API_KEY_AND_SESSION_SET,
+        'description' => 'API key and session used in the same request. Use either `setSession` or `setKey`. Learn about which authentication method to use in the SSR docs: https://appwrite.io/docs/products/auth/server-side-rendering',
+        'code' => 403,
+    ],
 
     /** Teams */
     Exception::TEAM_NOT_FOUND => [
@@ -420,6 +430,11 @@ return [
         'description' => 'The value for x-appwrite-id header is invalid. Please check the value of the x-appwrite-id header is a valid id and not unique().',
         'code' => 400,
     ],
+    Exception::STORAGE_FILE_NOT_PUBLIC => [
+        'name' => Exception::STORAGE_FILE_NOT_PUBLIC,
+        'description' => 'The requested file is not publicly readable.',
+        'code' => 403,
+    ],
 
     /** VCS */
     Exception::INSTALLATION_NOT_FOUND => [
@@ -647,11 +662,6 @@ return [
         'description' => 'Project with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409,
     ],
-    Exception::PROJECT_UNKNOWN => [
-        'name' => Exception::PROJECT_UNKNOWN,
-        'description' => 'The project ID is either missing or not valid. Please check the value of the X-Appwrite-Project header to ensure the correct project ID is being used.',
-        'code' => 400,
-    ],
     Exception::PROJECT_PROVIDER_DISABLED => [
         'name' => Exception::PROJECT_PROVIDER_DISABLED,
         'description' => 'The chosen OAuth provider is disabled. You can enable the OAuth provider using the Appwrite console.',
@@ -723,6 +733,11 @@ return [
         'description' => 'You can\'t delete default template. If you are trying to reset your template changes, you can ignore this error as it\'s already been reset.',
         'code' => 401,
     ],
+    Exception::PROJECT_REGION_UNSUPPORTED => [
+        'name' => Exception::PROJECT_REGION_UNSUPPORTED,
+        'description' => 'The requested region is either inactive or unsupported. Please check the value of the _APP_REGIONS environment variable.',
+        'code' => 400,
+    ],
     Exception::WEBHOOK_NOT_FOUND => [
         'name' => Exception::WEBHOOK_NOT_FOUND,
         'description' => 'Webhook with the requested ID could not be found.',
@@ -872,7 +887,7 @@ return [
     ],
     Exception::MESSAGE_MISSING_TARGET => [
         'name' => Exception::MESSAGE_MISSING_TARGET,
-        'description' => 'Message with the requested ID is missing a target (Topics or Users or Targets).',
+        'description' => 'Message with the requested ID has no recipients (topics or users or targets).',
         'code' => 400,
     ],
     Exception::MESSAGE_ALREADY_SENT => [
@@ -920,4 +935,11 @@ return [
         'description' => 'Schedule with the requested ID could not be found.',
         'code' => 404,
     ],
+
+    /** Targets */
+    Exception::TARGET_PROVIDER_INVALID_TYPE => [
+        'name' => Exception::TARGET_PROVIDER_INVALID_TYPE,
+        'description' => 'Target has an invalid provider type.',
+        'code' => 400,
+    ],
 ];

app/config/locale/templates.php

@@ -6,10 +6,12 @@ return [
         'magicSession',
         'recovery',
         'invitation',
+        'mfaChallenge'
     ],
     'sms' => [
         'verification',
         'login',
-        'invitation'
+        'invitation',
+        'mfaChallenge'
     ]
 ];

app/config/locale/templates/email-magic-url.tpl

@@ -1,4 +1,4 @@
-<p>{{hello}}</p>
+<p>{{hello}},</p>
 
 <p>{{optionButton}}</p>
 

app/config/locale/templates/email-mfa-challenge.tpl

@@ -0,0 +1,16 @@
+<p>{{hello}},</p>
+
+<p>{{description}}</p>
+
+<table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
+    <tr>
+        <td align="center" style="border-radius: 8px; background-color: #ffffff;">
+            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: Inter; color: #414146; text-decoration: none; border-radius: 8px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
+        </td>
+    </tr>
+</table>
+
+<p>{{clientInfo}}</p>
+
+<p style="margin-bottom: 0px;">{{thanks}}</p>
+<p style="margin-top: 0px;">{{signature}}</p>

app/config/locale/templates/email-otp.tpl

@@ -1,4 +1,4 @@
-<p>{{hello}}</p>
+<p>{{hello}},</p>
 
 <p>{{description}}</p>
 

app/config/locale/translations/en.json

@@ -4,36 +4,42 @@
     "settings.direction": "ltr",
     "emails.sender": "%s Team",
     "emails.verification.subject": "Account Verification",
-    "emails.verification.hello": "Hey {{user}}",
-    "emails.verification.body": "Follow this link to verify your email address.",
+    "emails.verification.hello": "Hello {{user}}",
+    "emails.verification.body": "Follow this link to verify your email address to your {{b}}{{project}}{{/b}} account.",
     "emails.verification.footer": "If you didn’t ask to verify this address, you can ignore this message.",
     "emails.verification.thanks": "Thanks",
     "emails.verification.signature": "{{project}} team",
     "emails.magicSession.subject": "{{project}} Login",
-    "emails.magicSession.hello": "Hello,",
-    "emails.magicSession.optionButton": "Click the button below to securely sign in to your {{project}} account. This link will expire in 1 hour.",
+    "emails.magicSession.hello": "Hello {{user}}",
+    "emails.magicSession.optionButton": "Click the button below to securely sign in to your {{b}}{{project}}{{/b}} account. This link will expire in 1 hour.",
     "emails.magicSession.buttonText": "Sign in to {{project}}",
     "emails.magicSession.optionUrl": "If you are unable to sign in using the button above, please visit the following link:",
-    "emails.magicSession.clientInfo": "This sign in was requested using {{agentClient}} on {{agentDevice}} {{agentOs}}. If you didn't request the sign in, you can safely ignore this email.",
-    "emails.magicSession.securityPhrase": "Security phrase for this email is {{phrase}}. You can trust this email if this phrase matches the phrase shown during sign in.",
+    "emails.magicSession.clientInfo": "This sign in was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the sign in, you can safely ignore this email.",
+    "emails.magicSession.securityPhrase": "Security phrase for this email is {{b}}{{phrase}}{{/b}}. You can trust this email if this phrase matches the phrase shown during sign in.",
     "emails.magicSession.thanks": "Thanks,",
     "emails.magicSession.signature": "{{project}} team",
     "emails.otpSession.subject": "OTP for {{project}} Login",
-    "emails.otpSession.hello": "Hello,",
-    "emails.otpSession.description": "Enter the following verification code when prompted to securely sign in to your {{project}} account. This code will expire in 15 minutes.",
-    "emails.otpSession.clientInfo": "This sign in was requested using {{agentClient}} on {{agentDevice}} {{agentOs}}. If you didn't request the sign in, you can safely ignore this email.",
-    "emails.otpSession.securityPhrase": "Security phrase for this email is {{phrase}}. You can trust this email if this phrase matches the phrase shown during sign in.",
+    "emails.otpSession.hello": "Hello {{user}}",
+    "emails.otpSession.description": "Enter the following verification code when prompted to securely sign in to your {{b}}{{project}}{{/b}} account. This code will expire in 15 minutes.",
+    "emails.otpSession.clientInfo": "This sign in was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the sign in, you can safely ignore this email.",
+    "emails.otpSession.securityPhrase": "Security phrase for this email is {{b}}{{phrase}}{{/b}}. You can trust this email if this phrase matches the phrase shown during sign in.",
     "emails.otpSession.thanks": "Thanks,",
     "emails.otpSession.signature": "{{project}} team",
+    "emails.mfaChallenge.subject": "Verification Code for {{project}}",
+    "emails.mfaChallenge.hello": "Hello {{user}}",
+    "emails.mfaChallenge.description": "Enter the following verification code to verify your email and activate two-step verification in {{b}}{{project}}{{/b}}. This code will expire in 15 minutes.",
+    "emails.mfaChallenge.clientInfo": "This verification code was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the verification code, you can safely ignore this email.",
+    "emails.mfaChallenge.thanks": "Thanks,",
+    "emails.mfaChallenge.signature": "{{project}} team",
     "emails.recovery.subject": "Password Reset",
     "emails.recovery.hello": "Hello {{user}}",
-    "emails.recovery.body": "Follow this link to reset your {{project}} password.",
+    "emails.recovery.body": "Follow this link to reset your {{b}}{{project}}{{/b}} password.",
     "emails.recovery.footer": "If you didn’t ask to reset your password, you can ignore this message.",
     "emails.recovery.thanks": "Thanks",
     "emails.recovery.signature": "{{project}} team",
     "emails.invitation.subject": "Invitation to %s Team at %s",
-    "emails.invitation.hello": "Hello",
-    "emails.invitation.body": "This mail was sent to you because {{owner}} wanted to invite you to become a member of the {{team}} team at {{project}}.",
+    "emails.invitation.hello": "Hello {{user}}",
+    "emails.invitation.body": "This mail was sent to you because {{b}}{{owner}}{{/b}} wanted to invite you to become a member of the {{b}}{{team}}{{/b}} team at {{b}}{{project}}{{/b}}.",
     "emails.invitation.footer": "If you are not interested, you can ignore this message.",
     "emails.invitation.thanks": "Thanks",
     "emails.invitation.signature": "{{project}} team",

app/config/platforms.php

@@ -303,7 +303,7 @@ return [
             [
                 'key' => 'ruby',
                 'name' => 'Ruby',
-                'version' => '10.1.0',
+                'version' => '10.1.1',
                 'url' => 'https://github.com/appwrite/sdk-for-ruby',
                 'package' => 'https://rubygems.org/gems/appwrite',
                 'enabled' => true,

app/config/regions.php

@@ -2,8 +2,73 @@
 
 return [
     'default' => [
-        'name' => 'Default',
-        'default' => true,
+        '$id' => 'default',
+        'name' => 'Frankfurt',
         'disabled' => false,
-    ]
+        'flag' => 'de',
+        'default' => true,
+    ],
+    'fra' => [
+        '$id' => 'fra',
+        'name' => 'Frankfurt',
+        'disabled' => false,
+        'flag' => 'de',
+        'default' => true,
+    ],
+    'nyc' => [
+        '$id' => 'nyc',
+        'name' => 'New York',
+        'disabled' => true,
+        'flag' => 'us',
+        'default' => true,
+    ],
+    'sfo' => [
+        '$id' => 'sfo',
+        'name' => 'San Francisco',
+        'disabled' => true,
+        'flag' => 'us',
+        'default' => true,
+    ],
+    'blr' => [
+        '$id' => 'blr',
+        'name' => 'Banglore',
+        'disabled' => true,
+        'flag' => 'in',
+        'default' => true,
+    ],
+    'lon' => [
+        '$id' => 'lon',
+        'name' => 'London',
+        'disabled' => true,
+        'flag' => 'gb',
+        'default' => true,
+    ],
+    'ams' => [
+        '$id' => 'ams',
+        'name' => 'Amsterdam',
+        'disabled' => true,
+        'flag' => 'nl',
+        'default' => true,
+    ],
+    'sgp' => [
+        '$id' => 'sgp',
+        'name' => 'Singapore',
+        'disabled' => true,
+        'flag' => 'sg',
+        'default' => true,
+    ],
+    'tor' => [
+        '$id' => 'tor',
+        'name' => 'Toronto',
+        'disabled' => true,
+        'flag' => 'ca',
+        'default' => true,
+    ],
+    'syd' => [
+        '$id' => 'syd',
+        'name' => 'Sydney',
+        'disabled' => true,
+        'flag' => 'au',
+        'default' => true,
+    ],
 ];

app/config/roles.php

@@ -9,8 +9,7 @@ $member = [
     'console',
     'graphql',
     'sessions.write',
-    'accounts.read',
-    'accounts.write',
+    'account',
     'teams.read',
     'teams.write',
     'documents.read',

app/config/runtimes.php

@@ -1,16 +1,9 @@
 <?php
 
 /**
- * List of Appwrite Cloud Functions supported runtimes
+ * List of Appwrite Functions supported runtimes
  */
 
-use Utopia\App;
 use Appwrite\Runtimes\Runtimes;
 
-$runtimes = new Runtimes('v3');
-
-$allowList = empty(App::getEnv('_APP_FUNCTIONS_RUNTIMES')) ? [] : \explode(',', App::getEnv('_APP_FUNCTIONS_RUNTIMES'));
-
-$runtimes = $runtimes->getAll(true, $allowList);
-
-return $runtimes;
+return (new Runtimes('v3'))->getAll();

app/config/scopes.php

@@ -1,12 +1,6 @@
 <?php
 
 return [ // List of publicly visible scopes
-    'accounts.read' => [
-        'description' => 'Access to read your active user account',
-    ],
-    'accounts.write' => [
-        'description' => 'Access to create, update, and delete your active user account',
-    ],
     'sessions.write' => [
         'description' => 'Access to create, update, and delete user sessions',
     ],

app/controllers/api/account.php

@@ -163,6 +163,11 @@ App::post('/v1/account')
             $user = Authorization::skip(fn() => $dbForProject->createDocument('users', $user));
             try {
                 $target = Authorization::skip(fn() => $dbForProject->createDocument('targets', new Document([
+                    '$permissions' => [
+                        Permission::read(Role::user($user->getId())),
+                        Permission::update(Role::user($user->getId())),
+                        Permission::delete(Role::user($user->getId())),
+                    ],
                     'userId' => $user->getId(),
                     'userInternalId' => $user->getInternalId(),
                     'providerType' => MESSAGE_TYPE_EMAIL,
@@ -261,7 +266,7 @@ App::post('/v1/account/sessions/email')
                 'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
                 'userAgent' => $request->getUserAgent('UNKNOWN'),
                 'ip' => $request->getIP(),
-                'factors' => ['email'],
+                'factors' => ['password'],
                 'countryCode' => ($record) ? \strtolower($record['country']['iso_code']) : '--',
                 'expire' => DateTime::addSeconds(new \DateTime(), $duration)
             ],
@@ -337,14 +342,11 @@ App::get('/v1/account/sessions/oauth2/:provider')
     ->param('provider', '', new WhiteList(\array_keys(Config::getParam('oAuthProviders')), true), 'OAuth2 Provider. Currently, supported providers are: ' . \implode(', ', \array_keys(\array_filter(Config::getParam('oAuthProviders'), fn($node) => (!$node['mock'])))) . '.')
     ->param('success', '', fn($clients) => new Host($clients), 'URL to redirect back to your app after a successful login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['clients'])
     ->param('failure', '', fn($clients) => new Host($clients), 'URL to redirect back to your app after a failed login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['clients'])
-    ->param('token', false, new Boolean(true), 'Include token credentials in the final redirect, useful for server-side integrations, or when cookies are not available.', true)
     ->param('scopes', [], new ArrayList(new Text(APP_LIMIT_ARRAY_ELEMENT_SIZE), APP_LIMIT_ARRAY_PARAMS_SIZE), 'A list of custom OAuth2 scopes. Check each provider internal docs for a list of supported scopes. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' scopes are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long.', true)
     ->inject('request')
     ->inject('response')
     ->inject('project')
-    ->action(function (string $provider, string $success, string $failure, mixed $token, array $scopes, Request $request, Response $response, Document $project) use ($oauthDefaultSuccess, $oauthDefaultFailure) {
-        $token = in_array($token, ['true', true], true);
-
+    ->action(function (string $provider, string $success, string $failure, array $scopes, Request $request, Response $response, Document $project) use ($oauthDefaultSuccess, $oauthDefaultFailure) {
         $protocol = $request->getProtocol();
 
         $callback = $protocol . '://' . $request->getHostname() . '/v1/account/sessions/oauth2/callback/' . $provider . '/' . $project->getId();
@@ -383,7 +385,77 @@ App::get('/v1/account/sessions/oauth2/:provider')
         $oauth2 = new $className($appId, $appSecret, $callback, [
             'success' => $success,
             'failure' => $failure,
-            'token' => $token,
+            'token' => false,
+        ], $scopes);
+
+        $response
+            ->addHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
+            ->addHeader('Pragma', 'no-cache')
+            ->redirect($oauth2->getLoginURL());
+    });
+
+App::get('/v1/account/tokens/oauth2/:provider')
+    ->desc('Create OAuth2 token')
+    ->groups(['api', 'account'])
+    ->label('error', __DIR__ . '/../../views/general/error.phtml')
+    ->label('scope', 'sessions.write')
+    ->label('sdk.auth', [])
+    ->label('sdk.hideServer', true)
+    ->label('sdk.namespace', 'account')
+    ->label('sdk.method', 'createOAuth2Token')
+    ->label('sdk.description', '/docs/references/account/create-token-oauth2.md')
+    ->label('sdk.response.code', Response::STATUS_CODE_MOVED_PERMANENTLY)
+    ->label('sdk.response.type', Response::CONTENT_TYPE_HTML)
+    ->label('sdk.methodType', 'webAuth')
+    ->label('abuse-limit', 50)
+    ->label('abuse-key', 'ip:{ip}')
+    ->param('provider', '', new WhiteList(\array_keys(Config::getParam('oAuthProviders')), true), 'OAuth2 Provider. Currently, supported providers are: ' . \implode(', ', \array_keys(\array_filter(Config::getParam('oAuthProviders'), fn($node) => (!$node['mock'])))) . '.')
+    ->param('success', '', fn($clients) => new Host($clients), 'URL to redirect back to your app after a successful login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['clients'])
+    ->param('failure', '', fn($clients) => new Host($clients), 'URL to redirect back to your app after a failed login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['clients'])
+    ->param('scopes', [], new ArrayList(new Text(APP_LIMIT_ARRAY_ELEMENT_SIZE), APP_LIMIT_ARRAY_PARAMS_SIZE), 'A list of custom OAuth2 scopes. Check each provider internal docs for a list of supported scopes. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' scopes are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long.', true)
+    ->inject('request')
+    ->inject('response')
+    ->inject('project')
+    ->action(function (string $provider, string $success, string $failure, array $scopes, Request $request, Response $response, Document $project) use ($oauthDefaultSuccess, $oauthDefaultFailure) {
+        $protocol = $request->getProtocol();
+
+        $callback = $protocol . '://' . $request->getHostname() . '/v1/account/sessions/oauth2/callback/' . $provider . '/' . $project->getId();
+        $providerEnabled = $project->getAttribute('oAuthProviders', [])[$provider . 'Enabled'] ?? false;
+
+        if (!$providerEnabled) {
+            throw new Exception(Exception::PROJECT_PROVIDER_DISABLED, 'This provider is disabled. Please enable the provider from your ' . APP_NAME . ' console to continue.');
+        }
+
+        $appId = $project->getAttribute('oAuthProviders', [])[$provider . 'Appid'] ?? '';
+        $appSecret = $project->getAttribute('oAuthProviders', [])[$provider . 'Secret'] ?? '{}';
+
+        if (!empty($appSecret) && isset($appSecret['version'])) {
+            $key = App::getEnv('_APP_OPENSSL_KEY_V' . $appSecret['version']);
+            $appSecret = OpenSSL::decrypt($appSecret['data'], $appSecret['method'], $key, 0, \hex2bin($appSecret['iv']), \hex2bin($appSecret['tag']));
+        }
+
+        if (empty($appId) || empty($appSecret)) {
+            throw new Exception(Exception::PROJECT_PROVIDER_DISABLED, 'This provider is disabled. Please configure the provider app ID and app secret key from your ' . APP_NAME . ' console to continue.');
+        }
+
+        $className = 'Appwrite\\Auth\\OAuth2\\' . \ucfirst($provider);
+
+        if (!\class_exists($className)) {
+            throw new Exception(Exception::PROJECT_PROVIDER_UNSUPPORTED);
+        }
+
+        if (empty($success)) {
+            $success = $protocol . '://' . $request->getHostname() . $oauthDefaultSuccess;
+        }
+
+        if (empty($failure)) {
+            $failure = $protocol . '://' . $request->getHostname() . $oauthDefaultFailure;
+        }
+
+        $oauth2 = new $className($appId, $appSecret, $callback, [
+            'success' => $success,
+            'failure' => $failure,
+            'token' => true,
         ], $scopes);
 
         $response
@@ -707,7 +779,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                     $userDoc = Authorization::skip(fn() => $dbForProject->createDocument('users', $user));
                     $dbForProject->createDocument('targets', new Document([
                         '$permissions' => [
-                            Permission::read(Role::any()),
+                            Permission::read(Role::user($user->getId())),
                             Permission::update(Role::user($user->getId())),
                             Permission::delete(Role::user($user->getId())),
                         ],
@@ -893,7 +965,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
 App::get('/v1/account/identities')
     ->desc('List Identities')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listIdentities')
@@ -949,7 +1021,7 @@ App::get('/v1/account/identities')
 App::delete('/v1/account/identities/:identityId')
     ->desc('Delete identity')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].identities.[identityId].delete')
     ->label('audits.event', 'identity.delete')
     ->label('audits.resource', 'identity/{request.$identityId}')
@@ -1187,15 +1259,16 @@ App::post('/v1/account/tokens/magic-url')
 
         $emailVariables = [
             'direction' => $locale->getText('settings.direction'),
-            /* {{user}}, {{team}}, {{redirect}} and {{project}} are required in default and custom templates */
-            'user' => '',
-            'team' => '',
+            // {{user}}, {{redirect}} and {{project}} are required in default and custom templates
+            'user' => $user->getAttribute('name'),
             'project' => $project->getAttribute('name'),
             'redirect' => $url,
-            'agentDevice' => '<strong>' . ( $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN') . '</strong>',
-            'agentClient' => '<strong>' . ($agentClient['clientName'] ?? 'UNKNOWN') . '</strong>',
-            'agentOs' => '<strong>' . ($agentOs['osName'] ?? 'UNKNOWN') . '</strong>',
-            'phrase' => '<strong>' . (!empty($phrase) ? $phrase : '') . '</strong>'
+            'agentDevice' => $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN',
+            'agentClient' => $agentClient['clientName'] ?? 'UNKNOWN',
+            'agentOs' => $agentOs['osName'] ?? 'UNKNOWN',
+            'phrase' => !empty($phrase) ? $phrase : '',
+            // TODO: remove unnecessary team variable from this email
+            'team' => '',
         ];
 
         $queueForMails
@@ -1415,15 +1488,16 @@ App::post('/v1/account/tokens/email')
 
         $emailVariables = [
             'direction' => $locale->getText('settings.direction'),
-            /* {{user}} ,{{team}}, {{project}} and {{otp}} are required in the templates */
-            'user' => '',
-            'team' => '',
+            // {{user}}, {{project}} and {{otp}} are required in the templates
+            'user' => $user->getAttribute('name'),
             'project' => $project->getAttribute('name'),
             'otp' => $tokenSecret,
-            'agentDevice' => '<strong>' . ( $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN') . '</strong>',
-            'agentClient' => '<strong>' . ($agentClient['clientName'] ?? 'UNKNOWN') . '</strong>',
-            'agentOs' => '<strong>' . ($agentOs['osName'] ?? 'UNKNOWN') . '</strong>',
-            'phrase' => '<strong>' . (!empty($phrase) ? $phrase : '') . '</strong>'
+            'agentDevice' => $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN',
+            'agentClient' => $agentClient['clientName'] ?? 'UNKNOWN',
+            'agentOs' => $agentOs['osName'] ?? 'UNKNOWN',
+            'phrase' => !empty($phrase) ? $phrase : '',
+            // TODO: remove unnecessary team variable from this email
+            'team' => '',
         ];
 
         $queueForMails
@@ -1699,6 +1773,11 @@ App::post('/v1/account/tokens/phone')
             Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
             try {
                 $target = Authorization::skip(fn() => $dbForProject->createDocument('targets', new Document([
+                    '$permissions' => [
+                        Permission::read(Role::user($user->getId())),
+                        Permission::update(Role::user($user->getId())),
+                        Permission::delete(Role::user($user->getId())),
+                    ],
                     'userId' => $user->getId(),
                     'userInternalId' => $user->getInternalId(),
                     'providerType' => MESSAGE_TYPE_SMS,
@@ -1763,10 +1842,10 @@ App::post('/v1/account/tokens/phone')
         ]);
 
         $queueForMessaging
+            ->setType(MESSAGE_SEND_TYPE_INTERNAL)
             ->setMessage($messageDoc)
             ->setRecipients([$phone])
-            ->setProviderType(MESSAGE_TYPE_SMS)
-            ->trigger();
+            ->setProviderType(MESSAGE_TYPE_SMS);
 
         $queueForEvents->setPayload(
             $response->output(
@@ -1930,7 +2009,7 @@ App::post('/v1/account/sessions/anonymous')
 App::post('/v1/account/jwt')
     ->desc('Create JWT')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('auth.type', 'jwt')
     ->label('sdk.auth', [])
     ->label('sdk.namespace', 'account')
@@ -1977,7 +2056,7 @@ App::post('/v1/account/jwt')
 App::get('/v1/account')
     ->desc('Get account')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'get')
@@ -2000,7 +2079,7 @@ App::get('/v1/account')
 App::get('/v1/account/prefs')
     ->desc('Get account preferences')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'getPrefs')
@@ -2022,7 +2101,7 @@ App::get('/v1/account/prefs')
 App::get('/v1/account/sessions')
     ->desc('List sessions')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listSessions')
@@ -2057,7 +2136,7 @@ App::get('/v1/account/sessions')
 App::get('/v1/account/logs')
     ->desc('List logs')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listLogs')
@@ -2114,7 +2193,7 @@ App::get('/v1/account/logs')
         }
 
         $response->dynamic(new Document([
-            'total' => $audit->countLogsByUser($user->getId()),
+            'total' => $audit->countLogsByUser($user->getInternalId()),
             'logs' => $output,
         ]), Response::MODEL_LOG_LIST);
     });
@@ -2122,7 +2201,7 @@ App::get('/v1/account/logs')
 App::get('/v1/account/sessions/:sessionId')
     ->desc('Get session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'getSession')
@@ -2164,7 +2243,7 @@ App::patch('/v1/account/name')
     ->desc('Update name')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.name')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2197,7 +2276,7 @@ App::patch('/v1/account/password')
     ->desc('Update password')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.password')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -2266,7 +2345,7 @@ App::patch('/v1/account/email')
     ->desc('Update email')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.email')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2358,7 +2437,7 @@ App::patch('/v1/account/phone')
     ->desc('Update phone')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.phone')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2439,7 +2518,7 @@ App::patch('/v1/account/prefs')
     ->desc('Update preferences')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.prefs')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2472,7 +2551,7 @@ App::patch('/v1/account/status')
     ->desc('Update status')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.status')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
@@ -2514,7 +2593,7 @@ App::patch('/v1/account/status')
 App::delete('/v1/account/sessions/:sessionId')
     ->desc('Delete session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].delete')
     ->label('audits.event', 'session.delete')
     ->label('audits.resource', 'user/{user.$id}')
@@ -2594,7 +2673,7 @@ App::delete('/v1/account/sessions/:sessionId')
 App::patch('/v1/account/sessions/:sessionId')
     ->desc('Update (or renew) a session')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].update')
     ->label('audits.event', 'session.update')
     ->label('audits.resource', 'user/{response.userId}')
@@ -2670,7 +2749,7 @@ App::patch('/v1/account/sessions/:sessionId')
 App::delete('/v1/account/sessions')
     ->desc('Delete sessions')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[sessionId].delete')
     ->label('audits.event', 'session.delete')
     ->label('audits.resource', 'user/{user.$id}')
@@ -2876,11 +2955,12 @@ App::post('/v1/account/recovery')
 
         $emailVariables = [
             'direction' => $locale->getText('settings.direction'),
-            /* {{user}}, {{team}}, {{redirect}} and {{project}} are required in default and custom templates */
+            // {{user}}, {{redirect}} and {{project}} are required in default and custom templates
             'user' => $profile->getAttribute('name'),
-            'team' => '',
             'redirect' => $url,
-            'project' => $projectName
+            'project' => $projectName,
+            // TODO: remove unnecessary team variable from this email
+            'team' => ''
         ];
 
         $queueForMails
@@ -2997,7 +3077,7 @@ App::put('/v1/account/recovery')
 App::post('/v1/account/verification')
     ->desc('Create email verification')
     ->groups(['api', 'account'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].verification.[tokenId].create')
     ->label('audits.event', 'verification.create')
     ->label('audits.resource', 'user/{response.userId}')
@@ -3123,11 +3203,12 @@ App::post('/v1/account/verification')
 
         $emailVariables = [
             'direction' => $locale->getText('settings.direction'),
-            /* {{user}}, {{team}}, {{redirect}} and {{project}} are required in default and custom templates */
+            // {{user}}, {{redirect}} and {{project}} are required in default and custom templates
             'user' => $user->getAttribute('name'),
-            'team' => '',
             'redirect' => $url,
-            'project' => $projectName
+            'project' => $projectName,
+            // TODO: remove unnecessary team variable from this email
+            'team' => '',
         ];
 
         $queueForMails
@@ -3217,7 +3298,7 @@ App::put('/v1/account/verification')
 App::post('/v1/account/verification/phone')
     ->desc('Create phone verification')
     ->groups(['api', 'account', 'auth'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('auth.type', 'phone')
     ->label('event', 'users.[userId].verification.[tokenId].create')
     ->label('audits.event', 'verification.create')
@@ -3304,10 +3385,10 @@ App::post('/v1/account/verification/phone')
         ]);
 
         $queueForMessaging
+            ->setType(MESSAGE_SEND_TYPE_INTERNAL)
             ->setMessage($messageDoc)
             ->setRecipients([$user->getAttribute('phone')])
-            ->setProviderType(MESSAGE_TYPE_SMS)
-            ->trigger();
+            ->setProviderType(MESSAGE_TYPE_SMS);
 
         $queueForEvents
             ->setParam('userId', $user->getId())
@@ -3388,7 +3469,7 @@ App::patch('/v1/account/mfa')
     ->desc('Update MFA')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3421,14 +3502,14 @@ App::patch('/v1/account/mfa')
 App::get('/v1/account/mfa/factors')
     ->desc('List Factors')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.read')
+    ->label('scope', 'account')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'listFactors')
-    ->label('sdk.description', '/docs/references/account/get.md')
+    ->label('sdk.description', '/docs/references/account/list-factors.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
-    ->label('sdk.response.model', Response::MODEL_MFA_PROVIDERS)
+    ->label('sdk.response.model', Response::MODEL_MFA_FACTORS)
     ->label('sdk.offline.model', '/account')
     ->label('sdk.offline.key', 'current')
     ->inject('response')
@@ -3441,38 +3522,38 @@ App::get('/v1/account/mfa/factors')
             'phone' => $user->getAttribute('phone', false) && $user->getAttribute('phoneVerification', false)
         ]);
 
-        $response->dynamic($providers, Response::MODEL_MFA_PROVIDERS);
+        $response->dynamic($providers, Response::MODEL_MFA_FACTORS);
     });
 
-App::post('/v1/account/mfa/:factor')
+App::post('/v1/account/mfa/:type')
     ->desc('Add Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'addAuthenticator')
-    ->label('sdk.description', '/docs/references/account/update-mfa.md')
+    ->label('sdk.description', '/docs/references/account/add-authenticator.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
-    ->label('sdk.response.model', Response::MODEL_MFA_PROVIDER)
+    ->label('sdk.response.model', Response::MODEL_MFA_TYPE)
     ->label('sdk.offline.model', '/account')
     ->label('sdk.offline.key', 'current')
-    ->param('factor', null, new WhiteList(['totp']), 'Factor.')
+    ->param('type', null, new WhiteList(['totp']), 'Type of authenticator.')
     ->inject('requestTimestamp')
     ->inject('response')
     ->inject('project')
     ->inject('user')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $factor, ?\DateTime $requestTimestamp, Response $response, Document $project, Document $user, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $type, ?\DateTime $requestTimestamp, Response $response, Document $project, Document $user, Database $dbForProject, Event $queueForEvents) {
 
-        $otp = match ($factor) {
+        $otp = match ($type) {
             'totp' => new TOTP(),
-            default => throw new Exception(Exception::GENERAL_UNKNOWN, 'Unknown provider.')
+            default => throw new Exception(Exception::GENERAL_UNKNOWN, 'Unknown type.')
         };
 
         $otp->setLabel($user->getAttribute('email'));
@@ -3481,7 +3562,7 @@ App::post('/v1/account/mfa/:factor')
         $backups = Provider::generateBackupCodes();
 
     if ($user->getAttribute('totp') && $user->getAttribute('totpVerification')) {
-        throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP already exists.');
+        throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP already exists on this account.');
     }
 
         $user
@@ -3500,27 +3581,27 @@ App::post('/v1/account/mfa/:factor')
 
         $queueForEvents->setParam('userId', $user->getId());
 
-        $response->dynamic($model, Response::MODEL_MFA_PROVIDER);
+        $response->dynamic($model, Response::MODEL_MFA_TYPE);
     });
 
-App::put('/v1/account/mfa/:factor')
+App::put('/v1/account/mfa/:type')
     ->desc('Verify Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].update.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_SESSION, APP_AUTH_TYPE_JWT])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'verifyAuthenticator')
-    ->label('sdk.description', '/docs/references/account/update-mfa.md')
+    ->label('sdk.description', '/docs/references/account/verify-authenticator.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_USER)
     ->label('sdk.offline.model', '/account')
     ->label('sdk.offline.key', 'current')
-    ->param('factor', null, new WhiteList(['totp']), 'Factor.')
+    ->param('type', null, new WhiteList(['totp']), 'Type of authenticator.')
     ->param('otp', '', new Text(256), 'Valid verification token.')
     ->inject('requestTimestamp')
     ->inject('response')
@@ -3528,9 +3609,9 @@ App::put('/v1/account/mfa/:factor')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $factor, string $otp, ?\DateTime $requestTimestamp, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $type, string $otp, ?\DateTime $requestTimestamp, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {
 
-        $success = match ($factor) {
+        $success = match ($type) {
             'totp' => Challenge\TOTP::verify($user, $otp),
             default => false
         };
@@ -3540,9 +3621,9 @@ App::put('/v1/account/mfa/:factor')
     }
 
     if (!$user->getAttribute('totp')) {
-        throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP not added.');
+        throw new Exception(Exception::GENERAL_UNKNOWN, 'Authenticator needs to be added first.');
     } elseif ($user->getAttribute('totpVerification')) {
-        throw new Exception(Exception::GENERAL_UNKNOWN, 'TOTP already verified.');
+        throw new Exception(Exception::GENERAL_UNKNOWN, 'Authenticator already verified on this account.');
     }
 
         $user->setAttribute('totpVerification', true);
@@ -3552,18 +3633,18 @@ App::put('/v1/account/mfa/:factor')
         $authDuration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
         $sessionId = Auth::sessionVerify($user->getAttribute('sessions', []), Auth::$secret, $authDuration);
         $session = $dbForProject->getDocument('sessions', $sessionId);
-        $dbForProject->updateDocument('sessions', $sessionId, $session->setAttribute('factors', $provider, Document::SET_TYPE_APPEND));
+        $dbForProject->updateDocument('sessions', $sessionId, $session->setAttribute('factors', $type, Document::SET_TYPE_APPEND));
 
         $queueForEvents->setParam('userId', $user->getId());
 
         $response->dynamic($user, Response::MODEL_ACCOUNT);
     });
 
-App::delete('/v1/account/mfa/:provider')
+App::delete('/v1/account/mfa/:type')
     ->desc('Delete Authenticator')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].delete.mfa')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.update')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('audits.userId', '{response.$id}')
@@ -3574,16 +3655,16 @@ App::delete('/v1/account/mfa/:provider')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_USER)
-    ->param('provider', null, new WhiteList(['totp']), 'Provider.')
+    ->param('type', null, new WhiteList(['totp']), 'Type of authenticator.')
     ->param('otp', '', new Text(256), 'Valid verification token.')
     ->inject('requestTimestamp')
     ->inject('response')
     ->inject('user')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $provider, string $otp, ?\DateTime $requestTimestamp, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $type, string $otp, ?\DateTime $requestTimestamp, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {
 
-        $success = match ($provider) {
+        $success = match ($type) {
             'totp' => Challenge\TOTP::verify($user, $otp),
             default => false
         };
@@ -3610,40 +3691,40 @@ App::delete('/v1/account/mfa/:provider')
     });
 
 App::post('/v1/account/mfa/challenge')
-    ->desc('Create MFA Challenge')
+    ->desc('Create 2FA Challenge')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].challenges.[challengeId].create')
-    ->label('auth.type', 'createChallenge')
     ->label('audits.event', 'challenge.create')
     ->label('audits.resource', 'user/{response.userId}')
     ->label('audits.userId', '{response.userId}')
     ->label('sdk.auth', [])
     ->label('sdk.namespace', 'account')
     ->label('sdk.method', 'createChallenge')
-    ->label('sdk.description', '/docs/references/account/create-challenge.md')
+    ->label('sdk.description', '/docs/references/account/create-2fa-challenge.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_MFA_CHALLENGE)
     ->label('abuse-limit', 10)
     ->label('abuse-key', 'url:{url},token:{param-token}')
-    ->param('provider', '', new WhiteList(['totp', 'phone', 'email']), 'provider.')
+    ->param('factor', '', new WhiteList(['totp', 'phone', 'email']), 'Factor used for verification.')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('user')
+    ->inject('locale')
     ->inject('project')
+    ->inject('request')
     ->inject('queueForEvents')
     ->inject('queueForMessaging')
     ->inject('queueForMails')
-    ->inject('locale')
-    ->action(function (string $provider, Response $response, Database $dbForProject, Document $user, Document $project, Event $queueForEvents, Messaging $queueForMessaging, Mail $queueForMails, Locale $locale) {
+    ->action(function (string $factor, Response $response, Database $dbForProject, Document $user, Locale $locale, Document $project, Request $request, Event $queueForEvents, Messaging $queueForMessaging, Mail $queueForMails) {
 
         $expire = DateTime::addSeconds(new \DateTime(), Auth::TOKEN_EXPIRATION_CONFIRM);
         $code = Auth::codeGenerator();
         $challenge = new Document([
             'userId' => $user->getId(),
             'userInternalId' => $user->getInternalId(),
-            'provider' => $provider,
+            'provider' => $factor,
             'token' => Auth::tokenGenerator(),
             'code' => $code,
             'expire' => $expire,
@@ -3656,7 +3737,7 @@ App::post('/v1/account/mfa/challenge')
 
         $challenge = $dbForProject->createDocument('challenges', $challenge);
 
-        switch ($provider) {
+        switch ($factor) {
             case 'phone':
                 if (empty(App::getEnv('_APP_SMS_PROVIDER'))) {
                     throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
@@ -3668,7 +3749,24 @@ App::post('/v1/account/mfa/challenge')
                     throw new Exception(Exception::USER_PHONE_NOT_VERIFIED);
                 }
 
+                $message = Template::fromFile(__DIR__ . '/../../config/locale/templates/sms-base.tpl');
+
+                $customTemplate = $project->getAttribute('templates', [])['sms.mfaChallenge-' . $locale->default] ?? [];
+                if (!empty($customTemplate)) {
+                    $message = $customTemplate['message'] ?? $message;
+                }
+
+                $messageContent = Template::fromString($locale->getText("sms.verification.body"));
+                $messageContent
+                    ->setParam('{{project}}', $project->getAttribute('name'))
+                    ->setParam('{{secret}}', $code);
+                $messageContent = \strip_tags($messageContent->render());
+                $message = $message->setParam('{{token}}', $messageContent);
+
+                $message = $message->render();
+
                 $queueForMessaging
+                    ->setType(MESSAGE_SEND_TYPE_INTERNAL)
                     ->setMessage(new Document([
                         '$id' => $challenge->getId(),
                         'data' => [
@@ -3676,7 +3774,7 @@ App::post('/v1/account/mfa/challenge')
                         ],
                     ]))
                     ->setRecipients([$user->getAttribute('phone')])
-                    ->trigger();
+                    ->setProviderType(MESSAGE_TYPE_SMS);
                 break;
             case 'email':
                 if (empty(App::getEnv('_APP_SMTP_HOST'))) {
@@ -3689,9 +3787,85 @@ App::post('/v1/account/mfa/challenge')
                     throw new Exception(Exception::USER_EMAIL_NOT_VERIFIED);
                 }
 
+                $subject = $locale->getText("emails.mfaChallenge.subject");
+                $customTemplate = $project->getAttribute('templates', [])['email.mfaChallenge-' . $locale->default] ?? [];
+
+                $detector = new Detector($request->getUserAgent('UNKNOWN'));
+                $agentOs = $detector->getOS();
+                $agentClient = $detector->getClient();
+                $agentDevice = $detector->getDevice();
+
+                $message = Template::fromFile(__DIR__ . '/../../config/locale/templates/email-mfa-challenge.tpl');
+                $message
+                    ->setParam('{{hello}}', $locale->getText("emails.mfaChallenge.hello"))
+                    ->setParam('{{description}}', $locale->getText("emails.mfaChallenge.description"))
+                    ->setParam('{{clientInfo}}', $locale->getText("emails.mfaChallenge.clientInfo"))
+                    ->setParam('{{thanks}}', $locale->getText("emails.mfaChallenge.thanks"))
+                    ->setParam('{{signature}}', $locale->getText("emails.mfaChallenge.signature"));
+
+                $body = $message->render();
+
+                $smtp = $project->getAttribute('smtp', []);
+                $smtpEnabled = $smtp['enabled'] ?? false;
+
+                $senderEmail = App::getEnv('_APP_SYSTEM_EMAIL_ADDRESS', APP_EMAIL_TEAM);
+                $senderName = App::getEnv('_APP_SYSTEM_EMAIL_NAME', APP_NAME . ' Server');
+                $replyTo = "";
+
+                if ($smtpEnabled) {
+                    if (!empty($smtp['senderEmail'])) {
+                        $senderEmail = $smtp['senderEmail'];
+                    }
+                    if (!empty($smtp['senderName'])) {
+                        $senderName = $smtp['senderName'];
+                    }
+                    if (!empty($smtp['replyTo'])) {
+                        $replyTo = $smtp['replyTo'];
+                    }
+
+                    $queueForMails
+                        ->setSmtpHost($smtp['host'] ?? '')
+                        ->setSmtpPort($smtp['port'] ?? '')
+                        ->setSmtpUsername($smtp['username'] ?? '')
+                        ->setSmtpPassword($smtp['password'] ?? '')
+                        ->setSmtpSecure($smtp['secure'] ?? '');
+
+                    if (!empty($customTemplate)) {
+                        if (!empty($customTemplate['senderEmail'])) {
+                            $senderEmail = $customTemplate['senderEmail'];
+                        }
+                        if (!empty($customTemplate['senderName'])) {
+                            $senderName = $customTemplate['senderName'];
+                        }
+                        if (!empty($customTemplate['replyTo'])) {
+                            $replyTo = $customTemplate['replyTo'];
+                        }
+
+                        $body = $customTemplate['message'] ?? '';
+                        $subject = $customTemplate['subject'] ?? $subject;
+                    }
+
+                    $queueForMails
+                        ->setSmtpReplyTo($replyTo)
+                        ->setSmtpSenderEmail($senderEmail)
+                        ->setSmtpSenderName($senderName);
+                }
+
+                $emailVariables = [
+                    'direction' => $locale->getText('settings.direction'),
+                    // {{user}}, {{project}} and {{otp}} are required in the templates
+                    'user' => $user->getAttribute('name'),
+                    'project' => $project->getAttribute('name'),
+                    'otp' => $code,
+                    'agentDevice' => $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN',
+                    'agentClient' => $agentClient['clientName'] ?? 'UNKNOWN',
+                    'agentOs' => $agentOs['osName'] ?? 'UNKNOWN'
+                ];
+
                 $queueForMails
-                    ->setSubject("{$code} is your 6-digit code")
-                    ->setBody($code)
+                    ->setSubject($subject)
+                    ->setBody($body)
+                    ->setVariables($emailVariables)
                     ->setRecipient($user->getAttribute('email'))
                     ->trigger();
                 break;
@@ -3707,7 +3881,7 @@ App::post('/v1/account/mfa/challenge')
 App::put('/v1/account/mfa/challenge')
     ->desc('Create MFA Challenge (confirmation)')
     ->groups(['api', 'account', 'mfa'])
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('event', 'users.[userId].sessions.[tokenId].create')
     ->label('audits.event', 'challenges.update')
     ->label('audits.resource', 'user/{response.userId}')
@@ -3720,7 +3894,7 @@ App::put('/v1/account/mfa/challenge')
     ->label('sdk.response.model', Response::MODEL_SESSION)
     ->label('abuse-limit', 10)
     ->label('abuse-key', 'userId:{param-userId}')
-    ->param('challengeId', '', new Text(256), 'Valid verification token.')
+    ->param('challengeId', '', new Text(256), 'ID of the challenge.')
     ->param('otp', '', new Text(256), 'Valid verification token.')
     ->inject('project')
     ->inject('response')
@@ -3766,6 +3940,9 @@ App::put('/v1/account/mfa/challenge')
 
         $dbForProject->updateDocument('sessions', $sessionId, $session->setAttribute('factors', $provider, Document::SET_TYPE_APPEND));
 
+        $queueForEvents
+            ->setParam('userId', $user->getId());
+
         $response->dynamic($session, Response::MODEL_SESSION);
     });
 
@@ -3773,7 +3950,7 @@ App::delete('/v1/account')
     ->desc('Delete account')
     ->groups(['api', 'account'])
     ->label('event', 'users.[userId].delete')
-    ->label('scope', 'accounts.write')
+    ->label('scope', 'account')
     ->label('audits.event', 'user.delete')
     ->label('audits.resource', 'user/{response.$id}')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN])
@@ -3783,15 +3960,27 @@ App::delete('/v1/account')
     ->label('sdk.response.code', Response::STATUS_CODE_NOCONTENT)
     ->label('sdk.response.model', Response::MODEL_NONE)
     ->inject('user')
+    ->inject('project')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
     ->inject('queueForDeletes')
-    ->action(function (Document $user, Response $response, Database $dbForProject, Event $queueForEvents, Delete $queueForDeletes) {
+    ->action(function (Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents, Delete $queueForDeletes) {
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
+        if ($project->getId() === 'console') {
+            // get all memberships
+            $memberships = $user->getAttribute('memberships', []);
+            foreach ($memberships as $membership) {
+                // prevent deletion if at least one active membership
+                if ($membership->getAttribute('confirm', false)) {
+                    throw new Exception(Exception::USER_DELETION_PROHIBITED);
+                }
+            }
+        }
+
         $dbForProject->deleteDocument('users', $user->getId());
 
         $queueForDeletes

app/controllers/api/avatars.php

@@ -76,7 +76,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
         }
 
         if (empty($gitHubSession)) {
-            throw new Exception(Exception::GENERAL_UNKNOWN, 'GitHub session not found.');
+            throw new Exception(Exception::USER_SESSION_NOT_FOUND, 'GitHub session not found.');
         }
 
         $provider = $gitHubSession->getAttribute('provider', '');

app/controllers/api/databases.php

@@ -3660,7 +3660,7 @@ App::get('/v1/databases/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -3668,7 +3668,7 @@ App::get('/v1/databases/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),
@@ -3744,7 +3744,7 @@ App::get('/v1/databases/:databaseId/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -3752,7 +3752,7 @@ App::get('/v1/databases/:databaseId/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),
@@ -3830,7 +3830,7 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -3838,7 +3838,7 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),

app/controllers/api/functions.php

@@ -121,9 +121,7 @@ $redeployVcs = function (Request $request, Document $function, Document $project
         ->setType(BUILD_TYPE_DEPLOYMENT)
         ->setResource($function)
         ->setDeployment($deployment)
-        ->setTemplate($template)
-        ->setProject($project)
-        ->trigger();
+        ->setTemplate($template);
 };
 
 App::post('/v1/functions')
@@ -172,6 +170,12 @@ App::post('/v1/functions')
     ->action(function (string $functionId, string $name, string $runtime, array $execute, array $events, string $schedule, int $timeout, bool $enabled, bool $logging, string $entrypoint, string $commands, string $installationId, string $providerRepositoryId, string $providerBranch, bool $providerSilentMode, string $providerRootDirectory, string $templateRepository, string $templateOwner, string $templateRootDirectory, string $templateBranch, Request $request, Response $response, Database $dbForProject, Document $project, Document $user, Event $queueForEvents, Build $queueForBuilds, Database $dbForConsole, GitHub $github) use ($redeployVcs) {
         $functionId = ($functionId == 'unique()') ? ID::unique() : $functionId;
 
+        $allowList = \array_filter(\explode(',', App::getEnv('_APP_FUNCTIONS_RUNTIMES', '')));
+
+        if (!empty($allowList) && !\in_array($runtime, $allowList)) {
+            throw new Exception(Exception::FUNCTION_RUNTIME_UNSUPPORTED, 'Runtime "' . $runtime . '" is not supported');
+        }
+
         // build from template
         $template = new Document([]);
         if (
@@ -229,7 +233,6 @@ App::post('/v1/functions')
             fn () => $dbForConsole->createDocument('schedules', new Document([
                 'region' => App::getEnv('_APP_REGION', 'default'), // Todo replace with projects region
                 'resourceType' => 'function',
-                'resourceCollection' => 'functions',
                 'resourceId' => $function->getId(),
                 'resourceInternalId' => $function->getInternalId(),
                 'resourceUpdatedAt' => DateTime::now(),
@@ -417,17 +420,23 @@ App::get('/v1/functions/runtimes')
     ->label('sdk.response.model', Response::MODEL_RUNTIME_LIST)
     ->inject('response')
     ->action(function (Response $response) {
-
         $runtimes = Config::getParam('runtimes');
 
-        $runtimes = array_map(function ($key) use ($runtimes) {
+        $allowList = \array_filter(\explode(',', App::getEnv('_APP_FUNCTIONS_RUNTIMES', '')));
+
+        $allowed = [];
+        foreach ($runtimes as $key => $runtime) {
+            if (!empty($allowList) && !\in_array($key, $allowList)) {
+                continue;
+            }
+
             $runtimes[$key]['$id'] = $key;
-            return $runtimes[$key];
-        }, array_keys($runtimes));
+            $allowed[] = $runtimes[$key];
+        }
 
         $response->dynamic(new Document([
-            'total' => count($runtimes),
-            'runtimes' => $runtimes
+            'total' => count($allowed),
+            'runtimes' => $allowed
         ]), Response::MODEL_RUNTIME_LIST);
     });
 
@@ -492,7 +501,7 @@ App::get('/v1/functions/:functionId/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -500,7 +509,7 @@ App::get('/v1/functions/:functionId/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),
@@ -584,7 +593,7 @@ App::get('/v1/functions/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -592,7 +601,7 @@ App::get('/v1/functions/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),
@@ -841,8 +850,8 @@ App::get('/v1/functions/:functionId/deployments/:deploymentId/download')
     ->inject('response')
     ->inject('request')
     ->inject('dbForProject')
-    ->inject('deviceFunctions')
-    ->action(function (string $functionId, string $deploymentId, Response $response, Request $request, Database $dbForProject, Device $deviceFunctions) {
+    ->inject('deviceForFunctions')
+    ->action(function (string $functionId, string $deploymentId, Response $response, Request $request, Database $dbForProject, Device $deviceForFunctions) {
 
         $function = $dbForProject->getDocument('functions', $functionId);
         if ($function->isEmpty()) {
@@ -859,7 +868,7 @@ App::get('/v1/functions/:functionId/deployments/:deploymentId/download')
         }
 
         $path = $deployment->getAttribute('path', '');
-        if (!$deviceFunctions->exists($path)) {
+        if (!$deviceForFunctions->exists($path)) {
             throw new Exception(Exception::DEPLOYMENT_NOT_FOUND);
         }
 
@@ -869,7 +878,7 @@ App::get('/v1/functions/:functionId/deployments/:deploymentId/download')
             ->addHeader('X-Peak', \memory_get_peak_usage())
             ->addHeader('Content-Disposition', 'attachment; filename="' . $deploymentId . '.tar.gz"');
 
-        $size = $deviceFunctions->getFileSize($path);
+        $size = $deviceForFunctions->getFileSize($path);
         $rangeHeader = $request->getHeader('range');
 
         if (!empty($rangeHeader)) {
@@ -891,13 +900,13 @@ App::get('/v1/functions/:functionId/deployments/:deploymentId/download')
                 ->addHeader('Content-Length', $end - $start + 1)
                 ->setStatusCode(Response::STATUS_CODE_PARTIALCONTENT);
 
-            $response->send($deviceFunctions->read($path, $start, ($end - $start + 1)));
+            $response->send($deviceForFunctions->read($path, $start, ($end - $start + 1)));
         }
 
         if ($size > APP_STORAGE_READ_BUFFER) {
             for ($i = 0; $i < ceil($size / MAX_OUTPUT_CHUNK_SIZE); $i++) {
                 $response->chunk(
-                    $deviceFunctions->read(
+                    $deviceForFunctions->read(
                         $path,
                         ($i * MAX_OUTPUT_CHUNK_SIZE),
                         min(MAX_OUTPUT_CHUNK_SIZE, $size - ($i * MAX_OUTPUT_CHUNK_SIZE))
@@ -906,7 +915,7 @@ App::get('/v1/functions/:functionId/deployments/:deploymentId/download')
                 );
             }
         } else {
-            $response->send($deviceFunctions->read($path));
+            $response->send($deviceForFunctions->read($path));
         }
     });
 
@@ -1045,10 +1054,10 @@ App::post('/v1/functions/:functionId/deployments')
     ->inject('dbForProject')
     ->inject('queueForEvents')
     ->inject('project')
-    ->inject('deviceFunctions')
-    ->inject('deviceLocal')
+    ->inject('deviceForFunctions')
+    ->inject('deviceForLocal')
     ->inject('queueForBuilds')
-    ->action(function (string $functionId, ?string $entrypoint, ?string $commands, mixed $code, bool $activate, Request $request, Response $response, Database $dbForProject, Event $queueForEvents, Document $project, Device $deviceFunctions, Device $deviceLocal, Build $queueForBuilds) {
+    ->action(function (string $functionId, ?string $entrypoint, ?string $commands, mixed $code, bool $activate, Request $request, Response $response, Database $dbForProject, Event $queueForEvents, Document $project, Device $deviceForFunctions, Device $deviceForLocal, Build $queueForBuilds) {
 
         $activate = filter_var($activate, FILTER_VALIDATE_BOOLEAN);
 
@@ -1129,11 +1138,11 @@ App::post('/v1/functions/:functionId/deployments')
         }
 
         // Save to storage
-        $fileSize ??= $deviceLocal->getFileSize($fileTmpName);
-        $path = $deviceFunctions->getPath($deploymentId . '.' . \pathinfo($fileName, PATHINFO_EXTENSION));
+        $fileSize ??= $deviceForLocal->getFileSize($fileTmpName);
+        $path = $deviceForFunctions->getPath($deploymentId . '.' . \pathinfo($fileName, PATHINFO_EXTENSION));
         $deployment = $dbForProject->getDocument('deployments', $deploymentId);
 
-        $metadata = ['content_type' => $deviceLocal->getFileMimeType($fileTmpName)];
+        $metadata = ['content_type' => $deviceForLocal->getFileMimeType($fileTmpName)];
         if (!$deployment->isEmpty()) {
             $chunks = $deployment->getAttribute('chunksTotal', 1);
             $metadata = $deployment->getAttribute('metadata', []);
@@ -1142,7 +1151,7 @@ App::post('/v1/functions/:functionId/deployments')
             }
         }
 
-        $chunksUploaded = $deviceFunctions->upload($fileTmpName, $path, $chunk, $chunks, $metadata);
+        $chunksUploaded = $deviceForFunctions->upload($fileTmpName, $path, $chunk, $chunks, $metadata);
 
         if (empty($chunksUploaded)) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed moving file');
@@ -1165,7 +1174,7 @@ App::post('/v1/functions/:functionId/deployments')
                 }
             }
 
-            $fileSize = $deviceFunctions->getFileSize($path);
+            $fileSize = $deviceForFunctions->getFileSize($path);
 
             if ($deployment->isEmpty()) {
                 $deployment = $dbForProject->createDocument('deployments', new Document([
@@ -1196,9 +1205,7 @@ App::post('/v1/functions/:functionId/deployments')
             $queueForBuilds
                 ->setType(BUILD_TYPE_DEPLOYMENT)
                 ->setResource($function)
-                ->setDeployment($deployment)
-                ->setProject($project)
-                ->trigger();
+                ->setDeployment($deployment);
         } else {
             if ($deployment->isEmpty()) {
                 $deployment = $dbForProject->createDocument('deployments', new Document([
@@ -1376,8 +1383,8 @@ App::delete('/v1/functions/:functionId/deployments/:deploymentId')
     ->inject('dbForProject')
     ->inject('queueForDeletes')
     ->inject('queueForEvents')
-    ->inject('deviceFunctions')
-    ->action(function (string $functionId, string $deploymentId, Response $response, Database $dbForProject, Delete $queueForDeletes, Event $queueForEvents, Device $deviceFunctions) {
+    ->inject('deviceForFunctions')
+    ->action(function (string $functionId, string $deploymentId, Response $response, Database $dbForProject, Delete $queueForDeletes, Event $queueForEvents, Device $deviceForFunctions) {
 
         $function = $dbForProject->getDocument('functions', $functionId);
         if ($function->isEmpty()) {
@@ -1398,7 +1405,7 @@ App::delete('/v1/functions/:functionId/deployments/:deploymentId')
         }
 
         if (!empty($deployment->getAttribute('path', ''))) {
-            if (!($deviceFunctions->delete($deployment->getAttribute('path', '')))) {
+            if (!($deviceForFunctions->delete($deployment->getAttribute('path', '')))) {
                 throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed to remove deployment from storage');
             }
         }
@@ -1478,9 +1485,7 @@ App::post('/v1/functions/:functionId/deployments/:deploymentId/builds/:buildId')
         $queueForBuilds
             ->setType(BUILD_TYPE_DEPLOYMENT)
             ->setResource($function)
-            ->setDeployment($deployment)
-            ->setProject($project)
-            ->trigger();
+            ->setDeployment($deployment);
 
         $queueForEvents
             ->setParam('functionId', $function->getId())

app/controllers/api/health.php

@@ -792,8 +792,8 @@ App::get('/v1/health/stats') // Currently only used internally
     ->label('docs', false)
     ->inject('response')
     ->inject('register')
-    ->inject('deviceFiles')
-    ->action(function (Response $response, Registry $register, Device $deviceFiles) {
+    ->inject('deviceForFiles')
+    ->action(function (Response $response, Registry $register, Device $deviceForFiles) {
 
         $cache = $register->get('cache');
 
@@ -802,9 +802,9 @@ App::get('/v1/health/stats') // Currently only used internally
         $response
             ->json([
                 'storage' => [
-                    'used' => Storage::human($deviceFiles->getDirectorySize($deviceFiles->getRoot() . '/')),
-                    'partitionTotal' => Storage::human($deviceFiles->getPartitionTotalSpace()),
-                    'partitionFree' => Storage::human($deviceFiles->getPartitionFreeSpace()),
+                    'used' => Storage::human($deviceForFiles->getDirectorySize($deviceForFiles->getRoot() . '/')),
+                    'partitionTotal' => Storage::human($deviceForFiles->getPartitionTotalSpace()),
+                    'partitionFree' => Storage::human($deviceForFiles->getPartitionFreeSpace()),
                 ],
                 'cache' => [
                     'uptime' => $cacheStats['uptime_in_seconds'] ?? 0,

app/controllers/api/messaging.php

@@ -10,6 +10,7 @@ use Appwrite\Messaging\Status as MessageStatus;
 use Appwrite\Network\Validator\Email;
 use Appwrite\Permission;
 use Appwrite\Role;
+use Appwrite\Utopia\Database\Validator\CompoundUID;
 use Appwrite\Utopia\Database\Validator\CustomId;
 use Appwrite\Utopia\Database\Validator\Queries\Messages;
 use Appwrite\Utopia\Database\Validator\Queries\Providers;
@@ -27,10 +28,13 @@ use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
 use Utopia\Database\Validator\Datetime as DatetimeValidator;
+use Utopia\Database\Validator\Key;
 use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Limit;
 use Utopia\Database\Validator\Query\Offset;
+use Utopia\Database\Validator\Roles;
 use Utopia\Database\Validator\UID;
+use Utopia\Domains\Domain;
 use Utopia\Locale\Locale;
 use Utopia\Validator\ArrayList;
 use Utopia\Validator\Boolean;
@@ -215,14 +219,14 @@ App::post('/v1/messaging/providers/smtp')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'createSMTPProvider')
+    ->label('sdk.method', 'createSmtpProvider')
     ->label('sdk.description', '/docs/references/messaging/create-smtp-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_PROVIDER)
     ->param('providerId', '', new CustomId(), 'Provider ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
     ->param('name', '', new Text(128), 'Provider name.')
-    ->param('host', '', new Text(0), 'SMTP hosts. Either a single hostname or multiple semicolon-delimited hostnames. You can also specify a different port for each host by using this format: [hostname:port] (e.g. "smtp1.example.com:25;smtp2.example.com"). You can also specify encryption type, for example: (e.g. "tls://smtp1.example.com:587;ssl://smtp2.example.com:465"). Hosts will be tried in order.')
+    ->param('host', '', new Text(0), 'SMTP hosts. Either a single hostname or multiple semicolon-delimited hostnames. You can also specify a different port for each host such as `smtp1.example.com:25;smtp2.example.com`. You can also specify encryption type, for example: `tls://smtp1.example.com:587;ssl://smtp2.example.com:465"`. Hosts will be tried in order.')
     ->param('port', 587, new Range(1, 65535), 'The default SMTP server port.', true)
     ->param('username', '', new Text(0), 'Authentication username.', true)
     ->param('password', '', new Text(0), 'Authentication password.', true)
@@ -688,7 +692,7 @@ App::post('/v1/messaging/providers/fcm')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'createFCMProvider')
+    ->label('sdk.method', 'createFcmProvider')
     ->label('sdk.description', '/docs/references/messaging/create-fcm-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -751,7 +755,7 @@ App::post('/v1/messaging/providers/apns')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'createAPNSProvider')
+    ->label('sdk.method', 'createApnsProvider')
     ->label('sdk.description', '/docs/references/messaging/create-apns-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -762,11 +766,12 @@ App::post('/v1/messaging/providers/apns')
     ->param('authKeyId', '', new Text(0), 'APNS authentication key ID.', true)
     ->param('teamId', '', new Text(0), 'APNS team ID.', true)
     ->param('bundleId', '', new Text(0), 'APNS bundle ID.', true)
+    ->param('sandbox', false, new Boolean(), 'Use APNS sandbox environment.', true)
     ->param('enabled', null, new Boolean(), 'Set as enabled.', true)
     ->inject('queueForEvents')
     ->inject('dbForProject')
     ->inject('response')
-    ->action(function (string $providerId, string $name, string $authKey, string $authKeyId, string $teamId, string $bundleId, ?bool $enabled, Event $queueForEvents, Database $dbForProject, Response $response) {
+    ->action(function (string $providerId, string $name, string $authKey, string $authKeyId, string $teamId, string $bundleId, bool $sandbox, ?bool $enabled, Event $queueForEvents, Database $dbForProject, Response $response) {
         $providerId = $providerId == 'unique()' ? ID::unique() : $providerId;
 
         $credentials = [];
@@ -799,6 +804,10 @@ App::post('/v1/messaging/providers/apns')
             $enabled = false;
         }
 
+        $options = [
+            'sandbox' => $sandbox
+        ];
+
         $provider = new Document([
             '$id' => $providerId,
             'name' => $name,
@@ -806,6 +815,7 @@ App::post('/v1/messaging/providers/apns')
             'type' => MESSAGE_TYPE_PUSH,
             'enabled' => $enabled,
             'credentials' => $credentials,
+            'options' => $options
         ]);
 
         try {
@@ -880,7 +890,7 @@ App::get('/v1/messaging/providers/:providerId/logs')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'listProviderLogs')
-    ->label('sdk.description', '/docs/references/messaging/providers/get-logs.md')
+    ->label('sdk.description', '/docs/references/messaging/list-provider-logs.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_LOG_LIST)
@@ -1191,14 +1201,14 @@ App::patch('/v1/messaging/providers/smtp/:providerId')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'updateSMTPProvider')
+    ->label('sdk.method', 'updateSmtpProvider')
     ->label('sdk.description', '/docs/references/messaging/update-smtp-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_PROVIDER)
     ->param('providerId', '', new UID(), 'Provider ID.')
     ->param('name', '', new Text(128), 'Provider name.', true)
-    ->param('host', '', new Text(0), 'SMTP hosts. Either a single hostname or multiple semicolon-delimited hostnames. You can also specify a different port for each host by using this format: [hostname:port] (e.g. "smtp1.example.com:25;smtp2.example.com"). You can also specify encryption type, for example: (e.g. "tls://smtp1.example.com:587;ssl://smtp2.example.com:465"). Hosts will be tried in order.', true)
+    ->param('host', '', new Text(0), 'SMTP hosts. Either a single hostname or multiple semicolon-delimited hostnames. You can also specify a different port for each host such as `smtp1.example.com:25;smtp2.example.com`. You can also specify encryption type, for example: `tls://smtp1.example.com:587;ssl://smtp2.example.com:465"`. Hosts will be tried in order.', true)
     ->param('port', null, new Range(1, 65535), 'SMTP port.', true)
     ->param('username', '', new Text(0), 'Authentication username.', true)
     ->param('password', '', new Text(0), 'Authentication password.', true)
@@ -1723,7 +1733,7 @@ App::patch('/v1/messaging/providers/fcm/:providerId')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'updateFCMProvider')
+    ->label('sdk.method', 'updateFcmProvider')
     ->label('sdk.description', '/docs/references/messaging/update-fcm-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -1792,7 +1802,7 @@ App::patch('/v1/messaging/providers/apns/:providerId')
     ->label('scope', 'providers.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'updateAPNSProvider')
+    ->label('sdk.method', 'updateApnsProvider')
     ->label('sdk.description', '/docs/references/messaging/update-apns-provider.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -1804,10 +1814,11 @@ App::patch('/v1/messaging/providers/apns/:providerId')
     ->param('authKeyId', '', new Text(0), 'APNS authentication key ID.', true)
     ->param('teamId', '', new Text(0), 'APNS team ID.', true)
     ->param('bundleId', '', new Text(0), 'APNS bundle ID.', true)
+    ->param('sandbox', null, new Boolean(), 'Use APNS sandbox environment.', true)
     ->inject('queueForEvents')
     ->inject('dbForProject')
     ->inject('response')
-    ->action(function (string $providerId, string $name, ?bool $enabled, string $authKey, string $authKeyId, string $teamId, string $bundleId, Event $queueForEvents, Database $dbForProject, Response $response) {
+    ->action(function (string $providerId, string $name, ?bool $enabled, string $authKey, string $authKeyId, string $teamId, string $bundleId, ?bool $sandbox, Event $queueForEvents, Database $dbForProject, Response $response) {
         $provider = $dbForProject->getDocument('providers', $providerId);
 
         if ($provider->isEmpty()) {
@@ -1843,6 +1854,14 @@ App::patch('/v1/messaging/providers/apns/:providerId')
 
         $provider->setAttribute('credentials', $credentials);
 
+        $options = $provider->getAttribute('options');
+
+        if (!\is_null($sandbox)) {
+            $options['sandbox'] = $sandbox;
+        }
+
+        $provider->setAttribute('options', $options);
+
         if (!\is_null($enabled)) {
             if ($enabled) {
                 if (
@@ -1905,7 +1924,7 @@ App::delete('/v1/messaging/providers/:providerId')
     });
 
 App::post('/v1/messaging/topics')
-    ->desc('Create a topic.')
+    ->desc('Create a topic')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'topic.create')
     ->label('audits.resource', 'topic/{response.$id}')
@@ -1920,15 +1939,17 @@ App::post('/v1/messaging/topics')
     ->label('sdk.response.model', Response::MODEL_TOPIC)
     ->param('topicId', '', new CustomId(), 'Topic ID. Choose a custom Topic ID or a new Topic ID.')
     ->param('name', '', new Text(128), 'Topic Name.')
+    ->param('subscribe', [Role::users()], new Roles(APP_LIMIT_ARRAY_PARAMS_SIZE), 'An array of role strings with subscribe permission. By default all users are granted with any subscribe permission. [learn more about roles](https://appwrite.io/docs/permissions#permission-roles). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' roles are allowed, each 64 characters long.', true)
     ->inject('queueForEvents')
     ->inject('dbForProject')
     ->inject('response')
-    ->action(function (string $topicId, string $name, Event $queueForEvents, Database $dbForProject, Response $response) {
+    ->action(function (string $topicId, string $name, array $subscribe, Event $queueForEvents, Database $dbForProject, Response $response) {
         $topicId = $topicId == 'unique()' ? ID::unique() : $topicId;
 
         $topic = new Document([
             '$id' => $topicId,
             'name' => $name,
+            'subscribe' => $subscribe,
         ]);
 
         try {
@@ -1946,7 +1967,7 @@ App::post('/v1/messaging/topics')
     });
 
 App::get('/v1/messaging/topics')
-    ->desc('List topics.')
+    ->desc('List topics')
     ->groups(['api', 'messaging'])
     ->label('scope', 'topics.read')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
@@ -2003,7 +2024,7 @@ App::get('/v1/messaging/topics/:topicId/logs')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'listTopicLogs')
-    ->label('sdk.description', '/docs/references/messaging/topics/get-logs.md')
+    ->label('sdk.description', '/docs/references/messaging/list-topic-logs.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_LOG_LIST)
@@ -2086,7 +2107,7 @@ App::get('/v1/messaging/topics/:topicId/logs')
     });
 
 App::get('/v1/messaging/topics/:topicId')
-    ->desc('Get a topic.')
+    ->desc('Get a topic')
     ->groups(['api', 'messaging'])
     ->label('scope', 'topics.read')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
@@ -2113,7 +2134,7 @@ App::get('/v1/messaging/topics/:topicId')
     });
 
 App::patch('/v1/messaging/topics/:topicId')
-    ->desc('Update a topic.')
+    ->desc('Update a topic')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'topic.update')
     ->label('audits.resource', 'topic/{response.$id}')
@@ -2127,21 +2148,26 @@ App::patch('/v1/messaging/topics/:topicId')
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_TOPIC)
     ->param('topicId', '', new UID(), 'Topic ID.')
-    ->param('name', '', new Text(128), 'Topic Name.', true)
+    ->param('name', null, new Text(128), 'Topic Name.', true)
+    ->param('subscribe', null, new Roles(APP_LIMIT_ARRAY_PARAMS_SIZE), 'An array of role strings with subscribe permission. By default all users are granted with any subscribe permission. [learn more about roles](https://appwrite.io/docs/permissions#permission-roles). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' roles are allowed, each 64 characters long.', true)
     ->inject('queueForEvents')
     ->inject('dbForProject')
     ->inject('response')
-    ->action(function (string $topicId, string $name, Event $queueForEvents, Database $dbForProject, Response $response) {
+    ->action(function (string $topicId, ?string $name, ?array $subscribe, Event $queueForEvents, Database $dbForProject, Response $response) {
         $topic = $dbForProject->getDocument('topics', $topicId);
 
         if ($topic->isEmpty()) {
             throw new Exception(Exception::TOPIC_NOT_FOUND);
         }
 
-        if (!empty($name)) {
+        if (!\is_null($name)) {
             $topic->setAttribute('name', $name);
         }
 
+        if (!\is_null($subscribe)) {
+            $topic->setAttribute('subscribe', $subscribe);
+        }
+
         $topic = $dbForProject->updateDocument('topics', $topicId, $topic);
 
         $queueForEvents
@@ -2152,7 +2178,7 @@ App::patch('/v1/messaging/topics/:topicId')
     });
 
 App::delete('/v1/messaging/topics/:topicId')
-    ->desc('Delete a topic.')
+    ->desc('Delete a topic')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'topic.delete')
     ->label('audits.resource', 'topic/{request.$topicId}')
@@ -2192,7 +2218,7 @@ App::delete('/v1/messaging/topics/:topicId')
     });
 
 App::post('/v1/messaging/topics/:topicId/subscribers')
-    ->desc('Create a subscriber.')
+    ->desc('Create a subscriber')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'subscriber.create')
     ->label('audits.resource', 'subscriber/{response.$id}')
@@ -2220,6 +2246,12 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
             throw new Exception(Exception::TOPIC_NOT_FOUND);
         }
 
+        $validator = new Authorization('subscribe');
+
+        if (!$validator->isValid($topic->getAttribute('subscribe'))) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $validator->getDescription());
+        }
+
         $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
 
         if ($target->isEmpty()) {
@@ -2228,32 +2260,42 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
 
         $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
 
-        $userId = $user->getId();
-
         $subscriber = new Document([
             '$id' => $subscriberId,
             '$permissions' => [
-                Permission::read(Role::user($userId)),
-                Permission::delete(Role::user($userId)),
+                Permission::read(Role::user($user->getId())),
+                Permission::delete(Role::user($user->getId())),
             ],
             'topicId' => $topicId,
             'topicInternalId' => $topic->getInternalId(),
             'targetId' => $targetId,
             'targetInternalId' => $target->getInternalId(),
-            'userId' => $userId,
+            'userId' => $user->getId(),
             'userInternalId' => $user->getInternalId(),
             'providerType' => $target->getAttribute('providerType'),
             'search' => implode(' ', [
                 $subscriberId,
                 $targetId,
-                $userId,
+                $user->getId(),
                 $target->getAttribute('providerType'),
             ]),
         ]);
 
         try {
             $subscriber = $dbForProject->createDocument('subscribers', $subscriber);
-            Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('topics', $topicId, 'total', 1));
+
+            $totalAttribute = match ($target->getAttribute('providerType')) {
+                MESSAGE_TYPE_EMAIL => 'emailTotal',
+                MESSAGE_TYPE_SMS => 'smsTotal',
+                MESSAGE_TYPE_PUSH => 'pushTotal',
+                default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
+            };
+
+            Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute(
+                'topics',
+                $topicId,
+                $totalAttribute,
+            ));
         } catch (DuplicateException) {
             throw new Exception(Exception::SUBSCRIBER_ALREADY_EXISTS);
         }
@@ -2272,7 +2314,7 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
     });
 
 App::get('/v1/messaging/topics/:topicId/subscribers')
-    ->desc('List subscribers.')
+    ->desc('List subscribers')
     ->groups(['api', 'messaging'])
     ->label('scope', 'subscribers.read')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
@@ -2304,7 +2346,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
             throw new Exception(Exception::TOPIC_NOT_FOUND);
         }
 
-        \array_push($queries, Query::equal('topicInternalId', [$topic->getInternalId()]));
+        $queries[] = Query::equal('topicInternalId', [$topic->getInternalId()]);
 
         /**
          * Get cursor document if there was a cursor query, we use array_filter and reset for reference $cursor to $queries
@@ -2352,7 +2394,7 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'listSubscriberLogs')
-    ->label('sdk.description', '/docs/references/messaging/subscribers/get-logs.md')
+    ->label('sdk.description', '/docs/references/messaging/list-subscriber-logs.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_LOG_LIST)
@@ -2435,7 +2477,7 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
     });
 
 App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
-    ->desc('Get a subscriber.')
+    ->desc('Get a subscriber')
     ->groups(['api', 'messaging'])
     ->label('scope', 'subscribers.read')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
@@ -2474,7 +2516,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
     });
 
 App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
-    ->desc('Delete a subscriber.')
+    ->desc('Delete a subscriber')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'subscriber.delete')
     ->label('audits.resource', 'subscriber/{request.$subscriberId}')
@@ -2505,8 +2547,23 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
             throw new Exception(Exception::SUBSCRIBER_NOT_FOUND);
         }
 
+        $target = $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId'));
+
         $dbForProject->deleteDocument('subscribers', $subscriberId);
-        Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute('topics', $topicId, 'total', 1));
+
+        $totalAttribute = match ($target->getAttribute('providerType')) {
+            MESSAGE_TYPE_EMAIL => 'emailTotal',
+            MESSAGE_TYPE_SMS => 'smsTotal',
+            MESSAGE_TYPE_PUSH => 'pushTotal',
+            default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
+        };
+
+        Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute(
+            'topics',
+            $topicId,
+            $totalAttribute,
+            min: 0
+        ));
 
         $queueForEvents
             ->setParam('topicId', $topic->getId())
@@ -2518,7 +2575,7 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
     });
 
 App::post('/v1/messaging/messages/email')
-    ->desc('Create an email.')
+    ->desc('Create an email')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.create')
     ->label('audits.resource', 'message/{response.$id}')
@@ -2539,6 +2596,7 @@ App::post('/v1/messaging/messages/email')
     ->param('targets', [], new ArrayList(new UID()), 'List of Targets IDs.', true)
     ->param('cc', [], new ArrayList(new UID()), 'Array of target IDs to be added as CC.', true)
     ->param('bcc', [], new ArrayList(new UID()), 'Array of target IDs to be added as BCC.', true)
+    ->param('attachments', [], new ArrayList(new CompoundUID()), 'Array of compound bucket IDs to file IDs to be attached to the email.', true)
     ->param('status', MessageStatus::DRAFT, new WhiteList([MessageStatus::DRAFT, MessageStatus::SCHEDULED, MessageStatus::PROCESSING]), 'Message Status. Value must be one of: ' . implode(', ', [MessageStatus::DRAFT, MessageStatus::SCHEDULED, MessageStatus::PROCESSING]) . '.', true)
     ->param('html', false, new Boolean(), 'Is content of type HTML', true)
     ->param('scheduledAt', null, new DatetimeValidator(requireDateInFuture: true), 'Scheduled delivery time for message in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. DateTime value must be in future.', true)
@@ -2548,7 +2606,7 @@ App::post('/v1/messaging/messages/email')
     ->inject('project')
     ->inject('queueForMessaging')
     ->inject('response')
-    ->action(function (string $messageId, string $subject, string $content, array $topics, array $users, array $targets, array $cc, array $bcc, string $status, bool $html, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
+    ->action(function (string $messageId, string $subject, string $content, array $topics, array $users, array $targets, array $cc, array $bcc, array $attachments, string $status, bool $html, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
         $messageId = $messageId == 'unique()'
             ? ID::unique()
             : $messageId;
@@ -2581,6 +2639,29 @@ App::post('/v1/messaging/messages/email')
             }
         }
 
+        if (!empty($attachments)) {
+            foreach ($attachments as &$attachment) {
+                [$bucketId, $fileId] = CompoundUID::parse($attachment);
+
+                $bucket = $dbForProject->getDocument('buckets', $bucketId);
+
+                if ($bucket->isEmpty()) {
+                    throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+                }
+
+                $file = $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId);
+
+                if ($file->isEmpty()) {
+                    throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
+                }
+
+                $attachment = [
+                    'bucketId' => $bucketId,
+                    'fileId' => $fileId,
+                ];
+            }
+        }
+
         $message = $dbForProject->createDocument('messages', new Document([
             '$id' => $messageId,
             'providerType' => MESSAGE_TYPE_EMAIL,
@@ -2594,6 +2675,7 @@ App::post('/v1/messaging/messages/email')
                 'html' => $html,
                 'cc' => $cc,
                 'bcc' => $bcc,
+                'attachments' => $attachments,
             ],
             'status' => $status,
         ]));
@@ -2601,14 +2683,13 @@ App::post('/v1/messaging/messages/email')
         switch ($status) {
             case MessageStatus::PROCESSING:
                 $queueForMessaging
-                    ->setMessageId($message->getId())
-                    ->trigger();
+                    ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                    ->setMessageId($message->getId());
                 break;
             case MessageStatus::SCHEDULED:
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -2638,7 +2719,7 @@ App::post('/v1/messaging/messages/email')
     });
 
 App::post('/v1/messaging/messages/sms')
-    ->desc('Create an SMS.')
+    ->desc('Create an SMS')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.create')
     ->label('audits.resource', 'message/{response.$id}')
@@ -2646,7 +2727,7 @@ App::post('/v1/messaging/messages/sms')
     ->label('scope', 'messages.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'createSMS')
+    ->label('sdk.method', 'createSms')
     ->label('sdk.description', '/docs/references/messaging/create-sms.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -2710,14 +2791,13 @@ App::post('/v1/messaging/messages/sms')
         switch ($status) {
             case MessageStatus::PROCESSING:
                 $queueForMessaging
-                    ->setMessageId($message->getId())
-                    ->trigger();
+                    ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                    ->setMessageId($message->getId());
                 break;
             case MessageStatus::SCHEDULED:
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -2747,7 +2827,7 @@ App::post('/v1/messaging/messages/sms')
     });
 
 App::post('/v1/messaging/messages/push')
-    ->desc('Create a push notification.')
+    ->desc('Create a push notification')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.create')
     ->label('audits.resource', 'message/{response.$id}')
@@ -2756,7 +2836,7 @@ App::post('/v1/messaging/messages/push')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'createPush')
-    ->label('sdk.description', '/docs/references/messaging/create-push-notification.md')
+    ->label('sdk.description', '/docs/references/messaging/create-push.md')
     ->label('sdk.response.code', Response::STATUS_CODE_CREATED)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_MESSAGE)
@@ -2768,6 +2848,7 @@ App::post('/v1/messaging/messages/push')
     ->param('targets', [], new ArrayList(new UID()), 'List of Targets IDs.', true)
     ->param('data', null, new JSON(), 'Additional Data for push notification.', true)
     ->param('action', '', new Text(256), 'Action for push notification.', true)
+    ->param('image', '', new CompoundUID(), 'Image for push notification. Must be a compound bucket ID to file ID of a jpeg, png, or bmp image in Appwrite Storage.', true)
     ->param('icon', '', new Text(256), 'Icon for push notification. Available only for Android and Web Platform.', true)
     ->param('sound', '', new Text(256), 'Sound for push notification. Available only for Android and IOS Platform.', true)
     ->param('color', '', new Text(256), 'Color for push notification. Available only for Android Platform.', true)
@@ -2781,7 +2862,7 @@ App::post('/v1/messaging/messages/push')
     ->inject('project')
     ->inject('queueForMessaging')
     ->inject('response')
-    ->action(function (string $messageId, string $title, string $body, array $topics, array $users, array $targets, ?array $data, string $action, string $icon, string $sound, string $color, string $tag, string $badge, string $status, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
+    ->action(function (string $messageId, string $title, string $body, array $topics, array $users, array $targets, ?array $data, string $action, string $image, string $icon, string $sound, string $color, string $tag, string $badge, string $status, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
         $messageId = $messageId == 'unique()'
             ? ID::unique()
             : $messageId;
@@ -2812,9 +2893,41 @@ App::post('/v1/messaging/messages/push')
             }
         }
 
+        if (!empty($image)) {
+            [$bucketId, $fileId] = CompoundUID::parse($image);
+
+            $bucket = $dbForProject->getDocument('buckets', $bucketId);
+            if ($bucket->isEmpty()) {
+                throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+            }
+
+            $file = $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId);
+            if ($file->isEmpty()) {
+                throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+            }
+
+            if (!\in_array(Permission::read(Role::any()), \array_merge($file->getRead(), $bucket->getRead()))) {
+                throw new Exception(Exception::STORAGE_FILE_NOT_PUBLIC);
+            }
+
+            if (!\in_array($file->getAttribute('mimeType'), ['image/png', 'image/jpeg'])) {
+                throw new Exception(Exception::STORAGE_FILE_TYPE_UNSUPPORTED);
+            }
+
+            $host = App::getEnv('_APP_DOMAIN', 'localhost');
+            $domain = new Domain(\parse_url($host, PHP_URL_HOST));
+            $protocol = App::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
+
+            if (!$domain->isKnown()) {
+                throw new Exception(Exception::STORAGE_FILE_NOT_PUBLIC);
+            }
+
+            $image = "{$protocol}://{$host}/v1/storage/buckets/{$bucket->getId()}/files/{$file->getId()}/view?project={$project->getId()}";
+        }
+
         $pushData = [];
 
-        $keys = ['title', 'body', 'data', 'action', 'icon', 'sound', 'color', 'tag', 'badge'];
+        $keys = ['title', 'body', 'data', 'action', 'image', 'icon', 'sound', 'color', 'tag', 'badge'];
 
         foreach ($keys as $key) {
             if (!empty($$key)) {
@@ -2836,14 +2949,13 @@ App::post('/v1/messaging/messages/push')
         switch ($status) {
             case MessageStatus::PROCESSING:
                 $queueForMessaging
-                    ->setMessageId($message->getId())
-                    ->trigger();
+                    ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                    ->setMessageId($message->getId());
                 break;
             case MessageStatus::SCHEDULED:
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -2930,7 +3042,7 @@ App::get('/v1/messaging/messages/:messageId/logs')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'listMessageLogs')
-    ->label('sdk.description', '/docs/references/messaging/messages/get-logs.md')
+    ->label('sdk.description', '/docs/references/messaging/list-message-logs.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_LOG_LIST)
@@ -3102,7 +3214,7 @@ App::get('/v1/messaging/messages/:messageId')
     });
 
 App::patch('/v1/messaging/messages/email/:messageId')
-    ->desc('Update an email.')
+    ->desc('Update an email')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.update')
     ->label('audits.resource', 'message/{response.$id}')
@@ -3197,7 +3309,6 @@ App::patch('/v1/messaging/messages/email/:messageId')
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -3229,8 +3340,8 @@ App::patch('/v1/messaging/messages/email/:messageId')
 
         if ($status === MessageStatus::PROCESSING) {
             $queueForMessaging
-                ->setMessageId($message->getId())
-                ->trigger();
+                ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                ->setMessageId($message->getId());
         }
 
         $queueForEvents
@@ -3241,7 +3352,7 @@ App::patch('/v1/messaging/messages/email/:messageId')
     });
 
 App::patch('/v1/messaging/messages/sms/:messageId')
-    ->desc('Update an SMS.')
+    ->desc('Update an SMS')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.update')
     ->label('audits.resource', 'message/{response.$id}')
@@ -3249,7 +3360,7 @@ App::patch('/v1/messaging/messages/sms/:messageId')
     ->label('scope', 'messages.write')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
-    ->label('sdk.method', 'updateSMS')
+    ->label('sdk.method', 'updateSms')
     ->label('sdk.description', '/docs/references/messaging/update-email.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
@@ -3316,7 +3427,6 @@ App::patch('/v1/messaging/messages/sms/:messageId')
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -3348,8 +3458,8 @@ App::patch('/v1/messaging/messages/sms/:messageId')
 
         if ($status === MessageStatus::PROCESSING) {
             $queueForMessaging
-                ->setMessageId($message->getId())
-                ->trigger();
+                ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                ->setMessageId($message->getId());
         }
 
         $queueForEvents
@@ -3360,7 +3470,7 @@ App::patch('/v1/messaging/messages/sms/:messageId')
     });
 
 App::patch('/v1/messaging/messages/push/:messageId')
-    ->desc('Update a push notification.')
+    ->desc('Update a push notification')
     ->groups(['api', 'messaging'])
     ->label('audits.event', 'message.update')
     ->label('audits.resource', 'message/{response.$id}')
@@ -3369,7 +3479,7 @@ App::patch('/v1/messaging/messages/push/:messageId')
     ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN, APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'messaging')
     ->label('sdk.method', 'updatePush')
-    ->label('sdk.description', '/docs/references/messaging/update-push-notification.md')
+    ->label('sdk.description', '/docs/references/messaging/update-push.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_MESSAGE)
@@ -3381,6 +3491,7 @@ App::patch('/v1/messaging/messages/push/:messageId')
     ->param('body', null, new Text(64230), 'Body for push notification.', true)
     ->param('data', null, new JSON(), 'Additional Data for push notification.', true)
     ->param('action', null, new Text(256), 'Action for push notification.', true)
+    ->param('image', null, new CompoundUID(), 'Image for push notification. Must be a compound bucket ID to file ID of a jpeg, png, or bmp image in Appwrite Storage.', true)
     ->param('icon', null, new Text(256), 'Icon for push notification. Available only for Android and Web platforms.', true)
     ->param('sound', null, new Text(256), 'Sound for push notification. Available only for Android and iOS platforms.', true)
     ->param('color', null, new Text(256), 'Color for push notification. Available only for Android platforms.', true)
@@ -3394,7 +3505,7 @@ App::patch('/v1/messaging/messages/push/:messageId')
     ->inject('project')
     ->inject('queueForMessaging')
     ->inject('response')
-    ->action(function (string $messageId, ?array $topics, ?array $users, ?array $targets, ?string $title, ?string $body, ?array $data, ?string $action, ?string $icon, ?string $sound, ?string $color, ?string $tag, ?int $badge, ?string $status, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
+    ->action(function (string $messageId, ?array $topics, ?array $users, ?array $targets, ?string $title, ?string $body, ?array $data, ?string $action, ?string $image, ?string $icon, ?string $sound, ?string $color, ?string $tag, ?int $badge, ?string $status, ?string $scheduledAt, Event $queueForEvents, Database $dbForProject, Database $dbForConsole, Document $project, Messaging $queueForMessaging, Response $response) {
         $message = $dbForProject->getDocument('messages', $messageId);
 
         if ($message->isEmpty()) {
@@ -3464,6 +3575,38 @@ App::patch('/v1/messaging/messages/push/:messageId')
             $pushData['badge'] = $badge;
         }
 
+        if (!\is_null($image)) {
+            [$bucketId, $fileId] = CompoundUID::parse($image);
+
+            $bucket = $dbForProject->getDocument('buckets', $bucketId);
+            if ($bucket->isEmpty()) {
+                throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+            }
+
+            $file = $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId);
+            if ($file->isEmpty()) {
+                throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+            }
+
+            if (!\in_array(Permission::read(Role::any()), \array_merge($file->getRead(), $bucket->getRead()))) {
+                throw new Exception(Exception::STORAGE_FILE_NOT_PUBLIC);
+            }
+
+            if (!\in_array($file->getAttribute('mimeType'), ['image/png', 'image/jpeg'])) {
+                throw new Exception(Exception::STORAGE_FILE_TYPE_UNSUPPORTED);
+            }
+
+            $host = App::getEnv('_APP_DOMAIN', 'localhost');
+            $domain = new Domain(\parse_url($host, PHP_URL_HOST));
+            $protocol = App::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
+
+            if (!$domain->isKnown()) {
+                throw new Exception(Exception::STORAGE_FILE_NOT_PUBLIC);
+            }
+
+            $pushData['image'] = "{$protocol}://{$host}/v1/storage/buckets/{$bucket->getId()}/files/{$file->getId()}/view?project={$project->getId()}";
+        }
+
         $message->setAttribute('data', $pushData);
 
         if (!\is_null($status)) {
@@ -3475,7 +3618,6 @@ App::patch('/v1/messaging/messages/push/:messageId')
                 $schedule = $dbForConsole->createDocument('schedules', new Document([
                     'region' => App::getEnv('_APP_REGION', 'default'),
                     'resourceType' => 'message',
-                    'resourceCollection' => 'messages',
                     'resourceId' => $message->getId(),
                     'resourceInternalId' => $message->getInternalId(),
                     'resourceUpdatedAt' => DateTime::now(),
@@ -3507,8 +3649,8 @@ App::patch('/v1/messaging/messages/push/:messageId')
 
         if ($status === MessageStatus::PROCESSING) {
             $queueForMessaging
-                ->setMessageId($message->getId())
-                ->trigger();
+                ->setType(MESSAGE_SEND_TYPE_EXTERNAL)
+                ->setMessageId($message->getId());
         }
 
         $queueForEvents

app/controllers/api/project.php

@@ -73,7 +73,7 @@ App::get('/v1/project/usage')
 
         Authorization::skip(function () use ($dbForProject, $firstDay, $lastDay, $period, $metrics, &$total, &$stats) {
             foreach ($metrics['total'] as $metric) {
-                $result = $dbForProject->findOne('stats_v2', [
+                $result = $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -81,7 +81,7 @@ App::get('/v1/project/usage')
             }
 
             foreach ($metrics['period'] as $metric) {
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::greaterThanEqual('time', $firstDay),
@@ -116,7 +116,7 @@ App::get('/v1/project/usage')
             $id = $function->getId();
             $name = $function->getAttribute('name');
             $metric = str_replace('{functionInternalId}', $function->getInternalId(), METRIC_FUNCTION_ID_EXECUTIONS);
-            $value = $dbForProject->findOne('stats_v2', [
+            $value = $dbForProject->findOne('stats', [
                 Query::equal('metric', [$metric]),
                 Query::equal('period', ['inf'])
             ]);
@@ -132,7 +132,7 @@ App::get('/v1/project/usage')
             $id = $bucket->getId();
             $name = $bucket->getAttribute('name');
             $metric = str_replace('{bucketInternalId}', $bucket->getInternalId(), METRIC_BUCKET_ID_FILES_STORAGE);
-            $value = $dbForProject->findOne('stats_v2', [
+            $value = $dbForProject->findOne('stats', [
                 Query::equal('metric', [$metric]),
                 Query::equal('period', ['inf'])
             ]);
@@ -144,9 +144,30 @@ App::get('/v1/project/usage')
             ];
         }, $dbForProject->find('buckets'));
 
+        // merge network inbound + outbound
+        $projectBandwidth = [];
+        foreach ($usage[METRIC_NETWORK_INBOUND] as $item) {
+            $projectBandwidth[$item['date']] ??= 0;
+            $projectBandwidth[$item['date']] += $item['value'];
+        }
+
+        foreach ($usage[METRIC_NETWORK_OUTBOUND] as $item) {
+            $projectBandwidth[$item['date']] ??= 0;
+            $projectBandwidth[$item['date']] += $item['value'];
+        }
+
+
+        $network = [];
+        foreach ($projectBandwidth as $date => $value) {
+            $network[] = [
+                'date' => $date,
+                'value' => $value
+            ];
+        }
+
         $response->dynamic(new Document([
             'requests' => ($usage[METRIC_NETWORK_REQUESTS]),
-            'network' => ($usage[METRIC_NETWORK_INBOUND] + $usage[METRIC_NETWORK_OUTBOUND]),
+            'network' => $network,
             'users' => ($usage[METRIC_USERS]),
             'executions' => ($usage[METRIC_EXECUTIONS]),
             'executionsTotal' => $total[METRIC_EXECUTIONS],

app/controllers/api/projects.php

@@ -78,13 +78,18 @@ App::post('/v1/projects')
     ->inject('pools')
     ->action(function (string $projectId, string $name, string $teamId, string $region, string $description, string $logo, string $url, string $legalName, string $legalCountry, string $legalState, string $legalCity, string $legalAddress, string $legalTaxId, Response $response, Database $dbForConsole, Cache $cache, Group $pools) {
 
-
         $team = $dbForConsole->getDocument('teams', $teamId);
 
         if ($team->isEmpty()) {
             throw new Exception(Exception::TEAM_NOT_FOUND);
         }
 
+        $allowList = \array_filter(\explode(',', App::getEnv('_APP_PROJECT_REGIONS', '')));
+
+        if (!empty($allowList) && !\in_array($region, $allowList)) {
+            throw new Exception(Exception::PROJECT_REGION_UNSUPPORTED, 'Region "' . $region . '" is not supported');
+        }
+
         $auth = Config::getParam('auth', []);
         $auths = ['limit' => 0, 'maxSessions' => APP_LIMIT_USER_SESSIONS_DEFAULT, 'passwordHistory' => 0, 'passwordDictionary' => false, 'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG, 'personalDataCheck' => false];
         foreach ($auth as $index => $method) {

app/controllers/api/storage.php

@@ -360,9 +360,9 @@ App::post('/v1/storage/buckets/:bucketId/files')
     ->inject('user')
     ->inject('queueForEvents')
     ->inject('mode')
-    ->inject('deviceFiles')
-    ->inject('deviceLocal')
-    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceFiles, Device $deviceLocal) {
+    ->inject('deviceForFiles')
+    ->inject('deviceForLocal')
+    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceForFiles, Device $deviceForLocal) {
 
         $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
@@ -493,13 +493,13 @@ App::post('/v1/storage/buckets/:bucketId/files')
         }
 
         // Save to storage
-        $fileSize ??= $deviceLocal->getFileSize($fileTmpName);
-        $path = $deviceFiles->getPath($fileId . '.' . \pathinfo($fileName, PATHINFO_EXTENSION));
-        $path = str_ireplace($deviceFiles->getRoot(), $deviceFiles->getRoot() . DIRECTORY_SEPARATOR . $bucket->getId(), $path); // Add bucket id to path after root
+        $fileSize ??= $deviceForLocal->getFileSize($fileTmpName);
+        $path = $deviceForFiles->getPath($fileId . '.' . \pathinfo($fileName, PATHINFO_EXTENSION));
+        $path = str_ireplace($deviceForFiles->getRoot(), $deviceForFiles->getRoot() . DIRECTORY_SEPARATOR . $bucket->getId(), $path); // Add bucket id to path after root
 
         $file = $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId);
 
-        $metadata = ['content_type' => $deviceLocal->getFileMimeType($fileTmpName)];
+        $metadata = ['content_type' => $deviceForLocal->getFileMimeType($fileTmpName)];
         if (!$file->isEmpty()) {
             $chunks = $file->getAttribute('chunksTotal', 1);
             $uploaded = $file->getAttribute('chunksUploaded', 0);
@@ -514,32 +514,32 @@ App::post('/v1/storage/buckets/:bucketId/files')
             }
         }
 
-        $chunksUploaded = $deviceFiles->upload($fileTmpName, $path, $chunk, $chunks, $metadata);
+        $chunksUploaded = $deviceForFiles->upload($fileTmpName, $path, $chunk, $chunks, $metadata);
 
         if (empty($chunksUploaded)) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed uploading file');
         }
 
         if ($chunksUploaded === $chunks) {
-            if (App::getEnv('_APP_STORAGE_ANTIVIRUS') === 'enabled' && $bucket->getAttribute('antivirus', true) && $fileSize <= APP_LIMIT_ANTIVIRUS && $deviceFiles->getType() === Storage::DEVICE_LOCAL) {
+            if (App::getEnv('_APP_STORAGE_ANTIVIRUS') === 'enabled' && $bucket->getAttribute('antivirus', true) && $fileSize <= APP_LIMIT_ANTIVIRUS && $deviceForFiles->getType() === Storage::DEVICE_LOCAL) {
                 $antivirus = new Network(
                     App::getEnv('_APP_STORAGE_ANTIVIRUS_HOST', 'clamav'),
                     (int) App::getEnv('_APP_STORAGE_ANTIVIRUS_PORT', 3310)
                 );
 
                 if (!$antivirus->fileScan($path)) {
-                    $deviceFiles->delete($path);
+                    $deviceForFiles->delete($path);
                     throw new Exception(Exception::STORAGE_INVALID_FILE);
                 }
             }
 
-            $mimeType = $deviceFiles->getFileMimeType($path); // Get mime-type before compression and encryption
-            $fileHash = $deviceFiles->getFileHash($path); // Get file hash before compression and encryption
+            $mimeType = $deviceForFiles->getFileMimeType($path); // Get mime-type before compression and encryption
+            $fileHash = $deviceForFiles->getFileHash($path); // Get file hash before compression and encryption
             $data = '';
             // Compression
             $algorithm = $bucket->getAttribute('compression', Compression::NONE);
             if ($fileSize <= APP_STORAGE_READ_BUFFER && $algorithm != Compression::NONE) {
-                $data = $deviceFiles->read($path);
+                $data = $deviceForFiles->read($path);
                 switch ($algorithm) {
                     case Compression::ZSTD:
                         $compressor = new Zstd();
@@ -559,7 +559,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
 
             if ($bucket->getAttribute('encryption', true) && $fileSize <= APP_STORAGE_READ_BUFFER) {
                 if (empty($data)) {
-                    $data = $deviceFiles->read($path);
+                    $data = $deviceForFiles->read($path);
                 }
                 $key = App::getEnv('_APP_OPENSSL_KEY_V1');
                 $iv = OpenSSL::randomPseudoBytes(OpenSSL::cipherIVLength(OpenSSL::CIPHER_AES_128_GCM));
@@ -567,12 +567,12 @@ App::post('/v1/storage/buckets/:bucketId/files')
             }
 
             if (!empty($data)) {
-                if (!$deviceFiles->write($path, $data, $mimeType)) {
+                if (!$deviceForFiles->write($path, $data, $mimeType)) {
                     throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed to save file');
                 }
             }
 
-            $sizeActual = $deviceFiles->getFileSize($path);
+            $sizeActual = $deviceForFiles->getFileSize($path);
 
             $openSSLVersion = null;
             $openSSLCipher = null;
@@ -872,9 +872,9 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('mode')
-    ->inject('deviceFiles')
-    ->inject('deviceLocal')
-    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, Request $request, Response $response, Document $project, Database $dbForProject, string $mode, Device $deviceFiles, Device $deviceLocal) {
+    ->inject('deviceForFiles')
+    ->inject('deviceForLocal')
+    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, Request $request, Response $response, Document $project, Database $dbForProject, string $mode, Device $deviceForFiles, Device $deviceForLocal) {
 
         if (!\extension_loaded('imagick')) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Imagick extension is missing');
@@ -931,10 +931,10 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
             $cipher = null;
             $background = (empty($background)) ? 'eceff1' : $background;
             $type = \strtolower(\pathinfo($path, PATHINFO_EXTENSION));
-            $deviceFiles = $deviceLocal;
+            $deviceForFiles = $deviceForLocal;
         }
 
-        if (!$deviceFiles->exists($path)) {
+        if (!$deviceForFiles->exists($path)) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
 
@@ -950,7 +950,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
             $output = empty($type) ? (array_search($mime, $outputs) ?? 'jpg') : $type;
         }
 
-        $source = $deviceFiles->read($path);
+        $source = $deviceForFiles->read($path);
 
         if (!empty($cipher)) { // Decrypt
             $source = OpenSSL::decrypt(
@@ -1033,8 +1033,8 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('mode')
-    ->inject('deviceFiles')
-    ->action(function (string $bucketId, string $fileId, Request $request, Response $response, Database $dbForProject, string $mode, Device $deviceFiles) {
+    ->inject('deviceForFiles')
+    ->action(function (string $bucketId, string $fileId, Request $request, Response $response, Database $dbForProject, string $mode, Device $deviceForFiles) {
 
         $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
@@ -1064,7 +1064,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
 
         $path = $file->getAttribute('path', '');
 
-        if (!$deviceFiles->exists($path)) {
+        if (!$deviceForFiles->exists($path)) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
         }
 
@@ -1100,7 +1100,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
 
         $source = '';
         if (!empty($file->getAttribute('openSSLCipher'))) { // Decrypt
-            $source = $deviceFiles->read($path);
+            $source = $deviceForFiles->read($path);
             $source = OpenSSL::decrypt(
                 $source,
                 $file->getAttribute('openSSLCipher'),
@@ -1114,14 +1114,14 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
         switch ($file->getAttribute('algorithm', Compression::NONE)) {
             case Compression::ZSTD:
                 if (empty($source)) {
-                    $source = $deviceFiles->read($path);
+                    $source = $deviceForFiles->read($path);
                 }
                 $compressor = new Zstd();
                 $source = $compressor->decompress($source);
                 break;
             case Compression::GZIP:
                 if (empty($source)) {
-                    $source = $deviceFiles->read($path);
+                    $source = $deviceForFiles->read($path);
                 }
                 $compressor = new GZIP();
                 $source = $compressor->decompress($source);
@@ -1136,13 +1136,13 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
         }
 
         if (!empty($rangeHeader)) {
-            $response->send($deviceFiles->read($path, $start, ($end - $start + 1)));
+            $response->send($deviceForFiles->read($path, $start, ($end - $start + 1)));
         }
 
         if ($size > APP_STORAGE_READ_BUFFER) {
             for ($i = 0; $i < ceil($size / MAX_OUTPUT_CHUNK_SIZE); $i++) {
                 $response->chunk(
-                    $deviceFiles->read(
+                    $deviceForFiles->read(
                         $path,
                         ($i * MAX_OUTPUT_CHUNK_SIZE),
                         min(MAX_OUTPUT_CHUNK_SIZE, $size - ($i * MAX_OUTPUT_CHUNK_SIZE))
@@ -1151,7 +1151,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
                 );
             }
         } else {
-            $response->send($deviceFiles->read($path));
+            $response->send($deviceForFiles->read($path));
         }
     });
 
@@ -1173,8 +1173,8 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
     ->inject('request')
     ->inject('dbForProject')
     ->inject('mode')
-    ->inject('deviceFiles')
-    ->action(function (string $bucketId, string $fileId, Response $response, Request $request, Database $dbForProject, string $mode, Device $deviceFiles) {
+    ->inject('deviceForFiles')
+    ->action(function (string $bucketId, string $fileId, Response $response, Request $request, Database $dbForProject, string $mode, Device $deviceForFiles) {
         $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
         $isAPIKey = Auth::isAppUser(Authorization::getRoles());
@@ -1205,7 +1205,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
 
         $path = $file->getAttribute('path', '');
 
-        if (!$deviceFiles->exists($path)) {
+        if (!$deviceForFiles->exists($path)) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
         }
 
@@ -1249,7 +1249,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
 
         $source = '';
         if (!empty($file->getAttribute('openSSLCipher'))) { // Decrypt
-            $source = $deviceFiles->read($path);
+            $source = $deviceForFiles->read($path);
             $source = OpenSSL::decrypt(
                 $source,
                 $file->getAttribute('openSSLCipher'),
@@ -1263,14 +1263,14 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
         switch ($file->getAttribute('algorithm', Compression::NONE)) {
             case Compression::ZSTD:
                 if (empty($source)) {
-                    $source = $deviceFiles->read($path);
+                    $source = $deviceForFiles->read($path);
                 }
                 $compressor = new Zstd();
                 $source = $compressor->decompress($source);
                 break;
             case Compression::GZIP:
                 if (empty($source)) {
-                    $source = $deviceFiles->read($path);
+                    $source = $deviceForFiles->read($path);
                 }
                 $compressor = new GZIP();
                 $source = $compressor->decompress($source);
@@ -1286,15 +1286,15 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
         }
 
         if (!empty($rangeHeader)) {
-            $response->send($deviceFiles->read($path, $start, ($end - $start + 1)));
+            $response->send($deviceForFiles->read($path, $start, ($end - $start + 1)));
             return;
         }
 
-        $size = $deviceFiles->getFileSize($path);
+        $size = $deviceForFiles->getFileSize($path);
         if ($size > APP_STORAGE_READ_BUFFER) {
             for ($i = 0; $i < ceil($size / MAX_OUTPUT_CHUNK_SIZE); $i++) {
                 $response->chunk(
-                    $deviceFiles->read(
+                    $deviceForFiles->read(
                         $path,
                         ($i * MAX_OUTPUT_CHUNK_SIZE),
                         min(MAX_OUTPUT_CHUNK_SIZE, $size - ($i * MAX_OUTPUT_CHUNK_SIZE))
@@ -1303,7 +1303,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
                 );
             }
         } else {
-            $response->send($deviceFiles->read($path));
+            $response->send($deviceForFiles->read($path));
         }
     });
 
@@ -1438,9 +1438,9 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
     ->inject('dbForProject')
     ->inject('queueForEvents')
     ->inject('mode')
-    ->inject('deviceFiles')
+    ->inject('deviceForFiles')
     ->inject('queueForDeletes')
-    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceFiles, Delete $queueForDeletes) {
+    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceForFiles, Delete $queueForDeletes) {
         $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
         $isAPIKey = Auth::isAppUser(Authorization::getRoles());
@@ -1471,17 +1471,18 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
 
         $deviceDeleted = false;
         if ($file->getAttribute('chunksTotal') !== $file->getAttribute('chunksUploaded')) {
-            $deviceDeleted = $deviceFiles->abort(
+            $deviceDeleted = $deviceForFiles->abort(
                 $file->getAttribute('path'),
                 ($file->getAttribute('metadata', [])['uploadId'] ?? '')
             );
         } else {
-            $deviceDeleted = $deviceFiles->delete($file->getAttribute('path'));
+            $deviceDeleted = $deviceForFiles->delete($file->getAttribute('path'));
         }
 
         if ($deviceDeleted) {
             $queueForDeletes
                 ->setType(DELETE_TYPE_CACHE_BY_RESOURCE)
+                ->setResourceType('bucket/' . $bucket->getId())
                 ->setResource('file/' . $fileId)
             ;
 
@@ -1539,7 +1540,7 @@ App::get('/v1/storage/usage')
         $total = [];
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -1547,7 +1548,7 @@ App::get('/v1/storage/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),
@@ -1624,7 +1625,7 @@ App::get('/v1/storage/:bucketId/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
             foreach ($metrics as $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -1632,7 +1633,7 @@ App::get('/v1/storage/:bucketId/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),

app/controllers/api/teams.php

@@ -658,10 +658,10 @@ App::post('/v1/teams/:teamId/memberships')
                 ]);
 
                 $queueForMessaging
+                    ->setType(MESSAGE_SEND_TYPE_INTERNAL)
                     ->setMessage($messageDoc)
                     ->setRecipients([$phone])
-                    ->setProviderType('SMS')
-                    ->trigger();
+                    ->setProviderType('SMS');
             }
         }
 
@@ -995,7 +995,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
 
         $dbForProject->purgeCachedDocument('users', $user->getId());
 
-        $team = Authorization::skip(fn() => $dbForProject->updateDocument('teams', $team->getId(), $team->setAttribute('total', $team->getAttribute('total', 0) + 1)));
+        Authorization::skip(fn() => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
 
         $queueForEvents
             ->setParam('teamId', $team->getId())
@@ -1075,8 +1075,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
         $dbForProject->purgeCachedDocument('users', $user->getId());
 
         if ($membership->getAttribute('confirm')) { // Count only confirmed members
-            $team->setAttribute('total', \max($team->getAttribute('total', 0) - 1, 0));
-            Authorization::skip(fn() => $dbForProject->updateDocument('teams', $team->getId(), $team));
+            Authorization::skip(fn() => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
         }
 
         $queueForEvents

app/controllers/api/users.php

@@ -115,6 +115,11 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
         if ($email) {
             try {
                 $target = $dbForProject->createDocument('targets', new Document([
+                    '$permissions' => [
+                        Permission::read(Role::user($user->getId())),
+                        Permission::update(Role::user($user->getId())),
+                        Permission::delete(Role::user($user->getId())),
+                    ],
                     'userId' => $user->getId(),
                     'userInternalId' => $user->getInternalId(),
                     'providerType' => 'email',
@@ -132,6 +137,11 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
         if ($phone) {
             try {
                 $target = $dbForProject->createDocument('targets', new Document([
+                    '$permissions' => [
+                        Permission::read(Role::user($user->getId())),
+                        Permission::update(Role::user($user->getId())),
+                        Permission::delete(Role::user($user->getId())),
+                    ],
                     'userId' => $user->getId(),
                     'userInternalId' => $user->getInternalId(),
                     'providerType' => 'sms',
@@ -182,7 +192,6 @@ App::post('/v1/users')
     ->inject('hooks')
     ->action(function (string $userId, ?string $email, ?string $phone, ?string $password, string $name, Response $response, Document $project, Database $dbForProject, Event $queueForEvents, Hooks $hooks) {
         $user = createUser('plaintext', '{}', $userId, $email, $password, $phone, $name, $project, $dbForProject, $queueForEvents, $hooks);
-
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
             ->dynamic($user, Response::MODEL_USER);
@@ -498,8 +507,13 @@ App::post('/v1/users/:userId/targets')
         try {
             $target = $dbForProject->createDocument('targets', new Document([
                 '$id' => $targetId,
+                '$permissions' => [
+                    Permission::read(Role::user($user->getId())),
+                    Permission::update(Role::user($user->getId())),
+                    Permission::delete(Role::user($user->getId())),
+                ],
                 'providerId' => $providerId ?? null,
-                'providerInternalId' => $provider->getInternalId() ?? null,
+                'providerInternalId' => $provider->isEmpty() ? null : $provider->getInternalId(),
                 'providerType' =>  $providerType,
                 'userId' => $userId,
                 'userInternalId' => $user->getInternalId(),
@@ -791,6 +805,9 @@ App::get('/v1/users/:userId/logs')
 
             $output[$i] = new Document([
                 'event' => $log['event'],
+                'userId' => ID::custom($log['data']['userId']),
+                'userEmail' => $log['data']['userEmail'] ?? null,
+                'userName' => $log['data']['userName'] ?? null,
                 'ip' => $log['ip'],
                 'time' => $log['time'],
                 'osCode' => $os['osCode'],
@@ -819,7 +836,7 @@ App::get('/v1/users/:userId/logs')
         }
 
         $response->dynamic(new Document([
-            'total' => $audit->countLogsByUser($user->getId()),
+            'total' => $audit->countLogsByUser($user->getInternalId()),
             'logs' => $output,
         ]), Response::MODEL_LOG_LIST);
     });
@@ -1227,6 +1244,11 @@ App::patch('/v1/users/:userId/email')
             } else {
                 if (\strlen($email) !== 0) {
                     $target = $dbForProject->createDocument('targets', new Document([
+                        '$permissions' => [
+                            Permission::read(Role::user($user->getId())),
+                            Permission::update(Role::user($user->getId())),
+                            Permission::delete(Role::user($user->getId())),
+                        ],
                         'userId' => $user->getId(),
                         'userInternalId' => $user->getInternalId(),
                         'providerType' => 'email',
@@ -1305,6 +1327,11 @@ App::patch('/v1/users/:userId/phone')
             } else {
                 if (\strlen($number) !== 0) {
                     $target = $dbForProject->createDocument('targets', new Document([
+                        '$permissions' => [
+                            Permission::read(Role::user($user->getId())),
+                            Permission::update(Role::user($user->getId())),
+                            Permission::delete(Role::user($user->getId())),
+                        ],
                         'userId' => $user->getId(),
                         'userInternalId' => $user->getInternalId(),
                         'providerType' => 'sms',
@@ -1523,18 +1550,18 @@ App::patch('/v1/users/:userId/mfa')
         $response->dynamic($user, Response::MODEL_USER);
     });
 
-App::get('/v1/users/:userId/providers')
-    ->desc('List Providers')
+App::get('/v1/users/:userId/mfa/factors')
+    ->desc('List Factors')
     ->groups(['api', 'users'])
     ->label('scope', 'users.read')
     ->label('usage.metric', 'users.{scope}.requests.read')
     ->label('sdk.auth', [APP_AUTH_TYPE_KEY])
     ->label('sdk.namespace', 'users')
-    ->label('sdk.method', 'listProviders')
-    ->label('sdk.description', '/docs/references/users/list-providers.md')
+    ->label('sdk.method', 'listFactors')
+    ->label('sdk.description', '/docs/references/users/list-factors.md')
     ->label('sdk.response.code', Response::STATUS_CODE_OK)
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
-    ->label('sdk.response.model', Response::MODEL_MFA_PROVIDERS)
+    ->label('sdk.response.model', Response::MODEL_MFA_FACTORS)
     ->param('userId', '', new UID(), 'User ID.')
     ->inject('response')
     ->inject('dbForProject')
@@ -1551,10 +1578,10 @@ App::get('/v1/users/:userId/providers')
             'phone' => $user->getAttribute('phone', false) && $user->getAttribute('phoneVerification', false)
         ]);
 
-        $response->dynamic($providers, Response::MODEL_MFA_PROVIDERS);
+        $response->dynamic($providers, Response::MODEL_MFA_FACTORS);
     });
 
-App::delete('/v1/users/:userId/mfa/:provider')
+App::delete('/v1/users/:userId/mfa/:type')
     ->desc('Delete Authenticator')
     ->groups(['api', 'users'])
     ->label('event', 'users.[userId].delete.mfa')
@@ -1571,20 +1598,20 @@ App::delete('/v1/users/:userId/mfa/:provider')
     ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
     ->label('sdk.response.model', Response::MODEL_USER)
     ->param('userId', '', new UID(), 'User ID.')
-    ->param('provider', null, new WhiteList(['totp']), 'Provider.')
+    ->param('type', null, new WhiteList(['totp']), 'Type of authenticator.')
     ->param('otp', '', new Text(256), 'Valid verification token.')
     ->inject('requestTimestamp')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $userId, string $provider, string $otp, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $userId, string $type, string $otp, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Event $queueForEvents) {
         $user = $dbForProject->getDocument('users', $userId);
 
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $success = match ($provider) {
+        $success = match ($type) {
             'totp' => Challenge\TOTP::verify($user, $otp),
             default => false
         };
@@ -1635,7 +1662,7 @@ App::post('/v1/users/:userId/sessions')
     ->inject('queueForEvents')
     ->action(function (string $userId, Request $request, Response $response, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents) {
         $user = $dbForProject->getDocument('users', $userId);
-        if ($user === false || $user->isEmpty()) {
+        if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
@@ -1704,7 +1731,7 @@ App::post('/v1/users/:userId/tokens')
     ->action(function (string $userId, int $length, int $expire, Request $request, Response $response, Database $dbForProject, Event $queueForEvents) {
         $user = $dbForProject->getDocument('users', $userId);
 
-        if ($user === false || $user->isEmpty()) {
+        if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
@@ -1976,7 +2003,7 @@ App::get('/v1/users/usage')
 
         Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $count => $metric) {
-                $result =  $dbForProject->findOne('stats_v2', [
+                $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', ['inf'])
                 ]);
@@ -1984,7 +2011,7 @@ App::get('/v1/users/usage')
                 $stats[$metric]['total'] = $result['value'] ?? 0;
                 $limit = $days['limit'];
                 $period = $days['period'];
-                $results = $dbForProject->find('stats_v2', [
+                $results = $dbForProject->find('stats', [
                     Query::equal('metric', [$metric]),
                     Query::equal('period', [$period]),
                     Query::limit($limit),

app/controllers/api/vcs.php

@@ -238,9 +238,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
             $queueForBuilds
                 ->setType(BUILD_TYPE_DEPLOYMENT)
                 ->setResource($function)
-                ->setDeployment($deployment)
-                ->setProject($project)
-                ->trigger();
+                ->setDeployment($deployment);
 
             //TODO: Add event?
         }

app/controllers/general.php

@@ -3,7 +3,6 @@
 require_once __DIR__ . '/../init.php';
 
 use Utopia\App;
-use Utopia\Database\Helpers\Role;
 use Utopia\Locale\Locale;
 use Utopia\Logger\Logger;
 use Utopia\Logger\Log;
@@ -15,7 +14,6 @@ use Appwrite\Utopia\View;
 use Appwrite\Extend\Exception as AppwriteException;
 use Utopia\Config\Config;
 use Utopia\Domains\Domain;
-use Appwrite\Auth\Auth;
 use Appwrite\Event\Certificate;
 use Appwrite\Network\Validator\Origin;
 use Appwrite\Utopia\Response\Filters\V11 as ResponseV11;
@@ -24,9 +22,9 @@ use Appwrite\Utopia\Response\Filters\V13 as ResponseV13;
 use Appwrite\Utopia\Response\Filters\V14 as ResponseV14;
 use Appwrite\Utopia\Response\Filters\V15 as ResponseV15;
 use Appwrite\Utopia\Response\Filters\V16 as ResponseV16;
+use Appwrite\Utopia\Response\Filters\V17 as ResponseV17;
 use Utopia\CLI\Console;
 use Utopia\Database\Database;
-use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
@@ -36,8 +34,8 @@ use Appwrite\Utopia\Request\Filters\V13 as RequestV13;
 use Appwrite\Utopia\Request\Filters\V14 as RequestV14;
 use Appwrite\Utopia\Request\Filters\V15 as RequestV15;
 use Appwrite\Utopia\Request\Filters\V16 as RequestV16;
+use Appwrite\Utopia\Request\Filters\V17 as RequestV17;
 use Utopia\Validator\Text;
-use Utopia\Validator\WhiteList;
 
 Config::setParam('domainVerification', false);
 Config::setParam('cookieDomain', 'localhost');
@@ -203,15 +201,11 @@ App::init()
     ->inject('console')
     ->inject('project')
     ->inject('dbForConsole')
-    ->inject('user')
     ->inject('locale')
     ->inject('localeCodes')
     ->inject('clients')
-    ->inject('servers')
-    ->inject('session')
-    ->inject('mode')
     ->inject('queueForCertificates')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Document $console, Document $project, Database $dbForConsole, Document $user, Locale $locale, array $localeCodes, array $clients, array $servers, ?Document $session, string $mode, Certificate $queueForCertificates) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Document $console, Document $project, Database $dbForConsole, Locale $locale, array $localeCodes, array $clients, Certificate $queueForCertificates) {
         /*
         * Appwrite Router
         */
@@ -252,6 +246,9 @@ App::init()
                 case version_compare($requestFormat, '1.4.0', '<'):
                     Request::setFilter(new RequestV16());
                     break;
+                case version_compare($requestFormat, '1.5.0', '<'):
+                    Request::setFilter(new RequestV17());
+                    break;
                 default:
                     Request::setFilter(null);
             }
@@ -319,14 +316,6 @@ App::init()
             $locale->setDefault($localeParam);
         }
 
-        if ($project->isEmpty()) {
-            throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
-        }
-
-        if (!empty($route->getLabel('sdk.auth', [])) && $project->isEmpty() && ($route->getLabel('scope', '') !== 'public')) {
-            throw new AppwriteException(AppwriteException::PROJECT_UNKNOWN);
-        }
-
         $referrer = $request->getReferer();
         $origin = \parse_url($request->getOrigin($referrer), PHP_URL_HOST);
         $protocol = \parse_url($request->getOrigin($referrer), PHP_URL_SCHEME);
@@ -393,6 +382,9 @@ App::init()
                 case version_compare($responseFormat, '1.4.0', '<'):
                     Response::setFilter(new ResponseV16());
                     break;
+                case version_compare($responseFormat, '1.5.0', '<'):
+                    Response::setFilter(new ResponseV17());
+                    break;
                 default:
                     Response::setFilter(null);
             }
@@ -445,138 +437,6 @@ App::init()
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_UNKNOWN_ORIGIN, $originValidator->getDescription());
         }
-
-        /*
-        * ACL Check
-        */
-        $role = ($user->isEmpty())
-            ? Role::guests()->toString()
-            : Role::users()->toString();
-
-        // Add user roles
-        $memberships = $user->find('teamId', $project->getAttribute('teamId'), 'memberships');
-
-        if ($memberships) {
-            foreach ($memberships->getAttribute('roles', []) as $memberRole) {
-                switch ($memberRole) {
-                    case 'owner':
-                        $role = Auth::USER_ROLE_OWNER;
-                        break;
-                    case 'admin':
-                        $role = Auth::USER_ROLE_ADMIN;
-                        break;
-                    case 'developer':
-                        $role = Auth::USER_ROLE_DEVELOPER;
-                        break;
-                }
-            }
-        }
-
-        $roles = Config::getParam('roles', []);
-        $scope = $route->getLabel('scope', 'none'); // Allowed scope for chosen route
-        $scopes = $roles[$role]['scopes']; // Allowed scopes for user role
-
-        $authKey = $request->getHeader('x-appwrite-key', '');
-
-        if (!empty($authKey)) { // API Key authentication
-            // Check if given key match project API keys
-            $key = $project->find('secret', $authKey, 'keys');
-
-            /*
-            * Try app auth when we have project key and no user
-            *  Mock user to app and grant API key scopes in addition to default app scopes
-            */
-            if ($key && $user->isEmpty()) {
-                $user = new Document([
-                    '$id' => '',
-                    'status' => true,
-                    'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(),
-                    'password' => '',
-                    'name' => $project->getAttribute('name', 'Untitled'),
-                ]);
-
-                $role = Auth::USER_ROLE_APPS;
-                $scopes = \array_merge($roles[$role]['scopes'], $key->getAttribute('scopes', []));
-
-                $expire = $key->getAttribute('expire');
-                if (!empty($expire) && $expire < DateTime::formatTz(DateTime::now())) {
-                    throw new AppwriteException(AppwriteException::PROJECT_KEY_EXPIRED);
-                }
-
-                Authorization::setRole(Auth::USER_ROLE_APPS);
-                Authorization::setDefaultStatus(false);  // Cancel security segmentation for API keys.
-
-                $accessedAt = $key->getAttribute('accessedAt', '');
-                if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_KEY_ACCCESS)) > $accessedAt) {
-                    $key->setAttribute('accessedAt', DateTime::now());
-                    $dbForConsole->updateDocument('keys', $key->getId(), $key);
-                    $dbForConsole->purgeCachedDocument('projects', $project->getId());
-                }
-
-                $sdkValidator = new WhiteList($servers, true);
-                $sdk = $request->getHeader('x-sdk-name', 'UNKNOWN');
-                if ($sdkValidator->isValid($sdk)) {
-                    $sdks = $key->getAttribute('sdks', []);
-                    if (!in_array($sdk, $sdks)) {
-                        array_push($sdks, $sdk);
-                        $key->setAttribute('sdks', $sdks);
-
-                        /** Update access time as well */
-                        $key->setAttribute('accessedAt', Datetime::now());
-                        $dbForConsole->updateDocument('keys', $key->getId(), $key);
-                        $dbForConsole->purgeCachedDocument('projects', $project->getId());
-                    }
-                }
-            }
-        }
-
-        Authorization::setRole($role);
-
-        foreach (Auth::getRoles($user) as $authRole) {
-            Authorization::setRole($authRole);
-        }
-
-        $service = $route->getLabel('sdk.namespace', '');
-        if (!empty($service)) {
-            if (
-                array_key_exists($service, $project->getAttribute('services', []))
-                && !$project->getAttribute('services', [])[$service]
-                && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
-            ) {
-                throw new AppwriteException(AppwriteException::GENERAL_SERVICE_DISABLED);
-            }
-        }
-
-        if (!\in_array($scope, $scopes)) {
-            if ($project->isEmpty()) { // Check if permission is denied because project is missing
-                throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
-            }
-
-            throw new AppwriteException(AppwriteException::GENERAL_UNAUTHORIZED_SCOPE, $user->getAttribute('email', 'User') . ' (role: ' . \strtolower($roles[$role]['label']) . ') missing scope (' . $scope . ')');
-        }
-
-        if (false === $user->getAttribute('status')) { // Account is blocked
-            throw new AppwriteException(AppwriteException::USER_BLOCKED);
-        }
-
-        if ($user->getAttribute('reset')) {
-            throw new AppwriteException(AppwriteException::USER_PASSWORD_RESET_REQUIRED);
-        }
-
-        if ($mode !== APP_MODE_ADMIN) {
-            $mfaEnabled = $user->getAttribute('mfa', false);
-            $hasVerifiedAuthenticator = $user->getAttribute('totpVerification', false);
-            $hasVerifiedEmail = $user->getAttribute('emailVerification', false);
-            $hasVerifiedPhone = $user->getAttribute('phoneVerification', false);
-            $hasMoreFactors = $hasVerifiedEmail || $hasVerifiedPhone || $hasVerifiedAuthenticator;
-            $minimumFactors = ($mfaEnabled && $hasMoreFactors) ? 2 : 1;
-
-            if (!in_array('mfa', $route->getGroups())) {
-                if ($session && \count($session->getAttribute('factors')) < $minimumFactors) {
-                    throw new AppwriteException(AppwriteException::USER_MORE_FACTORS_REQUIRED);
-                }
-            }
-        }
     });
 
 App::options()

app/controllers/shared/api.php

@@ -2,11 +2,11 @@
 
 use Appwrite\Auth\Auth;
 use Appwrite\Event\Audit;
+use Appwrite\Event\Build;
 use Appwrite\Event\Database as EventDatabase;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Event;
 use Appwrite\Event\Func;
-use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
 use Appwrite\Extend\Exception;
 use Appwrite\Event\Usage;
@@ -22,7 +22,9 @@ use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Validator\Authorization;
-use MaxMind\Db\Reader;
+use Utopia\Config\Config;
+use Utopia\Database\Helpers\Role;
+use Utopia\Validator\WhiteList;
 
 $parseLabel = function (string $label, array $responsePayload, array $requestParams, Document $user) {
     preg_match_all('/{(.*?)}/', $label, $matches);
@@ -135,7 +137,7 @@ $databaseListener = function (string $event, Document $document, Document $proje
             $queueForUsage
                 ->addMetric(METRIC_DEPLOYMENTS, $value) // per project
                 ->addMetric(METRIC_DEPLOYMENTS_STORAGE, $document->getAttribute('size') * $value) // per project
-                ->addMetric(str_replace(['{resourceType}', '{resourceInternalId}'], [$document->getAttribute('resourceType'), $document->getAttribute('resourceInternalId')], METRIC_FUNCTION_ID_DEPLOYMENTS), $value)// per function
+                ->addMetric(str_replace(['{resourceType}', '{resourceInternalId}'], [$document->getAttribute('resourceType'), $document->getAttribute('resourceInternalId')], METRIC_FUNCTION_ID_DEPLOYMENTS), $value) // per function
                 ->addMetric(str_replace(['{resourceType}', '{resourceInternalId}'], [$document->getAttribute('resourceType'), $document->getAttribute('resourceInternalId')], METRIC_FUNCTION_ID_DEPLOYMENTS_STORAGE), $document->getAttribute('size') * $value);
             break;
         default:
@@ -143,6 +145,155 @@ $databaseListener = function (string $event, Document $document, Document $proje
     }
 };
 
+App::init()
+    ->groups(['api'])
+    ->inject('utopia')
+    ->inject('request')
+    ->inject('dbForConsole')
+    ->inject('project')
+    ->inject('user')
+    ->inject('session')
+    ->inject('servers')
+    ->inject('mode')
+    ->action(function (App $utopia, Request $request, Database $dbForConsole, Document $project, Document $user, ?Document $session, array $servers, string $mode) {
+        $route = $utopia->getRoute();
+
+        if ($project->isEmpty()) {
+            throw new Exception(Exception::PROJECT_NOT_FOUND);
+        }
+
+        /**
+         * ACL Check
+         */
+        $role = ($user->isEmpty())
+            ? Role::guests()->toString()
+            : Role::users()->toString();
+
+        // Add user roles
+        $memberships = $user->find('teamId', $project->getAttribute('teamId'), 'memberships');
+
+        if ($memberships) {
+            foreach ($memberships->getAttribute('roles', []) as $memberRole) {
+                switch ($memberRole) {
+                    case 'owner':
+                        $role = Auth::USER_ROLE_OWNER;
+                        break;
+                    case 'admin':
+                        $role = Auth::USER_ROLE_ADMIN;
+                        break;
+                    case 'developer':
+                        $role = Auth::USER_ROLE_DEVELOPER;
+                        break;
+                }
+            }
+        }
+
+        $roles = Config::getParam('roles', []);
+        $scope = $route->getLabel('scope', 'none'); // Allowed scope for chosen route
+        $scopes = $roles[$role]['scopes']; // Allowed scopes for user role
+
+        $authKey = $request->getHeader('x-appwrite-key', '');
+
+        if (!empty($authKey)) { // API Key authentication
+            // Do not allow API key and session to be set at the same time
+            if (!$user->isEmpty()) {
+                throw new Exception(Exception::USER_API_KEY_AND_SESSION_SET);
+            }
+
+            // Check if given key match project API keys
+            $key = $project->find('secret', $authKey, 'keys');
+            if ($key) {
+                $user = new Document([
+                    '$id' => '',
+                    'status' => true,
+                    'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(),
+                    'password' => '',
+                    'name' => $project->getAttribute('name', 'Untitled'),
+                ]);
+
+                $role = Auth::USER_ROLE_APPS;
+                $scopes = \array_merge($roles[$role]['scopes'], $key->getAttribute('scopes', []));
+
+                $expire = $key->getAttribute('expire');
+                if (!empty($expire) && $expire < DateTime::formatTz(DateTime::now())) {
+                    throw new Exception(Exception::PROJECT_KEY_EXPIRED);
+                }
+
+                Authorization::setRole(Auth::USER_ROLE_APPS);
+                Authorization::setDefaultStatus(false);  // Cancel security segmentation for API keys.
+
+                $accessedAt = $key->getAttribute('accessedAt', '');
+                if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_KEY_ACCCESS)) > $accessedAt) {
+                    $key->setAttribute('accessedAt', DateTime::now());
+                    $dbForConsole->updateDocument('keys', $key->getId(), $key);
+                    $dbForConsole->purgeCachedDocument('projects', $project->getId());
+                }
+
+                $sdkValidator = new WhiteList($servers, true);
+                $sdk = $request->getHeader('x-sdk-name', 'UNKNOWN');
+                if ($sdkValidator->isValid($sdk)) {
+                    $sdks = $key->getAttribute('sdks', []);
+                    if (!in_array($sdk, $sdks)) {
+                        array_push($sdks, $sdk);
+                        $key->setAttribute('sdks', $sdks);
+
+                        /** Update access time as well */
+                        $key->setAttribute('accessedAt', Datetime::now());
+                        $dbForConsole->updateDocument('keys', $key->getId(), $key);
+                        $dbForConsole->purgeCachedDocument('projects', $project->getId());
+                    }
+                }
+            }
+        }
+
+        Authorization::setRole($role);
+
+        foreach (Auth::getRoles($user) as $authRole) {
+            Authorization::setRole($authRole);
+        }
+
+        $service = $route->getLabel('sdk.namespace', '');
+        if (!empty($service)) {
+            if (
+                array_key_exists($service, $project->getAttribute('services', []))
+                && !$project->getAttribute('services', [])[$service]
+                && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
+            ) {
+                throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
+            }
+        }
+        if (!\in_array($scope, $scopes)) {
+            if ($project->isEmpty()) { // Check if permission is denied because project is missing
+                throw new Exception(Exception::PROJECT_NOT_FOUND);
+            }
+
+            throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE, $user->getAttribute('email', 'User') . ' (role: ' . \strtolower($roles[$role]['label']) . ') missing scope (' . $scope . ')');
+        }
+
+        if (false === $user->getAttribute('status')) { // Account is blocked
+            throw new Exception(Exception::USER_BLOCKED);
+        }
+
+        if ($user->getAttribute('reset')) {
+            throw new Exception(Exception::USER_PASSWORD_RESET_REQUIRED);
+        }
+
+        if ($mode !== APP_MODE_ADMIN) {
+            $mfaEnabled = $user->getAttribute('mfa', false);
+            $hasVerifiedAuthenticator = $user->getAttribute('totpVerification', false);
+            $hasVerifiedEmail = $user->getAttribute('emailVerification', false);
+            $hasVerifiedPhone = $user->getAttribute('phoneVerification', false);
+            $hasMoreFactors = $hasVerifiedEmail || $hasVerifiedPhone || $hasVerifiedAuthenticator;
+            $minimumFactors = ($mfaEnabled && $hasMoreFactors) ? 2 : 1;
+
+            if (!in_array('mfa', $route->getGroups())) {
+                if ($session && \count($session->getAttribute('factors')) < $minimumFactors) {
+                    throw new Exception(Exception::USER_MORE_FACTORS_REQUIRED);
+                }
+            }
+        }
+    });
+
 App::init()
     ->groups(['api'])
     ->inject('utopia')
@@ -155,17 +306,14 @@ App::init()
     ->inject('queueForAudits')
     ->inject('queueForDeletes')
     ->inject('queueForDatabase')
+    ->inject('queueForBuilds')
     ->inject('queueForUsage')
     ->inject('dbForProject')
     ->inject('mode')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Usage $queueForUsage, Database $dbForProject, string $mode) use ($databaseListener) {
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Usage $queueForUsage, Database $dbForProject, string $mode) use ($databaseListener) {
 
         $route = $utopia->getRoute();
 
-        if ($project->isEmpty() && $route->getLabel('abuse-limit', 0) > 0) { // Abuse limit requires an active project scope
-            throw new Exception(Exception::PROJECT_UNKNOWN);
-        }
-
         /*
         * Abuse Check
         */
@@ -236,9 +384,6 @@ App::init()
             ->setProject($project)
             ->setUser($user);
 
-        $queueForMessaging
-            ->setProject($project);
-
         $queueForAudits
             ->setMode($mode)
             ->setUserAgent($request->getUserAgent(''))
@@ -247,9 +392,10 @@ App::init()
             ->setProject($project)
             ->setUser($user);
 
-
         $queueForDeletes->setProject($project);
         $queueForDatabase->setProject($project);
+        $queueForBuilds->setProject($project);
+        $queueForMessaging->setProject($project);
 
         $dbForProject
             ->on(Database::EVENT_DOCUMENT_CREATE, 'calculate-usage', fn ($event, $document) => $databaseListener($event, $document, $project, $queueForUsage, $dbForProject))
@@ -257,24 +403,22 @@ App::init()
         ;
 
         $useCache = $route->getLabel('cache', false);
-
         if ($useCache) {
             $key = md5($request->getURI() . implode('*', $request->getParams()) . '*' . APP_CACHE_BUSTER);
+            $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
             $cache = new Cache(
                 new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
             );
             $timestamp = 60 * 60 * 24 * 30;
             $data = $cache->load($key, $timestamp);
 
-            if (!empty($data)) {
-                $data = json_decode($data, true);
-                $parts = explode('/', $data['resourceType']);
+            if (!empty($data) && !$cacheLog->isEmpty()) {
+                $parts = explode('/', $cacheLog->getAttribute('resourceType'));
                 $type = $parts[0] ?? null;
 
                 if ($type === 'bucket') {
                     $bucketId = $parts[1] ?? null;
-
-                    $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+                    $bucket   = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
                     $isAPIKey = Auth::isAppUser(Authorization::getRoles());
                     $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
@@ -286,17 +430,18 @@ App::init()
                     $fileSecurity = $bucket->getAttribute('fileSecurity', false);
                     $validator = new Authorization(Database::PERMISSION_READ);
                     $valid = $validator->isValid($bucket->getRead());
+
                     if (!$fileSecurity && !$valid) {
                         throw new Exception(Exception::USER_UNAUTHORIZED);
                     }
 
-                    $parts = explode('/', $data['resource']);
+                    $parts = explode('/', $cacheLog->getAttribute('resource'));
                     $fileId = $parts[1] ?? null;
 
                     if ($fileSecurity && !$valid) {
                         $file = $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId);
                     } else {
-                        $file = Authorization::skip(fn() => $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId));
+                        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getInternalId(), $fileId));
                     }
 
                     if ($file->isEmpty()) {
@@ -307,8 +452,8 @@ App::init()
                 $response
                     ->addHeader('Expires', \date('D, d M Y H:i:s', \time() + $timestamp) . ' GMT')
                     ->addHeader('X-Appwrite-Cache', 'hit')
-                    ->setContentType($data['contentType'])
-                    ->send(base64_decode($data['payload']))
+                    ->setContentType($cacheLog->getAttribute('mimeType'))
+                    ->send($data)
                 ;
             } else {
                 $response->addHeader('X-Appwrite-Cache', 'miss');
@@ -316,81 +461,6 @@ App::init()
         }
     });
 
-App::init()
-    ->groups(['auth'])
-    ->inject('utopia')
-    ->inject('request')
-    ->inject('project')
-    ->inject('geodb')
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
-        $denylist = App::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
-        if (!empty($denylist) && $project->getId() === 'console') {
-            $countries = explode(',', $denylist);
-            $record = $geodb->get($request->getIP()) ?? [];
-            $country = $record['country']['iso_code'] ?? '';
-            if (in_array($country, $countries)) {
-                throw new Exception(Exception::GENERAL_REGION_ACCESS_DENIED);
-            }
-        }
-
-        $route = $utopia->getRoute();
-
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
-        $isAppUser = Auth::isAppUser(Authorization::getRoles());
-
-        if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
-            return;
-        }
-
-        $auths = $project->getAttribute('auths', []);
-        switch ($route->getLabel('auth.type', '')) {
-            case 'emailPassword':
-                if (($auths['emailPassword'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Email / Password authentication is disabled for this project');
-                }
-                break;
-
-            case 'magic-url':
-                if (($auths['usersAuthMagicURL'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Magic URL authentication is disabled for this project');
-                }
-                break;
-
-            case 'anonymous':
-                if (($auths['anonymous'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Anonymous authentication is disabled for this project');
-                }
-                break;
-
-            case 'phone':
-                if (($auths['phone'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Phone authentication is disabled for this project');
-                }
-                break;
-
-            case 'invites':
-                if (($auths['invites'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Invites authentication is disabled for this project');
-                }
-                break;
-
-            case 'jwt':
-                if (($auths['JWT'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'JWT authentication is disabled for this project');
-                }
-                break;
-
-            case 'email-otp':
-                if (($auths['emailOTP'] ?? true) === false) {
-                    throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Email OTP authentication is disabled for this project');
-                }
-                break;
-
-            default:
-                throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Unsupported authentication type: ' . $route->getLabel('auth.type', ''));
-        }
-    });
-
 /**
  * Limit user session
  *
@@ -442,11 +512,13 @@ App::shutdown()
     ->inject('queueForUsage')
     ->inject('queueForDeletes')
     ->inject('queueForDatabase')
+    ->inject('queueForBuilds')
+    ->inject('queueForMessaging')
     ->inject('dbForProject')
     ->inject('queueForFunctions')
     ->inject('mode')
     ->inject('dbForConsole')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, Usage $queueForUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Database $dbForProject, Func $queueForFunctions, string $mode, Database $dbForConsole) use ($parseLabel) {
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, Usage $queueForUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Database $dbForProject, Func $queueForFunctions, string $mode, Database $dbForConsole) use ($parseLabel) {
 
         $responsePayload = $response->getPayload();
 
@@ -547,6 +619,14 @@ App::shutdown()
             $queueForDatabase->trigger();
         }
 
+        if (!empty($queueForBuilds->getType())) {
+            $queueForBuilds->trigger();
+        }
+
+        if (!empty($queueForMessaging->getType())) {
+            $queueForMessaging->trigger();
+        }
+
         /**
          * Cache label
          */
@@ -554,7 +634,6 @@ App::shutdown()
         if ($useCache) {
             $resource = $resourceType = null;
             $data = $response->getPayload();
-
             if (!empty($data['payload'])) {
                 $pattern = $route->getLabel('cache.resource', null);
                 if (!empty($pattern)) {
@@ -566,22 +645,17 @@ App::shutdown()
                     $resourceType = $parseLabel($pattern, $responsePayload, $requestParams, $user);
                 }
 
-                $key = md5($request->getURI() . implode('*', $request->getParams()) . '*' . APP_CACHE_BUSTER);
-                $data = json_encode([
-                    'resourceType' => $resourceType,
-                    'resource' => $resource,
-                    'contentType' => $response->getContentType(),
-                    'payload' => base64_encode($data['payload']),
-                ]) ;
-
-                $signature = md5($data);
-                $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
+                $key = md5($request->getURI() . '*' . implode('*', $request->getParams())) . '*' . APP_CACHE_BUSTER;
+                $signature = md5($data['payload']);
+                $cacheLog  =  Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
                 $accessedAt = $cacheLog->getAttribute('accessedAt', '');
                 $now = DateTime::now();
                 if ($cacheLog->isEmpty()) {
                     Authorization::skip(fn () => $dbForProject->createDocument('cache', new Document([
                     '$id' => $key,
                     'resource' => $resource,
+                    'resourceType' => $resourceType,
+                    'mimeType' => $response->getContentType(),
                     'accessedAt' => $now,
                     'signature' => $signature,
                     ])));
@@ -594,7 +668,7 @@ App::shutdown()
                     $cache = new Cache(
                         new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
                     );
-                    $cache->save($key, $data);
+                    $cache->save($key, $data['payload']);
                 }
             }
         }

app/controllers/web/console.php

@@ -21,6 +21,7 @@ App::get('/console/*')
     ->alias('auth/*')
     ->alias('/invite')
     ->alias('/login')
+    ->alias('/mfa')
     ->alias('/card/*')
     ->alias('/recover')
     ->alias('/register/*')

app/http.php

@@ -3,6 +3,7 @@
 require_once __DIR__ . '/../vendor/autoload.php';
 
 use Appwrite\Utopia\Response;
+use Swoole\Constant;
 use Swoole\Process;
 use Swoole\Http\Server;
 use Swoole\Http\Request as SwooleRequest;
@@ -20,12 +21,15 @@ use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Swoole\Files;
 use Appwrite\Utopia\Request;
-use Swoole\Coroutine;
 use Utopia\Logger\Log;
 use Utopia\Logger\Log\User;
 use Utopia\Pools\Group;
 
-$http = new Server("0.0.0.0", App::getEnv('PORT', 80));
+$http = new Server(
+    host: "0.0.0.0",
+    port: App::getEnv('PORT', 80),
+    mode: SWOOLE_PROCESS,
+);
 
 $payloadSize = 6 * (1024 * 1024); // 6MB
 $workerNumber = swoole_cpu_num() * intval(App::getEnv('_APP_WORKER_PER_CORE', 6));
@@ -34,23 +38,21 @@ $http
     ->set([
         'worker_num' => $workerNumber,
         'open_http2_protocol' => true,
-        // 'document_root' => __DIR__.'/../public',
-        // 'enable_static_handler' => true,
         'http_compression' => true,
         'http_compression_level' => 6,
         'package_max_length' => $payloadSize,
         'buffer_output_size' => $payloadSize,
     ]);
 
-$http->on('WorkerStart', function ($server, $workerId) {
+$http->on(Constant::EVENT_WORKER_START, function ($server, $workerId) {
     Console::success('Worker ' . ++$workerId . ' started successfully');
 });
 
-$http->on('BeforeReload', function ($server, $workerId) {
+$http->on(Constant::EVENT_BEFORE_RELOAD, function ($server, $workerId) {
     Console::success('Starting reload...');
 });
 
-$http->on('AfterReload', function ($server, $workerId) {
+$http->on(Constant::EVENT_AFTER_RELOAD, function ($server, $workerId) {
     Console::success('Reload completed...');
 });
 
@@ -58,7 +60,7 @@ Files::load(__DIR__ . '/../console');
 
 include __DIR__ . '/controllers/general.php';
 
-$http->on('start', function (Server $http) use ($payloadSize, $register) {
+$http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $register) {
     $app = new App('UTC');
 
     go(function () use ($register, $app) {

app/init.php

@@ -112,8 +112,8 @@ const APP_LIMIT_LIST_DEFAULT = 25; // Default maximum number of items to return
 const APP_KEY_ACCCESS = 24 * 60 * 60; // 24 hours
 const APP_USER_ACCCESS = 24 * 60 * 60; // 24 hours
 const APP_CACHE_UPDATE = 24 * 60 * 60; // 24 hours
-const APP_CACHE_BUSTER = 329;
-const APP_VERSION_STABLE = '1.4.13';
+const APP_CACHE_BUSTER = 330;
+const APP_VERSION_STABLE = '1.5.0';
 const APP_DATABASE_ATTRIBUTE_EMAIL = 'email';
 const APP_DATABASE_ATTRIBUTE_ENUM = 'enum';
 const APP_DATABASE_ATTRIBUTE_IP = 'ip';
@@ -142,9 +142,11 @@ const APP_SOCIAL_DEV = 'https://dev.to/appwrite';
 const APP_SOCIAL_STACKSHARE = 'https://stackshare.io/appwrite';
 const APP_SOCIAL_YOUTUBE = 'https://www.youtube.com/c/appwrite?sub_confirmation=1';
 const APP_HOSTNAME_INTERNAL = 'appwrite';
+
 // Database Reconnect
 const DATABASE_RECONNECT_SLEEP = 2;
 const DATABASE_RECONNECT_MAX_ATTEMPTS = 10;
+
 // Database Worker Types
 const DATABASE_TYPE_CREATE_ATTRIBUTE = 'createAttribute';
 const DATABASE_TYPE_CREATE_INDEX = 'createIndex';
@@ -152,9 +154,11 @@ const DATABASE_TYPE_DELETE_ATTRIBUTE = 'deleteAttribute';
 const DATABASE_TYPE_DELETE_INDEX = 'deleteIndex';
 const DATABASE_TYPE_DELETE_COLLECTION = 'deleteCollection';
 const DATABASE_TYPE_DELETE_DATABASE = 'deleteDatabase';
+
 // Build Worker Types
 const BUILD_TYPE_DEPLOYMENT = 'deployment';
 const BUILD_TYPE_RETRY = 'retry';
+
 // Deletion Types
 const DELETE_TYPE_DATABASES = 'databases';
 const DELETE_TYPE_DOCUMENT = 'document';
@@ -180,6 +184,10 @@ const DELETE_TYPE_TOPIC = 'topic';
 const DELETE_TYPE_TARGET = 'target';
 const DELETE_TYPE_EXPIRED_TARGETS = 'invalid_targets';
 const DELETE_TYPE_SESSION_TARGETS = 'session_targets';
+
+// Message types
+const MESSAGE_SEND_TYPE_INTERNAL = 'internal';
+const MESSAGE_SEND_TYPE_EXTERNAL = 'external';
 // Mail Types
 const MAIL_TYPE_VERIFICATION = 'verification';
 const MAIL_TYPE_MAGIC_SESSION = 'magicSession';
@@ -940,7 +948,7 @@ $register->set('smtp', function () {
     return $mail;
 });
 $register->set('geodb', function () {
-    return new Reader(__DIR__ . '/assets/dbip/dbip-country-lite-2023-01.mmdb');
+    return new Reader(__DIR__ . '/assets/dbip/dbip-country-lite-2024-02.mmdb');
 });
 $register->set('passwordsDictionary', function () {
     $content = \file_get_contents(__DIR__ . '/assets/security/10k-common-passwords');
@@ -1375,19 +1383,19 @@ App::setResource('cache', function (Group $pools) {
     return new Cache(new Sharding($adapters));
 }, ['pools']);
 
-App::setResource('deviceLocal', function () {
+App::setResource('deviceForLocal', function () {
     return new Local();
 });
 
-App::setResource('deviceFiles', function ($project) {
+App::setResource('deviceForFiles', function ($project) {
     return getDevice(APP_STORAGE_UPLOADS . '/app-' . $project->getId());
 }, ['project']);
 
-App::setResource('deviceFunctions', function ($project) {
+App::setResource('deviceForFunctions', function ($project) {
     return getDevice(APP_STORAGE_FUNCTIONS . '/app-' . $project->getId());
 }, ['project']);
 
-App::setResource('deviceBuilds', function ($project) {
+App::setResource('deviceForBuilds', function ($project) {
     return getDevice(APP_STORAGE_BUILDS . '/app-' . $project->getId());
 }, ['project']);
 

app/preload.php

@@ -1,51 +0,0 @@
-<?php
-
-/**
- * Init
- *
- * Inializes both Appwrite API entry point, queue workers, and CLI tasks.
- * Set configuration, framework resources, app constants
- *
- */
-
-ini_set('display_errors', 1);
-ini_set('display_startup_errors', 1);
-error_reporting(E_ALL);
-
-if (file_exists(__DIR__ . '/../vendor/autoload.php')) {
-    require __DIR__ . '/../vendor/autoload.php';
-}
-
-use Utopia\Preloader\Preloader;
-
-include __DIR__ . '/controllers/general.php';
-
-$preloader = new Preloader();
-
-foreach (
-    [
-    realpath(__DIR__ . '/../vendor/composer'),
-    realpath(__DIR__ . '/../vendor/amphp'),
-    realpath(__DIR__ . '/../vendor/felixfbecker'),
-    realpath(__DIR__ . '/../vendor/twig/twig'),
-    realpath(__DIR__ . '/../vendor/guzzlehttp/guzzle'),
-    realpath(__DIR__ . '/../vendor/slickdeals'),
-    realpath(__DIR__ . '/../vendor/psr/log'),
-    realpath(__DIR__ . '/../vendor/matomo'),
-    realpath(__DIR__ . '/../vendor/symfony'),
-    realpath(__DIR__ . '/../vendor/mongodb'),
-    realpath(__DIR__ . '/../vendor/utopia-php/websocket'), // TODO: remove workerman autoload
-    realpath(__DIR__ . '/../vendor/utopia-php/cache'), // TODO: remove memcached autoload
-    realpath(__DIR__ . '/../vendor/utopia-php/queue/src/Queue/Adapter/Workerman.php'), // TODO: remove workerman autoload
-    ] as $key => $value
-) {
-    if ($value !== false) {
-        $preloader->ignore($value);
-    }
-}
-
-$preloader
-    ->paths(realpath(__DIR__ . '/../app/config'))
-    ->paths(realpath(__DIR__ . '/../app/controllers'))
-    ->paths(realpath(__DIR__ . '/../src'))
-    ->load();

app/worker.php

@@ -15,6 +15,7 @@ use Appwrite\Event\Messaging;
 use Appwrite\Event\Migration;
 use Appwrite\Event\Phone;
 use Appwrite\Event\Usage;
+use Appwrite\Event\UsageDump;
 use Appwrite\Platform\Appwrite;
 use Swoole\Runtime;
 use Utopia\App;
@@ -34,6 +35,7 @@ use Utopia\Logger\Log;
 use Utopia\Logger\Logger;
 use Utopia\Pools\Group;
 use Utopia\Queue\Connection;
+use Utopia\Storage\Device\Local;
 
 Authorization::disable();
 Runtime::enableCoroutine(SWOOLE_HOOK_ALL);
@@ -45,8 +47,7 @@ Server::setResource('dbForConsole', function (Cache $cache, Registry $register)
     $database = $pools
         ->get('console')
         ->pop()
-        ->getResource()
-    ;
+        ->getResource();
 
     $adapter = new Database($database, $cache);
     $adapter->setNamespace('_console');
@@ -54,26 +55,6 @@ Server::setResource('dbForConsole', function (Cache $cache, Registry $register)
     return $adapter;
 }, ['cache', 'register']);
 
-Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Database $dbForConsole) {
-    $payload = $message->getPayload() ?? [];
-    $project = new Document($payload['project'] ?? []);
-
-    if ($project->isEmpty() || $project->getId() === 'console') {
-        return $dbForConsole;
-    }
-
-    $pools = $register->get('pools');
-    $database = $pools
-        ->get($project->getAttribute('database'))
-        ->pop()
-        ->getResource()
-    ;
-
-    $adapter = new Database($database, $cache);
-    $adapter->setNamespace('_' . $project->getInternalId());
-    return $adapter;
-}, ['cache', 'register', 'message', 'dbForConsole']);
-
 Server::setResource('project', function (Message $message, Database $dbForConsole) {
     $payload = $message->getPayload() ?? [];
     $project = new Document($payload['project'] ?? []);
@@ -81,10 +62,26 @@ Server::setResource('project', function (Message $message, Database $dbForConsol
     if ($project->getId() === 'console') {
         return $project;
     }
+
     return $dbForConsole->getDocument('projects', $project->getId());
-    ;
 }, ['message', 'dbForConsole']);
 
+Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForConsole) {
+    if ($project->isEmpty() || $project->getId() === 'console') {
+        return $dbForConsole;
+    }
+
+    $pools = $register->get('pools');
+    $database = $pools
+        ->get($project->getAttribute('database'))
+        ->pop()
+        ->getResource();
+
+    $adapter = new Database($database, $cache);
+    $adapter->setNamespace('_' . $project->getInternalId());
+    return $adapter;
+}, ['cache', 'register', 'message', 'project', 'dbForConsole']);
+
 Server::setResource('getProjectDB', function (Group $pools, Database $dbForConsole, $cache) {
     $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools
 
@@ -143,72 +140,92 @@ Server::setResource('cache', function (Registry $register) {
 
     return new Cache(new Sharding($adapters));
 }, ['register']);
+
 Server::setResource('log', fn() => new Log());
+
 Server::setResource('queueForUsage', function (Connection $queue) {
     return new Usage($queue);
 }, ['queue']);
+
+Server::setResource('queueForUsageDump', function (Connection $queue) {
+    return new UsageDump($queue);
+}, ['queue']);
+
 Server::setResource('queue', function (Group $pools) {
     return $pools->get('queue')->pop()->getResource();
 }, ['pools']);
+
 Server::setResource('queueForDatabase', function (Connection $queue) {
     return new EventDatabase($queue);
 }, ['queue']);
+
 Server::setResource('queueForMessaging', function (Connection $queue) {
     return new Messaging($queue);
 }, ['queue']);
+
 Server::setResource('queueForMails', function (Connection $queue) {
     return new Mail($queue);
 }, ['queue']);
+
 Server::setResource('queueForBuilds', function (Connection $queue) {
     return new Build($queue);
 }, ['queue']);
+
 Server::setResource('queueForDeletes', function (Connection $queue) {
     return new Delete($queue);
 }, ['queue']);
+
 Server::setResource('queueForEvents', function (Connection $queue) {
     return new Event($queue);
 }, ['queue']);
+
 Server::setResource('queueForAudits', function (Connection $queue) {
     return new Audit($queue);
 }, ['queue']);
+
 Server::setResource('queueForFunctions', function (Connection $queue) {
     return new Func($queue);
 }, ['queue']);
+
 Server::setResource('queueForCertificates', function (Connection $queue) {
     return new Certificate($queue);
 }, ['queue']);
+
 Server::setResource('queueForMigrations', function (Connection $queue) {
     return new Migration($queue);
 }, ['queue']);
+
 Server::setResource('queueForHamster', function (Connection $queue) {
     return new Hamster($queue);
 }, ['queue']);
+
 Server::setResource('logger', function (Registry $register) {
     return $register->get('logger');
 }, ['register']);
+
 Server::setResource('pools', function (Registry $register) {
     return $register->get('pools');
 }, ['register']);
-Server::setResource('getFunctionsDevice', function () {
-    return function (string $projectId) {
-        return getDevice(APP_STORAGE_FUNCTIONS . '/app-' . $projectId);
-    };
-});
-Server::setResource('getFilesDevice', function () {
-    return function (string $projectId) {
-        return getDevice(APP_STORAGE_UPLOADS . '/app-' . $projectId);
-    };
-});
-Server::setResource('getBuildsDevice', function () {
-    return function (string $projectId) {
-        return getDevice(APP_STORAGE_BUILDS . '/app-' . $projectId);
-    };
-});
-Server::setResource('getCacheDevice', function () {
-    return function (string $projectId) {
-        return getDevice(APP_STORAGE_CACHE . '/app-' . $projectId);
-    };
-});
+
+Server::setResource('deviceForFunctions', function (Document $project) {
+    return getDevice(APP_STORAGE_FUNCTIONS . '/app-' . $project->getId());
+}, ['project']);
+
+Server::setResource('deviceForFiles', function (Document $project) {
+    return getDevice(APP_STORAGE_UPLOADS . '/app-' . $project->getId());
+}, ['project']);
+
+Server::setResource('deviceForBuilds', function (Document $project) {
+    return getDevice(APP_STORAGE_BUILDS . '/app-' . $project->getId());
+}, ['project']);
+
+Server::setResource('deviceForCache', function (Document $project) {
+    return getDevice(APP_STORAGE_CACHE . '/app-' . $project->getId());
+}, ['project']);
+
+Server::setResource('deviceForLocalFiles', function (Document $project) {
+    return new Local(APP_STORAGE_UPLOADS . '/app-' . $project->getId());
+}, ['project']);
 
 $pools = $register->get('pools');
 $platform = new Appwrite();
@@ -303,12 +320,9 @@ $worker
         Console::error('[Error] Line: ' . $error->getLine());
     });
 
-try {
-    $workerStart = $worker->getWorkerStart();
-} catch (\Throwable $error) {
-    $worker->workerStart();
-} finally {
-    Console::info("Worker $workerName  started");
-}
+$worker->workerStart()
+    ->action(function () use ($workerName) {
+        Console::info("Worker $workerName  started");
+    });
 
 $worker->start();

bin/worker-usage-dump

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+php /usr/src/code/app/worker.php usage-dump $@

composer.json

@@ -1,4 +1,5 @@
 {
+
     "name": "appwrite/server-ce",
     "description": "End to end backend server for frontend and mobile apps.",
     "type": "project",
@@ -56,12 +57,11 @@
         "utopia-php/image": "0.6.*",
         "utopia-php/locale": "0.4.*",
         "utopia-php/logger": "0.3.*",
-        "utopia-php/messaging": "0.9.*",
+        "utopia-php/messaging": "0.10.*",
         "utopia-php/migration": "0.3.*",
         "utopia-php/orchestration": "0.9.*",
         "utopia-php/platform": "0.5.*",
         "utopia-php/pools": "0.4.*",
-        "utopia-php/preloader": "0.2.*",
         "utopia-php/queue": "0.7.*",
         "utopia-php/registry": "0.5.*",
         "utopia-php/storage": "0.18.*",
@@ -70,19 +70,13 @@
         "utopia-php/websocket": "0.1.*",
         "matomo/device-detector": "6.1.*",
         "dragonmantank/cron-expression": "3.3.2",
-        "phpmailer/phpmailer": "6.8.0",
+        "phpmailer/phpmailer": "6.9.1",
         "chillerlan/php-qrcode": "4.3.4",
         "adhocore/jwt": "1.1.2",
         "spomky-labs/otphp": "^10.0",
         "webonyx/graphql-php": "14.11.*",
         "league/csv": "9.14.*"
     },
-    "repositories": [
-        {
-            "url": "https://github.com/appwrite/runtimes.git",
-            "type": "git"
-        }
-    ],
     "require-dev": {
         "ext-fileinfo": "*",
         "appwrite/sdk-generator": "0.36.*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "55d2ed1081591f2b3b3af9999236b109",
+    "content-hash": "f19c09e7e233fe0f767bf5255fb46b86",
     "packages": [
         {
             "name": "adhocore/jwt",
@@ -162,6 +162,12 @@
                 "url": "https://github.com/appwrite/runtimes.git",
                 "reference": "214a37c2c66e0f2bc9c30fdfde66955d9fd084a1"
             },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/appwrite/runtimes/zipball/214a37c2c66e0f2bc9c30fdfde66955d9fd084a1",
+                "reference": "214a37c2c66e0f2bc9c30fdfde66955d9fd084a1",
+                "shasum": ""
+            },
             "require": {
                 "php": ">=8.0",
                 "utopia-php/system": "0.7.*"
@@ -176,6 +182,7 @@
                     "Appwrite\\Runtimes\\": "src/Runtimes"
                 }
             },
+            "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "BSD-3-Clause"
             ],
@@ -195,6 +202,10 @@
                 "php",
                 "runtimes"
             ],
+            "support": {
+                "issues": "https://github.com/appwrite/runtimes/issues",
+                "source": "https://github.com/appwrite/runtimes/tree/0.13.2"
+            },
             "time": "2023-11-22T15:36:00+00:00"
         },
         {
@@ -874,16 +885,16 @@
         },
         {
             "name": "phpmailer/phpmailer",
-            "version": "v6.8.0",
+            "version": "v6.9.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPMailer/PHPMailer.git",
-                "reference": "df16b615e371d81fb79e506277faea67a1be18f1"
+                "reference": "039de174cd9c17a8389754d3b877a2ed22743e18"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/df16b615e371d81fb79e506277faea67a1be18f1",
-                "reference": "df16b615e371d81fb79e506277faea67a1be18f1",
+                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/039de174cd9c17a8389754d3b877a2ed22743e18",
+                "reference": "039de174cd9c17a8389754d3b877a2ed22743e18",
                 "shasum": ""
             },
             "require": {
@@ -893,16 +904,17 @@
                 "php": ">=5.5.0"
             },
             "require-dev": {
-                "dealerdirect/phpcodesniffer-composer-installer": "^0.7.2",
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
                 "doctrine/annotations": "^1.2.6 || ^1.13.3",
                 "php-parallel-lint/php-console-highlighter": "^1.0.0",
                 "php-parallel-lint/php-parallel-lint": "^1.3.2",
                 "phpcompatibility/php-compatibility": "^9.3.5",
                 "roave/security-advisories": "dev-latest",
-                "squizlabs/php_codesniffer": "^3.7.1",
+                "squizlabs/php_codesniffer": "^3.7.2",
                 "yoast/phpunit-polyfills": "^1.0.4"
             },
             "suggest": {
+                "decomplexity/SendOauth2": "Adapter for using XOAUTH2 authentication",
                 "ext-mbstring": "Needed to send email in multibyte encoding charset or decode encoded addresses",
                 "ext-openssl": "Needed for secure SMTP sending and DKIM signing",
                 "greew/oauth2-azure-provider": "Needed for Microsoft Azure XOAUTH2 authentication",
@@ -942,7 +954,7 @@
             "description": "PHPMailer is a full-featured email creation and transfer class for PHP",
             "support": {
                 "issues": "https://github.com/PHPMailer/PHPMailer/issues",
-                "source": "https://github.com/PHPMailer/PHPMailer/tree/v6.8.0"
+                "source": "https://github.com/PHPMailer/PHPMailer/tree/v6.9.1"
             },
             "funding": [
                 {
@@ -950,7 +962,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2023-03-06T14:43:22+00:00"
+            "time": "2023-11-25T22:23:28+00:00"
         },
         {
             "name": "spomky-labs/otphp",
@@ -1900,28 +1912,28 @@
         },
         {
             "name": "utopia-php/messaging",
-            "version": "0.9.1",
+            "version": "0.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/utopia-php/messaging.git",
-                "reference": "7beec07684e9e1dfcf4ab5b1ba731fa396dccbdf"
+                "reference": "71dce00ad43eb278a877cb2c329f7b8d677adfeb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/messaging/zipball/7beec07684e9e1dfcf4ab5b1ba731fa396dccbdf",
-                "reference": "7beec07684e9e1dfcf4ab5b1ba731fa396dccbdf",
+                "url": "https://api.github.com/repos/utopia-php/messaging/zipball/71dce00ad43eb278a877cb2c329f7b8d677adfeb",
+                "reference": "71dce00ad43eb278a877cb2c329f7b8d677adfeb",
                 "shasum": ""
             },
             "require": {
                 "ext-curl": "*",
                 "ext-openssl": "*",
-                "php": ">=8.0.0"
+                "php": ">=8.0.0",
+                "phpmailer/phpmailer": "6.9.1"
             },
             "require-dev": {
-                "laravel/pint": "1.13.*",
-                "phpmailer/phpmailer": "6.8.*",
-                "phpstan/phpstan": "1.10.*",
-                "phpunit/phpunit": "9.6.10"
+                "laravel/pint": "1.13.11",
+                "phpstan/phpstan": "1.10.58",
+                "phpunit/phpunit": "10.5.10"
             },
             "type": "library",
             "autoload": {
@@ -1944,9 +1956,9 @@
             ],
             "support": {
                 "issues": "https://github.com/utopia-php/messaging/issues",
-                "source": "https://github.com/utopia-php/messaging/tree/0.9.1"
+                "source": "https://github.com/utopia-php/messaging/tree/0.10.0"
             },
-            "time": "2024-02-15T03:44:44+00:00"
+            "time": "2024-02-20T07:30:15+00:00"
         },
         {
             "name": "utopia-php/migration",
@@ -2206,59 +2218,6 @@
             },
             "time": "2022-11-22T07:55:45+00:00"
         },
-        {
-            "name": "utopia-php/preloader",
-            "version": "0.2.4",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/utopia-php/preloader.git",
-                "reference": "65ef48392e72172f584b0baa2e224f9a1cebcce0"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/preloader/zipball/65ef48392e72172f584b0baa2e224f9a1cebcce0",
-                "reference": "65ef48392e72172f584b0baa2e224f9a1cebcce0",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=7.1"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "^9.3",
-                "vimeo/psalm": "4.0.1"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Utopia\\Preloader\\": "src/Preloader"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Eldad Fux",
-                    "email": "team@appwrite.io"
-                }
-            ],
-            "description": "Utopia Preloader library is simple and lite library for managing PHP preloading configuration",
-            "keywords": [
-                "framework",
-                "php",
-                "preload",
-                "preloader",
-                "preloading",
-                "upf",
-                "utopia"
-            ],
-            "support": {
-                "issues": "https://github.com/utopia-php/preloader/issues",
-                "source": "https://github.com/utopia-php/preloader/tree/0.2.4"
-            },
-            "time": "2020-10-24T07:04:59+00:00"
-        },
         {
             "name": "utopia-php/queue",
             "version": "0.7.0",
@@ -3525,16 +3484,16 @@
         },
         {
             "name": "phpstan/phpdoc-parser",
-            "version": "1.26.0",
+            "version": "1.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpdoc-parser.git",
-                "reference": "231e3186624c03d7e7c890ec662b81e6b0405227"
+                "reference": "bd84b629c8de41aa2ae82c067c955e06f1b00240"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/231e3186624c03d7e7c890ec662b81e6b0405227",
-                "reference": "231e3186624c03d7e7c890ec662b81e6b0405227",
+                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/bd84b629c8de41aa2ae82c067c955e06f1b00240",
+                "reference": "bd84b629c8de41aa2ae82c067c955e06f1b00240",
                 "shasum": ""
             },
             "require": {
@@ -3566,9 +3525,9 @@
             "description": "PHPDoc parser with support for nullable, intersection and generic types",
             "support": {
                 "issues": "https://github.com/phpstan/phpdoc-parser/issues",
-                "source": "https://github.com/phpstan/phpdoc-parser/tree/1.26.0"
+                "source": "https://github.com/phpstan/phpdoc-parser/tree/1.25.0"
             },
-            "time": "2024-02-23T16:05:55+00:00"
+            "time": "2024-01-04T17:06:16+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",

docker-compose.yml

@@ -92,7 +92,6 @@ services:
       - php
       - -e
       - app/http.php
-      - -dopcache.preload=opcache.preload=/usr/src/code/app/preload.php
     environment:
       - _APP_ENV
       - _APP_WORKER_PER_CORE
@@ -582,7 +581,6 @@ services:
       - _APP_REDIS_PORT
       - _APP_REDIS_USER
       - _APP_REDIS_PASS
-      - _APP_SMS_PROJECTS_DENY_LIST
       - _APP_DB_HOST
       - _APP_DB_PORT
       - _APP_DB_SCHEMA
@@ -592,6 +590,7 @@ services:
       - _APP_LOGGING_CONFIG
       - _APP_SMS_FROM
       - _APP_SMS_PROVIDER
+      - _APP_SMS_PROJECTS_DENY_LIST
 
   appwrite-worker-migrations:
     entrypoint: worker-migrations
@@ -696,6 +695,37 @@ services:
       - _APP_LOGGING_CONFIG
       - _APP_USAGE_AGGREGATION_INTERVAL
 
+  appwrite-worker-usage-dump:
+    entrypoint: worker-usage-dump
+    <<: *x-logging
+    container_name: appwrite-worker-usage-dump
+    image: appwrite-dev
+    networks:
+      - appwrite
+    volumes:
+      - ./app:/usr/src/code/app
+      - ./src:/usr/src/code/src
+    depends_on:
+      - redis
+      - mariadb
+    environment:
+      - _APP_ENV
+      - _APP_WORKER_PER_CORE
+      - _APP_OPENSSL_KEY_V1
+      - _APP_DB_HOST
+      - _APP_DB_PORT
+      - _APP_DB_SCHEMA
+      - _APP_DB_USER
+      - _APP_DB_PASS
+      - _APP_REDIS_HOST
+      - _APP_REDIS_PORT
+      - _APP_REDIS_USER
+      - _APP_REDIS_PASS
+      - _APP_USAGE_STATS
+      - _APP_LOGGING_PROVIDER
+      - _APP_LOGGING_CONFIG
+      - _APP_USAGE_AGGREGATION_INTERVAL
+
   appwrite-scheduler-functions:
     entrypoint: schedule-functions
     <<: *x-logging
@@ -941,6 +971,7 @@ services:
   #     - appwrite
   #   volumes:
   #     - appwrite-uploads:/storage/uploads
+
   # Dev Tools Start ------------------------------------------------------------------------------------------
   #
   # The Appwrite Team uses the following tools to help debug, monitor and diagnose the Appwrite stack
@@ -949,8 +980,9 @@ services:
   #
   # MailCatcher - An SMTP server. Catches all system emails and displays them in a nice UI.
   # RequestCatcher - An HTTP server. Catches all system https calls and displays them using a simple HTTP API. Used to debug & tests webhooks and HTTP tasks
-  # RedisCommander - A nice UI for exploring Redis data
-  # Webgrind - A nice UI for exploring and debugging code-level stuff
+  # Redis Insight - A nice UI for exploring Redis data
+  # Adminer - A nice UI for exploring MariaDB data
+  # GraphQl Explorer - A nice UI for exploring GraphQL API
 
   maildev: # used mainly for dev tests
     image: appwrite/mailcatcher:1.0.0
@@ -980,21 +1012,15 @@ services:
     networks:
       - appwrite
 
-  # redis-commander:
-  #   image: rediscommander/redis-commander:latest
-  #   restart: unless-stopped
-  #   networks:
-  #   - appwrite
-  #   environment:
-  #   - REDIS_HOSTS=redis
-  #   ports:
-  #   - "8081:8081"
-  # webgrind:
-  #   image: 'jokkedk/webgrind:latest'
-  #   volumes:
-  #     - './debug:/tmp'
-  #   ports:
-  #     - '3001:80'
+  redis-insight:
+    image: redis/redisinsight:latest
+    restart: unless-stopped
+    networks:
+    - appwrite
+    environment:
+    - REDIS_HOSTS=redis
+    ports:
+    - "8081:5540"
 
   graphql-explorer:
     container_name: appwrite-graphql-explorer

docs/examples/1.4.x/server-ruby/examples/account/create-phone-verification.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.create_phone_verification()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/create-recovery.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.create_recovery(email: 'email@example.com', url: 'https://example.com')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/create-verification.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.create_verification(url: 'https://example.com')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/delete-identity.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.delete_identity(identity_id: '[IDENTITY_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/delete-session.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.delete_session(session_id: '[SESSION_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/delete-sessions.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.delete_sessions()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/get-prefs.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.get_prefs()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/get-session.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.get_session(session_id: '[SESSION_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/get.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.get()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/list-identities.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.list_identities()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/list-logs.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.list_logs()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/list-sessions.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.list_sessions()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-email.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_email(email: 'email@example.com', password: 'password')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-name.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_name(name: '[NAME]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-password.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_password(password: '')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-phone-verification.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_phone_verification(user_id: '[USER_ID]', secret: '[SECRET]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-phone.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_phone(phone: '+12065550100', password: 'password')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-prefs.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_prefs(prefs: {})
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-recovery.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_recovery(user_id: '[USER_ID]', secret: '[SECRET]', password: 'password', password_again: 'password')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-session.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_session(session_id: '[SESSION_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-status.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_status()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/account/update-verification.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ account = Account.new(client)
 
 response = account.update_verification(user_id: '[USER_ID]', secret: '[SECRET]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-browser.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_browser(code: 'aa')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-credit-card.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_credit_card(code: 'amex')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-favicon.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_favicon(url: 'https://example.com')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-flag.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_flag(code: 'af')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-image.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_image(url: 'https://example.com')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-initials.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_initials()
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/avatars/get-q-r.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ avatars = Avatars.new(client)
 
 response = avatars.get_qr(text: '[TEXT]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-boolean-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_boolean_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-collection.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_collection(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', name: '[NAME]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-datetime-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_datetime_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-document.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_document(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', document_id: '[DOCUMENT_ID]', data: {})
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-email-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_email_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-enum-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_enum_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', elements: [], required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-float-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_float_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-index.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_index(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', type: 'key', attributes: [])
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-integer-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_integer_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-ip-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_ip_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-relationship-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_relationship_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', related_collection_id: '[RELATED_COLLECTION_ID]', type: 'oneToOne')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-string-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_string_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', size: 1, required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create-url-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create_url_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '', required: false)
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/create.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.create(database_id: '[DATABASE_ID]', name: '[NAME]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/delete-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.delete_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/delete-collection.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.delete_collection(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/delete-document.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.delete_document(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', document_id: '[DOCUMENT_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/delete-index.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.delete_index(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/delete.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.delete(database_id: '[DATABASE_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/get-attribute.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.get_attribute(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/get-collection.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.get_collection(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/get-document.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.get_document(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', document_id: '[DOCUMENT_ID]')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/get-index.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.get_index(database_id: '[DATABASE_ID]', collection_id: '[COLLECTION_ID]', key: '')
 
-puts response.inspect
+puts response.inspect

docs/examples/1.4.x/server-ruby/examples/databases/get.md

@@ -1,4 +1,4 @@
-require 'Appwrite'
+require 'appwrite'
 
 include Appwrite
 
@@ -11,4 +11,4 @@ databases = Databases.new(client)
 
 response = databases.get(database_id: '[DATABASE_ID]')
 
-puts response.inspect
+puts response.inspect