Commit Graph

9131 Commits

Author SHA1 Message Date
Jake Barnby 7e4645ffbd Merge branch '1.9.x' into users-skip-targets 2026-05-25 20:09:58 +12:00
Damodar Lohani ce31a4f336 feat!: rename User::ROLE_APPS to ROLE_KEYS and isApp() to isKey() 2026-05-24 02:20:47 +00:00
Damodar Lohani 27370b6acb feat!: rename ACTIVITY_TYPE_* constants to ACTOR_TYPE_*
Renames the actor identity constants used by the audit/auth flow:

- ACTIVITY_TYPE_USER             -> ACTOR_TYPE_USER             ('user')
- ACTIVITY_TYPE_ADMIN            -> ACTOR_TYPE_ADMIN            ('admin')
- ACTIVITY_TYPE_GUEST            -> ACTOR_TYPE_GUEST            ('guest')
- ACTIVITY_TYPE_KEY_PROJECT      -> ACTOR_TYPE_KEY_PROJECT      ('keyProject')
- ACTIVITY_TYPE_KEY_ACCOUNT      -> ACTOR_TYPE_KEY_ACCOUNT      ('keyAccount')
- ACTIVITY_TYPE_KEY_ORGANIZATION -> ACTOR_TYPE_KEY_ORGANIZATION ('keyOrganization')

Values are unchanged. Call sites updated in:
- app/controllers/shared/api.php
- src/Appwrite/Platform/Workers/Audits.php

Audit payload key rename (userType -> actorType) and utopia-php/audit
bump will land in a follow-up PR.

BREAKING CHANGE: ACTIVITY_TYPE_* global constants are removed. Any
downstream extension or plugin importing those names must be updated
to the ACTOR_TYPE_* equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-24 02:20:17 +00:00
loks0n 035cbacbfb Use 'params' injection in V20 filter
Drops the redundant Route::resolveParams() call. The matched path
params are now provided directly via the new frame-local 'params'
injection from utopia-php/http, avoiding a second URL parse.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 21:09:55 +01:00
loks0n 690c72b789 Use 'route' injection in remaining api/auth init hooks
The 'route' injection is frame-local and non-nullable inside a
matched action's hooks. Replaces \$utopia->match() lookups in api.php
and auth.php init hooks, drops the dead \$utopia inject from the
session shutdown hook, and removes the now-redundant null guards.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 21:09:41 +01:00
loks0n dd0c8af160 Use 'route' injection in shutdown hooks
The 'route' injection introduced in utopia-php/http feat-safe-wildcards
is frame-local and non-nullable inside a matched action's hooks, so
the shutdown handlers in api.php and mock.php no longer need to call
match() and dereference a nullable result.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 21:09:41 +01:00
loks0n 933fffd763 Use route template instead of request URI for documentsdb path check
The documentsdb/vectorsdb routes are registered with
setHttpPath('/v1/documentsdb/...') with no aliases, so getPath()
returns a template containing the substring we're matching against
— and matches the prior getMatchedPath() semantics without depending
on the raw request URI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 21:09:41 +01:00
loks0n 1538927486 chore: migrate to utopia-php/http feat-safe-wildcards
Adopts the new safe-wildcard dispatch primitive from
utopia-php/http#feat-safe-wildcards. Http::execute() is now the
re-entrant dispatch entry point and Http::match() is pure (returns
?RouteMatch). The removed Http::getRoute()/setRoute(),
Route::getMatchedPath(), Route::getPathValues() callsites are migrated
to the new API.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 21:09:41 +01:00
fogelito 7312f4bfe0 Merge branch '1.9.x' of https://github.com/appwrite/appwrite into users-skip-targets 2026-05-20 13:50:31 +03:00
Chirag Aggarwal 1d9acf5f29 Fix account SDK specs auth 2026-05-20 14:03:20 +05:30
fogelito aa3a63c87b Merge branch '1.9.x' of https://github.com/appwrite/appwrite into users-skip-targets 2026-05-19 15:51:12 +03:00
Chirag Aggarwal 05eead1857 Remove router deployment fallback 2026-05-18 18:34:12 +05:30
fogelito 5c9f360744 Merge branch '1.9.x' of https://github.com/appwrite/appwrite into users-skip-targets 2026-05-17 17:17:09 +03:00
Chirag Aggarwal ad88b827e6 Refactor database queue publisher 2026-05-15 13:22:35 +05:30
fogelito 3684fee2a2 Merge branch '1.9.x' of https://github.com/appwrite/appwrite into users-skip-targets 2026-05-14 14:58:50 +03:00
fogelito d9446fa892 address 2026-05-14 14:45:00 +03:00
Chirag Aggarwal 65d1e58e34 refactor: migrate delete queue publisher 2026-05-14 14:40:11 +05:30
Chirag Aggarwal 1ced50db1f Merge remote-tracking branch 'origin/1.9.x' into codex/resolve-12284-conflict
# Conflicts:
#	app/controllers/shared/api.php
2026-05-14 10:43:05 +05:30
Chirag Aggarwal 85e2cf7d8b (refactor): Migrate queueForFunctions to FunctionPublisher and FunctionMessage 2026-05-13 18:28:05 +05:30
Chirag Aggarwal d9987dd645 Fix rate limit headers when abuse check is skipped 2026-05-13 15:00:51 +05:30
fogelito 1435e2c526 use max 2026-05-13 08:41:14 +03:00
fogelito 2ea66a0d8b APP_LIMIT_SUBQUERY 2026-05-13 08:36:57 +03:00
Luke B. Silver 35941ddc34 Merge pull request #12220 from appwrite/feat/utopia-http-resources-context
Migrate to utopia-php/http resources/context API
2026-05-12 23:01:29 +01:00
fogelito 06068c0406 skip subQueryTargets 2026-05-12 20:51:57 +03:00
Matej Bačo 5e1439f64e Merge pull request #12276 from appwrite/feat-rework-project-response-model
Feat: Rework project response model
2026-05-12 12:57:16 +02:00
Chirag Aggarwal e132784532 Fix cache auth role lookup after rate limit refactor 2026-05-12 16:24:50 +05:30
Chirag Aggarwal a51fd49ed1 Refactor abuse rate limiting init hook 2026-05-12 16:17:23 +05:30
loks0n 4bdcdb6f96 Migrate to utopia-php/http resources/context API
Adopts the new split DI containers in utopia-php/http: `resources()` for
boot-time wiring (shared across requests) and `context()` for per-request
state. Replaces the removed `getResource()`/`setResource()`/`getContainer()`
helpers throughout the HTTP entry point, controllers, GraphQL layer, and
installer.

Bumps the dependency chain accordingly: utopia-php/http to the dev branch
(aliased to 0.34.25 to satisfy platform's exact pin), servers 0.4.*,
queue 0.18.*, and pulled-along cli/platform/database upgrades.

Also tightens app/init/resources/request.php by collapsing single-return
factories to arrow functions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-12 11:41:42 +01:00
Chirag Aggarwal 7914fde9f1 Use error_log for abuse timelimit failures 2026-05-12 16:09:20 +05:30
Chirag Aggarwal d523c7425a Log abuse timelimit fail-open errors 2026-05-12 13:31:33 +05:30
Chirag Aggarwal 728298d2f5 Address abuse timelimit review comments 2026-05-12 13:23:39 +05:30
Chirag Aggarwal ac79a91aa9 Fail open on abuse timelimit failures 2026-05-12 13:12:13 +05:30
Matej Bačo 152b45087e Fix more tests 2026-05-11 17:01:00 +02:00
Matej Bačo 5cd737b901 Backwards compatibility for GET /v1/project 2026-05-11 15:08:15 +02:00
Matej Bačo 2da400d5b4 Bump version to introduce response filter (for project get) 2026-05-11 12:53:01 +02:00
Matej Bačo fd893a8b10 Migrate project GET endpoint 2026-05-11 12:10:38 +02:00
Chirag Aggarwal 34075322d7 Migrate mails and messaging queues to publishers 2026-05-08 14:32:11 +05:30
Chirag Aggarwal 75a30793ac Remove preview flag from storage cache config 2026-05-08 10:42:39 +05:30
Chirag Aggarwal 5841d0a944 Inline storage preview cache control 2026-05-08 09:59:36 +05:30
Chirag Aggarwal bf76736971 Split storage cache control context 2026-05-08 09:57:33 +05:30
Chirag Aggarwal 707e5d231a Scope storage cache control to previews 2026-05-08 09:55:33 +05:30
Chirag Aggarwal 6abd88b8f1 Type storage cache control config 2026-05-08 09:44:00 +05:30
Chirag Aggarwal 7b5a5b8d19 Rename storage cache control hook 2026-05-08 08:44:35 +05:30
Chirag Aggarwal 20ab5b026e Add cached response cache-control callback 2026-05-08 08:33:37 +05:30
Luke B. Silver 1d004240e6 Merge pull request #12236 from appwrite/refactor/builds-publishing
refactor: migrate queueForBuilds to publisherForBuilds pattern
2026-05-07 17:06:32 +01:00
Matej Bačo c3881f9974 Fix console email policy features 2026-05-07 17:13:26 +02:00
loks0n 7d0843cc7f Migrate queueForBuilds to publisherForBuilds pattern
Replaces the stateful Appwrite\Event\Build queue class with a stateless
BuildPublisher and BuildMessage DTO, matching the publisher pattern used
by audits, certificates, executions, migrations, screenshots, stats, and
usage. Call sites now enqueue messages directly instead of mutating a
shared event object and relying on the API shutdown hook.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-07 13:23:21 +01:00
loks0n 8201fea9ef Differentiate executor timeouts for builds, sync, and async executions
Adds Executor\Exception\Timeout (with timeoutSeconds) and translates it at
each call site into BUILD_TIMEOUT, FUNCTION_SYNCHRONOUS_TIMEOUT, or
FUNCTION_ASYNCHRONOUS_TIMEOUT instead of always using the misleading sync
function error. Build timeouts now append to streamed buildLogs rather
than replacing them, and the build worker reports its timeout via Span.
2026-05-06 15:54:11 +01:00
Matej Bačo e834a95213 PR review improvements 2026-05-06 16:21:50 +02:00
Matej Bačo d2b551cd12 Fix refreshing nonoauth sessions 2026-05-06 15:50:18 +02:00